]>
Commit | Line | Data |
---|---|---|
caa08508 | 1 | { lib, pkgs, pkgsNext, config, myconfig, mylibs, ... }: |
4ff90563 | 2 | let |
caa08508 | 3 | pkgs = pkgsNext.appendOverlays config.nixpkgs.overlays; |
4ff90563 IB |
4 | cfg = config.services.myDatabases; |
5 | in { | |
6 | options.services.myDatabases = { | |
7 | mariadb = { | |
8 | enable = lib.mkOption { | |
9 | default = cfg.enable; | |
10 | example = true; | |
11 | description = "Whether to enable mariadb database"; | |
12 | type = lib.types.bool; | |
13 | }; | |
14 | }; | |
15 | }; | |
16 | ||
17 | config = lib.mkIf cfg.enable { | |
2368a4b7 | 18 | nixpkgs.overlays = [ (self: super: rec { |
4ff90563 | 19 | mariadb = mariadbPAM; |
2368a4b7 | 20 | mariadbPAM = super.mariadb.overrideAttrs(old: rec { |
4ff90563 | 21 | cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ]; |
2368a4b7 | 22 | buildInputs = old.buildInputs ++ [ self.pam ]; |
4ff90563 | 23 | }); |
2368a4b7 | 24 | }) ]; |
4ff90563 IB |
25 | |
26 | networking.firewall.allowedTCPPorts = [ 3306 ]; | |
27 | ||
28 | # for adminer, ssl is implemented with mysqli only, which is | |
29 | # currently disabled because it’s not compatible with pam. | |
30 | # Thus we need to generate two users for each 'remote': one remote | |
31 | # with SSL, and one localhost without SSL. | |
32 | # User identified by LDAP: | |
33 | # CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL; | |
34 | # CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql'; | |
35 | services.mysql = rec { | |
36 | enable = cfg.mariadb.enable; | |
37 | package = pkgs.mariadb; | |
38 | extraOptions = '' | |
39 | ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt | |
40 | ssl_key = /var/lib/acme/mysql/key.pem | |
41 | ssl_cert = /var/lib/acme/mysql/fullchain.pem | |
42 | ''; | |
43 | }; | |
44 | ||
45 | security.acme.certs."mysql" = config.services.myCertificates.certConfig // { | |
46 | user = "mysql"; | |
47 | group = "mysql"; | |
48 | plugins = [ "fullchain.pem" "key.pem" "account_key.json" ]; | |
49 | domain = "db-1.immae.eu"; | |
50 | postRun = '' | |
51 | systemctl restart mysql.service | |
52 | ''; | |
53 | }; | |
54 | ||
85fe2b41 IB |
55 | services.cron = { |
56 | enable = true; | |
57 | systemCronJobs = let | |
58 | mycnf = pkgs.writeText "my.cnf" '' | |
59 | [mysqldump] | |
60 | user = root | |
61 | password = ${myconfig.env.databases.mysql.systemUsers.root} | |
62 | ''; | |
63 | in [ | |
64 | '' | |
65 | 30 1,13 * * * root ${pkgs.mariadb}/bin/mysqldump --defaults-file=${mycnf} --all-databases > /var/lib/mysql/backup.sql | |
66 | '' | |
67 | ]; | |
68 | }; | |
69 | ||
4ff90563 IB |
70 | security.pam.services = let |
71 | pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so"; | |
72 | pam_ldap_mysql = with myconfig.env.databases.mysql.pam; | |
73 | pkgs.writeText "mysql.conf" '' | |
74 | host ${myconfig.env.ldap.host} | |
75 | base ${myconfig.env.ldap.base} | |
76 | binddn ${dn} | |
77 | bindpw ${password} | |
78 | pam_filter ${filter} | |
79 | ssl start_tls | |
80 | ''; | |
81 | in [ | |
82 | { | |
83 | name = "mysql"; | |
84 | text = '' | |
85 | # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/ | |
86 | auth required ${pam_ldap} config=${pam_ldap_mysql} | |
87 | account required ${pam_ldap} config=${pam_ldap_mysql} | |
88 | ''; | |
89 | } | |
90 | ]; | |
91 | ||
92 | }; | |
93 | } | |
94 |