diff options
Diffstat (limited to 'nixops/modules/databases/mysql.nix')
-rw-r--r-- | nixops/modules/databases/mysql.nix | 78 |
1 files changed, 78 insertions, 0 deletions
diff --git a/nixops/modules/databases/mysql.nix b/nixops/modules/databases/mysql.nix new file mode 100644 index 0000000..acf4750 --- /dev/null +++ b/nixops/modules/databases/mysql.nix | |||
@@ -0,0 +1,78 @@ | |||
1 | { lib, pkgs, config, myconfig, mylibs, ... }: | ||
2 | let | ||
3 | cfg = config.services.myDatabases; | ||
4 | in { | ||
5 | options.services.myDatabases = { | ||
6 | mariadb = { | ||
7 | enable = lib.mkOption { | ||
8 | default = cfg.enable; | ||
9 | example = true; | ||
10 | description = "Whether to enable mariadb database"; | ||
11 | type = lib.types.bool; | ||
12 | }; | ||
13 | }; | ||
14 | }; | ||
15 | |||
16 | config = lib.mkIf cfg.enable { | ||
17 | nixpkgs.config.packageOverrides = oldpkgs: rec { | ||
18 | mariadb = mariadbPAM; | ||
19 | mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec { | ||
20 | cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ]; | ||
21 | buildInputs = old.buildInputs ++ [ pkgs.pam ]; | ||
22 | }); | ||
23 | }; | ||
24 | |||
25 | networking.firewall.allowedTCPPorts = [ 3306 ]; | ||
26 | |||
27 | # for adminer, ssl is implemented with mysqli only, which is | ||
28 | # currently disabled because it’s not compatible with pam. | ||
29 | # Thus we need to generate two users for each 'remote': one remote | ||
30 | # with SSL, and one localhost without SSL. | ||
31 | # User identified by LDAP: | ||
32 | # CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL; | ||
33 | # CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql'; | ||
34 | services.mysql = rec { | ||
35 | enable = cfg.mariadb.enable; | ||
36 | package = pkgs.mariadb; | ||
37 | extraOptions = '' | ||
38 | ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt | ||
39 | ssl_key = /var/lib/acme/mysql/key.pem | ||
40 | ssl_cert = /var/lib/acme/mysql/fullchain.pem | ||
41 | ''; | ||
42 | }; | ||
43 | |||
44 | security.acme.certs."mysql" = config.services.myCertificates.certConfig // { | ||
45 | user = "mysql"; | ||
46 | group = "mysql"; | ||
47 | plugins = [ "fullchain.pem" "key.pem" "account_key.json" ]; | ||
48 | domain = "db-1.immae.eu"; | ||
49 | postRun = '' | ||
50 | systemctl restart mysql.service | ||
51 | ''; | ||
52 | }; | ||
53 | |||
54 | security.pam.services = let | ||
55 | pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so"; | ||
56 | pam_ldap_mysql = with myconfig.env.databases.mysql.pam; | ||
57 | pkgs.writeText "mysql.conf" '' | ||
58 | host ${myconfig.env.ldap.host} | ||
59 | base ${myconfig.env.ldap.base} | ||
60 | binddn ${dn} | ||
61 | bindpw ${password} | ||
62 | pam_filter ${filter} | ||
63 | ssl start_tls | ||
64 | ''; | ||
65 | in [ | ||
66 | { | ||
67 | name = "mysql"; | ||
68 | text = '' | ||
69 | # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/ | ||
70 | auth required ${pam_ldap} config=${pam_ldap_mysql} | ||
71 | account required ${pam_ldap} config=${pam_ldap_mysql} | ||
72 | ''; | ||
73 | } | ||
74 | ]; | ||
75 | |||
76 | }; | ||
77 | } | ||
78 | |||