]> Git — Sourcephile - sourcephile-nix.git/blob - install/logical/friot/openldap/commonsoft.coop.nix
openldap: fix databases.default.
[sourcephile-nix.git] / install / logical / friot / openldap / commonsoft.coop.nix
1 {pkgs, lib, config, ...}:
2 let inherit (config) networking;
3 inherit (config.services) openldap;
4 inherit (config.users) users groups;
5 inherit (pkgs.lib) unlines;
6 domainSuffix = openldap.domainSuffix;
7 posixAccount =
8 { uid
9 , uidNumber ? null
10 , gidNumber ? uidNumber
11 , cn ? ""
12 , sn ? ""
13 , userPassword ? "{SSHA}dwqaKo5nmId8Bym5PghloK+UEndwrVTN"
14 , mailAlias ? []
15 , loginShell ? "/run/current-system/sw/bin/bash"
16 , mailEnabled ? true
17 , mailForwardingAddress ? []
18 , domain ? networking.domain
19 }: "\n" + lib.concatStringsSep "\n\n" [
20 (unlines ([ ''
21 dn: uid=${uid},ou=accounts,ou=posix,${domainSuffix}
22 objectClass: person
23 objectClass: posixAccount
24 objectClass: PostfixBookMailAccount
25 objectClass: PostfixBookMailForward
26 cn: ${cn}
27 sn: ${sn}
28 mail: ${uid}${lib.optionalString (networking.domain != "") "@${networking.domain}"}
29 mailEnabled: ${if mailEnabled then "TRUE" else "FALSE"}
30 #mailGroupMember: ${networking.domainBase}
31 homeDirectory: /home/${uid}
32 uidNumber: ${toString uidNumber}
33 gidNumber: ${toString gidNumber}
34 loginShell: ${loginShell}'' ]
35 ++ lib.optional (userPassword != "") "userPassword: ${userPassword}"
36 ++ map (forward: "mailForwardingAddress: ${forward}") mailForwardingAddress
37 ++ map (alias: "mailAlias: ${alias}@${networking.domain}") mailAlias
38 ++ lib.optional (mailAlias == []) "mailAlias:"
39 # NOTE: required by PostfixBookMailForward
40 ))
41 ''
42 dn: cn=${uid},ou=groups,ou=posix,${domainSuffix}
43 objectClass: top
44 objectClass: posixGroup
45 gidNumber: ${toString gidNumber}
46 memberUid: ${uid}
47 ''
48 ];
49 in
50 {
51 config = {
52 services.openldap = {
53 databases = {
54 "${domainSuffix}" = {
55 resetData = true;
56 conf = ''
57 # sudo ldapsearch -LLL -H ldapi:// -D cn=admin,cn=config -Y EXTERNAL -b 'olcDatabase={1}mdb,cn=config' -s sub
58 dn: olcBackend={1}mdb,cn=config
59 objectClass: olcBackendConfig
60
61 dn: olcDatabase={1}mdb,cn=config
62 objectClass: olcDatabaseConfig
63 objectClass: olcMdbConfig
64 # NOTE: checkpoint the database periodically in case of system failure
65 # and to speed slapd shutdown.
66 olcDbCheckpoint: 512 30
67 # Database max size is 1G
68 olcDbMaxSize: 1073741824
69 olcLastMod: TRUE
70 # NOTE: database superuser. Needed for syncrepl.
71 olcRootDN: cn=admin,${domainSuffix}
72 # NOTE: superuser password, generated with slappasswd -s SECRET
73 #olcRootPW: {SSHA}NONVwwKnKsCBmFxkMqTCFekdu3SJQHc9
74 #
75 olcDbIndex: objectClass eq
76 olcDbIndex: cn,uid eq
77 olcDbIndex: uidNumber,gidNumber eq
78 olcDbIndex: member,memberUid eq
79 olcDbIndex: mail eq
80 olcDbIndex: mailEnabled eq
81 #
82 olcAccess: to attrs=userPassword
83 by self write
84 by anonymous auth
85 by dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
86 by * none
87 olcAccess: to attrs=shadowLastChange
88 by self write
89 by * none
90 olcAccess: to dn.sub="ou=posix,${domainSuffix}"
91 by dn="gidNumber=${toString groups.nslcd.gid}+uidNumber=${toString users.nslcd.uid},cn=peercred,cn=external,cn=auth" read
92 by dn="gidNumber=${toString groups.postfix.gid}+uidNumber=${toString users.postfix.uid},cn=peercred,cn=external,cn=auth" read
93 by dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
94 # NOTE: dovecot/auth runs as root, hence the gidNumber=0+uidNumber=0
95 olcAccess: to *
96 by self read
97 by * none
98 '';
99 data = ''
100 dn: ${domainSuffix}
101 objectClass: top
102 objectClass: dcObject
103 objectClass: organization
104 o: ${networking.domainBase}
105
106 dn: cn=admin,${domainSuffix}
107 objectClass: simpleSecurityObject
108 objectClass: organizationalRole
109 description: ${networking.domainBase} LDAP administrator
110 roleOccupant: ${domainSuffix}
111 userPassword:
112 #userPassword: {SSHA}NONVwwKnKsCBmFxkMqTCFekdu3SJQHc9
113
114 dn: ou=posix,${domainSuffix}
115 objectClass: top
116 objectClass: organizationalUnit
117
118 dn: ou=accounts,ou=posix,${domainSuffix}
119 objectClass: top
120 objectClass: organizationalUnit
121
122 dn: ou=groups,ou=posix,${domainSuffix}
123 objectClass: top
124 objectClass: organizationalUnit
125
126 dn: cn=${networking.domainBase},ou=groups,ou=posix,${domainSuffix}
127 objectClass: top
128 objectClass: posixGroup
129 gidnumber: 20000
130 memberuid: ju
131 memberuid: sevy
132
133 ''
134 + lib.concatMapStrings posixAccount [
135 { uid="ju"; uidNumber=10000; cn="Julien M."; sn="julm"; mailAlias = ["juju"]; }
136 { uid="sevy"; uidNumber=10001; cn="Séverine P."; sn="sévy"; mailAlias = ["severine.popek" "ouais-ouais"]; }
137 { uid="nomail"; uidNumber=10002; mailAlias = ["noalias"]; mailEnabled = false; }
138 { uid="post"; domain="friot"; mailForwardingAddress = ["ju@commonsoft.coop"]; }
139 { uid="host"; mailForwardingAddress = ["ju@commonsoft.coop"]; }
140 ];
141 };
142 };
143 };
144 };
145 }