X-Git-Url: https://git.immae.eu/?p=perso%2FImmae%2FConfig%2FNix.git;a=blobdiff_plain;f=modules%2Fprivate%2Fdatabases%2Fpostgresql.nix;h=911a6d1b2a22ddfac33cf6965db78d7d3b619974;hp=8c36d84e0ccbab15e68b555c4d46008861fd5ffc;hb=4aac110f17f0528d90510eec00c9a8df60bcf04f;hpb=ffb14c1c25280777f5db3d2129c48dd319381f65

diff --git a/modules/private/databases/postgresql.nix b/modules/private/databases/postgresql.nix
index 8c36d84..911a6d1 100644
--- a/modules/private/databases/postgresql.nix
+++ b/modules/private/databases/postgresql.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, config, myconfig,  ... }:
+{ lib, pkgs, config, ... }:
 let
     cfg = config.myServices.databases.postgresql;
 in {
@@ -10,6 +10,78 @@ in {
         description = "Whether to enable postgresql database";
         type = lib.types.bool;
       };
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.postgresql;
+        description = ''
+          Postgresql package to use.
+          '';
+      };
+      ldapConfig = lib.mkOption {
+        description = "LDAP configuration to allow PAM identification via LDAP";
+        type = lib.types.submodule {
+          options = {
+            host = lib.mkOption { type = lib.types.str; };
+            base = lib.mkOption { type = lib.types.str; };
+            dn = lib.mkOption { type = lib.types.str; };
+            password = lib.mkOption { type = lib.types.str; };
+            filter = lib.mkOption { type = lib.types.str; };
+          };
+        };
+      };
+      replicationLdapConfig = lib.mkOption {
+        description = "LDAP configuration to allow replication";
+        type = lib.types.submodule {
+          options = {
+            host = lib.mkOption { type = lib.types.str; };
+            base = lib.mkOption { type = lib.types.str; };
+            dn = lib.mkOption { type = lib.types.str; };
+            password = lib.mkOption { type = lib.types.str; };
+          };
+        };
+      };
+      authorizedHosts = lib.mkOption {
+        default = {};
+        description = "Hosts to allow connections from";
+        type = lib.types.attrsOf (lib.types.listOf (lib.types.submodule {
+          options = {
+            method = lib.mkOption {
+              default = "md5";
+              type = lib.types.str;
+            };
+            username = lib.mkOption {
+              default = "all";
+              type = lib.types.str;
+            };
+            database = lib.mkOption {
+              default = "all";
+              type = lib.types.str;
+            };
+            ip4 = lib.mkOption {
+              default = [];
+              type = lib.types.listOf lib.types.str;
+            };
+            ip6 = lib.mkOption {
+              default = [];
+              type = lib.types.listOf lib.types.str;
+            };
+          };
+        }));
+      };
+      replicationHosts = lib.mkOption {
+        default = {};
+        description = "Hosts to allow replication from";
+        type = lib.types.attrsOf (lib.types.submodule {
+          options = {
+            ip4 = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+            };
+            ip6 = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+            };
+          };
+        });
+      };
       # Output variables
       socketsDir = lib.mkOption {
         type = lib.types.path;
@@ -33,10 +105,6 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-    nixpkgs.overlays = [ (self: super: rec {
-      postgresql = self.postgresql_11_custom;
-    }) ];
-
     networking.firewall.allowedTCPPorts = [ 5432 ];
 
     security.acme.certs."postgresql" = config.myServices.databasesCerts // {
@@ -53,9 +121,9 @@ in {
       SupplementaryGroups = "keys";
       RuntimeDirectory = cfg.systemdRuntimeDirectory;
     };
-    services.postgresql = rec {
+    services.postgresql = {
       enable = true;
-      package = pkgs.postgresql;
+      package = cfg.package;
       enableTCPIP = true;
       extraConfig = ''
         max_connections = 100
@@ -76,14 +144,25 @@ in {
         ssl_cert_file = '${config.security.acme.directory}/postgresql/fullchain.pem'
         ssl_key_file = '${config.security.acme.directory}/postgresql/key.pem'
         '';
-      authentication = ''
+      authentication = let
+        hosts = builtins.concatStringsSep "\n" (
+          lib.lists.flatten (lib.mapAttrsToList (k: vs: map (v:
+            map (ip6: "hostssl	${v.database}	${v.username}	${ip6}/128	${v.method}") v.ip6
+            ++ map (ip4: "hostssl	${v.database}	${v.username}	${ip4}/32		${v.method}") v.ip4
+          ) vs) cfg.authorizedHosts
+        ));
+        replication = builtins.concatStringsSep "\n" (
+          lib.lists.flatten (lib.mapAttrsToList (k: v:
+          map (ip6: "hostssl	replication	${k}	${ip6}/128	pam pamservice=postgresql_replication") v.ip6
+          ++ map (ip4: "hostssl	replication	${k}	${ip4}/32		pam pamservice=postgresql_replication") v.ip4
+          ) cfg.replicationHosts
+        ));
+      in ''
         local	all	postgres				ident
         local	all	all					md5
-        hostssl	all	all	188.165.209.148/32		md5
-        hostssl	all	all	178.33.252.96/32		md5
+        ${hosts}
         hostssl	all	all	all				pam
-        hostssl	replication	backup-1	2001:41d0:302:1100::9:e5a9/128	pam pamservice=postgresql_replication
-        hostssl	replication	backup-1	54.37.151.137/32		pam pamservice=postgresql_replication
+        ${replication}
       '';
     };
 
@@ -93,9 +172,9 @@ in {
         permissions = "0400";
         group = "postgres";
         user = "postgres";
-        text =  with myconfig.env.databases.postgresql.pam; ''
-          host ${myconfig.env.ldap.host}
-          base ${myconfig.env.ldap.base}
+        text =  with cfg.ldapConfig; ''
+          host ${host}
+          base ${base}
           binddn ${dn}
           bindpw ${password}
           pam_filter ${filter}
@@ -107,11 +186,11 @@ in {
         permissions = "0400";
         group = "postgres";
         user = "postgres";
-        text = ''
-          host ${myconfig.env.ldap.host}
-          base ${myconfig.env.ldap.base}
-          binddn ${myconfig.env.ldap.host_dn}
-          bindpw ${myconfig.env.ldap.password}
+        text = with cfg.replicationLdapConfig; ''
+          host ${host}
+          base ${base}
+          binddn ${dn}
+          bindpw ${password}
           pam_login_attribute cn
           ssl start_tls
         '';