nixos/modules/services/databases/openldap.nix

   1 { pkgs, lib, config, ... }:
   2 let inherit (builtins) baseNameOf readFile;
   3     inherit (lib) types;
   4     inherit (pkgs.lib) unlinesAttrs;
   5     inherit (config.services) openldap;
   6     inherit (config.users) ldap;
   7     # FIXME: readFIle ?
   8     copyFile = file: pkgs.writeText (baseNameOf file) (readFile file);
   9 in
  10 {
  11 options = {
  12   services.openldap.domainSuffix = lib.mkOption {
  13     type        = types.str;
  14     default     = "dc=${lib.concatStringsSep ",dc=" (lib.splitString "." config.networking.domain)}";
  15     description = ''LDAP suffix for config.networking.domain.'';
  16   };
  17   services.openldap.initConfig = lib.mkOption {
  18     type = types.lines;
  19     description = "The databases' initial config in LDIF.";
  20     apply = lines: pkgs.writeText "cn=config.ldif.nix"
  21       (lines + "\n" + unlinesAttrs (olcSuffix: {conf, olcDbDirectory, ...}:
  22         "include: file://" + pkgs.writeText "config.ldif" (conf + ''
  23           olcSuffix: ${olcSuffix}
  24           olcDbDirectory: ${olcDbDirectory}
  25         '')
  26       ) openldap.databases);
  27     default = ''
  28       dn: cn=config
  29       objectClass: olcGlobal
  30       #olcPidFile: /run/slapd/slapd.pid
  31       # List of arguments that were passed to the server
  32       #olcArgsFile: /run/slapd/slapd.args
  33       # Read slapd-config(5) for possible values
  34       olcLogLevel: none
  35       # The tool-threads parameter sets the actual amount of CPU's
  36       # that is used for indexing.
  37       olcToolThreads: 1
  38
  39       dn: olcDatabase={-1}frontend,cn=config
  40       objectClass: olcDatabaseConfig
  41       objectClass: olcFrontendConfig
  42       # The maximum number of entries that is returned for a search operation
  43       olcSizeLimit: 500
  44       # Allow unlimited access to local connection from the local root user
  45       olcAccess: to *
  46         by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
  47         by * break
  48       # Allow unauthenticated read access for schema and base DN autodiscovery
  49       olcAccess: to dn.exact=""
  50         by * read
  51       olcAccess: to dn.base="cn=Subschema"
  52         by * read
  53
  54       dn: olcDatabase=config,cn=config
  55       objectClass: olcDatabaseConfig
  56       olcRootDN: cn=admin,cn=config
  57       # Access to cn=config, system root can be manager
  58       # with SASL mechanism (-Y EXTERNAL) over unix socket (-H ldapi://)
  59       olcAccess: to *
  60         by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
  61         by * break
  62
  63       dn: cn=schema,cn=config
  64       objectClass: olcSchemaConfig
  65
  66       include: file://${pkgs.openldap}/etc/schema/core.ldif
  67       include: file://${pkgs.openldap}/etc/schema/cosine.ldif
  68       include: file://${pkgs.openldap}/etc/schema/nis.ldif
  69       include: file://${pkgs.openldap}/etc/schema/inetorgperson.ldif
  70       include: file://${copyFile openldap/schema/postfix-book.ldif}
  71
  72       dn: cn=module{0},cn=config
  73       objectClass: olcModuleList
  74       # Where the dynamically loaded modules are stored
  75       #olcModulePath: /usr/lib/ldap
  76       olcModuleLoad: back_mdb
  77     '';
  78   };
  79   services.openldap.databases = lib.mkOption {
  80     default = {};
  81     type = types.attrsOf (types.submodule ({name, options, config, ...}: {
  82       options = {
  83         conf = lib.mkOption {
  84           type = types.lines;
  85           description = "The database's config in LDIF.";
  86         };
  87         data = lib.mkOption {
  88           type = types.lines;
  89           description = "The database's data in LDIF.";
  90         };
  91         olcDbDirectory = lib.mkOption {
  92           type = types.str;
  93           description = "The directory where the database is stored.";
  94           default = "${openldap.dataDir}/${name}";
  95         };
  96         resetData = lib.mkOption {
  97           type = types.bool;
  98           description = "Whether to reset the data at each start of the slapd service.";
  99           default = false;
 100         };
 101       };
 102     }));
 103   };
 104 };
 105 config = {
 106   systemd.services.openldap = {
 107     preStart = ''
 108         set -e
 109         # NOTE: slapd's config is always re-initialized.
 110         rm -rf "${openldap.configDir}"/cn=config \
 111                "${openldap.configDir}"/cn=config.ldif
 112         install -D -d -m 0700 -o "${openldap.user}" -g "${openldap.group}" "${openldap.configDir}"
 113         # NOTE: olcDbDirectory must be created before adding the config.
 114         '' +
 115         unlinesAttrs (olcSuffix: {data, olcDbDirectory, resetData, ...}:
 116           lib.optionalString resetData ''
 117             rm -rf "${olcDbDirectory}"
 118           '' + ''
 119           install -D -d -m 0700 -o "${openldap.user}" -g "${openldap.group}" "${olcDbDirectory}"
 120           '') openldap.databases
 121         + ''
 122         # NOTE: slapd is supposed to have been stopped by systemd
 123         # before entering this preStart,
 124         # hence slap* commands can safely be used.
 125         #
 126         # NOTE: slapadd(8):
 127         # To populate the config database slapd-config(5),
 128         # use -n 0 as it is always the first database.
 129         # It must physically exist on the filesystem prior to this, however.
 130         umask 0077
 131         ${pkgs.openldap}/bin/slapadd -n 0 \
 132          -F "${openldap.configDir}" \
 133          -l ${openldap.initConfig}
 134         chown -R "${openldap.user}:${openldap.group}" "${openldap.configDir}"
 135       '' +
 136       unlinesAttrs (olcSuffix: {data, olcDbDirectory, resetData, ...}:
 137         lib.optionalString resetData ''
 138           ${pkgs.openldap}/bin/slapadd \
 139            -F "${openldap.configDir}" \
 140            -l ${pkgs.writeText "data.ldif" data}
 141         '' + ''
 142         test ! -e "${olcDbDirectory}" ||
 143         chown -R "${openldap.user}:${openldap.group}" "${olcDbDirectory}"
 144       '') openldap.databases;
 145   };
 146 };
 147 }