Move databases configs to modules

7 files changed, 644 insertions, 0 deletions

diff --git a/modules/private/databases/default.nix b/modules/private/databases/default.nix
new file mode 100644
index 0000000..78d91dc
--- /dev/null
+++ b/modules/private/databases/default.nix
@@ -0,0 +1,18 @@
+{ lib, config, ... }:
+let
+  cfg = config.myServices.databases;
+in
+{
+  options.myServices = {
+    databases.enable = lib.mkEnableOption "my databases service";
+    databasesCerts = lib.mkOption {
+      description = "Default databases configurations for certificates as accepted by acme";
+    };
+  };
+  config.myServices.databases = lib.mkIf cfg.enable {
+    mariadb.enable = true;
+    openldap.enable = true;
+    postgresql.enable = true;
+    redis.enable = true;
+  };
+}
diff --git a/modules/private/databases/mariadb.nix b/modules/private/databases/mariadb.nix
new file mode 100644
index 0000000..21f4359
--- /dev/null
+++ b/modules/private/databases/mariadb.nix
@@ -0,0 +1,125 @@
+{ lib, pkgs, config, myconfig,  ... }:
+let
+    cfg = config.myServices.databases.mariadb;
+in {
+  options.myServices.databases = {
+    mariadb = {
+      enable = lib.mkOption {
+        default = cfg.enable;
+        example = true;
+        description = "Whether to enable mariadb database";
+        type = lib.types.bool;
+      };
+      dataDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/var/lib/mysql";
+        description = ''
+          The directory where Mariadb stores its data.
+        '';
+      };
+      # Output variables
+      socketsDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/run/mysqld";
+        description = ''
+          The directory where Mariadb puts sockets.
+          '';
+      };
+      sockets = lib.mkOption {
+        type = lib.types.attrsOf lib.types.path;
+        default = {
+          mysqld  = "${cfg.socketsDir}/mysqld.sock";
+        };
+        readOnly = true;
+        description = ''
+          Mariadb sockets
+          '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    networking.firewall.allowedTCPPorts = [ 3306 ];
+
+    # for adminer, ssl is implemented with mysqli only, which is
+    # currently disabled because it’s not compatible with pam.
+    # Thus we need to generate two users for each 'remote': one remote
+    # with SSL, and one localhost without SSL.
+    # User identified by LDAP:
+    # CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL;
+    # CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql';
+    services.mysql = {
+      enable = true;
+      package = pkgs.mariadb;
+      dataDir = cfg.dataDir;
+      extraOptions = ''
+        ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+        ssl_key = /var/lib/acme/mysql/key.pem
+        ssl_cert = /var/lib/acme/mysql/fullchain.pem
+        '';
+    };
+
+    users.users.mysql.extraGroups = [ "keys" ];
+    security.acme.certs."mysql" = config.myServices.databasesCerts // {
+      user = "mysql";
+      group = "mysql";
+      plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
+      domain = "db-1.immae.eu";
+      postRun = ''
+        systemctl restart mysql.service
+      '';
+    };
+
+    secrets.keys = [
+      {
+        dest = "mysql/mysqldump";
+        permissions = "0400";
+        user = "root";
+        group = "root";
+        text = ''
+          [mysqldump]
+          user = root
+          password = ${myconfig.env.databases.mysql.systemUsers.root}
+        '';
+      }
+      {
+        dest = "mysql/pam";
+        permissions = "0400";
+        user = "mysql";
+        group = "mysql";
+        text = with myconfig.env.databases.mysql.pam; ''
+          host ${myconfig.env.ldap.host}
+          base ${myconfig.env.ldap.base}
+          binddn ${dn}
+          bindpw ${password}
+          pam_filter ${filter}
+          ssl start_tls
+          '';
+      }
+    ];
+
+    services.cron = {
+      enable = true;
+      systemCronJobs = [
+        ''
+          30 1,13 * * * root ${pkgs.mariadb}/bin/mysqldump --defaults-file=${config.secrets.location}/mysql/mysqldump --all-databases > ${cfg.dataDir}/backup.sql
+        ''
+      ];
+    };
+
+    security.pam.services = let
+      pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
+    in [
+      {
+        name = "mysql";
+        text = ''
+          # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
+          auth    required ${pam_ldap} config=${config.secrets.location}/mysql/pam
+          account required ${pam_ldap} config=${config.secrets.location}/mysql/pam
+          '';
+      }
+    ];
+
+  };
+}
+
diff --git a/modules/private/databases/openldap/default.nix b/modules/private/databases/openldap/default.nix
new file mode 100644
index 0000000..850f3ff
--- /dev/null
+++ b/modules/private/databases/openldap/default.nix
@@ -0,0 +1,130 @@
+{ lib, pkgs, config, myconfig,  ... }:
+let
+  cfg = config.myServices.databases.openldap;
+  ldapConfig = let
+    kerberosSchema = pkgs.fetchurl {
+      url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema";
+      sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww";
+    };
+    puppetSchema = pkgs.fetchurl {
+      url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema";
+      sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh";
+    };
+  in ''
+    include         ${pkgs.openldap}/etc/schema/core.schema
+    include         ${pkgs.openldap}/etc/schema/cosine.schema
+    include         ${pkgs.openldap}/etc/schema/inetorgperson.schema
+    include         ${pkgs.openldap}/etc/schema/nis.schema
+    include         ${puppetSchema}
+    include         ${kerberosSchema}
+    include         ${./immae.schema}
+
+    pidfile         ${cfg.pids.pid}
+    argsfile        ${cfg.pids.args}
+
+    moduleload      back_hdb
+    backend         hdb
+
+    moduleload      memberof
+    database        hdb
+    suffix          "${myconfig.env.ldap.base}"
+    rootdn          "${myconfig.env.ldap.root_dn}"
+    include         ${config.secrets.location}/ldap/password
+    directory       ${cfg.dataDir}
+    overlay         memberof
+
+    TLSCertificateFile    /var/lib/acme/ldap/cert.pem
+    TLSCertificateKeyFile /var/lib/acme/ldap/key.pem
+    TLSCACertificateFile  /var/lib/acme/ldap/fullchain.pem
+    TLSCACertificatePath  ${pkgs.cacert.unbundled}/etc/ssl/certs/
+    #This makes openldap crash
+    #TLSCipherSuite        DEFAULT
+
+    sasl-host kerberos.immae.eu
+    include ${config.secrets.location}/ldap/access
+    '';
+in
+{
+  options.myServices.databases = {
+    openldap = {
+      enable = lib.mkOption {
+        default = cfg.enable;
+        example = true;
+        description = "Whether to enable ldap";
+        type = lib.types.bool;
+      };
+      dataDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/var/lib/openldap";
+        description = ''
+          The directory where Openldap stores its data.
+        '';
+      };
+      socketsDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/run/slapd";
+        description = ''
+          The directory where Openldap puts sockets and pid files.
+          '';
+      };
+      # Output variables
+      pids = lib.mkOption {
+        type = lib.types.attrsOf lib.types.path;
+        default = {
+          pid  = "${cfg.socketsDir}/slapd.pid";
+          args = "${cfg.socketsDir}/slapd.args";
+        };
+        readOnly = true;
+        description = ''
+          Slapd pid files
+          '';
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    secrets.keys = [
+       {
+        dest = "ldap/password";
+        permissions = "0400";
+        user = "openldap";
+        group = "openldap";
+        text = "rootpw          ${myconfig.env.ldap.root_pw}";
+      }
+      {
+        dest = "ldap/access ";
+        permissions = "0400";
+        user = "openldap";
+        group = "openldap";
+        text = builtins.readFile "${myconfig.privateFiles}/ldap.conf";
+      }
+    ];
+    users.users.openldap.extraGroups = [ "keys" ];
+    networking.firewall.allowedTCPPorts = [ 636 389 ];
+
+    services.cron = {
+      systemCronJobs = [
+        ''
+          35 1,13 * * * root ${pkgs.openldap}/bin/slapcat -v -b "dc=immae,dc=eu" -f ${pkgs.writeText "slapd.conf" ldapConfig} -l ${cfg.dataDir}/backup.ldif | ${pkgs.gnugrep}/bin/grep -v "^# id=[0-9a-f]*$"
+        ''
+      ];
+    };
+
+    security.acme.certs."ldap" = config.myServices.databasesCerts // {
+      user = "openldap";
+      group = "openldap";
+      plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
+      domain = "ldap.immae.eu";
+      postRun = ''
+        systemctl restart openldap.service
+      '';
+    };
+
+    services.openldap = {
+      enable = true;
+      dataDir = cfg.dataDir;
+      urlList = [ "ldap://" "ldaps://" ];
+      extraConfig = ldapConfig;
+    };
+  };
+}
diff --git a/modules/private/databases/openldap/immae.schema b/modules/private/databases/openldap/immae.schema
new file mode 100644
index 0000000..f5ee5d5
--- /dev/null
+++ b/modules/private/databases/openldap/immae.schema
@@ -0,0 +1,167 @@
+# vim: set filetype=slapd:
+objectIdentifier Immaeroot 1.3.6.1.4.1.50071
+
+objectIdentifier Immae Immaeroot:2
+objectIdentifier ImmaeattributeType Immae:3
+objectIdentifier ImmaeobjectClass Immae:4
+
+# TT-RSS
+attributetype ( ImmaeattributeType:1 NAME 'immaeTtrssLogin'
+        DESC 'login for TTRSS'
+        EQUALITY caseIgnoreMatch
+        SUBSTR caseIgnoreSubstringsMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+
+objectclass ( ImmaeobjectClass:1 NAME 'immaeTtrssClass'
+        DESC 'Expansion of the existing object classes for ttrss'
+        SUP top AUXILIARY
+        MUST ( immaeTtrssLogin ) )
+
+# FTP
+attributetype ( ImmaeattributeType:2 NAME 'immaeFtpDirectory'
+        DESC 'home directory for ftp'
+        EQUALITY caseExactIA5Match
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+
+attributetype ( ImmaeattributeType:3 NAME 'immaeFtpUid'
+        DESC 'user id for ftp'
+        EQUALITY integerMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+
+attributetype ( ImmaeattributeType:4 NAME 'immaeFtpGid'
+        DESC 'group id for ftp'
+        EQUALITY integerMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+
+objectclass ( ImmaeobjectClass:2 NAME 'immaeFtpClass'
+        DESC 'Expansion of the existing object classes for ftp'
+        SUP top AUXILIARY
+        MUST ( immaeFtpDirectory $ immaeFtpGid $ immaeFtpUid ) )
+
+
+# SSH keys
+attributetype ( ImmaeattributeType:5 NAME 'immaeSshKey'
+        DESC 'OpenSSH Public key'
+        EQUALITY octetStringMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+
+objectClass ( ImmaeobjectClass:3 NAME 'immaeSshClass'
+        DESC 'OpenSSH class'
+        SUP top AUXILIARY
+        MAy ( immaeSSHKey ) )
+
+# Specific access
+attributetype (ImmaeattributeType:6 NAME 'immaeAccessDn'
+        EQUALITY distinguishedNameMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+
+attributetype (ImmaeattributeType:17 NAME 'immaeAccessWriteDn'
+        EQUALITY distinguishedNameMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+
+attributetype (ImmaeattributeType:18 NAME 'immaeAccessReadSubtree'
+        EQUALITY distinguishedNameMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+
+objectClass ( ImmaeobjectClass:4 NAME 'immaeAccessClass'
+        DESC 'Access class'
+        SUP top AUXILIARY
+        MAY ( immaeAccessDn $ immaeAccessWriteDn $ immaeAccessReadSubtree ) )
+
+# Xmpp uid
+attributetype ( ImmaeattributeType:7 NAME 'immaeXmppUid'
+        DESC 'user part for Xmpp'
+        EQUALITY caseIgnoreMatch
+        SUBSTR caseIgnoreSubstringsMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+
+objectclass ( ImmaeobjectClass:5 NAME 'immaeXmppClass'
+        DESC 'Expansion of the existing object classes for XMPP'
+        SUP top AUXILIARY
+        MUST ( immaeXmppUid ) )
+
+# Postfix accounts
+attributetype ( ImmaeattributeType:8 NAME 'immaePostfixAddress'
+        DESC 'the dovecot address to match as username'
+        EQUALITY caseIgnoreIA5Match
+        SUBSTR caseIgnoreIA5SubstringsMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+
+attributetype ( ImmaeattributeType:9 NAME 'immaePostfixHome'
+        DESC 'the postfix home directory'
+        EQUALITY caseExactIA5Match
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+attributetype ( ImmaeattributeType:10 NAME 'immaePostfixMail'
+        DESC 'the dovecot mail location'
+        EQUALITY caseExactIA5Match
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+attributetype ( ImmaeattributeType:11 NAME 'immaePostfixUid'
+        DESC 'the dovecot uid'
+        EQUALITY caseExactIA5Match
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+attributetype ( ImmaeattributeType:12 NAME 'immaePostfixGid'
+        DESC 'the dovecot gid'
+        EQUALITY caseExactIA5Match
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+objectclass ( ImmaeobjectClass:6 NAME 'immaePostfixClass'
+        DESC 'Expansion of the existing object classes for Postfix'
+        SUP top AUXILIARY
+        MUST ( immaePostfixAddress $ immaePostfixHome $
+          immaePostfixMail $ immaePostfixUid $ immaePostfixGid )
+        )
+
+# Tinc informations
+# Domaine = une classe a part ou une partie du dn ?
+# attributetype ( ImmaeattributeType:13 NAME 'immaeTincIpSegment'
+#         DESC 'the internal ip segment in tinc'
+#         EQUALITY caseIgnoreIA5Match
+#         SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+# 
+# attributetype ( ImmaeattributeType:14 NAME 'immaeTincSubdomain'
+#         DESC 'the host subdomain'
+#         EQUALITY caseIgnoreIA5Match
+#         SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+# 
+# attributetype ( ImmaeattributeType:15 NAME 'immaeTincHostname'
+#         DESC 'the host name'
+#         EQUALITY caseIgnoreIA5Match
+#         SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+# 
+# objectclass ( ImmaeobjectClass:7 NAME 'immaeTincHostClass'
+#       DESC 'Expansion of the existing object classes for Tinc'
+#       SUP top AUXILIARY
+#       MUST ( immaeTincInternalIp $ immaeTincSubdomain $
+#         immaeTincHostname )
+#         )
+
+attributetype (ImmaeattributeType:16 NAME 'immaePuppetJson'
+        DESC 'Puppet hiera json'
+        EQUALITY octetStringMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+
+objectclass ( ImmaeobjectClass:8 NAME 'immaePuppetClass'
+        DESC 'Expansion of the existing object classes for Puppet'
+        SUP top AUXILIARY
+        MUST ( immaePuppetJson )
+        )
+
+attributetype (ImmaeattributeType:19 NAME 'immaeTaskId'
+        DESC 'Taskwarrior server Org:Name:Key'
+        EQUALITY caseIgnoreMatch
+        SUBSTR caseIgnoreSubstringsMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+
+objectclass ( ImmaeobjectClass:9 NAME 'immaeTaskClass'
+        DESC 'Expansion of the existing object classes for Task'
+        SUP top AUXILIARY
+        MUST ( immaeTaskId )
+        )
+
+# Last:
+# attributetype (ImmaeattributeType:19 NAME 'immaeTaskId'
+# objectclass ( ImmaeobjectClass:9 NAME 'immaeTaskClass'
+
diff --git a/modules/private/databases/postgresql.nix b/modules/private/databases/postgresql.nix
new file mode 100644
index 0000000..26242a8
--- /dev/null
+++ b/modules/private/databases/postgresql.nix
@@ -0,0 +1,141 @@
+{ lib, pkgs, config, myconfig,  ... }:
+let
+    cfg = config.myServices.databases.postgresql;
+in {
+  options.myServices.databases = {
+    postgresql = {
+      enable = lib.mkOption {
+        default = cfg.enable;
+        example = true;
+        description = "Whether to enable postgresql database";
+        type = lib.types.bool;
+      };
+      # Output variables
+      socketsDir = lib.mkOption {
+        type = lib.types.path;
+        default = "/run/postgresql";
+        description = ''
+          The directory where Postgresql puts sockets.
+          '';
+        readOnly = true;
+      };
+      systemdRuntimeDirectory = lib.mkOption {
+        type = lib.types.str;
+        # Use ReadWritePaths= instead if socketsDir is outside of /run
+        default = assert lib.strings.hasPrefix "/run/" cfg.socketsDir;
+          lib.strings.removePrefix "/run/" cfg.socketsDir;
+        description = ''
+        Adjusted Postgresql sockets directory for systemd
+        '';
+        readOnly = true;
+      };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    nixpkgs.overlays = [ (self: super: rec {
+      postgresql = self.postgresql_11_custom;
+    }) ];
+
+    networking.firewall.allowedTCPPorts = [ 5432 ];
+
+    security.acme.certs."postgresql" = config.myServices.databasesCerts // {
+      user = "postgres";
+      group = "postgres";
+      plugins = [ "fullchain.pem" "key.pem" "account_key.json" ];
+      domain = "db-1.immae.eu";
+      postRun = ''
+        systemctl reload postgresql.service
+      '';
+    };
+
+    systemd.services.postgresql.serviceConfig = {
+      SupplementaryGroups = "keys";
+      RuntimeDirectory = cfg.systemdRuntimeDirectory;
+    };
+    services.postgresql = rec {
+      enable = true;
+      package = pkgs.postgresql;
+      enableTCPIP = true;
+      extraConfig = ''
+        max_connections = 100
+        wal_level = logical
+        shared_buffers = 512MB
+        work_mem = 10MB
+        max_wal_size = 1GB
+        min_wal_size = 80MB
+        log_timezone = 'Europe/Paris'
+        datestyle = 'iso, mdy'
+        timezone = 'Europe/Paris'
+        lc_messages = 'en_US.UTF-8'
+        lc_monetary = 'en_US.UTF-8'
+        lc_numeric = 'en_US.UTF-8'
+        lc_time = 'en_US.UTF-8'
+        default_text_search_config = 'pg_catalog.english'
+        ssl = on
+        ssl_cert_file = '/var/lib/acme/postgresql/fullchain.pem'
+        ssl_key_file = '/var/lib/acme/postgresql/key.pem'
+        '';
+      authentication = ''
+        local   all     postgres                                ident
+        local   all     all                                     md5
+        hostssl all     all     188.165.209.148/32              md5
+        hostssl all     all     178.33.252.96/32                md5
+        hostssl all     all     all                             pam
+        hostssl replication     backup-1        2001:41d0:302:1100::9:e5a9/128  pam pamservice=postgresql_replication
+        hostssl replication     backup-1        54.37.151.137/32                pam pamservice=postgresql_replication
+      '';
+    };
+
+    secrets.keys = [
+      {
+        dest = "postgresql/pam";
+        permissions = "0400";
+        group = "postgres";
+        user = "postgres";
+        text =  with myconfig.env.databases.postgresql.pam; ''
+          host ${myconfig.env.ldap.host}
+          base ${myconfig.env.ldap.base}
+          binddn ${dn}
+          bindpw ${password}
+          pam_filter ${filter}
+          ssl start_tls
+        '';
+      }
+      {
+        dest = "postgresql/pam_replication";
+        permissions = "0400";
+        group = "postgres";
+        user = "postgres";
+        text = ''
+          host ${myconfig.env.ldap.host}
+          base ${myconfig.env.ldap.base}
+          binddn ${myconfig.env.ldap.host_dn}
+          bindpw ${myconfig.env.ldap.password}
+          pam_login_attribute cn
+          ssl start_tls
+        '';
+      }
+    ];
+
+    security.pam.services = let
+      pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
+    in [
+      {
+        name = "postgresql";
+        text = ''
+          auth    required ${pam_ldap} config=${config.secrets.location}/postgresql/pam
+          account required ${pam_ldap} config=${config.secrets.location}/postgresql/pam
+          '';
+      }
+      {
+        name = "postgresql_replication";
+        text = ''
+          auth    required ${pam_ldap} config=${config.secrets.location}/postgresql/pam_replication
+          account required ${pam_ldap} config=${config.secrets.location}/postgresql/pam_replication
+          '';
+      }
+    ];
+  };
+}
+
diff --git a/modules/private/databases/redis.nix b/modules/private/databases/redis.nix
new file mode 100644
index 0000000..a1c2c75
--- /dev/null
+++ b/modules/private/databases/redis.nix
@@ -0,0 +1,57 @@
+{ lib, config, myconfig,  ... }:
+let
+    cfg = config.myServices.databases.redis;
+in {
+  options.myServices.databases.redis = {
+    enable = lib.mkOption {
+      default = cfg.enable;
+      example = true;
+      description = "Whether to enable redis database";
+      type = lib.types.bool;
+    };
+    socketsDir = lib.mkOption {
+      type = lib.types.path;
+      default = "/run/redis";
+      description = ''
+        The directory where Redis puts sockets.
+        '';
+    };
+    # Output variables
+    systemdRuntimeDirectory = lib.mkOption {
+      type = lib.types.str;
+      # Use ReadWritePaths= instead if socketsDir is outside of /run
+      default = assert lib.strings.hasPrefix "/run/" cfg.socketsDir;
+        lib.strings.removePrefix "/run/" cfg.socketsDir;
+      description = ''
+      Adjusted redis sockets directory for systemd
+      '';
+      readOnly = true;
+    };
+    sockets = lib.mkOption {
+      type = lib.types.attrsOf lib.types.path;
+      default = {
+        redis  = "${cfg.socketsDir}/redis.sock";
+      };
+      readOnly = true;
+      description = ''
+        Redis sockets
+        '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    users.users.redis.uid = config.ids.uids.redis;
+    users.groups.redis.gid = config.ids.gids.redis;
+    services.redis = rec {
+      enable = true;
+      bind = "127.0.0.1";
+      unixSocket = cfg.sockets.redis;
+      extraConfig = ''
+        unixsocketperm 777
+        maxclients 1024
+        '';
+    };
+    systemd.services.redis.serviceConfig.RuntimeDirectory = cfg.systemdRuntimeDirectory;
+  };
+}
+
diff --git a/modules/private/default.nix b/modules/private/default.nix
index 394a85b..a7a23c2 100644
--- a/modules/private/default.nix
+++ b/modules/private/default.nix
@@ -3,4 +3,10 @@
   httpdInte  = import ../websites/httpd-service-builder.nix { httpdName = "Inte"; withUsers = false; };
   httpdProd  = import ../websites/httpd-service-builder.nix { httpdName = "Prod"; withUsers = false; };
   httpdTools = import ../websites/httpd-service-builder.nix { httpdName = "Tools"; withUsers = true; };
+
+  databases  = ./databases;
+  mariadb    = ./databases/mariadb.nix;
+  openldap   = ./databases/openldap;
+  postgresql = ./databases/postgresql.nix;
+  redis      = ./databases/redis.nix;
 }