blob: 542e209413a82c43158fc7cc7d75b6548933616a (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
|
{ lib, pkgs, config, myconfig, mylibs, ... }:
let
cfg = config.services.myDatabases;
ldapConfig = let
kerberosSchema = pkgs.fetchurl {
url = "https://raw.githubusercontent.com/krb5/krb5/master/src/plugins/kdb/ldap/libkdb_ldap/kerberos.schema";
sha256 = "17fnkkf6s3lznsl7wp6914pqsc78d038rh38l638big8z608ksww";
};
puppetSchema = pkgs.fetchurl {
url = "https://raw.githubusercontent.com/puppetlabs/puppet/master/ext/ldap/puppet.schema";
sha256 = "11bjf5zfvqlim7p9vddcafs0wiq3v8ys77x8h6fbp9c6bdfh0awh";
};
in ''
include ${pkgs.openldap}/etc/schema/core.schema
include ${pkgs.openldap}/etc/schema/cosine.schema
include ${pkgs.openldap}/etc/schema/inetorgperson.schema
include ${pkgs.openldap}/etc/schema/nis.schema
include ${puppetSchema}
include ${kerberosSchema}
include ${./immae.schema}
pidfile /run/slapd/slapd.pid
argsfile /run/slapd/slapd.args
moduleload back_hdb
backend hdb
moduleload memberof
database hdb
suffix "${myconfig.env.ldap.base}"
rootdn "${myconfig.env.ldap.root_dn}"
include /var/secrets/ldap/password
directory /var/lib/openldap
overlay memberof
TLSCertificateFile /var/lib/acme/ldap/cert.pem
TLSCertificateKeyFile /var/lib/acme/ldap/key.pem
TLSCACertificateFile /var/lib/acme/ldap/fullchain.pem
TLSCACertificatePath ${pkgs.cacert.unbundled}/etc/ssl/certs/
#This makes openldap crash
#TLSCipherSuite DEFAULT
sasl-host kerberos.immae.eu
include /var/secrets/ldap/access
'';
in {
options.services.myDatabases = {
ldap = {
enable = lib.mkOption {
default = cfg.enable;
example = true;
description = "Whether to enable ldap";
type = lib.types.bool;
};
};
};
config = lib.mkIf cfg.enable {
secrets.keys = [
{
dest = "ldap/password";
permissions = "0400";
user = "openldap";
group = "openldap";
text = "rootpw ${myconfig.env.ldap.root_pw}";
}
{
dest = "ldap/access ";
permissions = "0400";
user = "openldap";
group = "openldap";
text = builtins.readFile "${myconfig.privateFiles}/ldap.conf";
}
];
users.users.openldap.extraGroups = [ "keys" ];
networking.firewall.allowedTCPPorts = [ 636 389 ];
services.cron = {
systemCronJobs = [
''
35 1,13 * * * root ${pkgs.openldap}/bin/slapcat -v -b "dc=immae,dc=eu" -f ${pkgs.writeText "slapd.conf" ldapConfig} -l /var/lib/openldap/backup.ldif | ${pkgs.gnugrep}/bin/grep -v "^# id=[0-9a-f]*$"
''
];
};
security.acme.certs."ldap" = config.services.myCertificates.certConfig // {
user = "openldap";
group = "openldap";
plugins = [ "fullchain.pem" "key.pem" "cert.pem" "account_key.json" ];
domain = "ldap.immae.eu";
postRun = ''
systemctl restart openldap.service
'';
};
services.openldap = {
enable = config.services.myDatabases.ldap.enable;
dataDir = "/var/lib/openldap";
urlList = [ "ldap://" "ldaps://" ];
extraConfig = ldapConfig;
};
};
}
|
