servers/mermet/openldap/sourcephile.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins) hasAttr;
   4   inherit (builtins.extraBuiltins) pass-chomp;
   5   inherit (config) networking;
   6   inherit (config.services) openldap postfix dovecot2;
   7   inherit (config.users) users groups;
   8   inherit (pkgs.lib) unlines;
   9   domain = "sourcephile.fr";
  10   domainGroup = "sourcephile";
  11   domainOrg = "sourcephile";
  12   domainSuffix = "dc=" + lib.concatStringsSep ",dc=" (lib.splitString "." domain);
  13   posixAccount =
  14    { uid
  15    , uidNumber
  16    , gidNumber ? uidNumber
  17    , cn ? ""
  18    , sn ? ""
  19    , userPassword ? null # Use doveadm pw -s SSHA -u $user
  20    , mailAlias ? []
  21    , homeDirectory ? ""
  22    , mailStorageDirectory ? null
  23    , loginShell ? "/run/current-system/sw/bin/bash"
  24    , mailEnabled ? true
  25    , mailForwardingAddress ? []
  26    }:
  27     "\n" + lib.concatStringsSep "\n\n" [
  28     (unlines ([ ''
  29       dn: uid=${uid},ou=accounts,ou=posix,${domainSuffix}
  30       objectClass: person
  31       objectClass: posixAccount
  32       objectClass: shadowAccount
  33       objectClass: PostfixBookMailAccount
  34       objectClass: PostfixBookMailForward
  35       cn: ${cn}
  36       sn: ${sn}
  37       mail: ${uid}@${domain}
  38       mailEnabled: ${if mailEnabled then "TRUE" else "FALSE"}
  39       mailGroupMember: ${domainGroup}''
  40       ]
  41       ++ [ "uidNumber: ${toString uidNumber}" ]
  42       ++ [ "gidNumber: ${toString gidNumber}" ]
  43       ++ [ "homeDirectory: ${homeDirectory}" ]
  44       ++ lib.optional (loginShell != null)  "loginShell: ${loginShell}"
  45       ++ lib.optional (userPassword != null) "userPassword: ${userPassword}"
  46       ++ lib.optional (mailStorageDirectory != null) "mailStorageDirectory: ${mailStorageDirectory}"
  47       ++ map (forward: "mailForwardingAddress: ${forward}") mailForwardingAddress
  48       ++ map (alias: "mailAlias: ${alias}@${domain}") mailAlias
  49       ++ lib.optional (mailAlias == []) "mailAlias:"
  50       # NOTE: required by PostfixBookMailForward
  51     ))
  52     ''
  53       dn: cn=${uid},ou=groups,ou=posix,${domainSuffix}
  54       objectClass: top
  55       objectClass: posixGroup
  56       gidNumber: ${toString gidNumber}
  57       memberUid: ${uid}
  58     ''
  59   ];
  60 in
  61 {
  62 # DEBUG: echo "$(nixops show-option mermet -d production services.openldap.databases."g".data)"
  63 services.openldap.databases."${domainSuffix}" = {
  64   #
  65   #
  66   # WARNING: this deletes data.
  67   #
  68   #
  69   resetData = true;
  70
  71   # DEBUG: sudo ldapsearch -LLL -H ldapi:// -D cn=admin,cn=config -Y EXTERNAL -b 'olcDatabase={1}mdb,cn=config' -s sub
  72   # WARNING: newlines matter
  73   conf = ''
  74     dn: olcBackend={1}mdb,cn=config
  75     objectClass: olcBackendConfig
  76
  77     dn: olcDatabase={1}mdb,cn=config
  78     objectClass: olcDatabaseConfig
  79     objectClass: olcMdbConfig
  80     # NOTE: checkpoint the database periodically in case of system failure
  81     # and to speed up slapd shutdown.
  82     olcDbCheckpoint: 512 30
  83     # Database max size is 1G
  84     olcDbMaxSize: 1073741824
  85     olcLastMod: TRUE
  86     # NOTE: database superuser. Needed for syncrepl.
  87     olcRootDN: cn=admin,${domainSuffix}
  88     # NOTE: superuser password, generated with slappasswd -h "{SSHA}" -s "$password"
  89     #olcRootPW: {SSHA}COkATGNe7rs/g8vWcYP5rqt4u5sWdMgP
  90     #
  91     olcDbIndex: objectClass eq
  92     olcDbIndex: cn,uid eq
  93     olcDbIndex: uidNumber,gidNumber eq
  94     olcDbIndex: member,memberUid eq
  95     olcDbIndex: mail eq
  96     olcDbIndex: mailAlias eq
  97     olcDbIndex: mailEnabled eq
  98     #
  99     olcAccess: to attrs=userPassword
 100       by self write
 101       by anonymous auth
 102       by dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
 103       by * none
 104     olcAccess: to attrs=shadowLastChange
 105       by self write
 106       by dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
 107       by * none
 108     olcAccess: to dn.sub="ou=posix,${domainSuffix}"
 109       by self read
 110       by dn="gidNumber=${toString groups.nslcd.gid}+uidNumber=${toString users.nslcd.uid},cn=peercred,cn=external,cn=auth" read
 111       ${lib.optionalString (hasAttr postfix.user users) ''by dn="gidNumber=${toString groups.postfix.gid}+uidNumber=${toString users.postfix.uid},cn=peercred,cn=external,cn=auth" read''}
 112       ${lib.optionalString (hasAttr dovecot2.user users) ''by dn="gidNumber=${toString groups.dovecot2.gid}+uidNumber=${toString users.dovecot2.uid},cn=peercred,cn=external,cn=auth" read''}
 113       by dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
 114     olcAccess: to *
 115       by self read
 116       by * none
 117   '';
 118   data = ''
 119     dn: ${domainSuffix}
 120     objectClass: top
 121     objectClass: dcObject
 122     objectClass: organization
 123     o: ${domainOrg}
 124
 125     dn: cn=admin,${domainSuffix}
 126     objectClass: simpleSecurityObject
 127     objectClass: organizationalRole
 128     description: ${domainOrg} LDAP administrator
 129     roleOccupant: ${domainSuffix}
 130     userPassword:
 131
 132     dn: ou=posix,${domainSuffix}
 133     objectClass: top
 134     objectClass: organizationalUnit
 135
 136     dn: ou=accounts,ou=posix,${domainSuffix}
 137     objectClass: top
 138     objectClass: organizationalUnit
 139
 140     dn: ou=groups,ou=posix,${domainSuffix}
 141     objectClass: top
 142     objectClass: organizationalUnit
 143
 144     dn: cn=${domainGroup},ou=groups,ou=posix,${domainSuffix}
 145     objectClass: top
 146     objectClass: posixGroup
 147     gidNumber: 20000
 148     memberUid: julm
 149     memberUid: sevy
 150
 151   ''
 152   + lib.concatMapStrings posixAccount [ rec
 153     { uid = "julm";
 154       cn = "Julien Moutinho";
 155       sn = uid;
 156       uidNumber = users.julm.uid;
 157       gidNumber = groups.julm.gid;
 158       mailAlias = [ "julien.moutinho" ];
 159       userPassword = pass-chomp "members/julm/mail/hashedPassword";
 160       mailStorageDirectory =
 161         let stateDir = "/var/lib/dovecot";
 162             d=domain;
 163         in
 164         # I'm personnaly using "maildir:" instead of "sdbox:" to be able to use a local (neo)mutt on it,
 165         # bypassing IMAP because (neo)mutt support of IMAP is very bad
 166         # (can't even have a decent $folder_format (with %n or %m) working,
 167         # neither sorting them by date).
 168         "maildir:${stateDir}/mail/${d}/${uid}/mail.d:LAYOUT=maildir++:UTF-8:CONTROL=${stateDir}/control/${d}/${uid}:INDEX=${stateDir}/index/${d}/${uid}";
 169     }
 170     #{ uid="sevy"; uidNumber=10001; cn="Séverine Popek"; sn="sévy";
 171     #  mailAlias = ["severine.popek" "ouais-ouais"]; }
 172     #{ uid="nomail"; uidNumber=10002; mailAlias = ["noalias"]; mailEnabled = false; }
 173     #{ uid="post"; mailForwardingAddress = ["ju@${domain}"]; }
 174     #{ uid="host"; mailForwardingAddress = ["ju@${domain}"]; }
 175   ];
 176 };
 177 }