1 { lib, pkgs, config, myconfig, ... }:
3 cfg = config.myServices.databases.mariadb;
5 options.myServices.databases = {
7 enable = lib.mkOption {
10 description = "Whether to enable mariadb database";
11 type = lib.types.bool;
13 dataDir = lib.mkOption {
14 type = lib.types.path;
15 default = "/var/lib/mysql";
17 The directory where Mariadb stores its data.
21 socketsDir = lib.mkOption {
22 type = lib.types.path;
23 default = "/run/mysqld";
25 The directory where Mariadb puts sockets.
28 sockets = lib.mkOption {
29 type = lib.types.attrsOf lib.types.path;
31 mysqld = "${cfg.socketsDir}/mysqld.sock";
41 config = lib.mkIf cfg.enable {
42 networking.firewall.allowedTCPPorts = [ 3306 ];
44 # for adminer, ssl is implemented with mysqli only, which is
45 # currently disabled because it’s not compatible with pam.
46 # Thus we need to generate two users for each 'remote': one remote
47 # with SSL, and one localhost without SSL.
48 # User identified by LDAP:
49 # CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL;
50 # CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql';
53 package = pkgs.mariadb;
54 dataDir = cfg.dataDir;
56 ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
57 ssl_key = ${config.security.acme.directory}/mysql/key.pem
58 ssl_cert = ${config.security.acme.directory}/mysql/fullchain.pem
62 users.users.mysql.extraGroups = [ "keys" ];
63 security.acme.certs."mysql" = config.myServices.databasesCerts // {
66 plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
67 domain = "db-1.immae.eu";
69 systemctl restart mysql.service
75 dest = "mysql/mysqldump";
82 password = ${myconfig.env.databases.mysql.systemUsers.root}
90 text = with myconfig.env.databases.mysql.pam; ''
91 host ${myconfig.env.ldap.host}
92 base ${myconfig.env.ldap.base}
105 30 1,13 * * * root ${pkgs.mariadb}/bin/mysqldump --defaults-file=${config.secrets.location}/mysql/mysqldump --all-databases > ${cfg.dataDir}/backup.sql
110 security.pam.services = let
111 pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
116 # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
117 auth required ${pam_ldap} config=${config.secrets.location}/mysql/pam
118 account required ${pam_ldap} config=${config.secrets.location}/mysql/pam