modules/private/websites/tools/tools/ldap.nix

   1 { lib, php, env, writeText, phpldapadmin }:
   2 rec {
   3   activationScript = {
   4     deps = [ "httpd" ];
   5     text = ''
   6       install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/phpldapadmin
   7       '';
   8   };
   9   keys = [{
  10     dest = "webapps/tools-ldap";
  11     user = apache.user;
  12     group = apache.group;
  13     permissions = "0400";
  14     text = ''
  15       <?php
  16       $config->custom->appearance['show_clear_password'] = true;
  17       $config->custom->appearance['hide_template_warning'] = true;
  18       $config->custom->appearance['theme'] = "tango";
  19       $config->custom->appearance['minimalMode'] = false;
  20       $config->custom->appearance['tree'] = 'AJAXTree';
  21
  22       $servers = new Datastore();
  23
  24       $servers->newServer('ldap_pla');
  25       $servers->setValue('server','name','Immae&#x2019;s LDAP');
  26       $servers->setValue('server','host','ldaps://${env.ldap.host}');
  27       $servers->setValue('login','auth_type','cookie');
  28       $servers->setValue('login','bind_id','${env.ldap.dn}');
  29       $servers->setValue('login','bind_pass','${env.ldap.password}');
  30       $servers->setValue('appearance','pla_password_hash','ssha');
  31       $servers->setValue('login','attr','uid');
  32       $servers->setValue('login','fallback_dn',true);
  33       '';
  34   }];
  35   webRoot = phpldapadmin.override { config = "/var/secrets/webapps/tools-ldap"; };
  36   apache = rec {
  37     user = "wwwrun";
  38     group = "wwwrun";
  39     modules = [ "proxy_fcgi" ];
  40     webappName = "tools_ldap";
  41     root = "/run/current-system/webapps/${webappName}";
  42     vhostConf = ''
  43       Alias /ldap "${root}"
  44       <Directory "${root}">
  45         DirectoryIndex index.php
  46         <FilesMatch "\.php$">
  47           SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
  48         </FilesMatch>
  49
  50         AllowOverride None
  51         Require all granted
  52       </Directory>
  53       '';
  54   };
  55   phpFpm = rec {
  56     serviceDeps = [ "openldap.service" ];
  57     basedir = builtins.concatStringsSep ":" [ webRoot "/var/secrets/webapps/tools-ldap" ];
  58     socket = "/var/run/phpfpm/ldap.sock";
  59     pool = ''
  60       user = ${apache.user}
  61       group = ${apache.group}
  62       listen.owner = ${apache.user}
  63       listen.group = ${apache.group}
  64       pm = ondemand
  65       pm.max_children = 60
  66       pm.process_idle_timeout = 60
  67
  68       ; Needed to avoid clashes in browser cookies (same domain)
  69       php_value[session.name] = LdapPHPSESSID
  70       php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/phpldapadmin"
  71       php_admin_value[session.save_path] = "/var/lib/php/sessions/phpldapadmin"
  72       '';
  73   };
  74 }