machines/mermet/openldap/sourcephile.fr.nix

   1 { flakes, pkgs, lib, config, ... }:
   2 let
   3   inherit (builtins) hasAttr;
   4   inherit (config) networking;
   5   inherit (config.services) openldap postfix dovecot2;
   6   inherit (config.users) users groups;
   7   inherit (pkgs.lib) unlines;
   8   domain = "sourcephile.fr";
   9   domainGroup = "sourcephile";
  10   domainOrg = "sourcephile";
  11   domainSuffix = "dc=" + lib.concatStringsSep ",dc=" (lib.splitString "." domain);
  12   posixAccount = pkgs.callPackage (import ./posixAccount.nix) { inherit domain domainSuffix domainGroup; };
  13 in
  14 {
  15 users.groups."${domainGroup}" = {
  16   gid = 20000;
  17   members = [users."julm".name];
  18 };
  19 # DEBUG: echo "$(nixops show-option mermet -d production services.openldap.databases."g".data)"
  20 services.openldap.databases."${domainSuffix}" = {
  21   # DEBUG: sudo ldapsearch -LLL -H ldapi:// -D cn=admin,cn=config -Y EXTERNAL -b 'olcDatabase={1}mdb,cn=config' -s sub
  22   # WARNING: newlines matter
  23   conf = ''
  24     dn: olcDatabase=mdb,cn=config
  25     objectClass: olcDatabaseConfig
  26     objectClass: olcMdbConfig
  27     # Checkpoint the database periodically in case of system failure
  28     # and to speed up slapd shutdown.
  29     olcDbCheckpoint: 512 30
  30     # Database max size is 1G
  31     olcDbMaxSize: 1073741824
  32     olcLastMod: TRUE
  33     # Database superuser. Needed for syncrepl.
  34     olcRootDN: cn=admin,${domainSuffix}
  35     # Superuser password, generated with slappasswd -h "{SSHA}"
  36     # Commented-out because SASL EXTERNAL mechanism is used.
  37     #olcRootPW: {SSHA}COkATGNe7rs/g8vWcYP5rqt4u5sWdMgP
  38     #
  39     olcDbIndex: objectClass eq
  40     olcDbIndex: cn,uid eq
  41     olcDbIndex: uidNumber,gidNumber eq
  42     olcDbIndex: member,memberUid eq
  43     olcDbIndex: mail eq
  44     olcDbIndex: mailAlias eq
  45     olcDbIndex: mailEnabled eq
  46     #
  47     olcAccess: to attrs=userPassword
  48       by self write
  49       by anonymous auth
  50       by dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
  51       by * none
  52     olcAccess: to attrs=shadowLastChange
  53       by self write
  54       by dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" write
  55       by * none
  56     olcAccess: to dn.sub="ou=posix,${domainSuffix}"
  57       by self read
  58       ${lib.optionalString (hasAttr postfix.user users) ''by dn="gidNumber=${toString groups.postfix.gid}+uidNumber=${toString users.postfix.uid},cn=peercred,cn=external,cn=auth" read''}
  59       ${lib.optionalString (hasAttr dovecot2.user users) ''by dn="gidNumber=${toString groups.dovecot2.gid}+uidNumber=${toString users.dovecot2.uid},cn=peercred,cn=external,cn=auth" read''}
  60       by dn="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" read
  61     olcAccess: to *
  62       by self read
  63       by * none
  64   '';
  65   data = ''
  66     dn: ${domainSuffix}
  67     objectClass: top
  68     objectClass: dcObject
  69     objectClass: organization
  70     o: ${domainOrg}
  71
  72     dn: cn=admin,${domainSuffix}
  73     objectClass: simpleSecurityObject
  74     objectClass: organizationalRole
  75     description: ${domainOrg} LDAP administrator
  76     roleOccupant: ${domainSuffix}
  77     userPassword:
  78
  79     dn: ou=posix,${domainSuffix}
  80     objectClass: top
  81     objectClass: organizationalUnit
  82
  83     dn: ou=accounts,ou=posix,${domainSuffix}
  84     objectClass: top
  85     objectClass: organizationalUnit
  86
  87     dn: ou=groups,ou=posix,${domainSuffix}
  88     objectClass: top
  89     objectClass: organizationalUnit
  90
  91   ''
  92 /*
  93     dn: cn=${domainGroup},ou=groups,ou=posix,${domainSuffix}
  94     objectClass: top
  95     objectClass: posixGroup
  96     gidNumber: 20000
  97     memberUid: julm
  98
  99     dn: cn=autogeree,ou=groups,ou=posix,${domainSuffix}
 100     objectClass: top
 101     objectClass: posixGroup
 102     gidNumber: 20001
 103     memberUid: julm
 104 */
 105   + lib.concatMapStrings posixAccount [ rec
 106     { uid = "julm";
 107       cn = "Julien Moutinho";
 108       sn = uid;
 109       uidNumber = users."julm".uid;
 110       gidNumber = groups."users".gid;
 111       mailAlias = [ "julien.moutinho" ];
 112       userPassword = builtins.readFile (flakes.secrets + "/members/mail/julm/hashedPassword");
 113       mailHomeDirectory = "/home/${uid}/mail/${domain}";
 114       mailStorageDirectory =
 115         let stateDir = "/var/lib/dovecot"; in
 116         # I'm personnaly using "maildir:" instead of "sdbox:" to be able to use a local (neo)mutt on it,
 117         # bypassing IMAP because (neo)mutt support of IMAP is very bad
 118         # (can't even have a decent $folder_format (with %n or %m) working,
 119         # neither sorting them by date).
 120         # WARNING: regarding the atomicity of backuping,
 121         # it's not a good idea to put the mails
 122         # and the index/control on different ZFS datasets like here.
 123         "maildir:/home/${uid}/mail/${domain}/mail:LAYOUT=maildir++:UTF-8:CONTROL=${stateDir}/control/${domain}/${uid}:INDEX=${stateDir}/index/${domain}/${uid}";
 124     }
 125   ];
 126 };
 127 }