type = lib.types.bool;
};
};
+
+ ldap = {
+ enable = lib.mkOption {
+ default = cfg.enable;
+ example = true;
+ description = "Whether to enable ldap";
+ type = lib.types.bool;
+ };
+ };
};
config = lib.mkIf cfg.enable {
});
};
- networking.firewall.allowedTCPPorts = [ 3306 5432 ];
+ networking.firewall.allowedTCPPorts = [ 3306 5432 636 389 ];
# for adminer, ssl is implemented with mysqli only, which is
# currently disabled because it’s not compatible with pam.
'';
};
+ security.acme.certs."ldap" = config.services.myCertificates.certConfig // {
+ user = "openldap";
+ group = "openldap";
+ plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
+ domain = "ldap.immae.eu";
+ postRun = ''
+ systemctl restart openldap.service
+ '';
+ };
+
system.activationScripts.postgresql = ''
install -m 0755 -o postgres -g postgres -d ${myconfig.env.databases.postgresql.socket}
'';
mkdir -p $(dirname ${myconfig.env.databases.redis.socket})
chown redis $(dirname ${myconfig.env.databases.redis.socket})
'';
+
+ services.openldap = let
+ kerberosSchema = pkgs.fetchurl {
+ url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema";
+ sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww";
+ };
+ puppetSchema = pkgs.fetchurl {
+ url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema";
+ sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh";
+ };
+ in {
+ enable = config.services.myDatabases.ldap.enable;
+ dataDir = "/var/lib/openldap";
+ urlList = [ "ldap://" "ldaps://" ];
+ extraConfig = ''
+ include ${pkgs.openldap}/etc/schema/core.schema
+ include ${pkgs.openldap}/etc/schema/cosine.schema
+ include ${pkgs.openldap}/etc/schema/inetorgperson.schema
+ include ${pkgs.openldap}/etc/schema/nis.schema
+ include ${puppetSchema}
+ include ${kerberosSchema}
+ include ${./immae.schema}
+
+ pidfile /run/slapd/slapd.pid
+ argsfile /run/slapd/slapd.args
+
+ moduleload back_hdb
+ backend hdb
+
+ moduleload memberof
+ database hdb
+ suffix "${myconfig.env.ldap.base}"
+ rootdn "${myconfig.env.ldap.root_dn}"
+ rootpw ${myconfig.env.ldap.root_pw}
+ directory /var/lib/openldap
+ overlay memberof
+
+ TLSCertificateFile /var/lib/acme/ldap/cert.pem
+ TLSCertificateKeyFile /var/lib/acme/ldap/key.pem
+ TLSCACertificateFile /var/lib/acme/ldap/fullchain.pem
+ TLSCACertificatePath ${pkgs.cacert.unbundled}/etc/ssl/certs/
+ #This makes openldap crash
+ #TLSCipherSuite DEFAULT
+
+ sasl-host kerberos.immae.eu
+ ${builtins.readFile "${myconfig.privateFiles}/ldap.conf"}
+ '';
+ };
};
}
--- /dev/null
+# vim: set filetype=slapd:
+objectIdentifier Immaeroot 1.3.6.1.4.1.50071
+
+objectIdentifier Immae Immaeroot:2
+objectIdentifier ImmaeattributeType Immae:3
+objectIdentifier ImmaeobjectClass Immae:4
+
+# TT-RSS
+attributetype ( ImmaeattributeType:1 NAME 'immaeTtrssLogin'
+ DESC 'login for TTRSS'
+ EQUALITY caseIgnoreMatch
+ SUBSTR caseIgnoreSubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+
+objectclass ( ImmaeobjectClass:1 NAME 'immaeTtrssClass'
+ DESC 'Expansion of the existing object classes for ttrss'
+ SUP top AUXILIARY
+ MUST ( immaeTtrssLogin ) )
+
+# FTP
+attributetype ( ImmaeattributeType:2 NAME 'immaeFtpDirectory'
+ DESC 'home directory for ftp'
+ EQUALITY caseExactIA5Match
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+
+attributetype ( ImmaeattributeType:3 NAME 'immaeFtpUid'
+ DESC 'user id for ftp'
+ EQUALITY integerMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+
+attributetype ( ImmaeattributeType:4 NAME 'immaeFtpGid'
+ DESC 'group id for ftp'
+ EQUALITY integerMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+
+objectclass ( ImmaeobjectClass:2 NAME 'immaeFtpClass'
+ DESC 'Expansion of the existing object classes for ftp'
+ SUP top AUXILIARY
+ MUST ( immaeFtpDirectory $ immaeFtpGid $ immaeFtpUid ) )
+
+
+# SSH keys
+attributetype ( ImmaeattributeType:5 NAME 'immaeSshKey'
+ DESC 'OpenSSH Public key'
+ EQUALITY octetStringMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+
+objectClass ( ImmaeobjectClass:3 NAME 'immaeSshClass'
+ DESC 'OpenSSH class'
+ SUP top AUXILIARY
+ MAy ( immaeSSHKey ) )
+
+# Specific access
+attributetype (ImmaeattributeType:6 NAME 'immaeAccessDn'
+ EQUALITY distinguishedNameMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+
+attributetype (ImmaeattributeType:17 NAME 'immaeAccessWriteDn'
+ EQUALITY distinguishedNameMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+
+attributetype (ImmaeattributeType:18 NAME 'immaeAccessReadSubtree'
+ EQUALITY distinguishedNameMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+
+objectClass ( ImmaeobjectClass:4 NAME 'immaeAccessClass'
+ DESC 'Access class'
+ SUP top AUXILIARY
+ MAY ( immaeAccessDn $ immaeAccessWriteDn $ immaeAccessReadSubtree ) )
+
+# Xmpp uid
+attributetype ( ImmaeattributeType:7 NAME 'immaeXmppUid'
+ DESC 'user part for Xmpp'
+ EQUALITY caseIgnoreMatch
+ SUBSTR caseIgnoreSubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+
+objectclass ( ImmaeobjectClass:5 NAME 'immaeXmppClass'
+ DESC 'Expansion of the existing object classes for XMPP'
+ SUP top AUXILIARY
+ MUST ( immaeXmppUid ) )
+
+# Postfix accounts
+attributetype ( ImmaeattributeType:8 NAME 'immaePostfixAddress'
+ DESC 'the dovecot address to match as username'
+ EQUALITY caseIgnoreIA5Match
+ SUBSTR caseIgnoreIA5SubstringsMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+
+attributetype ( ImmaeattributeType:9 NAME 'immaePostfixHome'
+ DESC 'the postfix home directory'
+ EQUALITY caseExactIA5Match
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+attributetype ( ImmaeattributeType:10 NAME 'immaePostfixMail'
+ DESC 'the dovecot mail location'
+ EQUALITY caseExactIA5Match
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+attributetype ( ImmaeattributeType:11 NAME 'immaePostfixUid'
+ DESC 'the dovecot uid'
+ EQUALITY caseExactIA5Match
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+attributetype ( ImmaeattributeType:12 NAME 'immaePostfixGid'
+ DESC 'the dovecot gid'
+ EQUALITY caseExactIA5Match
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+objectclass ( ImmaeobjectClass:6 NAME 'immaePostfixClass'
+ DESC 'Expansion of the existing object classes for Postfix'
+ SUP top AUXILIARY
+ MUST ( immaePostfixAddress $ immaePostfixHome $
+ immaePostfixMail $ immaePostfixUid $ immaePostfixGid )
+ )
+
+# Tinc informations
+# Domaine = une classe a part ou une partie du dn ?
+# attributetype ( ImmaeattributeType:13 NAME 'immaeTincIpSegment'
+# DESC 'the internal ip segment in tinc'
+# EQUALITY caseIgnoreIA5Match
+# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+#
+# attributetype ( ImmaeattributeType:14 NAME 'immaeTincSubdomain'
+# DESC 'the host subdomain'
+# EQUALITY caseIgnoreIA5Match
+# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+#
+# attributetype ( ImmaeattributeType:15 NAME 'immaeTincHostname'
+# DESC 'the host name'
+# EQUALITY caseIgnoreIA5Match
+# SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+#
+# objectclass ( ImmaeobjectClass:7 NAME 'immaeTincHostClass'
+# DESC 'Expansion of the existing object classes for Tinc'
+# SUP top AUXILIARY
+# MUST ( immaeTincInternalIp $ immaeTincSubdomain $
+# immaeTincHostname )
+# )
+
+attributetype (ImmaeattributeType:16 NAME 'immaePuppetJson'
+ DESC 'Puppet hiera json'
+ EQUALITY octetStringMatch
+ SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+
+objectclass ( ImmaeobjectClass:8 NAME 'immaePuppetClass'
+ DESC 'Expansion of the existing object classes for Puppet'
+ SUP top AUXILIARY
+ MUST ( immaePuppetJson )
+ )
+
+# Last:
+# attributetype (ImmaeattributeType:18 NAME 'immaeAccessReadSubtree'
+# objectclass ( ImmaeobjectClass:8 NAME 'immaePuppetClass'
+