networking = {
firewall = {
enable = true;
- allowedTCPPorts = [ 22 80 443 5432 ];
+ allowedTCPPorts = [ 22 80 443 3306 5432 ];
};
};
};
};
+ # FIXME: environment variables ?
+ security.pam.services = let
+ pam_ldap = pkgs.pam_ldap;
+ pam_ldap_mysql = pkgs.writeText "mysql.conf" ''
+ host ldap.immae.eu
+ base dc=immae,dc=eu
+ binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
+ bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
+ pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
+ '';
+ in [
+ {
+ name = "mysql";
+ text = ''
+ # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
+ auth required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
+ account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
+ '';
+ }
+ ];
+
+ # FIXME: initial sync
+ # FIXME: backup
+ # FIXME: restart after pam
+ # FIXME: pam access doesn’t work (because of php module)
+ services.mysql = rec {
+ enable = true;
+ package = pkgs.mariadb.overrideAttrs(old: rec {
+ cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
+ buildInputs = old.buildInputs ++ [ pkgs.pam ];
+ });
+ };
+
# FIXME: initial sync
+ # FIXME: backup
services.postgresql = rec {
enable = true;
package = pkgs.postgresql100.overrideAttrs(old: rec {