Use ldap in matrix

2 files changed, 32 insertions, 3 deletions

diff --git a/systems/zoldene/flake.lock b/systems/zoldene/flake.lock
index 972b275..f07de8c 100644
--- a/systems/zoldene/flake.lock
+++ b/systems/zoldene/flake.lock
@@ -59,7 +59,7 @@
     "environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-44KJj+te7cnv7QP9VNXCgwnWDthdW626uvKaWf8ddBE=",
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
         "path": "../environment",
         "type": "path"
       },
@@ -436,7 +436,7 @@
     "private-environment": {
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-44KJj+te7cnv7QP9VNXCgwnWDthdW626uvKaWf8ddBE=",
+        "narHash": "sha256-xrpwkilnPpT6TklQVoLrID8tWUZAH4PJ5XqhRHXGbvo=",
         "path": "../../flakes/private/environment",
         "type": "path"
       },
@@ -455,7 +455,7 @@
       },
       "locked": {
         "lastModified": 1,
-        "narHash": "sha256-4BSHUGdctTxvJObi9jz6S5FH22ZtIpbIZbShFP40Ds0=",
+        "narHash": "sha256-zbQxRzS3bTCQO/0D/AJYNU/xwBmXgfU82PDLxVyXcAQ=",
         "path": "../../flakes/private/system",
         "type": "path"
       },
diff --git a/systems/zoldene/synapse.nix b/systems/zoldene/synapse.nix
index 1d892a7..cfcdc9a 100644
--- a/systems/zoldene/synapse.nix
+++ b/systems/zoldene/synapse.nix
@@ -72,9 +72,32 @@
 
     services.matrix-synapse = {
       enable = true;
+      log.root.level = "WARNING";
+      plugins = [
+        config.services.matrix-synapse.package.plugins.matrix-synapse-ldap3
+      ];
       extraConfigFiles = [
         config.secrets.fullPaths."matrix/homeserver_secrets.yaml"
       ];
+      settings.modules = [
+        {
+          module = "ldap_auth_provider.LdapAuthProviderModule";
+          config = {
+            enabled = true;
+            uri = "ldaps://${config.myEnv.tools.matrix.ldap.host}:636";
+            start_tls = false;
+            base = config.myEnv.tools.matrix.ldap.base;
+            attributes = {
+              uid = "uid";
+              mail = "mail";
+              name = "cn";
+            };
+            bind_dn = config.myEnv.tools.matrix.ldap.dn;
+            bind_password_file = config.secrets.fullPaths."matrix/ldap_password";
+            filter = config.myEnv.tools.matrix.ldap.filter;
+          };
+        }
+      ];
       settings.server_name = "immae.eu";
       settings.signing_key_path = config.secrets.fullPaths."matrix/signing.key";
       settings.listeners = [
@@ -152,6 +175,12 @@
         ];
       };
     };
+    secrets.keys."matrix/ldap_password" = {
+      permissions = "0400";
+      user = "matrix-synapse";
+      group = "matrix-synapse";
+      text = config.myEnv.tools.matrix.ldap.password;
+    };
     secrets.keys."matrix/signing.key" = {
       permissions = "0400";
       user = "matrix-synapse";