diff options
Diffstat (limited to 'modules/private/databases/mariadb.nix')
-rw-r--r-- | modules/private/databases/mariadb.nix | 149 |
1 files changed, 149 insertions, 0 deletions
diff --git a/modules/private/databases/mariadb.nix b/modules/private/databases/mariadb.nix new file mode 100644 index 00000000..a7239c0e --- /dev/null +++ b/modules/private/databases/mariadb.nix | |||
@@ -0,0 +1,149 @@ | |||
1 | { lib, pkgs, config, ... }: | ||
2 | let | ||
3 | cfg = config.myServices.databases.mariadb; | ||
4 | in { | ||
5 | options.myServices.databases = { | ||
6 | mariadb = { | ||
7 | enable = lib.mkOption { | ||
8 | default = cfg.enable; | ||
9 | example = true; | ||
10 | description = "Whether to enable mariadb database"; | ||
11 | type = lib.types.bool; | ||
12 | }; | ||
13 | package = lib.mkOption { | ||
14 | type = lib.types.package; | ||
15 | default = pkgs.mariadb; | ||
16 | description = '' | ||
17 | Mariadb package to use. | ||
18 | ''; | ||
19 | }; | ||
20 | credentials = lib.mkOption { | ||
21 | default = {}; | ||
22 | description = "Credentials"; | ||
23 | type = lib.types.attrsOf lib.types.str; | ||
24 | }; | ||
25 | ldapConfig = lib.mkOption { | ||
26 | description = "LDAP configuration to allow PAM identification via LDAP"; | ||
27 | type = lib.types.submodule { | ||
28 | options = { | ||
29 | host = lib.mkOption { type = lib.types.str; }; | ||
30 | base = lib.mkOption { type = lib.types.str; }; | ||
31 | dn = lib.mkOption { type = lib.types.str; }; | ||
32 | password = lib.mkOption { type = lib.types.str; }; | ||
33 | filter = lib.mkOption { type = lib.types.str; }; | ||
34 | }; | ||
35 | }; | ||
36 | }; | ||
37 | dataDir = lib.mkOption { | ||
38 | type = lib.types.path; | ||
39 | default = "/var/lib/mysql"; | ||
40 | description = '' | ||
41 | The directory where Mariadb stores its data. | ||
42 | ''; | ||
43 | }; | ||
44 | # Output variables | ||
45 | socketsDir = lib.mkOption { | ||
46 | type = lib.types.path; | ||
47 | default = "/run/mysqld"; | ||
48 | description = '' | ||
49 | The directory where Mariadb puts sockets. | ||
50 | ''; | ||
51 | }; | ||
52 | sockets = lib.mkOption { | ||
53 | type = lib.types.attrsOf lib.types.path; | ||
54 | default = { | ||
55 | mysqld = "${cfg.socketsDir}/mysqld.sock"; | ||
56 | }; | ||
57 | readOnly = true; | ||
58 | description = '' | ||
59 | Mariadb sockets | ||
60 | ''; | ||
61 | }; | ||
62 | }; | ||
63 | }; | ||
64 | |||
65 | config = lib.mkIf cfg.enable { | ||
66 | networking.firewall.allowedTCPPorts = [ 3306 ]; | ||
67 | |||
68 | # for adminer, ssl is implemented with mysqli only, which is | ||
69 | # currently disabled because it’s not compatible with pam. | ||
70 | # Thus we need to generate two users for each 'remote': one remote | ||
71 | # with SSL, and one localhost without SSL. | ||
72 | # User identified by LDAP: | ||
73 | # CREATE USER foo@% IDENTIFIED VIA pam USING 'mysql' REQUIRE SSL; | ||
74 | # CREATE USER foo@localhost IDENTIFIED VIA pam USING 'mysql'; | ||
75 | services.mysql = { | ||
76 | enable = true; | ||
77 | package = cfg.package; | ||
78 | dataDir = cfg.dataDir; | ||
79 | extraOptions = '' | ||
80 | ssl_ca = ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt | ||
81 | ssl_key = ${config.security.acme.directory}/mysql/key.pem | ||
82 | ssl_cert = ${config.security.acme.directory}/mysql/fullchain.pem | ||
83 | ''; | ||
84 | }; | ||
85 | |||
86 | users.users.mysql.extraGroups = [ "keys" ]; | ||
87 | security.acme.certs."mysql" = config.myServices.databasesCerts // { | ||
88 | user = "mysql"; | ||
89 | group = "mysql"; | ||
90 | plugins = [ "fullchain.pem" "key.pem" "account_key.json" ]; | ||
91 | domain = "db-1.immae.eu"; | ||
92 | postRun = '' | ||
93 | systemctl restart mysql.service | ||
94 | ''; | ||
95 | }; | ||
96 | |||
97 | secrets.keys = [ | ||
98 | { | ||
99 | dest = "mysql/mysqldump"; | ||
100 | permissions = "0400"; | ||
101 | user = "root"; | ||
102 | group = "root"; | ||
103 | text = '' | ||
104 | [mysqldump] | ||
105 | user = root | ||
106 | password = ${cfg.credentials.root} | ||
107 | ''; | ||
108 | } | ||
109 | { | ||
110 | dest = "mysql/pam"; | ||
111 | permissions = "0400"; | ||
112 | user = "mysql"; | ||
113 | group = "mysql"; | ||
114 | text = with cfg.ldapConfig; '' | ||
115 | host ${host} | ||
116 | base ${base} | ||
117 | binddn ${dn} | ||
118 | bindpw ${password} | ||
119 | pam_filter ${filter} | ||
120 | ssl start_tls | ||
121 | ''; | ||
122 | } | ||
123 | ]; | ||
124 | |||
125 | services.cron = { | ||
126 | enable = true; | ||
127 | systemCronJobs = [ | ||
128 | '' | ||
129 | 30 1,13 * * * root ${cfg.package}/bin/mysqldump --defaults-file=${config.secrets.location}/mysql/mysqldump --all-databases > ${cfg.dataDir}/backup.sql | ||
130 | '' | ||
131 | ]; | ||
132 | }; | ||
133 | |||
134 | security.pam.services = let | ||
135 | pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so"; | ||
136 | in [ | ||
137 | { | ||
138 | name = "mysql"; | ||
139 | text = '' | ||
140 | # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/ | ||
141 | auth required ${pam_ldap} config=${config.secrets.location}/mysql/pam | ||
142 | account required ${pam_ldap} config=${config.secrets.location}/mysql/pam | ||
143 | ''; | ||
144 | } | ||
145 | ]; | ||
146 | |||
147 | }; | ||
148 | } | ||
149 | |||