1 { pkgs, lib, config, ... }:
2 let inherit (builtins) baseNameOf readFile;
4 inherit (pkgs.lib) unlinesAttrs;
5 inherit (config.services) openldap;
6 inherit (config.users) ldap;
10 services.openldap.initConfig = lib.mkOption {
12 description = "The databases' initial config in LDIF.";
13 apply = lines: pkgs.writeText "cn=config.ldif"
14 (lines + "\n" + unlinesAttrs (olcSuffix: {conf, olcDbDirectory, ...}:
15 "include: file://" + pkgs.writeText "config.ldif" (conf + ''
16 olcSuffix: ${olcSuffix}
17 olcDbDirectory: ${olcDbDirectory}
19 ) openldap.databases);
20 # sudo ldapsearch -LLL -H ldapi:// -D cn=admin,cn=config -Y EXTERNAL -b "" -s base supportedControl
23 objectClass: olcGlobal
24 #olcPidFile: /run/slapd/slapd.pid
25 # List of arguments that were passed to the server
26 #olcArgsFile: /run/slapd/slapd.args
27 # Read slapd-config(5) for possible values
29 # The tool-threads parameter sets the actual amount of CPU's
30 # that is used for indexing.
33 dn: olcDatabase={-1}frontend,cn=config
34 objectClass: olcDatabaseConfig
35 objectClass: olcFrontendConfig
36 # The maximum number of entries that is returned for a search operation
38 # Hash algorithm to be used by LDAP Password Modify Extended Operation or the ppolicy overlay
39 olcPasswordHash: {SSHA}
40 # Allow unlimited access to local connection from the local root user
42 by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
44 # Allow unauthenticated read access for schema and base DN autodiscovery
45 olcAccess: to dn.exact=""
47 olcAccess: to dn.base="cn=Subschema"
50 dn: olcDatabase=config,cn=config
51 objectClass: olcDatabaseConfig
52 olcRootDN: cn=admin,cn=config
53 # Access to cn=config, system root can be manager
54 # with SASL mechanism (-Y EXTERNAL) over unix socket (-H ldapi://)
56 by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
59 dn: cn=schema,cn=config
60 objectClass: olcSchemaConfig
62 include: file://${pkgs.openldap}/etc/schema/core.ldif
63 include: file://${pkgs.openldap}/etc/schema/cosine.ldif
64 include: file://${pkgs.openldap}/etc/schema/nis.ldif
65 include: file://${pkgs.openldap}/etc/schema/inetorgperson.ldif
66 include: file://${openldap/schema/postfix-book.ldif}
68 dn: cn=module{0},cn=config
69 objectClass: olcModuleList
70 # Where the dynamically loaded modules are stored
71 #olcModulePath: /usr/lib/ldap
72 olcModuleLoad: back_mdb
73 #olcModuleLoad: pw-sha2
74 #olcModuleLoad: pw-pbkdf2
77 services.openldap.databases = lib.mkOption {
79 type = types.attrsOf (types.submodule ({name, options, config, ...}: {
83 description = "The database's config in LDIF.";
87 description = "The database's data in LDIF.";
89 olcDbDirectory = lib.mkOption {
91 description = "The directory where the database is stored.";
92 default = "${openldap.dataDir}/${name}";
94 resetData = lib.mkOption {
96 description = "Whether to reset the data at each start of the slapd service.";
103 config = lib.mkIf openldap.enable {
104 systemd.services.openldap.preStart = ''
106 # NOTE: slapd's config is always re-initialized.
107 rm -rf "${openldap.configDir}"/cn=config \
108 "${openldap.configDir}"/cn=config.ldif
109 install -D -d -m 0700 -o "${openldap.user}" -g "${openldap.group}" "${openldap.configDir}"
110 # NOTE: olcDbDirectory must be created before adding the config.
112 unlinesAttrs (olcSuffix: {data, olcDbDirectory, resetData, ...}:
113 lib.optionalString resetData ''
114 rm -rf "${olcDbDirectory}"
116 install -D -d -m 0700 -o "${openldap.user}" -g "${openldap.group}" "${olcDbDirectory}"
117 '') openldap.databases
119 # NOTE: slapd is supposed to have been stopped by systemd
120 # before entering this preStart,
121 # hence slap* commands can safely be used.
124 # To populate the config database slapd-config(5),
125 # use -n 0 as it is always the first database.
126 # It must physically exist on the filesystem prior to this, however.
128 ${pkgs.openldap}/bin/slapadd -n 0 \
129 -F "${openldap.configDir}" \
130 -l ${openldap.initConfig}
131 chown -R "${openldap.user}:${openldap.group}" "${openldap.configDir}"
133 unlinesAttrs (olcSuffix: {data, olcDbDirectory, resetData, ...}:
134 lib.optionalString resetData ''
135 ${pkgs.openldap}/bin/slapadd \
136 -F "${openldap.configDir}" \
137 -l ${pkgs.writeText "data.ldif" data}
139 test ! -e "${olcDbDirectory}" ||
140 chown -R "${openldap.user}:${openldap.group}" "${olcDbDirectory}"
141 '') openldap.databases;