Add ldap

Fixes https://git.immae.eu/mantisbt/view.php?id=78

2 files changed, 223 insertions, 1 deletions

diff --git a/nixops/modules/databases/default.nix b/nixops/modules/databases/default.nix
index 1115a29..1940b62 100644
--- a/nixops/modules/databases/default.nix
+++ b/nixops/modules/databases/default.nix
@@ -30,6 +30,15 @@ in {
         type = lib.types.bool;
       };
     };
+
+    ldap = {
+      enable = lib.mkOption {
+        default = cfg.enable;
+        example = true;
+        description = "Whether to enable ldap";
+        type = lib.types.bool;
+      };
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -55,7 +64,7 @@ in {
       });
     };
 
-    networking.firewall.allowedTCPPorts = [ 3306 5432 ];
+    networking.firewall.allowedTCPPorts = [ 3306 5432 636 389 ];
 
     # for adminer, ssl is implemented with mysqli only, which is
     # currently disabled because it’s not compatible with pam.
@@ -94,6 +103,16 @@ in {
       '';
     };
 
+    security.acme.certs."ldap" = config.services.myCertificates.certConfig // {
+      user = "openldap";
+      group = "openldap";
+      plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
+      domain = "ldap.immae.eu";
+      postRun = ''
+        systemctl restart openldap.service
+      '';
+    };
+
     system.activationScripts.postgresql = ''
       install -m 0755 -o postgres -g postgres -d ${myconfig.env.databases.postgresql.socket}
       '';
@@ -202,5 +221,53 @@ in {
       mkdir -p $(dirname ${myconfig.env.databases.redis.socket})
       chown redis $(dirname ${myconfig.env.databases.redis.socket})
     '';
+
+    services.openldap = let
+      kerberosSchema = pkgs.fetchurl {
+        url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema";
+        sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww";
+      };
+      puppetSchema = pkgs.fetchurl {
+        url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema";
+        sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh";
+      };
+    in {
+      enable = config.services.myDatabases.ldap.enable;
+      dataDir = "/var/lib/openldap";
+      urlList = [ "ldap://" "ldaps://" ];
+      extraConfig = ''
+        include         ${pkgs.openldap}/etc/schema/core.schema
+        include         ${pkgs.openldap}/etc/schema/cosine.schema
+        include         ${pkgs.openldap}/etc/schema/inetorgperson.schema
+        include         ${pkgs.openldap}/etc/schema/nis.schema
+        include         ${puppetSchema}
+        include         ${kerberosSchema}
+        include         ${./immae.schema}
+
+        pidfile         /run/slapd/slapd.pid
+        argsfile        /run/slapd/slapd.args
+
+        moduleload      back_hdb
+        backend         hdb
+
+        moduleload      memberof
+        database        hdb
+        suffix          "${myconfig.env.ldap.base}"
+        rootdn          "${myconfig.env.ldap.root_dn}"
+        rootpw          ${myconfig.env.ldap.root_pw}
+        directory       /var/lib/openldap
+        overlay         memberof
+
+        TLSCertificateFile    /var/lib/acme/ldap/cert.pem
+        TLSCertificateKeyFile /var/lib/acme/ldap/key.pem
+        TLSCACertificateFile  /var/lib/acme/ldap/fullchain.pem
+        TLSCACertificatePath  ${pkgs.cacert.unbundled}/etc/ssl/certs/
+        #This makes openldap crash
+        #TLSCipherSuite        DEFAULT
+
+        sasl-host kerberos.immae.eu
+        ${builtins.readFile "${myconfig.privateFiles}/ldap.conf"}
+        '';
+    };
   };
 }
diff --git a/nixops/modules/databases/immae.schema b/nixops/modules/databases/immae.schema
new file mode 100644
index 0000000..f0e12bc
--- /dev/null
+++ b/nixops/modules/databases/immae.schema
@@ -0,0 +1,155 @@
+# vim: set filetype=slapd:
+objectIdentifier Immaeroot 1.3.6.1.4.1.50071
+
+objectIdentifier Immae Immaeroot:2
+objectIdentifier ImmaeattributeType Immae:3
+objectIdentifier ImmaeobjectClass Immae:4
+
+# TT-RSS
+attributetype ( ImmaeattributeType:1 NAME 'immaeTtrssLogin'
+        DESC 'login for TTRSS'
+        EQUALITY caseIgnoreMatch
+        SUBSTR caseIgnoreSubstringsMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+
+objectclass ( ImmaeobjectClass:1 NAME 'immaeTtrssClass'
+        DESC 'Expansion of the existing object classes for ttrss'
+        SUP top AUXILIARY
+        MUST ( immaeTtrssLogin ) )
+
+# FTP
+attributetype ( ImmaeattributeType:2 NAME 'immaeFtpDirectory'
+        DESC 'home directory for ftp'
+        EQUALITY caseExactIA5Match
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 )
+
+attributetype ( ImmaeattributeType:3 NAME 'immaeFtpUid'
+        DESC 'user id for ftp'
+        EQUALITY integerMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+
+attributetype ( ImmaeattributeType:4 NAME 'immaeFtpGid'
+        DESC 'group id for ftp'
+        EQUALITY integerMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 )
+
+objectclass ( ImmaeobjectClass:2 NAME 'immaeFtpClass'
+        DESC 'Expansion of the existing object classes for ftp'
+        SUP top AUXILIARY
+        MUST ( immaeFtpDirectory $ immaeFtpGid $ immaeFtpUid ) )
+
+
+# SSH keys
+attributetype ( ImmaeattributeType:5 NAME 'immaeSshKey'
+        DESC 'OpenSSH Public key'
+        EQUALITY octetStringMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+
+objectClass ( ImmaeobjectClass:3 NAME 'immaeSshClass'
+        DESC 'OpenSSH class'
+        SUP top AUXILIARY
+        MAy ( immaeSSHKey ) )
+
+# Specific access
+attributetype (ImmaeattributeType:6 NAME 'immaeAccessDn'
+        EQUALITY distinguishedNameMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+
+attributetype (ImmaeattributeType:17 NAME 'immaeAccessWriteDn'
+        EQUALITY distinguishedNameMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+
+attributetype (ImmaeattributeType:18 NAME 'immaeAccessReadSubtree'
+        EQUALITY distinguishedNameMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.12 )
+
+objectClass ( ImmaeobjectClass:4 NAME 'immaeAccessClass'
+        DESC 'Access class'
+        SUP top AUXILIARY
+        MAY ( immaeAccessDn $ immaeAccessWriteDn $ immaeAccessReadSubtree ) )
+
+# Xmpp uid
+attributetype ( ImmaeattributeType:7 NAME 'immaeXmppUid'
+        DESC 'user part for Xmpp'
+        EQUALITY caseIgnoreMatch
+        SUBSTR caseIgnoreSubstringsMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )
+
+objectclass ( ImmaeobjectClass:5 NAME 'immaeXmppClass'
+        DESC 'Expansion of the existing object classes for XMPP'
+        SUP top AUXILIARY
+        MUST ( immaeXmppUid ) )
+
+# Postfix accounts
+attributetype ( ImmaeattributeType:8 NAME 'immaePostfixAddress'
+        DESC 'the dovecot address to match as username'
+        EQUALITY caseIgnoreIA5Match
+        SUBSTR caseIgnoreIA5SubstringsMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+
+attributetype ( ImmaeattributeType:9 NAME 'immaePostfixHome'
+        DESC 'the postfix home directory'
+        EQUALITY caseExactIA5Match
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+attributetype ( ImmaeattributeType:10 NAME 'immaePostfixMail'
+        DESC 'the dovecot mail location'
+        EQUALITY caseExactIA5Match
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+attributetype ( ImmaeattributeType:11 NAME 'immaePostfixUid'
+        DESC 'the dovecot uid'
+        EQUALITY caseExactIA5Match
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+attributetype ( ImmaeattributeType:12 NAME 'immaePostfixGid'
+        DESC 'the dovecot gid'
+        EQUALITY caseExactIA5Match
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.26 SINGLE-VALUE )
+
+objectclass ( ImmaeobjectClass:6 NAME 'immaePostfixClass'
+        DESC 'Expansion of the existing object classes for Postfix'
+        SUP top AUXILIARY
+        MUST ( immaePostfixAddress $ immaePostfixHome $
+          immaePostfixMail $ immaePostfixUid $ immaePostfixGid )
+        )
+
+# Tinc informations
+# Domaine = une classe a part ou une partie du dn ?
+# attributetype ( ImmaeattributeType:13 NAME 'immaeTincIpSegment'
+#         DESC 'the internal ip segment in tinc'
+#         EQUALITY caseIgnoreIA5Match
+#         SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+# 
+# attributetype ( ImmaeattributeType:14 NAME 'immaeTincSubdomain'
+#         DESC 'the host subdomain'
+#         EQUALITY caseIgnoreIA5Match
+#         SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+# 
+# attributetype ( ImmaeattributeType:15 NAME 'immaeTincHostname'
+#         DESC 'the host name'
+#         EQUALITY caseIgnoreIA5Match
+#         SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{256} )
+# 
+# objectclass ( ImmaeobjectClass:7 NAME 'immaeTincHostClass'
+#       DESC 'Expansion of the existing object classes for Tinc'
+#       SUP top AUXILIARY
+#       MUST ( immaeTincInternalIp $ immaeTincSubdomain $
+#         immaeTincHostname )
+#         )
+
+attributetype (ImmaeattributeType:16 NAME 'immaePuppetJson'
+        DESC 'Puppet hiera json'
+        EQUALITY octetStringMatch
+        SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 )
+
+objectclass ( ImmaeobjectClass:8 NAME 'immaePuppetClass'
+        DESC 'Expansion of the existing object classes for Puppet'
+        SUP top AUXILIARY
+        MUST ( immaePuppetJson )
+        )
+
+# Last:
+# attributetype (ImmaeattributeType:18 NAME 'immaeAccessReadSubtree'
+# objectclass ( ImmaeobjectClass:8 NAME 'immaePuppetClass'
+