install/logical/friot/openldap.nix

   1 {pkgs, lib, config, ...}:
   2 let inherit (config.services) openldap;
   3     inherit (config.users) ldap;
   4     cnConfigLDIF = pkgs.writeText "cn=config.ldif" ''
   5       dn: cn=config
   6       cn: config
   7       objectClass: olcGlobal
   8       #olcPidFile: /run/slapd/slapd.pid
   9       # List of arguments that were passed to the server
  10       #olcArgsFile: /run/slapd/slapd.args
  11       # Read slapd-config(5) for possible values
  12       olcLogLevel: none
  13       # The tool-threads parameter sets the actual amount of cpu's that is used
  14       # for indexing.
  15       olcToolThreads: 1
  16
  17       dn: olcDatabase={-1}frontend,cn=config
  18       olcDatabase: {-1}frontend
  19       objectClass: olcDatabaseConfig
  20       objectClass: olcFrontendConfig
  21       # The maximum number of entries that is returned for a search operation
  22       olcSizeLimit: 500
  23       # Allow unlimited access to local connection from the local root user
  24       olcAccess: to *
  25         by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
  26         by * break
  27       # Allow unauthenticated read access for schema and base DN autodiscovery
  28       olcAccess: to dn.exact=""
  29         by * read
  30       olcAccess: to dn.base="cn=Subschema"
  31         by * read
  32
  33       dn: olcDatabase=config,cn=config
  34       olcDatabase: config
  35       objectClass: olcDatabaseConfig
  36       olcRootDN: cn=admin,cn=config
  37       # Access to cn=config, system root can be manager
  38       # with SASL mechanism (-Y EXTERNAL) over unix socket (-H ldapi://)
  39       olcAccess: to *
  40         by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
  41         by * break
  42
  43       dn: cn=schema,cn=config
  44       cn: schema
  45       objectClass: olcSchemaConfig
  46
  47       include: file://${pkgs.openldap}/etc/schema/core.ldif
  48       include: file://${pkgs.openldap}/etc/schema/cosine.ldif
  49       include: file://${pkgs.openldap}/etc/schema/nis.ldif
  50       include: file://${pkgs.openldap}/etc/schema/inetorgperson.ldif
  51
  52       dn: cn=module{0},cn=config
  53       cn: module{0}
  54       objectClass: olcModuleList
  55       # Where the dynamically loaded modules are stored
  56       #olcModulePath: /usr/lib/ldap
  57       olcModuleLoad: back_mdb
  58
  59       dn: olcBackend={1}mdb,cn=config
  60       olcBackend: {1}mdb
  61       objectClass: olcBackendConfig
  62
  63       include: file://${mdb1Config}
  64     '';
  65     mdb1Suffix = "dc=${config.networking.baseName}";
  66     mdb1Config = pkgs.writeText "${mdb1Suffix}.config.ldif" ''
  67       # sudo ldapsearch -LLL -D cn=admin,cn=config -Y EXTERNAL -b 'olcDatabase={1}mdb,cn=config' -s sub
  68       dn: olcDatabase={1}mdb,cn=config
  69       olcDatabase: {1}mdb
  70       objectClass: olcDatabaseConfig
  71       objectClass: olcMdbConfig
  72       # Checkpoint the database periodically in case of system
  73       # failure and to speed slapd shutdown.
  74       olcDbCheckpoint: 512 30
  75       # Database max size is 1G
  76       olcDbMaxSize: 1073741824
  77       olcLastMod: TRUE
  78       olcSuffix: ${mdb1Suffix}
  79       olcDbDirectory: ${openldap.dataDir}
  80       # Database superuser. Needed for syncrepl.
  81       olcRootDN: cn=admin,${mdb1Suffix}
  82       # superuser password, generated with slappasswd -s SECRET
  83       # olcRootPW: {SSHA}VUlLVeNl3IKltfX50f/PokMRnlhRsSDI
  84       olcDbIndex: objectClass eq
  85       olcDbIndex: cn,uid eq
  86       olcDbIndex: uidNumber,gidNumber eq
  87       olcDbIndex: member,memberUid eq
  88       olcAccess: to attrs=userPassword
  89         by self write
  90         by anonymous auth
  91         by * none
  92       olcAccess: to attrs=shadowLastChange
  93         by self write
  94         by * none
  95       olcAccess: to dn.sub="ou=posix,${mdb1Suffix}"
  96         by dn="gidNumber=${toString config.users.groups.nslcd.gid}+uidNumber=${toString config.users.users.nslcd.uid},cn=peercred,cn=external,cn=auth" manage
  97       olcAccess: to *
  98         by self read
  99         by * none
 100     '';
 101     mdb1LDIF = pkgs.writeText "${mdb1Suffix}.ldif" ''
 102       dn: ${mdb1Suffix}
 103       dc: ${config.networking.baseName}
 104       objectClass: top
 105       objectClass: dcObject
 106       objectClass: organization
 107       o: Commonsoft
 108
 109       dn: cn=admin,${mdb1Suffix}
 110       cn: admin
 111       objectClass: simpleSecurityObject
 112       objectClass: organizationalRole
 113       description: ${config.networking.baseName} LDAP administrator
 114       roleOccupant: ${mdb1Suffix}
 115       userPassword:
 116
 117       dn: ou=posix,${mdb1Suffix}
 118       ou: posix
 119       objectClass: top
 120       objectClass: organizationalUnit
 121
 122       dn: ou=accounts,ou=posix,${mdb1Suffix}
 123       ou: accounts
 124       objectClass: top
 125       objectClass: organizationalUnit
 126
 127       dn: ou=groups,ou=posix,${mdb1Suffix}
 128       ou: groups
 129       objectClass: top
 130       objectClass: organizationalUnit
 131
 132       dn: cn=users,ou=groups,ou=posix,${mdb1Suffix}
 133       cn: users
 134       objectclass: top
 135       objectclass: posixGroup
 136       gidnumber: 10000
 137       memberuid: julm
 138       memberuid: sevy
 139
 140       dn: uid=julm,ou=accounts,ou=posix,${mdb1Suffix}
 141       uid: julm
 142       objectClass: account
 143       objectClass: posixAccount
 144       cn: Julien M.
 145       uidNumber: 10000
 146       gidNumber: 10000
 147       homeDirectory: /home/julm
 148       loginShell: /run/current-system/sw/bin/bash
 149       userPassword: {SSHA}144Rfau9KJ14U0U4KdLNB7OrtpiEc3E3
 150
 151       dn: uid=sevy,ou=accounts,ou=posix,${mdb1Suffix}
 152       uid: sevy
 153       objectClass: account
 154       objectClass: posixAccount
 155       cn: Séverine P.
 156       uidNumber: 10001
 157       gidNumber: 10000
 158       homeDirectory: /home/sevy
 159       loginShell: /run/current-system/sw/bin/bash
 160       userPassword: {SSHA}dwqaKo5nmId8Bym5PghloK+UEndwrVTN
 161     '';
 162 in
 163 {
 164   config = {
 165     users.ldap = {
 166       enable = true;
 167       # FIXME: even with the correct LD_LIBRARY_PATH to libnss_ldap.so,
 168       #        passwd still does not work on LDAP accounts.
 169       daemon = {
 170         enable = true;
 171         extraConfig = ''
 172           sasl_mech EXTERNAL
 173         '';
 174       };
 175       server = "ldapi:///";
 176       base = "ou=posix,${mdb1Suffix}";
 177       bind = {
 178         #distinguishedName = "cn=admin,${mdb1Suffix}";
 179       };
 180     };
 181     services.openldap = {
 182       enable    = true;
 183       dataDir   = "/var/db/ldap";
 184       configDir = "/var/db/slapd";
 185       urlList   = [ "ldapi:///" ]; # UNIX socket
 186     };
 187     systemd.services.openldap = {
 188       preStart = ''
 189         # NOTE: the config is always re-initialized.
 190         rm -rf "${openldap.configDir}"/cn=config \
 191                "${openldap.configDir}"/cn=config.ldif
 192         umask 0077
 193         install -D -d -m 0700 \
 194          -o "${openldap.user}" \
 195          -g "${openldap.group}" \
 196          "${openldap.dataDir}" \
 197          "${openldap.configDir}"
 198
 199         # NOTE: slapd is stopped in preStart, slap* commands can therefore be used.
 200         ${pkgs.openldap}/bin/slapadd -n 0 -F "${openldap.configDir}" -l ${cnConfigLDIF}
 201         # NOTE: slapadd(8): To populate the config database slapd-config(5),
 202         #                   use -n 0 as it is always the first database.
 203         #                   It must physically exist on the filesystem prior to this, however.
 204
 205         # NOTE: the data are only initialized, never re-initialized.
 206         if test ! -e "${openldap.dataDir}"/data.mdb
 207          then
 208           ${pkgs.openldap}/bin/slapadd -F "${openldap.configDir}" -l ${mdb1LDIF}
 209          fi
 210         chown -R "${openldap.user}:${openldap.group}" \
 211          "${openldap.dataDir}" \
 212          "${openldap.configDir}"
 213       '';
 214     };
 215   };
 216 }