virtual/modules/databases/default.nix

   1 { lib, pkgs, config, mylibs, ... }:
   2 let
   3     cfg = config.services.myDatabases;
   4 in {
   5   options.services.myDatabases = {
   6     enable = lib.mkEnableOption "my databases service";
   7     postgresql = {
   8       enable = lib.mkOption {
   9         default = cfg.enable;
  10         example = true;
  11         description = "Whether to enable postgresql database";
  12         type = lib.types.bool;
  13       };
  14     };
  15
  16     mariadb = {
  17       enable = lib.mkOption {
  18         default = cfg.enable;
  19         example = true;
  20         description = "Whether to enable mariadb database";
  21         type = lib.types.bool;
  22       };
  23     };
  24
  25     redis = {
  26       enable = lib.mkOption {
  27         default = cfg.enable;
  28         example = true;
  29         description = "Whether to enable redis database";
  30         type = lib.types.bool;
  31       };
  32     };
  33   };
  34
  35   config = lib.mkIf cfg.enable {
  36     nixpkgs.config.packageOverrides = oldpkgs: rec {
  37       postgresql = postgresql111;
  38       postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec {
  39         passthru = old.passthru // { psqlSchema = "11.0"; };
  40         name = "postgresql-11.1";
  41         src = pkgs.fetchurl {
  42           url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
  43           sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
  44         };
  45         configureFlags = old.configureFlags ++ [ "--with-pam" ];
  46         buildInputs = (old.buildInputs or []) ++ [ pkgs.pam ];
  47         patches = old.patches ++ [
  48           ./postgresql_run_socket_path.patch
  49         ];
  50       });
  51       mariadb = mariadbPAM;
  52       mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec {
  53         cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
  54         buildInputs = old.buildInputs ++ [ pkgs.pam ];
  55       });
  56     };
  57
  58     networking.firewall.allowedTCPPorts = [ 3306 5432 ];
  59
  60     # FIXME: initial sync
  61     # FIXME: backup
  62     # FIXME: restart after pam
  63     # FIXME: pam access doesn’t work (because of php module)
  64     # FIXME: ssl
  65     services.mysql = rec {
  66       enable = cfg.mariadb.enable;
  67       package = pkgs.mariadb;
  68     };
  69
  70     # Cannot use eldiron: psql complains too much rights on the key, and
  71     # setfacl cannot work properly because of acme prestart script
  72     security.acme.certs."postgresql" = config.services.myCertificates.certConfig // {
  73       user = "postgres";
  74       group = "postgres";
  75       plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
  76       domain = "db-1.immae.eu";
  77       postRun = ''
  78         systemctl reload postgresql.service
  79       '';
  80     };
  81
  82     system.activationScripts.postgresql = ''
  83       install -m 0755 -o postgres -g postgres -d /run/postgresql
  84       '';
  85
  86     # FIXME: initial sync
  87     services.postgresql = rec {
  88       enable = cfg.postgresql.enable;
  89       package = pkgs.postgresql;
  90       enableTCPIP = true;
  91       extraConfig = ''
  92         max_connections = 100
  93         wal_level = logical
  94         shared_buffers = 128MB
  95         max_wal_size = 1GB
  96         min_wal_size = 80MB
  97         log_timezone = 'Europe/Paris'
  98         datestyle = 'iso, mdy'
  99         timezone = 'Europe/Paris'
 100         lc_messages = 'en_US.UTF-8'
 101         lc_monetary = 'en_US.UTF-8'
 102         lc_numeric = 'en_US.UTF-8'
 103         lc_time = 'en_US.UTF-8'
 104         default_text_search_config = 'pg_catalog.english'
 105         ssl = on
 106         ssl_cert_file = '/var/lib/acme/postgresql/fullchain.pem'
 107         ssl_key_file = '/var/lib/acme/postgresql/key.pem'
 108         '';
 109       authentication = ''
 110         local   all     postgres                                ident
 111         local   all     all                                     md5
 112         hostssl all     all             samehost                md5
 113         hostssl all     all             178.33.252.96/32        md5
 114         hostssl all     all             188.165.209.148/32      md5
 115         hostssl all     all             all                     pam
 116         hostssl replication     backup-1        2001:41d0:302:1100::9:e5a9/128  pam pamservice=postgresql_replication
 117         hostssl replication     backup-1        54.37.151.137/32                pam pamservice=postgresql_replication
 118       '';
 119     };
 120
 121     security.pam.services = let
 122       pam_ldap = pkgs.pam_ldap;
 123       pam_ldap_mysql = assert mylibs.checkEnv "NIXOPS_MYSQL_PAM_PASSWORD";
 124               pkgs.writeText "mysql.conf" ''
 125         host ldap.immae.eu
 126         base dc=immae,dc=eu
 127         binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 128         bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
 129         pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 130         '';
 131       pam_ldap_postgresql_replication = assert mylibs.checkEnv "NIXOPS_ELDIRON_LDAP_PASSWORD";
 132               pkgs.writeText "postgresql.conf" ''
 133         host ldap.immae.eu
 134         base dc=immae,dc=eu
 135         binddn cn=eldiron,ou=hosts,dc=immae,dc=eu
 136         bindpw ${builtins.getEnv "NIXOPS_ELDIRON_LDAP_PASSWORD"}
 137         pam_login_attribute cn
 138         '';
 139     in [
 140       {
 141         name = "mysql";
 142         text = ''
 143           # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
 144           auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 145           account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 146           '';
 147       }
 148       {
 149         name = "postgresql";
 150         text = ''
 151           auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
 152           account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
 153           '';
 154       }
 155       {
 156         name = "postgresql_replication";
 157         text = ''
 158           auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
 159           account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
 160           '';
 161       }
 162     ];
 163
 164     # FIXME: backup
 165     # Diaspora: 15
 166     # Nextcloud: 14
 167     # Mastodon: 13
 168     # Mediagoblin: 12
 169     services.redis = rec {
 170       enable = config.services.myDatabases.redis.enable;
 171       bind = "127.0.0.1";
 172       unixSocket = "/run/redis/redis.sock";
 173       extraConfig = ''
 174         unixsocketperm 777
 175         maxclients 1024
 176         '';
 177     };
 178     system.activationScripts.redis = ''
 179       mkdir -p /run/redis
 180       chown redis /run/redis
 181     '';
 182   };
 183 }