};
security.pam.services = let
- pam_ldap = pkgs.pam_ldap;
+ pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
pam_ldap_mysql = pkgs.writeText "mysql.conf" ''
- host ldap.immae.eu
- base dc=immae,dc=eu
+ host ${myconfig.env.ldap.host}
+ base ${myconfig.env.ldap.base}
binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
bindpw ${myconfig.env.databases.mysql.pam_password}
+ ssl start_tls
pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
'';
pam_ldap_postgresql_replication = pkgs.writeText "postgresql.conf" ''
- host ldap.immae.eu
- base dc=immae,dc=eu
- binddn cn=eldiron,ou=hosts,dc=immae,dc=eu
+ host ${myconfig.env.ldap.host}
+ base ${myconfig.env.ldap.base}
+ binddn ${myconfig.env.ldap.host_dn}
bindpw ${myconfig.env.ldap.password}
+ ssl start_tls
pam_login_attribute cn
'';
in [
name = "mysql";
text = ''
# https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
- auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
- account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
+ auth required ${pam_ldap} config=${pam_ldap_mysql}
+ account required ${pam_ldap} config=${pam_ldap_mysql}
'';
}
{
name = "postgresql";
text = ''
- auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
- account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
+ auth required ${pam_ldap} config=${pam_ldap_postgresql_replication}
+ account required ${pam_ldap} config=${pam_ldap_postgresql_replication}
'';
}
{
name = "postgresql_replication";
text = ''
- auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
- account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_postgresql_replication}
+ auth required ${pam_ldap} config=${pam_ldap_postgresql_replication}
+ account required ${pam_ldap} config=${pam_ldap_postgresql_replication}
'';
}
];