nixops/modules/databases/openldap.nix

   1 { lib, pkgs, config, myconfig, mylibs, ... }:
   2 let
   3     cfg = config.services.myDatabases;
   4     ldapConfig = let
   5       kerberosSchema = pkgs.fetchurl {
   6         url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema";
   7         sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww";
   8       };
   9       puppetSchema = pkgs.fetchurl {
  10         url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema";
  11         sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh";
  12       };
  13     in ''
  14       include         ${pkgs.openldap}/etc/schema/core.schema
  15       include         ${pkgs.openldap}/etc/schema/cosine.schema
  16       include         ${pkgs.openldap}/etc/schema/inetorgperson.schema
  17       include         ${pkgs.openldap}/etc/schema/nis.schema
  18       include         ${puppetSchema}
  19       include         ${kerberosSchema}
  20       include         ${./immae.schema}
  21
  22       pidfile         /run/slapd/slapd.pid
  23       argsfile        /run/slapd/slapd.args
  24
  25       moduleload      back_hdb
  26       backend         hdb
  27
  28       moduleload      memberof
  29       database        hdb
  30       suffix          "${myconfig.env.ldap.base}"
  31       rootdn          "${myconfig.env.ldap.root_dn}"
  32       include         /var/secrets/ldap/password
  33       directory       /var/lib/openldap
  34       overlay         memberof
  35
  36       TLSCertificateFile    /var/lib/acme/ldap/cert.pem
  37       TLSCertificateKeyFile /var/lib/acme/ldap/key.pem
  38       TLSCACertificateFile  /var/lib/acme/ldap/fullchain.pem
  39       TLSCACertificatePath  ${pkgs.cacert.unbundled}/etc/ssl/certs/
  40       #This makes openldap crash
  41       #TLSCipherSuite        DEFAULT
  42
  43       sasl-host kerberos.immae.eu
  44       include /var/secrets/ldap/access
  45       '';
  46 in {
  47   options.services.myDatabases = {
  48     ldap = {
  49       enable = lib.mkOption {
  50         default = cfg.enable;
  51         example = true;
  52         description = "Whether to enable ldap";
  53         type = lib.types.bool;
  54       };
  55     };
  56   };
  57
  58   config = lib.mkIf cfg.enable {
  59     secrets.keys = [
  60        {
  61         dest = "ldap/password";
  62         permissions = "0400";
  63         user = "openldap";
  64         group = "openldap";
  65         text = "rootpw          ${myconfig.env.ldap.root_pw}";
  66       }
  67       {
  68         dest = "ldap/access ";
  69         permissions = "0400";
  70         user = "openldap";
  71         group = "openldap";
  72         text = builtins.readFile "${myconfig.privateFiles}/ldap.conf";
  73       }
  74     ];
  75     users.users.openldap.extraGroups = [ "keys" ];
  76     networking.firewall.allowedTCPPorts = [ 636 389 ];
  77
  78     services.cron = {
  79       systemCronJobs = [
  80         ''
  81           35 1,13 * * * root ${pkgs.openldap}/bin/slapcat -v -b "dc=immae,dc=eu" -f ${pkgs.writeText "slapd.conf" ldapConfig} -l /var/lib/openldap/backup.ldif | ${pkgs.gnugrep}/bin/grep -v "^# id=[0-9a-f]*$"
  82         ''
  83       ];
  84     };
  85
  86     security.acme.certs."ldap" = config.services.myCertificates.certConfig // {
  87       user = "openldap";
  88       group = "openldap";
  89       plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
  90       domain = "ldap.immae.eu";
  91       postRun = ''
  92         systemctl restart openldap.service
  93       '';
  94     };
  95
  96     services.openldap = {
  97       enable = config.services.myDatabases.ldap.enable;
  98       dataDir = "/var/lib/openldap";
  99       urlList = [ "ldap://" "ldaps://" ];
 100       extraConfig = ldapConfig;
 101     };
 102   };
 103 }
 104