6 files changed, 32 insertions, 49 deletions

diff --git a/modules/private/databases/mariadb.nix b/modules/private/databases/mariadb.nix
index ed647ea..04e4bd6 100644
--- a/modules/private/databases/mariadb.nix
+++ b/modules/private/databases/mariadb.nix
@@ -96,8 +96,8 @@ in {
       dataDir = cfg.dataDir;
       extraOptions = ''
         ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
-        ssl_key = ${config.security.acme2.certs.mysql.directory}/key.pem
-        ssl_cert = ${config.security.acme2.certs.mysql.directory}/fullchain.pem
+        ssl_key = ${config.security.acme.certs.mysql.directory}/key.pem
+        ssl_cert = ${config.security.acme.certs.mysql.directory}/fullchain.pem
 
         # for replication
         log-bin=mariadb-bin
@@ -110,7 +110,7 @@ in {
     };
 
     users.users.mysql.extraGroups = [ "keys" ];
-    security.acme2.certs."mysql" = config.myServices.databasesCerts // {
+    security.acme.certs."mysql" = config.myServices.databasesCerts // {
       user = "mysql";
       group = "mysql";
       plugins = [ "fullchain.pem" "key.pem" "account_key.json" "account_reg.json" ];
diff --git a/modules/private/databases/openldap/default.nix b/modules/private/databases/openldap/default.nix
index d7d61db..efe9379 100644
--- a/modules/private/databases/openldap/default.nix
+++ b/modules/private/databases/openldap/default.nix
@@ -12,27 +12,14 @@ let
     moduleload      back_hdb
     backend         hdb
 
-    moduleload      memberof
-    database        hdb
-    suffix          "${cfg.baseDn}"
-    rootdn          "${cfg.rootDn}"
-    include         ${config.secrets.location}/ldap/password
-    directory       ${cfg.dataDir}
-    overlay         memberof
-
-    moduleload      syncprov
-    overlay         syncprov
-    syncprov-checkpoint 100 10
-
-    TLSCertificateFile    ${config.security.acme2.certs.ldap.directory}/cert.pem
-    TLSCertificateKeyFile ${config.security.acme2.certs.ldap.directory}/key.pem
-    TLSCACertificateFile  ${config.security.acme2.certs.ldap.directory}/fullchain.pem
+    TLSCertificateFile    ${config.security.acme.certs.ldap.directory}/cert.pem
+    TLSCertificateKeyFile ${config.security.acme.certs.ldap.directory}/key.pem
+    TLSCACertificateFile  ${config.security.acme.certs.ldap.directory}/fullchain.pem
     TLSCACertificatePath  ${pkgs.cacert.unbundled}/etc/ssl/certs/
     #This makes openldap crash
     #TLSCipherSuite        DEFAULT
 
     sasl-host kerberos.immae.eu
-    include ${config.secrets.location}/ldap/access
     '';
 in
 {
@@ -117,7 +104,7 @@ in
     users.users.openldap.extraGroups = [ "keys" ];
     networking.firewall.allowedTCPPorts = [ 636 389 ];
 
-    security.acme2.certs."ldap" = config.myServices.databasesCerts // {
+    security.acme.certs."ldap" = config.myServices.databasesCerts // {
       user = "openldap";
       group = "openldap";
       plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" "account_reg.json" ];
@@ -137,6 +124,20 @@ in
       dataDir = cfg.dataDir;
       urlList = [ "ldap://" "ldaps://" ];
       extraConfig = ldapConfig;
+      extraDatabaseConfig = ''
+        moduleload      memberof
+        overlay         memberof
+
+        moduleload      syncprov
+        overlay         syncprov
+        syncprov-checkpoint 100 10
+
+        include ${config.secrets.location}/ldap/access
+        '';
+      rootpwFile = "${config.secrets.location}/ldap/password";
+      suffix = cfg.baseDn;
+      rootdn = cfg.rootDn;
+      database = "hdb";
     };
   };
 }
diff --git a/modules/private/databases/openldap/eldiron_schemas.nix b/modules/private/databases/openldap/eldiron_schemas.nix
index fc686dd..cf45ebe 100644
--- a/modules/private/databases/openldap/eldiron_schemas.nix
+++ b/modules/private/databases/openldap/eldiron_schemas.nix
@@ -9,10 +9,10 @@ let
     sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh";
   };
   schemas = [
-    "${openldap}/etc/schema/core.schema"
-    "${openldap}/etc/schema/cosine.schema"
-    "${openldap}/etc/schema/inetorgperson.schema"
-    "${openldap}/etc/schema/nis.schema"
+    #"${openldap}/etc/schema/core.schema"
+    #"${openldap}/etc/schema/cosine.schema"
+    #"${openldap}/etc/schema/inetorgperson.schema"
+    #"${openldap}/etc/schema/nis.schema"
     puppetSchema
     kerberosSchema
     ./immae.schema
diff --git a/modules/private/databases/openldap_replication.nix b/modules/private/databases/openldap_replication.nix
index 2980c97..df4101b 100644
--- a/modules/private/databases/openldap_replication.nix
+++ b/modules/private/databases/openldap_replication.nix
@@ -3,6 +3,10 @@ let
   cfg = config.myServices.databasesReplication.openldap;
   eldiron_schemas = pkgs.callPackage ./openldap/eldiron_schemas.nix {};
   ldapConfig = hcfg: name: pkgs.writeText "slapd.conf" ''
+    include ${pkgs.openldap}/etc/schema/core.schema
+    include ${pkgs.openldap}/etc/schema/cosine.schema
+    include ${pkgs.openldap}/etc/schema/inetorgperson.schema
+    include ${pkgs.openldap}/etc/schema/nis.schema
     ${eldiron_schemas}
     pidfile   /run/slapd_${name}/slapd.pid
     argsfile  /run/slapd_${name}/slapd.args
diff --git a/modules/private/databases/postgresql.nix b/modules/private/databases/postgresql.nix
index 27ea59c..d0b1a75 100644
--- a/modules/private/databases/postgresql.nix
+++ b/modules/private/databases/postgresql.nix
@@ -91,23 +91,13 @@ in {
           '';
         readOnly = true;
       };
-      systemdRuntimeDirectory = lib.mkOption {
-        type = lib.types.str;
-        # Use ReadWritePaths= instead if socketsDir is outside of /run
-        default = assert lib.strings.hasPrefix "/run/" cfg.socketsDir;
-          lib.strings.removePrefix "/run/" cfg.socketsDir;
-        description = ''
-        Adjusted Postgresql sockets directory for systemd
-        '';
-        readOnly = true;
-      };
     };
   };
 
   config = lib.mkIf cfg.enable {
     networking.firewall.allowedTCPPorts = [ 5432 ];
 
-    security.acme2.certs."postgresql" = config.myServices.databasesCerts // {
+    security.acme.certs."postgresql" = config.myServices.databasesCerts // {
       user = "postgres";
       group = "postgres";
       plugins = [ "fullchain.pem" "key.pem" "account_key.json" "account_reg.json" ];
@@ -119,7 +109,6 @@ in {
 
     systemd.services.postgresql.serviceConfig = {
       SupplementaryGroups = "keys";
-      RuntimeDirectory = cfg.systemdRuntimeDirectory;
     };
     systemd.services.postgresql.postStart = lib.mkAfter ''
       # This line is already defined in 19.09
@@ -165,8 +154,8 @@ in {
         # makes it order of magnitudes quicker
         synchronous_commit = off
         ssl = on
-        ssl_cert_file = '${config.security.acme2.certs.postgresql.directory}/fullchain.pem'
-        ssl_key_file = '${config.security.acme2.certs.postgresql.directory}/key.pem'
+        ssl_cert_file = '${config.security.acme.certs.postgresql.directory}/fullchain.pem'
+        ssl_key_file = '${config.security.acme.certs.postgresql.directory}/key.pem'
         '';
       authentication = let
         hosts = builtins.concatStringsSep "\n" (
diff --git a/modules/private/databases/redis.nix b/modules/private/databases/redis.nix
index 4b26283..4602510 100644
--- a/modules/private/databases/redis.nix
+++ b/modules/private/databases/redis.nix
@@ -17,16 +17,6 @@ in {
         '';
     };
     # Output variables
-    systemdRuntimeDirectory = lib.mkOption {
-      type = lib.types.str;
-      # Use ReadWritePaths= instead if socketsDir is outside of /run
-      default = assert lib.strings.hasPrefix "/run/" cfg.socketsDir;
-        lib.strings.removePrefix "/run/" cfg.socketsDir;
-      description = ''
-      Adjusted redis sockets directory for systemd
-      '';
-      readOnly = true;
-    };
     sockets = lib.mkOption {
       type = lib.types.attrsOf lib.types.path;
       default = {
@@ -51,7 +41,6 @@ in {
         maxclients 1024
         '';
     };
-    systemd.services.redis.serviceConfig.RuntimeDirectory = cfg.systemdRuntimeDirectory;
 
     services.spiped = {
       enable = true;