nixops/modules/databases/openldap.nix

   1 { lib, pkgs, config, myconfig, mylibs, ... }:
   2 let
   3     cfg = config.services.myDatabases;
   4     ldapConfig = let
   5       kerberosSchema = pkgs.fetchurl {
   6         url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema";
   7         sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww";
   8       };
   9       puppetSchema = pkgs.fetchurl {
  10         url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema";
  11         sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh";
  12       };
  13     in ''
  14       include         ${pkgs.openldap}/etc/schema/core.schema
  15       include         ${pkgs.openldap}/etc/schema/cosine.schema
  16       include         ${pkgs.openldap}/etc/schema/inetorgperson.schema
  17       include         ${pkgs.openldap}/etc/schema/nis.schema
  18       include         ${puppetSchema}
  19       include         ${kerberosSchema}
  20       include         ${./immae.schema}
  21
  22       pidfile         /run/slapd/slapd.pid
  23       argsfile        /run/slapd/slapd.args
  24
  25       moduleload      back_hdb
  26       backend         hdb
  27
  28       moduleload      memberof
  29       database        hdb
  30       suffix          "${myconfig.env.ldap.base}"
  31       rootdn          "${myconfig.env.ldap.root_dn}"
  32       rootpw          ${myconfig.env.ldap.root_pw}
  33       directory       /var/lib/openldap
  34       overlay         memberof
  35
  36       TLSCertificateFile    /var/lib/acme/ldap/cert.pem
  37       TLSCertificateKeyFile /var/lib/acme/ldap/key.pem
  38       TLSCACertificateFile  /var/lib/acme/ldap/fullchain.pem
  39       TLSCACertificatePath  ${pkgs.cacert.unbundled}/etc/ssl/certs/
  40       #This makes openldap crash
  41       #TLSCipherSuite        DEFAULT
  42
  43       sasl-host kerberos.immae.eu
  44       ${builtins.readFile "${myconfig.privateFiles}/ldap.conf"}
  45       '';
  46 in {
  47   options.services.myDatabases = {
  48     ldap = {
  49       enable = lib.mkOption {
  50         default = cfg.enable;
  51         example = true;
  52         description = "Whether to enable ldap";
  53         type = lib.types.bool;
  54       };
  55     };
  56   };
  57
  58   config = lib.mkIf cfg.enable {
  59     networking.firewall.allowedTCPPorts = [ 636 389 ];
  60
  61     services.cron = {
  62       systemCronJobs = [
  63         ''
  64           35 1,13 * * * root ${pkgs.openldap}/bin/slapcat -v -b "dc=immae,dc=eu" -f ${pkgs.writeText "slapd.conf" ldapConfig} -l /var/lib/openldap/backup.ldif
  65         ''
  66       ];
  67     };
  68
  69     security.acme.certs."ldap" = config.services.myCertificates.certConfig // {
  70       user = "openldap";
  71       group = "openldap";
  72       plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
  73       domain = "ldap.immae.eu";
  74       postRun = ''
  75         systemctl restart openldap.service
  76       '';
  77     };
  78
  79     services.openldap = {
  80       enable = config.services.myDatabases.ldap.enable;
  81       dataDir = "/var/lib/openldap";
  82       urlList = [ "ldap://" "ldaps://" ];
  83       extraConfig = ldapConfig;
  84     };
  85   };
  86 }
  87