modules/private/websites/tools/tools/ldap.nix

   1 { lib, php, env, writeText, phpldapadmin, config }:
   2 rec {
   3   activationScript = {
   4     deps = [ "httpd" ];
   5     text = ''
   6       install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/phpldapadmin
   7       '';
   8   };
   9   keys."webapps/tools-ldap" = {
  10     user = apache.user;
  11     group = apache.group;
  12     permissions = "0400";
  13     text = ''
  14       <?php
  15       $config->custom->appearance['show_clear_password'] = true;
  16       $config->custom->appearance['hide_template_warning'] = true;
  17       $config->custom->appearance['theme'] = "tango";
  18       $config->custom->appearance['minimalMode'] = false;
  19       $config->custom->appearance['tree'] = 'AJAXTree';
  20
  21       $servers = new Datastore();
  22
  23       $servers->newServer('ldap_pla');
  24       $servers->setValue('server','name','Immae&#x2019;s LDAP');
  25       $servers->setValue('server','host','ldaps://${env.ldap.host}');
  26       $servers->setValue('login','auth_type','cookie');
  27       $servers->setValue('login','bind_id','${env.ldap.dn}');
  28       $servers->setValue('login','bind_pass','${env.ldap.password}');
  29       $servers->setValue('appearance','pla_password_hash','ssha');
  30       $servers->setValue('login','attr','uid');
  31       $servers->setValue('login','fallback_dn',true);
  32       '';
  33   };
  34   webRoot = phpldapadmin.override { config = config.secrets.fullPaths."webapps/tools-ldap"; };
  35   apache = rec {
  36     user = "wwwrun";
  37     group = "wwwrun";
  38     modules = [ "proxy_fcgi" ];
  39     webappName = "tools_ldap";
  40     root = "/run/current-system/webapps/${webappName}";
  41     vhostConf = socket: ''
  42       Alias /ldap "${root}"
  43       <Directory "${root}">
  44         DirectoryIndex index.php
  45         <FilesMatch "\.php$">
  46           SetHandler "proxy:unix:${socket}|fcgi://localhost"
  47         </FilesMatch>
  48
  49         AllowOverride None
  50         Require all granted
  51       </Directory>
  52       '';
  53   };
  54   phpFpm = rec {
  55     serviceDeps = [ "openldap.service" ];
  56     basedir = builtins.concatStringsSep ":" [ webRoot config.secrets.fullPaths."webapps/tools-ldap" ];
  57     pool = {
  58       "listen.owner" = apache.user;
  59       "listen.group" = apache.group;
  60       "pm" = "ondemand";
  61       "pm.max_children" = "60";
  62       "pm.process_idle_timeout" = "60";
  63
  64       # Needed to avoid clashes in browser cookies (same domain)
  65       "php_value[session.name]" = "LdapPHPSESSID";
  66       "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/phpldapadmin";
  67       "php_admin_value[session.save_path]" = "/var/lib/php/sessions/phpldapadmin";
  68     };
  69   };
  70 }