modules/private/databases/mariadb.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3     cfg = config.myServices.databases.mariadb;
   4 in {
   5   options.myServices.databases = {
   6     mariadb = {
   7       enable = lib.mkOption {
   8         default = false;
   9         example = true;
  10         description = "Whether to enable mariadb database";
  11         type = lib.types.bool;
  12       };
  13       package = lib.mkOption {
  14         type = lib.types.package;
  15         default = pkgs.mariadb;
  16         description = ''
  17           Mariadb package to use.
  18           '';
  19       };
  20       credentials = lib.mkOption {
  21         default = {};
  22         description = "Credentials";
  23         type = lib.types.attrsOf lib.types.str;
  24       };
  25       ldapConfig = lib.mkOption {
  26         description = "LDAP configuration to allow PAM identification via LDAP";
  27         type = lib.types.submodule {
  28           options = {
  29             host = lib.mkOption { type = lib.types.str; };
  30             base = lib.mkOption { type = lib.types.str; };
  31             dn = lib.mkOption { type = lib.types.str; };
  32             password = lib.mkOption { type = lib.types.str; };
  33             filter = lib.mkOption { type = lib.types.str; };
  34           };
  35         };
  36       };
  37       replicationLdapConfig = lib.mkOption {
  38         description = "LDAP configuration to allow replication";
  39         type = lib.types.submodule {
  40           options = {
  41             host = lib.mkOption { type = lib.types.str; };
  42             base = lib.mkOption { type = lib.types.str; };
  43             dn = lib.mkOption { type = lib.types.str; };
  44             password = lib.mkOption { type = lib.types.str; };
  45           };
  46         };
  47       };
  48       dataDir = lib.mkOption {
  49         type = lib.types.path;
  50         default = "/var/lib/mysql";
  51         description = ''
  52           The directory where Mariadb stores its data.
  53         '';
  54       };
  55       # Output variables
  56       socketsDir = lib.mkOption {
  57         type = lib.types.path;
  58         default = "/run/mysqld";
  59         description = ''
  60           The directory where Mariadb puts sockets.
  61           '';
  62       };
  63       sockets = lib.mkOption {
  64         type = lib.types.attrsOf lib.types.path;
  65         default = {
  66           mysqld  = "${cfg.socketsDir}/mysqld.sock";
  67         };
  68         readOnly = true;
  69         description = ''
  70           Mariadb sockets
  71           '';
  72       };
  73     };
  74   };
  75
  76   config = lib.mkIf cfg.enable {
  77     networking.firewall.allowedTCPPorts = [ 3306 ];
  78
  79     # for adminer, ssl is implemented with mysqli only, which is
  80     # currently disabled because it’s not compatible with pam.
  81     # Thus we need to generate two users for each 'remote': one remote
  82     # with SSL, and one localhost without SSL.
  83     # User identified by LDAP:
  84     # CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL;
  85     # CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql';
  86
  87     # To create a user (host) for replication:
  88     # CREATE USER 'host'@'%' IDENTIFIED VIA pam USING 'mysql_replication' REQUIRE SSL;
  89     # GRANT REPLICATION SLAVE, REPLICATION CLIENT, RELOAD, LOCK TABLES, SELECT, SHOW VIEW ON *.* TO 'host'@'%';
  90     # (the lock/select grant permits to let the replication host handle
  91     # the initial fetch of the database)
  92     # % should be valid for both localhost (for cron dumps) and the origin host.
  93     services.mysql = {
  94       enable = true;
  95       package = cfg.package;
  96       dataDir = cfg.dataDir;
  97       extraOptions = ''
  98         ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
  99         ssl_key = ${config.security.acme.certs.mysql.directory}/key.pem
 100         ssl_cert = ${config.security.acme.certs.mysql.directory}/fullchain.pem
 101
 102         # for replication
 103         log-bin=mariadb-bin
 104         server-id=1
 105
 106         # this introduces a small delay before storing on disk, but
 107         # makes it order of magnitudes quicker
 108         innodb_flush_log_at_trx_commit = 0
 109         '';
 110     };
 111
 112     users.users.mysql.extraGroups = [ "keys" ];
 113     security.acme.certs."mysql" = config.myServices.databasesCerts // {
 114       user = "mysql";
 115       group = "mysql";
 116       plugins = [ "fullchain.pem" "key.pem" "account_key.json" "account_reg.json" ];
 117       domain = "db-1.immae.eu";
 118       postRun = ''
 119         systemctl restart mysql.service
 120       '';
 121     };
 122
 123     secrets.keys = [
 124       {
 125         dest = "mysql/mysqldump";
 126         permissions = "0400";
 127         user = "root";
 128         group = "root";
 129         text = ''
 130           [mysqldump]
 131           user = root
 132           password = ${cfg.credentials.root}
 133         '';
 134       }
 135       {
 136         dest = "mysql/pam";
 137         permissions = "0400";
 138         user = "mysql";
 139         group = "mysql";
 140         text =  with cfg.ldapConfig; ''
 141           host ${host}
 142           base ${base}
 143           binddn ${dn}
 144           bindpw ${password}
 145           pam_filter ${filter}
 146           ssl start_tls
 147         '';
 148       }
 149       {
 150         dest = "mysql/pam_replication";
 151         permissions = "0400";
 152         user = "mysql";
 153         group = "mysql";
 154         text =  with cfg.replicationLdapConfig; ''
 155           host ${host}
 156           base ${base}
 157           binddn ${dn}
 158           bindpw ${password}
 159           pam_login_attribute cn
 160           ssl start_tls
 161         '';
 162       }
 163     ];
 164
 165     security.pam.services = let
 166       pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
 167     in [
 168       {
 169         name = "mysql";
 170         text = ''
 171           # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
 172           auth    required ${pam_ldap} config=${config.secrets.location}/mysql/pam
 173           account required ${pam_ldap} config=${config.secrets.location}/mysql/pam
 174           '';
 175       }
 176       {
 177         name = "mysql_replication";
 178         text = ''
 179           auth    required ${pam_ldap} config=${config.secrets.location}/mysql/pam_replication
 180           account required ${pam_ldap} config=${config.secrets.location}/mysql/pam_replication
 181           '';
 182       }
 183     ];
 184
 185   };
 186 }