aboutsummaryrefslogtreecommitdiff
path: root/nixops
diff options
context:
space:
mode:
Diffstat (limited to 'nixops')
-rw-r--r--nixops/modules/databases/default.nix71
-rw-r--r--nixops/modules/databases/openldap.nix87
2 files changed, 91 insertions, 67 deletions
diff --git a/nixops/modules/databases/default.nix b/nixops/modules/databases/default.nix
index 1940b62..3200181 100644
--- a/nixops/modules/databases/default.nix
+++ b/nixops/modules/databases/default.nix
@@ -2,6 +2,9 @@
2let 2let
3 cfg = config.services.myDatabases; 3 cfg = config.services.myDatabases;
4in { 4in {
5 imports = [
6 ./openldap.nix
7 ];
5 options.services.myDatabases = { 8 options.services.myDatabases = {
6 enable = lib.mkEnableOption "my databases service"; 9 enable = lib.mkEnableOption "my databases service";
7 postgresql = { 10 postgresql = {
@@ -30,15 +33,6 @@ in {
30 type = lib.types.bool; 33 type = lib.types.bool;
31 }; 34 };
32 }; 35 };
33
34 ldap = {
35 enable = lib.mkOption {
36 default = cfg.enable;
37 example = true;
38 description = "Whether to enable ldap";
39 type = lib.types.bool;
40 };
41 };
42 }; 36 };
43 37
44 config = lib.mkIf cfg.enable { 38 config = lib.mkIf cfg.enable {
@@ -64,7 +58,7 @@ in {
64 }); 58 });
65 }; 59 };
66 60
67 networking.firewall.allowedTCPPorts = [ 3306 5432 636 389 ]; 61 networking.firewall.allowedTCPPorts = [ 3306 5432 ];
68 62
69 # for adminer, ssl is implemented with mysqli only, which is 63 # for adminer, ssl is implemented with mysqli only, which is
70 # currently disabled because it’s not compatible with pam. 64 # currently disabled because it’s not compatible with pam.
@@ -103,16 +97,6 @@ in {
103 ''; 97 '';
104 }; 98 };
105 99
106 security.acme.certs."ldap" = config.services.myCertificates.certConfig // {
107 user = "openldap";
108 group = "openldap";
109 plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
110 domain = "ldap.immae.eu";
111 postRun = ''
112 systemctl restart openldap.service
113 '';
114 };
115
116 system.activationScripts.postgresql = '' 100 system.activationScripts.postgresql = ''
117 install -m 0755 -o postgres -g postgres -d ${myconfig.env.databases.postgresql.socket} 101 install -m 0755 -o postgres -g postgres -d ${myconfig.env.databases.postgresql.socket}
118 ''; 102 '';
@@ -222,52 +206,5 @@ in {
222 chown redis $(dirname ${myconfig.env.databases.redis.socket}) 206 chown redis $(dirname ${myconfig.env.databases.redis.socket})
223 ''; 207 '';
224 208
225 services.openldap = let
226 kerberosSchema = pkgs.fetchurl {
227 url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema";
228 sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww";
229 };
230 puppetSchema = pkgs.fetchurl {
231 url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema";
232 sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh";
233 };
234 in {
235 enable = config.services.myDatabases.ldap.enable;
236 dataDir = "/var/lib/openldap";
237 urlList = [ "ldap://" "ldaps://" ];
238 extraConfig = ''
239 include ${pkgs.openldap}/etc/schema/core.schema
240 include ${pkgs.openldap}/etc/schema/cosine.schema
241 include ${pkgs.openldap}/etc/schema/inetorgperson.schema
242 include ${pkgs.openldap}/etc/schema/nis.schema
243 include ${puppetSchema}
244 include ${kerberosSchema}
245 include ${./immae.schema}
246
247 pidfile /run/slapd/slapd.pid
248 argsfile /run/slapd/slapd.args
249
250 moduleload back_hdb
251 backend hdb
252
253 moduleload memberof
254 database hdb
255 suffix "${myconfig.env.ldap.base}"
256 rootdn "${myconfig.env.ldap.root_dn}"
257 rootpw ${myconfig.env.ldap.root_pw}
258 directory /var/lib/openldap
259 overlay memberof
260
261 TLSCertificateFile /var/lib/acme/ldap/cert.pem
262 TLSCertificateKeyFile /var/lib/acme/ldap/key.pem
263 TLSCACertificateFile /var/lib/acme/ldap/fullchain.pem
264 TLSCACertificatePath ${pkgs.cacert.unbundled}/etc/ssl/certs/
265 #This makes openldap crash
266 #TLSCipherSuite DEFAULT
267
268 sasl-host kerberos.immae.eu
269 ${builtins.readFile "${myconfig.privateFiles}/ldap.conf"}
270 '';
271 };
272 }; 209 };
273} 210}
diff --git a/nixops/modules/databases/openldap.nix b/nixops/modules/databases/openldap.nix
new file mode 100644
index 0000000..f49adc8
--- /dev/null
+++ b/nixops/modules/databases/openldap.nix
@@ -0,0 +1,87 @@
1{ lib, pkgs, config, myconfig, mylibs, ... }:
2let
3 cfg = config.services.myDatabases;
4 ldapConfig = let
5 kerberosSchema = pkgs.fetchurl {
6 url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema";
7 sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww";
8 };
9 puppetSchema = pkgs.fetchurl {
10 url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema";
11 sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh";
12 };
13 in ''
14 include ${pkgs.openldap}/etc/schema/core.schema
15 include ${pkgs.openldap}/etc/schema/cosine.schema
16 include ${pkgs.openldap}/etc/schema/inetorgperson.schema
17 include ${pkgs.openldap}/etc/schema/nis.schema
18 include ${puppetSchema}
19 include ${kerberosSchema}
20 include ${./immae.schema}
21
22 pidfile /run/slapd/slapd.pid
23 argsfile /run/slapd/slapd.args
24
25 moduleload back_hdb
26 backend hdb
27
28 moduleload memberof
29 database hdb
30 suffix "${myconfig.env.ldap.base}"
31 rootdn "${myconfig.env.ldap.root_dn}"
32 rootpw ${myconfig.env.ldap.root_pw}
33 directory /var/lib/openldap
34 overlay memberof
35
36 TLSCertificateFile /var/lib/acme/ldap/cert.pem
37 TLSCertificateKeyFile /var/lib/acme/ldap/key.pem
38 TLSCACertificateFile /var/lib/acme/ldap/fullchain.pem
39 TLSCACertificatePath ${pkgs.cacert.unbundled}/etc/ssl/certs/
40 #This makes openldap crash
41 #TLSCipherSuite DEFAULT
42
43 sasl-host kerberos.immae.eu
44 ${builtins.readFile "${myconfig.privateFiles}/ldap.conf"}
45 '';
46in {
47 options.services.myDatabases = {
48 ldap = {
49 enable = lib.mkOption {
50 default = cfg.enable;
51 example = true;
52 description = "Whether to enable ldap";
53 type = lib.types.bool;
54 };
55 };
56 };
57
58 config = lib.mkIf cfg.enable {
59 networking.firewall.allowedTCPPorts = [ 636 389 ];
60
61 services.cron = {
62 systemCronJobs = [
63 ''
64 35 1,13 * * * root ${pkgs.openldap}/bin/slapcat -v -b "dc=immae,dc=eu" -f ${pkgs.writeText "slapd.conf" ldapConfig} -l /var/lib/openldap/backup.ldif
65 ''
66 ];
67 };
68
69 security.acme.certs."ldap" = config.services.myCertificates.certConfig // {
70 user = "openldap";
71 group = "openldap";
72 plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
73 domain = "ldap.immae.eu";
74 postRun = ''
75 systemctl restart openldap.service
76 '';
77 };
78
79 services.openldap = {
80 enable = config.services.myDatabases.ldap.enable;
81 dataDir = "/var/lib/openldap";
82 urlList = [ "ldap://" "ldaps://" ];
83 extraConfig = ldapConfig;
84 };
85 };
86}
87