3 files changed, 205 insertions, 0 deletions

diff --git a/flakes/private/ssh/flake.lock b/flakes/private/ssh/flake.lock
new file mode 100644
index 0000000..bbb2011
--- /dev/null
+++ b/flakes/private/ssh/flake.lock
@@ -0,0 +1,36 @@
+{
+  "nodes": {
+    "environment": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-rMKbM7fHqWQbI7y59BsPG8KwoDj2jyrvN2niPWB24uE=",
+        "path": "../environment",
+        "type": "path"
+      },
+      "original": {
+        "path": "../environment",
+        "type": "path"
+      }
+    },
+    "root": {
+      "inputs": {
+        "environment": "environment",
+        "secrets": "secrets"
+      }
+    },
+    "secrets": {
+      "locked": {
+        "lastModified": 1,
+        "narHash": "sha256-5AakznhrJFmwCD7lr4JEh55MtdAJL6WA/YuBks6ISSE=",
+        "path": "../../secrets",
+        "type": "path"
+      },
+      "original": {
+        "path": "../../secrets",
+        "type": "path"
+      }
+    }
+  },
+  "root": "root",
+  "version": 7
+}
diff --git a/flakes/private/ssh/flake.nix b/flakes/private/ssh/flake.nix
new file mode 100644
index 0000000..0ca6d67
--- /dev/null
+++ b/flakes/private/ssh/flake.nix
@@ -0,0 +1,107 @@
+{
+  inputs.environment.url = "path:../environment";
+  inputs.secrets.url = "path:../../secrets";
+  outputs = { self, environment, secrets }: {
+    nixosModule = self.nixosModules.ssh;
+    nixosModules.ssh = { lib, pkgs, config, ... }:
+      let
+        cfg = config.myServices.ssh;
+      in
+      {
+        imports = [
+          environment.nixosModule
+          secrets.nixosModule
+        ];
+        options.myServices.ssh = let
+          module = lib.types.submodule {
+            options = {
+              vars = lib.mkOption {
+                type = lib.types.attrsOf lib.types.lines;
+                default = {};
+                description = ''
+                  variables to interpolate in the script. A `name_` prefix will be prepended
+                '';
+              };
+              snippet = lib.mkOption {
+                type = lib.types.lines;
+                description = ''
+                    Snippet to use
+                '';
+              };
+              dependencies = lib.mkOption {
+                type = lib.types.listOf lib.types.package;
+                default = [];
+                description = ''
+                    Dependencies of the package
+                '';
+              };
+            };
+          };
+        in {
+          modules = lib.mkOption {
+            type = lib.types.attrsOf module;
+            default = {};
+            description = ''
+              List of modules to enable
+              '';
+          };
+        };
+        config = lib.mkIf (builtins.length (builtins.attrValues cfg.modules) > 0) {
+
+          services.openssh.extraConfig = ''
+            AuthorizedKeysCommand     /etc/ssh/ldap_authorized_keys
+            AuthorizedKeysCommandUser nobody
+            '';
+
+          secrets.keys."ssh-ldap" = {
+            user = "nobody";
+            group = "nogroup";
+            permissions = "0400";
+            text = config.myEnv.sshd.ldap.password;
+          };
+          secrets.keys."ssh-psql" = {
+            user = "nobody";
+            group = "nogroup";
+            permissions = "0400";
+            text = config.myEnv.sshd.psql.password;
+          };
+          system.activationScripts.sshd = {
+            deps = [ "secrets" ];
+            text = ''
+            install -Dm400 -o nobody -g nogroup -T ${config.secrets.fullPaths."ssh-ldap"} /etc/ssh/ldap_password
+            install -Dm400 -o nobody -g nogroup -T ${config.secrets.fullPaths."ssh-psql"} /etc/ssh/psql_password
+            '';
+          };
+          # ssh is strict about parent directory having correct rights, don't
+          # move it in the nix store.
+          environment.etc."ssh/ldap_authorized_keys" = let
+            deps = lib.lists.unique (
+              [ pkgs.which pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils pkgs.postgresql ]
+              ++ lib.flatten (map (v: v.dependencies) (builtins.attrValues cfg.modules))
+              );
+            vars = lib.concatMapAttrs (n: v: (
+              lib.mapAttrs' (n': lib.nameValuePair "${n}_${n'}") v.vars
+            )) cfg.modules;
+            fullScript = pkgs.runCommand "ldap_authorized_keys" (vars // {
+              snippets = builtins.concatStringsSep "\n" (map (v: v.snippet) (builtins.attrValues cfg.modules));
+            }) ''
+              substituteAll ${./ldap_authorized_keys.sh} $out
+              # Second call for the included snippets
+              substituteAllInPlace $out
+              chmod a+x $out
+              '';
+            ldap_authorized_keys = pkgs.runCommand "ldap_authorized_keys" {
+              buildInputs = [ pkgs.makeWrapper ];
+            } ''
+              makeWrapper "${fullScript}" "$out" --prefix PATH : ${lib.makeBinPath deps}
+              '';
+          in {
+            enable = true;
+            mode = "0755";
+            user = "root";
+            source = ldap_authorized_keys;
+          };
+        };
+      };
+  };
+}
diff --git a/flakes/private/ssh/ldap_authorized_keys.sh b/flakes/private/ssh/ldap_authorized_keys.sh
new file mode 100755
index 0000000..f4395be
--- /dev/null
+++ b/flakes/private/ssh/ldap_authorized_keys.sh
@@ -0,0 +1,62 @@
+#!/usr/bin/env bash
+
+LDAPSEARCH=ldapsearch
+KEY="immaeSshKey"
+LDAP_BIND="cn=ssh,ou=services,dc=immae,dc=eu"
+LDAP_PASS=$(cat /etc/ssh/ldap_password)
+LDAP_HOST="ldap://ldap.immae.eu"
+LDAP_BASE="dc=immae,dc=eu"
+USER_LDAP_BASE="ou=users,dc=immae,dc=eu"
+
+PSQL_BASE="immae"
+PSQL_HOST="localhost"
+PSQL_USER="immae_auth_read"
+PSQL_PASS=$(cat /etc/ssh/psql_password)
+
+suitable_for() {
+  type_for="$1"
+  key="$2"
+
+  if [[ $key != *$'\n'* ]] && [[ $key == ssh-* ]]; then
+    echo "$key"
+  else
+    key_type=$(cut -d " " -f 1 <<< "$key")
+
+    if grep -q "\b-$type_for\b" <<< "$key_type"; then
+      echo ""
+    elif grep -q "\b$type_for\b" <<< "$key_type"; then
+      echo $(sed -e "s/^[^ ]* //g" <<< "$key")
+    else
+      echo ""
+    fi
+  fi
+}
+
+clean_key_line() {
+  type_for="$1"
+  line="$2"
+
+  if [[ "$line" == $KEY::* ]]; then
+    # base64 keys should't happen, unless wrong copy-pasting
+    key=""
+  else
+    key=$(sed -e "s/^$KEY: *//" -e "s/ *$//" <<< "$line")
+  fi
+
+  suitable_for "$type_for" "$key"
+}
+
+ldap_search() {
+  $LDAPSEARCH -H $LDAP_HOST -ZZ -b $LDAP_BASE -D $LDAP_BIND -w "$LDAP_PASS" -x -o ldif-wrap=no -LLL "$@"
+}
+
+psql_search() {
+  PGPASSWORD="$PSQL_PASS" psql -U "$PSQL_USER" -h "$PSQL_HOST" -X -A -t -d "$PSQL_BASE" -c "$@"
+}
+
+ldap_keys() {
+  user=$1;
+  @snippets@
+}
+
+ldap_keys $@