]> Git — Sourcephile - sourcephile-nix.git/blob - servers/mermet/openldap.nix
mermet: add dovecot
[sourcephile-nix.git] / servers / mermet / openldap.nix
1 { pkgs, lib, config, ... }:
2 let inherit (builtins) baseNameOf readFile;
3 inherit (lib) types;
4 inherit (pkgs.lib) unlinesAttrs;
5 inherit (config.services) openldap;
6 inherit (config.users) ldap;
7 in
8 {
9 imports = [
10 openldap/sourcephile.nix
11 ];
12 config = {
13 users.ldap = {
14 enable = true;
15 server = "ldapi:///";
16 base = "ou=posix,${openldap.domainSuffix}";
17 bind = {
18 #distinguishedName = "cn=admin,${openldap.domainSuffix}";
19 };
20 daemon = {
21 enable = true;
22 extraConfig = ''
23 sasl_mech EXTERNAL
24 # NOTE: nslcd cannot use SASL to bind to rootpwmoddn
25 # which is the DN used by nslcd when passwd is run by root
26 # to change the userPassword of an LDAP user.
27 # SEE: https://www.reddit.com/r/linuxadmin/comments/53sxpl/how_do_i_configure_nslcd_to_use_a_sasl_external/d7w9awd/
28 # Thus, use: ldappasswd -H ldapi:// -Y EXTERNAL uid=$SomeUID,ou=accounts,ou=posix,dc=sourcephile,dc=fr
29
30 deref never
31 log syslog debug
32 '';
33 };
34 };
35 services.openldap = {
36 enable = true;
37 dataDir = "/var/db/ldap";
38 configDir = "/var/db/slapd";
39 urlList = [ "ldapi:///" ]; # UNIX socket
40 };
41 };
42 }