servers/mermet/openldap.nix

   1 { pkgs, lib, config, ... }:
   2 let inherit (builtins) baseNameOf readFile;
   3     inherit (lib) types;
   4     inherit (pkgs.lib) unlinesAttrs;
   5     inherit (config.services) openldap;
   6     inherit (config.users) ldap;
   7 in
   8 {
   9   imports = [
  10     openldap/sourcephile.nix
  11   ];
  12   config = {
  13     users.ldap = {
  14       enable = true;
  15       server = "ldapi:///";
  16       base = "ou=posix,${openldap.domainSuffix}";
  17       bind = {
  18         #distinguishedName = "cn=admin,${openldap.domainSuffix}";
  19       };
  20       daemon = {
  21         enable = true;
  22         extraConfig = ''
  23           sasl_mech EXTERNAL
  24           # NOTE: nslcd cannot use SASL to bind to rootpwmoddn
  25           # which is the DN used by nslcd when passwd is run by root
  26           # to change the userPassword of an LDAP user.
  27           # SEE: https://www.reddit.com/r/linuxadmin/comments/53sxpl/how_do_i_configure_nslcd_to_use_a_sasl_external/d7w9awd/
  28           # Thus, use: ldappasswd -H ldapi:// -Y EXTERNAL uid=$SomeUID,ou=accounts,ou=posix,dc=sourcephile,dc=fr
  29
  30           deref never
  31           log syslog debug
  32         '';
  33       };
  34     };
  35     services.openldap = {
  36       enable    = true;
  37       dataDir   = "/var/db/ldap";
  38       configDir = "/var/db/slapd";
  39       urlList   = [ "ldapi:///" ]; # UNIX socket
  40     };
  41   };
  42 }