virtual/modules/databases/default.nix

   1 { lib, pkgs, config, myconfig, mylibs, ... }:
   2 let
   3     cfg = config.services.myDatabases;
   4 in {
   5   options.services.myDatabases = {
   6     enable = lib.mkEnableOption "my databases service";
   7     postgresql = {
   8       enable = lib.mkOption {
   9         default = cfg.enable;
  10         example = true;
  11         description = "Whether to enable postgresql database";
  12         type = lib.types.bool;
  13       };
  14     };
  15
  16     mariadb = {
  17       enable = lib.mkOption {
  18         default = cfg.enable;
  19         example = true;
  20         description = "Whether to enable mariadb database";
  21         type = lib.types.bool;
  22       };
  23     };
  24
  25     redis = {
  26       enable = lib.mkOption {
  27         default = cfg.enable;
  28         example = true;
  29         description = "Whether to enable redis database";
  30         type = lib.types.bool;
  31       };
  32     };
  33   };
  34
  35   config = lib.mkIf cfg.enable {
  36     nixpkgs.config.packageOverrides = oldpkgs: rec {
  37       postgresql = postgresql111;
  38       postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec {
  39         passthru = old.passthru // { psqlSchema = "11.0"; };
  40         name = "postgresql-11.1";
  41         src = pkgs.fetchurl {
  42           url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
  43           sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
  44         };
  45         configureFlags = old.configureFlags ++ [ "--with-pam" ];
  46         buildInputs = (old.buildInputs or []) ++ [ pkgs.pam ];
  47         patches = old.patches ++ [
  48           ./postgresql_run_socket_path.patch
  49         ];
  50       });
  51       mariadb = mariadbPAM;
  52       mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec {
  53         cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
  54         buildInputs = old.buildInputs ++ [ pkgs.pam ];
  55       });
  56     };
  57
  58     networking.firewall.allowedTCPPorts = [ 3306 5432 ];
  59
  60     services.mysql = rec {
  61       enable = cfg.mariadb.enable;
  62       package = pkgs.mariadb;
  63     };
  64
  65     security.acme.certs."postgresql" = config.services.myCertificates.certConfig // {
  66       user = "postgres";
  67       group = "postgres";
  68       plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
  69       domain = "db-1.immae.eu";
  70       postRun = ''
  71         systemctl reload postgresql.service
  72       '';
  73     };
  74
  75     system.activationScripts.postgresql = ''
  76       install -m 0755 -o postgres -g postgres -d /run/postgresql
  77       '';
  78
  79     services.postgresql = rec {
  80       enable = cfg.postgresql.enable;
  81       package = pkgs.postgresql;
  82       enableTCPIP = true;
  83       extraConfig = ''
  84         max_connections = 100
  85         wal_level = logical
  86         shared_buffers = 128MB
  87         max_wal_size = 1GB
  88         min_wal_size = 80MB
  89         log_timezone = 'Europe/Paris'
  90         datestyle = 'iso, mdy'
  91         timezone = 'Europe/Paris'
  92         lc_messages = 'en_US.UTF-8'
  93         lc_monetary = 'en_US.UTF-8'
  94         lc_numeric = 'en_US.UTF-8'
  95         lc_time = 'en_US.UTF-8'
  96         default_text_search_config = 'pg_catalog.english'
  97         ssl = on
  98         ssl_cert_file = '/var/lib/acme/postgresql/fullchain.pem'
  99         ssl_key_file = '/var/lib/acme/postgresql/key.pem'
 100         '';
 101       authentication = ''
 102         local   all     postgres                                ident
 103         local   all     all                                     md5
 104         hostssl all     all             samehost                md5
 105         hostssl all     all             178.33.252.96/32        md5
 106         hostssl all     all             188.165.209.148/32      md5
 107         hostssl all     all             all                     pam
 108         hostssl replication     backup-1        2001:41d0:302:1100::9:e5a9/128  pam pamservice=postgresql_replication
 109         hostssl replication     backup-1        54.37.151.137/32                pam pamservice=postgresql_replication
 110       '';
 111     };
 112
 113     security.pam.services = let
 114       pam_ldap = pkgs.pam_ldap;
 115       pam_ldap_mysql = pkgs.writeText "mysql.conf" ''
 116         host ldap.immae.eu
 117         base dc=immae,dc=eu
 118         binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 119         bindpw ${myconfig.env.databases.mysql.pam_password}
 120         pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 121         '';
 122       pam_ldap_postgresql_replication = pkgs.writeText "postgresql.conf" ''
 123         host ldap.immae.eu
 124         base dc=immae,dc=eu
 125         binddn cn=eldiron,ou=hosts,dc=immae,dc=eu
 126         bindpw ${myconfig.env.ldap.password}
 127         pam_login_attribute cn
 128         '';
 129     in [
 130       {
 131         name = "mysql";
 132         text = ''
 133           # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
 134           auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 135           account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 136           '';
 137       }
 138       {
 139         name = "postgresql";
 140         text = ''
 141           auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
 142           account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
 143           '';
 144       }
 145       {
 146         name = "postgresql_replication";
 147         text = ''
 148           auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
 149           account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
 150           '';
 151       }
 152     ];
 153
 154     services.redis = rec {
 155       enable = config.services.myDatabases.redis.enable;
 156       bind = "127.0.0.1";
 157       unixSocket = myconfig.env.databases.redis.socket;
 158       extraConfig = ''
 159         unixsocketperm 777
 160         maxclients 1024
 161         '';
 162     };
 163     system.activationScripts.redis = ''
 164       mkdir -p $(dirname ${myconfig.env.databases.redis.socket})
 165       chown redis $(dirname ${myconfig.env.databases.redis.socket})
 166     '';
 167   };
 168 }