]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/openldap/sourcephile.fr.nix
public-inbox: hide test@sourcephile.fr
[sourcephile-nix.git] / servers / mermet / openldap / sourcephile.fr.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (builtins) hasAttr;
4 inherit (builtins.extraBuiltins) pass-chomp;
5 inherit (config) networking;
6 inherit (config.services) openldap postfix dovecot2;
7 inherit (config.users) users groups;
8 inherit (pkgs.lib) unlines;
9 domain = "sourcephile.fr";
10 domainGroup = "sourcephile";
11 domainOrg = "sourcephile";
12 domainSuffix = "dc=" + lib.concatStringsSep ",dc=" (lib.splitString "." domain);
13 posixAccount = pkgs.callPackage (import ./posixAccount.nix) { inherit domain domainSuffix domainGroup; };
14 in
15 {
16 users.groups."${domainGroup}" = {
17 gid = 20000;
18 members = [users."julm".name];
19 };
20 # DEBUG: echo "$(nixops show-option mermet -d production services.openldap.databases."g".data)"
21 services.openldap.databases."${domainSuffix}" = {
22 # DEBUG: sudo ldapsearch -LLL -H ldapi:// -D cn=admin,cn=config -Y EXTERNAL -b 'olcDatabase={1}mdb,cn=config' -s sub
23 # WARNING: newlines matter
24 conf = ''
25 dn: olcDatabase=mdb,cn=config
26 objectClass: olcDatabaseConfig
27 objectClass: olcMdbConfig
28 # Checkpoint the database periodically in case of system failure
29 # and to speed up slapd shutdown.
30 olcDbCheckpoint: 512 30
31 # Database max size is 1G
32 olcDbMaxSize: 1073741824
33 olcLastMod: TRUE
34 # Database superuser. Needed for syncrepl.
35 olcRootDN: cn=admin,${domainSuffix}
36 # Superuser password, generated with slappasswd -h "{SSHA}"
37 # Commented-out because SASL EXTERNAL mechanism is used.
38 #olcRootPW: {SSHA}COkATGNe7rs/g8vWcYP5rqt4u5sWdMgP
39 #
40 olcDbIndex: objectClass eq
41 olcDbIndex: cn,uid eq
42 olcDbIndex: uidNumber,gidNumber eq
43 olcDbIndex: member,memberUid eq
44 olcDbIndex: mail eq
45 olcDbIndex: mailAlias eq
46 olcDbIndex: mailEnabled eq
47 #
48 olcAccess: to attrs=userPassword
49 by self write
50 by anonymous auth
51 by dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
52 by * none
53 olcAccess: to attrs=shadowLastChange
54 by self write
55 by dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
56 by * none
57 olcAccess: to dn.sub="ou=posix,${domainSuffix}"
58 by self read
59 ${lib.optionalString (hasAttr postfix.user users) ''by dn="gidNumber=${toString groups.postfix.gid}+uidNumber=${toString users.postfix.uid},cn=peercred,cn=external,cn=auth" read''}
60 ${lib.optionalString (hasAttr dovecot2.user users) ''by dn="gidNumber=${toString groups.dovecot2.gid}+uidNumber=${toString users.dovecot2.uid},cn=peercred,cn=external,cn=auth" read''}
61 by dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
62 olcAccess: to *
63 by self read
64 by * none
65 '';
66 data = ''
67 dn: ${domainSuffix}
68 objectClass: top
69 objectClass: dcObject
70 objectClass: organization
71 o: ${domainOrg}
72
73 dn: cn=admin,${domainSuffix}
74 objectClass: simpleSecurityObject
75 objectClass: organizationalRole
76 description: ${domainOrg} LDAP administrator
77 roleOccupant: ${domainSuffix}
78 userPassword:
79
80 dn: ou=posix,${domainSuffix}
81 objectClass: top
82 objectClass: organizationalUnit
83
84 dn: ou=accounts,ou=posix,${domainSuffix}
85 objectClass: top
86 objectClass: organizationalUnit
87
88 dn: ou=groups,ou=posix,${domainSuffix}
89 objectClass: top
90 objectClass: organizationalUnit
91
92 ''
93 /*
94 dn: cn=${domainGroup},ou=groups,ou=posix,${domainSuffix}
95 objectClass: top
96 objectClass: posixGroup
97 gidNumber: 20000
98 memberUid: julm
99
100 dn: cn=autogeree,ou=groups,ou=posix,${domainSuffix}
101 objectClass: top
102 objectClass: posixGroup
103 gidNumber: 20001
104 memberUid: julm
105 */
106 + lib.concatMapStrings posixAccount [ rec
107 { uid = "julm";
108 cn = "Julien Moutinho";
109 sn = uid;
110 uidNumber = users."julm".uid;
111 gidNumber = groups."users".gid;
112 mailAlias = [ "julien.moutinho" ];
113 userPassword = pass-chomp "members/julm/mail/hashedPassword";
114 mailHomeDirectory = "/home/${uid}/mail/${domain}";
115 mailStorageDirectory =
116 let stateDir = "/var/lib/dovecot"; in
117 # I'm personnaly using "maildir:" instead of "sdbox:" to be able to use a local (neo)mutt on it,
118 # bypassing IMAP because (neo)mutt support of IMAP is very bad
119 # (can't even have a decent $folder_format (with %n or %m) working,
120 # neither sorting them by date).
121 # WARNING: regarding the atomicity of backuping,
122 # it's not a good idea to put the mails
123 # and the index/control on different ZFS datasets like here.
124 "maildir:/home/${uid}/mail/${domain}/mail:LAYOUT=maildir++:UTF-8:CONTROL=${stateDir}/control/${domain}/${uid}:INDEX=${stateDir}/index/${domain}/${uid}";
125 }
126 ];
127 };
128 }