install/logical/friot/openldap.nix

   1 {pkgs, lib, config, ...}:
   2 let inherit (builtins) baseNameOf readFile;
   3     inherit (lib) types;
   4     inherit (pkgs.lib) unlinesAttrs;
   5     inherit (config.services) openldap;
   6     inherit (config.users) ldap;
   7     copyFile = file: pkgs.writeText (baseNameOf file) (readFile file);
   8     configLDIF = pkgs.writeText "cn=config.ldif" (''
   9       dn: cn=config
  10       objectClass: olcGlobal
  11       #olcPidFile: /run/slapd/slapd.pid
  12       # List of arguments that were passed to the server
  13       #olcArgsFile: /run/slapd/slapd.args
  14       # Read slapd-config(5) for possible values
  15       olcLogLevel: none
  16       # The tool-threads parameter sets the actual amount of CPU's
  17       # that is used for indexing.
  18       olcToolThreads: 1
  19
  20       dn: olcDatabase={-1}frontend,cn=config
  21       objectClass: olcDatabaseConfig
  22       objectClass: olcFrontendConfig
  23       # The maximum number of entries that is returned for a search operation
  24       olcSizeLimit: 500
  25       # Allow unlimited access to local connection from the local root user
  26       olcAccess: to *
  27         by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
  28         by * break
  29       # Allow unauthenticated read access for schema and base DN autodiscovery
  30       olcAccess: to dn.exact=""
  31         by * read
  32       olcAccess: to dn.base="cn=Subschema"
  33         by * read
  34
  35       dn: olcDatabase=config,cn=config
  36       objectClass: olcDatabaseConfig
  37       olcRootDN: cn=admin,cn=config
  38       # Access to cn=config, system root can be manager
  39       # with SASL mechanism (-Y EXTERNAL) over unix socket (-H ldapi://)
  40       olcAccess: to *
  41         by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
  42         by * break
  43
  44       dn: cn=schema,cn=config
  45       objectClass: olcSchemaConfig
  46
  47       include: file://${pkgs.openldap}/etc/schema/core.ldif
  48       include: file://${pkgs.openldap}/etc/schema/cosine.ldif
  49       include: file://${pkgs.openldap}/etc/schema/nis.ldif
  50       include: file://${pkgs.openldap}/etc/schema/inetorgperson.ldif
  51       include: file://${copyFile openldap/schema/postfix-book.ldif}
  52
  53       dn: cn=module{0},cn=config
  54       objectClass: olcModuleList
  55       # Where the dynamically loaded modules are stored
  56       #olcModulePath: /usr/lib/ldap
  57       olcModuleLoad: back_mdb
  58
  59     '' + unlinesAttrs (olcSuffix: {conf, olcDbDirectory, ...}:
  60       "include: file://" + pkgs.writeText "config.ldif" (conf + ''
  61         olcSuffix: ${olcSuffix}
  62         olcDbDirectory: ${olcDbDirectory}
  63       '')
  64     ) openldap.databases);
  65 in
  66 {
  67   imports = [
  68     openldap/commonsoft.coop.nix
  69   ];
  70   options = {
  71     services.openldap.domainSuffix = lib.mkOption {
  72       type    = types.str;
  73       default = "dc=${lib.concatStringsSep ",dc=" (lib.splitString "." config.networking.domain)}";
  74       description = ''
  75         LDAP suffix for config.networking.domain.
  76       '';
  77     };
  78     services.openldap.databases = lib.mkOption {
  79       type = types.attrsOf (types.submodule ({name, options, config, ...}: {
  80         options = {
  81           conf = lib.mkOption {
  82             type = types.lines;
  83             description = "The database's config in LDIF.";
  84           };
  85           data = lib.mkOption {
  86             type = types.lines;
  87             description = "The database's data in LDIF.";
  88           };
  89           olcDbDirectory = lib.mkOption {
  90             type = types.str;
  91             description = "The directory where the database is stored.";
  92             default = "${openldap.dataDir}/${name}";
  93           };
  94           resetData = lib.mkOption {
  95             type = types.bool;
  96             description = "Whether to reset the data at each start of the slapd service.";
  97             default = false;
  98           };
  99         };
 100       }));
 101     };
 102   };
 103   config = {
 104     users.ldap = {
 105       enable = true;
 106       # FIXME: even with the correct LD_LIBRARY_PATH to libnss_ldap.so,
 107       #        passwd still does not work on LDAP accounts.
 108       daemon = {
 109         enable = true;
 110         extraConfig = ''
 111           sasl_mech EXTERNAL
 112         '';
 113       };
 114       server = "ldapi:///";
 115       base = "ou=posix,${openldap.domainSuffix}";
 116       bind = {
 117         #distinguishedName = "cn=admin,${openldap.domainSuffix}";
 118       };
 119     };
 120     services.openldap = {
 121       enable    = true;
 122       dataDir   = "/var/db/ldap";
 123       configDir = "/var/db/slapd";
 124       urlList   = [ "ldapi:///" ]; # UNIX socket
 125     };
 126     systemd.services.openldap = {
 127       preStart = ''
 128           # NOTE: slapd's config is always re-initialized.
 129           rm -rf "${openldap.configDir}"/cn=config \
 130                  "${openldap.configDir}"/cn=config.ldif
 131           install -D -d -m 0700 -o "${openldap.user}" -g "${openldap.group}" "${openldap.configDir}"
 132           # NOTE: olcDbDirectory must be created before adding the config.
 133           '' +
 134           unlinesAttrs (olcSuffix: {data, olcDbDirectory, resetData, ...}:
 135             lib.optionalString resetData ''
 136               rm -rf "${olcDbDirectory}"
 137             '' + ''
 138             install -D -d -m 0700 -o "${openldap.user}" -g "${openldap.group}" "${olcDbDirectory}"
 139             '') openldap.databases
 140           + ''
 141           # NOTE: slapd is supposed to be stopped while in preStart,
 142           #       hence slap* commands can safely be used.
 143           umask 0077
 144           ${pkgs.openldap}/bin/slapadd -n 0 \
 145            -F "${openldap.configDir}" \
 146            -l ${configLDIF}
 147           chown -R "${openldap.user}:${openldap.group}" "${openldap.configDir}"
 148           # NOTE: slapadd(8): To populate the config database slapd-config(5),
 149           #                   use -n 0 as it is always the first database.
 150           #                   It must physically exist on the filesystem prior to this, however.
 151         '' +
 152         unlinesAttrs (olcSuffix: {data, olcDbDirectory, resetData, ...}:
 153           lib.optionalString resetData ''
 154             ${pkgs.openldap}/bin/slapadd \
 155              -F "${openldap.configDir}" \
 156              -l ${pkgs.writeText "data.ldif" data}
 157           '' + ''
 158           test ! -e "${olcDbDirectory}" ||
 159           chown -R "${openldap.user}:${openldap.group}" "${olcDbDirectory}"
 160         '') openldap.databases;
 161     };
 162   };
 163 }