blob: ca9b6fc34d525fb3258788a107c60c729cb9ed3a (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
|
{ lib, pkgs, config, ... }:
let
cfg = config.myServices.ssh;
in
{
options.myServices.ssh = let
module = lib.types.submodule {
options = {
snippet = lib.mkOption {
type = lib.types.lines;
description = ''
Snippet to use
'';
};
dependencies = lib.mkOption {
type = lib.types.listOf lib.types.package;
default = [];
description = ''
Dependencies of the package
'';
};
};
};
in {
predefinedModules = lib.mkOption {
type = lib.types.attrsOf module;
default = {
regular = {
snippet = builtins.readFile ./ldap_regular.sh;
};
};
readOnly = true;
description = ''
Predefined modules
'';
};
modules = lib.mkOption {
type = lib.types.listOf module;
default = [];
description = ''
List of modules to enable
'';
};
};
config = {
networking.firewall.allowedTCPPorts = [ 22 ];
} // (lib.mkIf (builtins.length cfg.modules > 0) {
services.openssh.extraConfig = ''
AuthorizedKeysCommand /etc/ssh/ldap_authorized_keys
AuthorizedKeysCommandUser nobody
'';
secrets.keys = [{
dest = "ssh-ldap";
user = "nobody";
group = "nogroup";
permissions = "0400";
text = config.myEnv.sshd.ldap.password;
}];
system.activationScripts.sshd = {
deps = [ "secrets" ];
text = ''
install -Dm400 -o nobody -g nogroup -T ${config.secrets.fullPaths."ssh-ldap"} /etc/ssh/ldap_password
'';
};
# ssh is strict about parent directory having correct rights, don't
# move it in the nix store.
environment.etc."ssh/ldap_authorized_keys" = let
deps = lib.lists.unique (
[ pkgs.which pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ]
++ lib.flatten (map (v: v.dependencies) cfg.modules)
);
fullScript = pkgs.runCommand "ldap_authorized_keys" {
snippets = builtins.concatStringsSep "\n" (map (v: v.snippet) cfg.modules);
} ''
substituteAll ${./ldap_authorized_keys.sh} $out
chmod a+x $out
'';
ldap_authorized_keys = pkgs.runCommand "ldap_authorized_keys" {
buildInputs = [ pkgs.makeWrapper ];
} ''
makeWrapper "${fullScript}" "$out" --prefix PATH : ${lib.makeBinPath deps}
'';
in {
enable = true;
mode = "0755";
user = "root";
source = ldap_authorized_keys;
};
});
}
|
