]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/mermet/openldap.nix
nixos: tweak default tools
[sourcephile-nix.git] / hosts / mermet / openldap.nix
1 { pkgs, lib, config, host, ... }:
2 let
3 inherit (builtins) baseNameOf readFile;
4 inherit (lib) types;
5 inherit (pkgs.lib) unlinesAttrs;
6 inherit (config) networking;
7 inherit (config.services) openldap;
8 inherit (config.users) ldap;
9 domainSuffix = "dc=" + lib.concatStringsSep ",dc=" (lib.splitString "." networking.domain);
10 in
11 {
12 imports = [
13 openldap/sourcephile.fr.nix
14 openldap/autogeree.net.nix
15 ];
16 users.ldap = {
17 enable = false;
18 server = "ldapi:///";
19 base = "ou=posix,${domainSuffix}";
20 bind = {
21 #distinguishedName = "cn=admin,${domainSuffix}";
22 };
23 daemon = {
24 enable = false;
25 extraConfig = ''
26 log syslog info
27
28 sasl_mech EXTERNAL
29 # NOTE: nslcd cannot use SASL to bind to rootpwmoddn
30 # which is the DN used by nslcd when passwd is run by root
31 # to change the userPassword of an LDAP user.
32 # SEE: https://www.reddit.com/r/linuxadmin/comments/53sxpl/how_do_i_configure_nslcd_to_use_a_sasl_external/d7w9awd/
33 # Thus, use: ldappasswd -H ldapi:// -Y EXTERNAL uid=$user,ou=accounts,ou=posix,dc=sourcephile,dc=fr
34 '';
35 };
36 };
37 services.openldap = {
38 enable = true;
39 #dataDir = "/var/db/ldap";
40 #configDir = "/var/db/slapd";
41 urlList = [ "ldapi:///" ]; # UNIX socket
42 # sudo ldapsearch -LLL -H ldapi:// -D cn=admin,cn=config -Y EXTERNAL -b "" -s base supportedControl
43 settings = {
44 attrs = {
45 objectClass = "olcGlobal";
46 olcLogLevel = [ "stats" ];
47 # The tool-threads parameter sets the actual amount of CPU's
48 # that is used for indexing.
49 olcToolThreads = toString host.CPUs;
50 };
51 children = {
52 "cn=schema".includes = [
53 "${pkgs.openldap}/etc/schema/core.ldif"
54 "${pkgs.openldap}/etc/schema/cosine.ldif"
55 "${pkgs.openldap}/etc/schema/nis.ldif"
56 "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
57 "${openldap/schema/postfix-book.ldif}"
58 ];
59 # The first database is the special frontend database
60 # whose settings are applied globally to all the other databases.
61 # Beware that cn={0}module,cn=config must appear before
62 # for enabling password schemes provided by the modules in olcPasswordHash.
63 # ldapsearch -LLL -H ldapi:// -D cn=admin,cn=config -Y EXTERNAL -b 'olcDatabase={-1}frontend,cn=config' -s sub '*'
64 "olcDatabase={-1}frontend".attrs = {
65 objectClass = [ "olcDatabaseConfig" "olcFrontendConfig" ];
66 olcDatabase = "{-1}frontend";
67 # The maximum number of entries that is returned for a search operation
68 olcSizeLimit = "500";
69 olcAccess = [
70 # Allow unlimited access to local connection from the local root user
71 ''to *
72 by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
73 by * break
74 ''
75 # Allow unauthenticated read access for schema and base DN autodiscovery
76 ''to dn.exact=""
77 by * read
78 ''
79 ''to dn.base="cn=Subschema"
80 by * read
81 ''
82 ];
83 # Hash algorithm to be used by LDAP Password Modify Extended Operation or the ppolicy overlay
84 #olcPasswordHash = "{PBKDF2-SHA256}";
85 olcPasswordHash = "{SSHA}";
86 };
87 "cn={0}module".attrs = {
88 objectClass = [ "olcModuleList" ];
89 olcModulePath = "${pkgs.openldap}/lib/modules";
90 #olcModuleLoad = "pw-sha2";
91 #olcModuleLoad = "pw-pbkdf2";
92 olcModuleLoad = "back_mdb";
93 };
94
95 "olcDatabase={0}config".attrs = {
96 objectClass = "olcDatabaseConfig";
97 olcDatabase = "{0}config";
98 olcRootDN = "cn=admin,cn=config";
99 # Access to cn=config, system root can be manager
100 # with SASL mechanism (-Y EXTERNAL) over unix socket (-H ldapi://)
101 olcAccess = [
102 ''to *
103 by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
104 by * break
105 ''
106 ];
107 };
108 };
109 };
110 /*
111 cnConfig = ''
112 dn: cn=schema,cn=config
113 objectClass: olcSchemaConfig
114
115 dn: olcBackend=mdb,cn=config
116 objectClass: olcBackendConfig
117 '';
118 */
119 };
120 }