modules/private/databases/mariadb.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3     cfg = config.myServices.databases.mariadb;
   4 in {
   5   options.myServices.databases = {
   6     mariadb = {
   7       enable = lib.mkOption {
   8         default = false;
   9         example = true;
  10         description = "Whether to enable mariadb database";
  11         type = lib.types.bool;
  12       };
  13       package = lib.mkOption {
  14         type = lib.types.package;
  15         default = pkgs.mariadb;
  16         description = ''
  17           Mariadb package to use.
  18           '';
  19       };
  20       credentials = lib.mkOption {
  21         default = {};
  22         description = "Credentials";
  23         type = lib.types.attrsOf lib.types.str;
  24       };
  25       ldapConfig = lib.mkOption {
  26         description = "LDAP configuration to allow PAM identification via LDAP";
  27         type = lib.types.submodule {
  28           options = {
  29             host = lib.mkOption { type = lib.types.str; };
  30             base = lib.mkOption { type = lib.types.str; };
  31             dn = lib.mkOption { type = lib.types.str; };
  32             password = lib.mkOption { type = lib.types.str; };
  33             filter = lib.mkOption { type = lib.types.str; };
  34           };
  35         };
  36       };
  37       replicationLdapConfig = lib.mkOption {
  38         description = "LDAP configuration to allow replication";
  39         type = lib.types.submodule {
  40           options = {
  41             host = lib.mkOption { type = lib.types.str; };
  42             base = lib.mkOption { type = lib.types.str; };
  43             dn = lib.mkOption { type = lib.types.str; };
  44             password = lib.mkOption { type = lib.types.str; };
  45           };
  46         };
  47       };
  48       dataDir = lib.mkOption {
  49         type = lib.types.path;
  50         default = "/var/lib/mysql";
  51         description = ''
  52           The directory where Mariadb stores its data.
  53         '';
  54       };
  55       # Output variables
  56       socketsDir = lib.mkOption {
  57         type = lib.types.path;
  58         default = "/run/mysqld";
  59         description = ''
  60           The directory where Mariadb puts sockets.
  61           '';
  62       };
  63       sockets = lib.mkOption {
  64         type = lib.types.attrsOf lib.types.path;
  65         default = {
  66           mysqld  = "${cfg.socketsDir}/mysqld.sock";
  67         };
  68         readOnly = true;
  69         description = ''
  70           Mariadb sockets
  71           '';
  72       };
  73     };
  74   };
  75
  76   config = lib.mkIf cfg.enable {
  77     networking.firewall.allowedTCPPorts = [ 3306 ];
  78
  79     # for adminer, ssl is implemented with mysqli only, which is
  80     # currently disabled because it’s not compatible with pam.
  81     # Thus we need to generate two users for each 'remote': one remote
  82     # with SSL, and one localhost without SSL.
  83     # User identified by LDAP:
  84     # CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL;
  85     # CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql';
  86
  87     # To create a user (host) for replication:
  88     # CREATE USER 'host'@'%' IDENTIFIED VIA pam USING 'mysql_replication' REQUIRE SSL;
  89     # GRANT REPLICATION SLAVE, REPLICATION CLIENT, RELOAD, LOCK TABLES, SELECT, SHOW VIEW ON *.* TO 'host'@'%';
  90     # (the lock/select grant permits to let the replication host handle
  91     # the initial fetch of the database)
  92     # % should be valid for both localhost (for cron dumps) and the origin host.
  93     services.mysql = {
  94       enable = true;
  95       package = cfg.package;
  96       dataDir = cfg.dataDir;
  97       settings = {
  98         mysqld = {
  99           ssl_ca = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
 100           ssl_key = "${config.security.acme.certs.mysql.directory}/key.pem";
 101           ssl_cert = "${config.security.acme.certs.mysql.directory}/fullchain.pem";
 102
 103           # for replication
 104           log-bin = "mariadb-bin";
 105           server-id = "1";
 106
 107           # this introduces a small delay before storing on disk, but
 108           # makes it order of magnitudes quicker
 109           innodb_flush_log_at_trx_commit = "0";
 110         };
 111       };
 112     };
 113
 114     users.users.mysql.extraGroups = [ "keys" ];
 115     security.acme.certs."mysql" = config.myServices.databasesCerts // {
 116       user = "mysql";
 117       group = "mysql";
 118       domain = "db-1.immae.eu";
 119       postRun = ''
 120         systemctl restart mysql.service
 121       '';
 122     };
 123
 124     secrets.keys = {
 125       "mysql/mysqldump" = {
 126         permissions = "0400";
 127         user = "root";
 128         group = "root";
 129         text = ''
 130           [mysqldump]
 131           user = root
 132           password = ${cfg.credentials.root}
 133         '';
 134       };
 135       "mysql/pam" = {
 136         permissions = "0400";
 137         user = "mysql";
 138         group = "mysql";
 139         text =  with cfg.ldapConfig; ''
 140           host ${host}
 141           base ${base}
 142           binddn ${dn}
 143           bindpw ${password}
 144           pam_filter ${filter}
 145           ssl start_tls
 146         '';
 147       };
 148       "mysql/pam_replication" = {
 149         permissions = "0400";
 150         user = "mysql";
 151         group = "mysql";
 152         text =  with cfg.replicationLdapConfig; ''
 153           host ${host}
 154           base ${base}
 155           binddn ${dn}
 156           bindpw ${password}
 157           pam_login_attribute cn
 158           ssl start_tls
 159         '';
 160       };
 161     };
 162
 163     security.pam.services = let
 164       pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
 165     in {
 166       mysql = {
 167         text = ''
 168           # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
 169           auth    required ${pam_ldap} config=${config.secrets.fullPaths."mysql/pam"}
 170           account required ${pam_ldap} config=${config.secrets.fullPaths."mysql/pam"}
 171           '';
 172       };
 173       mysql_replication = {
 174         text = ''
 175           auth    required ${pam_ldap} config=${config.secrets.fullPaths."mysql/pam_replication"}
 176           account required ${pam_ldap} config=${config.secrets.fullPaths."mysql/pam_replication"}
 177           '';
 178       };
 179     };
 180
 181   };
 182 }