diff options
author | Ismaël Bouya <ismael.bouya@normalesup.org> | 2019-02-22 21:09:52 +0100 |
---|---|---|
committer | Ismaël Bouya <ismael.bouya@normalesup.org> | 2019-02-22 22:17:43 +0100 |
commit | 1bb448839addbb1d66ee81141d21d08b1e925faf (patch) | |
tree | 3651af17dc13a5ab0131269bd2c5a1626099bb91 /nixops/modules/databases/default.nix | |
parent | 9690acd9e5ff473fdc88ef13bcc98bb698cfb269 (diff) | |
download | Nix-1bb448839addbb1d66ee81141d21d08b1e925faf.tar.gz Nix-1bb448839addbb1d66ee81141d21d08b1e925faf.tar.zst Nix-1bb448839addbb1d66ee81141d21d08b1e925faf.zip |
Add ldap
Fixes https://git.immae.eu/mantisbt/view.php?id=78
Diffstat (limited to 'nixops/modules/databases/default.nix')
-rw-r--r-- | nixops/modules/databases/default.nix | 69 |
1 files changed, 68 insertions, 1 deletions
diff --git a/nixops/modules/databases/default.nix b/nixops/modules/databases/default.nix index 1115a29..1940b62 100644 --- a/nixops/modules/databases/default.nix +++ b/nixops/modules/databases/default.nix | |||
@@ -30,6 +30,15 @@ in { | |||
30 | type = lib.types.bool; | 30 | type = lib.types.bool; |
31 | }; | 31 | }; |
32 | }; | 32 | }; |
33 | |||
34 | ldap = { | ||
35 | enable = lib.mkOption { | ||
36 | default = cfg.enable; | ||
37 | example = true; | ||
38 | description = "Whether to enable ldap"; | ||
39 | type = lib.types.bool; | ||
40 | }; | ||
41 | }; | ||
33 | }; | 42 | }; |
34 | 43 | ||
35 | config = lib.mkIf cfg.enable { | 44 | config = lib.mkIf cfg.enable { |
@@ -55,7 +64,7 @@ in { | |||
55 | }); | 64 | }); |
56 | }; | 65 | }; |
57 | 66 | ||
58 | networking.firewall.allowedTCPPorts = [ 3306 5432 ]; | 67 | networking.firewall.allowedTCPPorts = [ 3306 5432 636 389 ]; |
59 | 68 | ||
60 | # for adminer, ssl is implemented with mysqli only, which is | 69 | # for adminer, ssl is implemented with mysqli only, which is |
61 | # currently disabled because it’s not compatible with pam. | 70 | # currently disabled because it’s not compatible with pam. |
@@ -94,6 +103,16 @@ in { | |||
94 | ''; | 103 | ''; |
95 | }; | 104 | }; |
96 | 105 | ||
106 | security.acme.certs."ldap" = config.services.myCertificates.certConfig // { | ||
107 | user = "openldap"; | ||
108 | group = "openldap"; | ||
109 | plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ]; | ||
110 | domain = "ldap.immae.eu"; | ||
111 | postRun = '' | ||
112 | systemctl restart openldap.service | ||
113 | ''; | ||
114 | }; | ||
115 | |||
97 | system.activationScripts.postgresql = '' | 116 | system.activationScripts.postgresql = '' |
98 | install -m 0755 -o postgres -g postgres -d ${myconfig.env.databases.postgresql.socket} | 117 | install -m 0755 -o postgres -g postgres -d ${myconfig.env.databases.postgresql.socket} |
99 | ''; | 118 | ''; |
@@ -202,5 +221,53 @@ in { | |||
202 | mkdir -p $(dirname ${myconfig.env.databases.redis.socket}) | 221 | mkdir -p $(dirname ${myconfig.env.databases.redis.socket}) |
203 | chown redis $(dirname ${myconfig.env.databases.redis.socket}) | 222 | chown redis $(dirname ${myconfig.env.databases.redis.socket}) |
204 | ''; | 223 | ''; |
224 | |||
225 | services.openldap = let | ||
226 | kerberosSchema = pkgs.fetchurl { | ||
227 | url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema"; | ||
228 | sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww"; | ||
229 | }; | ||
230 | puppetSchema = pkgs.fetchurl { | ||
231 | url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema"; | ||
232 | sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh"; | ||
233 | }; | ||
234 | in { | ||
235 | enable = config.services.myDatabases.ldap.enable; | ||
236 | dataDir = "/var/lib/openldap"; | ||
237 | urlList = [ "ldap://" "ldaps://" ]; | ||
238 | extraConfig = '' | ||
239 | include ${pkgs.openldap}/etc/schema/core.schema | ||
240 | include ${pkgs.openldap}/etc/schema/cosine.schema | ||
241 | include ${pkgs.openldap}/etc/schema/inetorgperson.schema | ||
242 | include ${pkgs.openldap}/etc/schema/nis.schema | ||
243 | include ${puppetSchema} | ||
244 | include ${kerberosSchema} | ||
245 | include ${./immae.schema} | ||
246 | |||
247 | pidfile /run/slapd/slapd.pid | ||
248 | argsfile /run/slapd/slapd.args | ||
249 | |||
250 | moduleload back_hdb | ||
251 | backend hdb | ||
252 | |||
253 | moduleload memberof | ||
254 | database hdb | ||
255 | suffix "${myconfig.env.ldap.base}" | ||
256 | rootdn "${myconfig.env.ldap.root_dn}" | ||
257 | rootpw ${myconfig.env.ldap.root_pw} | ||
258 | directory /var/lib/openldap | ||
259 | overlay memberof | ||
260 | |||
261 | TLSCertificateFile /var/lib/acme/ldap/cert.pem | ||
262 | TLSCertificateKeyFile /var/lib/acme/ldap/key.pem | ||
263 | TLSCACertificateFile /var/lib/acme/ldap/fullchain.pem | ||
264 | TLSCACertificatePath ${pkgs.cacert.unbundled}/etc/ssl/certs/ | ||
265 | #This makes openldap crash | ||
266 | #TLSCipherSuite DEFAULT | ||
267 | |||
268 | sasl-host kerberos.immae.eu | ||
269 | ${builtins.readFile "${myconfig.privateFiles}/ldap.conf"} | ||
270 | ''; | ||
271 | }; | ||
205 | }; | 272 | }; |
206 | } | 273 | } |