1 files changed, 99 insertions, 20 deletions

diff --git a/modules/private/databases/postgresql.nix b/modules/private/databases/postgresql.nix
index 8c36d84..911a6d1 100644
--- a/modules/private/databases/postgresql.nix
+++ b/modules/private/databases/postgresql.nix
@@ -1,4 +1,4 @@
-{ lib, pkgs, config, myconfig,  ... }:
+{ lib, pkgs, config, ... }:
 let
     cfg = config.myServices.databases.postgresql;
 in {
@@ -10,6 +10,78 @@ in {
         description = "Whether to enable postgresql database";
         type = lib.types.bool;
       };
+      package = lib.mkOption {
+        type = lib.types.package;
+        default = pkgs.postgresql;
+        description = ''
+          Postgresql package to use.
+          '';
+      };
+      ldapConfig = lib.mkOption {
+        description = "LDAP configuration to allow PAM identification via LDAP";
+        type = lib.types.submodule {
+          options = {
+            host = lib.mkOption { type = lib.types.str; };
+            base = lib.mkOption { type = lib.types.str; };
+            dn = lib.mkOption { type = lib.types.str; };
+            password = lib.mkOption { type = lib.types.str; };
+            filter = lib.mkOption { type = lib.types.str; };
+          };
+        };
+      };
+      replicationLdapConfig = lib.mkOption {
+        description = "LDAP configuration to allow replication";
+        type = lib.types.submodule {
+          options = {
+            host = lib.mkOption { type = lib.types.str; };
+            base = lib.mkOption { type = lib.types.str; };
+            dn = lib.mkOption { type = lib.types.str; };
+            password = lib.mkOption { type = lib.types.str; };
+          };
+        };
+      };
+      authorizedHosts = lib.mkOption {
+        default = {};
+        description = "Hosts to allow connections from";
+        type = lib.types.attrsOf (lib.types.listOf (lib.types.submodule {
+          options = {
+            method = lib.mkOption {
+              default = "md5";
+              type = lib.types.str;
+            };
+            username = lib.mkOption {
+              default = "all";
+              type = lib.types.str;
+            };
+            database = lib.mkOption {
+              default = "all";
+              type = lib.types.str;
+            };
+            ip4 = lib.mkOption {
+              default = [];
+              type = lib.types.listOf lib.types.str;
+            };
+            ip6 = lib.mkOption {
+              default = [];
+              type = lib.types.listOf lib.types.str;
+            };
+          };
+        }));
+      };
+      replicationHosts = lib.mkOption {
+        default = {};
+        description = "Hosts to allow replication from";
+        type = lib.types.attrsOf (lib.types.submodule {
+          options = {
+            ip4 = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+            };
+            ip6 = lib.mkOption {
+              type = lib.types.listOf lib.types.str;
+            };
+          };
+        });
+      };
       # Output variables
       socketsDir = lib.mkOption {
         type = lib.types.path;
@@ -33,10 +105,6 @@ in {
   };
 
   config = lib.mkIf cfg.enable {
-    nixpkgs.overlays = [ (self: super: rec {
-      postgresql = self.postgresql_11_custom;
-    }) ];
-
     networking.firewall.allowedTCPPorts = [ 5432 ];
 
     security.acme.certs."postgresql" = config.myServices.databasesCerts // {
@@ -53,9 +121,9 @@ in {
       SupplementaryGroups = "keys";
       RuntimeDirectory = cfg.systemdRuntimeDirectory;
     };
-    services.postgresql = rec {
+    services.postgresql = {
       enable = true;
-      package = pkgs.postgresql;
+      package = cfg.package;
       enableTCPIP = true;
       extraConfig = ''
         max_connections = 100
@@ -76,14 +144,25 @@ in {
         ssl_cert_file = '${config.security.acme.directory}/postgresql/fullchain.pem'
         ssl_key_file = '${config.security.acme.directory}/postgresql/key.pem'
         '';
-      authentication = ''
+      authentication = let
+        hosts = builtins.concatStringsSep "\n" (
+          lib.lists.flatten (lib.mapAttrsToList (k: vs: map (v:
+            map (ip6: "hostssl  ${v.database}   ${v.username}   ${ip6}/128      ${v.method}") v.ip6
+            ++ map (ip4: "hostssl       ${v.database}   ${v.username}   ${ip4}/32               ${v.method}") v.ip4
+          ) vs) cfg.authorizedHosts
+        ));
+        replication = builtins.concatStringsSep "\n" (
+          lib.lists.flatten (lib.mapAttrsToList (k: v:
+          map (ip6: "hostssl    replication     ${k}    ${ip6}/128      pam pamservice=postgresql_replication") v.ip6
+          ++ map (ip4: "hostssl replication     ${k}    ${ip4}/32               pam pamservice=postgresql_replication") v.ip4
+          ) cfg.replicationHosts
+        ));
+      in ''
         local   all     postgres                                ident
         local   all     all                                     md5
-        hostssl all     all     188.165.209.148/32              md5
-        hostssl all     all     178.33.252.96/32                md5
+        ${hosts}
         hostssl all     all     all                             pam
-        hostssl replication     backup-1        2001:41d0:302:1100::9:e5a9/128  pam pamservice=postgresql_replication
-        hostssl replication     backup-1        54.37.151.137/32                pam pamservice=postgresql_replication
+        ${replication}
       '';
     };
 
@@ -93,9 +172,9 @@ in {
         permissions = "0400";
         group = "postgres";
         user = "postgres";
-        text =  with myconfig.env.databases.postgresql.pam; ''
-          host ${myconfig.env.ldap.host}
-          base ${myconfig.env.ldap.base}
+        text =  with cfg.ldapConfig; ''
+          host ${host}
+          base ${base}
           binddn ${dn}
           bindpw ${password}
           pam_filter ${filter}
@@ -107,11 +186,11 @@ in {
         permissions = "0400";
         group = "postgres";
         user = "postgres";
-        text = ''
-          host ${myconfig.env.ldap.host}
-          base ${myconfig.env.ldap.base}
-          binddn ${myconfig.env.ldap.host_dn}
-          bindpw ${myconfig.env.ldap.password}
+        text = with cfg.replicationLdapConfig; ''
+          host ${host}
+          base ${base}
+          binddn ${dn}
+          bindpw ${password}
           pam_login_attribute cn
           ssl start_tls
         '';