modules/private/databases/mariadb.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3     cfg = config.myServices.databases.mariadb;
   4 in {
   5   options.myServices.databases = {
   6     mariadb = {
   7       enable = lib.mkOption {
   8         default = false;
   9         example = true;
  10         description = "Whether to enable mariadb database";
  11         type = lib.types.bool;
  12       };
  13       package = lib.mkOption {
  14         type = lib.types.package;
  15         default = pkgs.mariadb;
  16         description = ''
  17           Mariadb package to use.
  18           '';
  19       };
  20       credentials = lib.mkOption {
  21         default = {};
  22         description = "Credentials";
  23         type = lib.types.attrsOf lib.types.str;
  24       };
  25       ldapConfig = lib.mkOption {
  26         description = "LDAP configuration to allow PAM identification via LDAP";
  27         type = lib.types.submodule {
  28           options = {
  29             host = lib.mkOption { type = lib.types.str; };
  30             base = lib.mkOption { type = lib.types.str; };
  31             dn = lib.mkOption { type = lib.types.str; };
  32             password = lib.mkOption { type = lib.types.str; };
  33             filter = lib.mkOption { type = lib.types.str; };
  34           };
  35         };
  36       };
  37       replicationLdapConfig = lib.mkOption {
  38         description = "LDAP configuration to allow replication";
  39         type = lib.types.submodule {
  40           options = {
  41             host = lib.mkOption { type = lib.types.str; };
  42             base = lib.mkOption { type = lib.types.str; };
  43             dn = lib.mkOption { type = lib.types.str; };
  44             password = lib.mkOption { type = lib.types.str; };
  45           };
  46         };
  47       };
  48       dataDir = lib.mkOption {
  49         type = lib.types.path;
  50         default = "/var/lib/mysql";
  51         description = ''
  52           The directory where Mariadb stores its data.
  53         '';
  54       };
  55       # Output variables
  56       socketsDir = lib.mkOption {
  57         type = lib.types.path;
  58         default = "/run/mysqld";
  59         description = ''
  60           The directory where Mariadb puts sockets.
  61           '';
  62       };
  63       sockets = lib.mkOption {
  64         type = lib.types.attrsOf lib.types.path;
  65         default = {
  66           mysqld  = "${cfg.socketsDir}/mysqld.sock";
  67         };
  68         readOnly = true;
  69         description = ''
  70           Mariadb sockets
  71           '';
  72       };
  73     };
  74   };
  75
  76   config = lib.mkIf cfg.enable {
  77     networking.firewall.allowedTCPPorts = [ 3306 ];
  78
  79     # for adminer, ssl is implemented with mysqli only, which is
  80     # currently disabled because it’s not compatible with pam.
  81     # Thus we need to generate two users for each 'remote': one remote
  82     # with SSL, and one localhost without SSL.
  83     # User identified by LDAP:
  84     # CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL;
  85     # CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql';
  86
  87     # To create a user (host) for replication:
  88     # CREATE USER 'host'@'%' IDENTIFIED VIA pam USING 'mysql_replication' REQUIRE SSL;
  89     # GRANT REPLICATION SLAVE, REPLICATION CLIENT, RELOAD, LOCK TABLES, SELECT, SHOW VIEW ON *.* TO 'host'@'%';
  90     # (the lock/select grant permits to let the replication host handle
  91     # the initial fetch of the database)
  92     # % should be valid for both localhost (for cron dumps) and the origin host.
  93     services.mysql = {
  94       enable = true;
  95       package = cfg.package;
  96       dataDir = cfg.dataDir;
  97       settings = {
  98         mysqld = {
  99           ssl_ca = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
 100           ssl_key = "${config.security.acme.certs.mysql.directory}/key.pem";
 101           ssl_cert = "${config.security.acme.certs.mysql.directory}/fullchain.pem";
 102
 103           # for replication
 104           log-bin = "mariadb-bin";
 105           server-id = "1";
 106
 107           # this introduces a small delay before storing on disk, but
 108           # makes it order of magnitudes quicker
 109           innodb_flush_log_at_trx_commit = "0";
 110         };
 111       };
 112     };
 113
 114     users.users.mysql.extraGroups = [ "keys" ];
 115     security.acme.certs."mysql" = config.myServices.databasesCerts // {
 116       user = "mysql";
 117       group = "mysql";
 118       domain = "db-1.immae.eu";
 119       postRun = ''
 120         systemctl restart mysql.service
 121       '';
 122     };
 123
 124     secrets.keys = [
 125       {
 126         dest = "mysql/mysqldump";
 127         permissions = "0400";
 128         user = "root";
 129         group = "root";
 130         text = ''
 131           [mysqldump]
 132           user = root
 133           password = ${cfg.credentials.root}
 134         '';
 135       }
 136       {
 137         dest = "mysql/pam";
 138         permissions = "0400";
 139         user = "mysql";
 140         group = "mysql";
 141         text =  with cfg.ldapConfig; ''
 142           host ${host}
 143           base ${base}
 144           binddn ${dn}
 145           bindpw ${password}
 146           pam_filter ${filter}
 147           ssl start_tls
 148         '';
 149       }
 150       {
 151         dest = "mysql/pam_replication";
 152         permissions = "0400";
 153         user = "mysql";
 154         group = "mysql";
 155         text =  with cfg.replicationLdapConfig; ''
 156           host ${host}
 157           base ${base}
 158           binddn ${dn}
 159           bindpw ${password}
 160           pam_login_attribute cn
 161           ssl start_tls
 162         '';
 163       }
 164     ];
 165
 166     security.pam.services = let
 167       pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
 168     in {
 169       mysql = {
 170         text = ''
 171           # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
 172           auth    required ${pam_ldap} config=${config.secrets.fullPaths."mysql/pam"}
 173           account required ${pam_ldap} config=${config.secrets.fullPaths."mysql/pam"}
 174           '';
 175       };
 176       mysql_replication = {
 177         text = ''
 178           auth    required ${pam_ldap} config=${config.secrets.fullPaths."mysql/pam_replication"}
 179           account required ${pam_ldap} config=${config.secrets.fullPaths."mysql/pam_replication"}
 180           '';
 181       };
 182     };
 183
 184   };
 185 }