]> Git — Sourcephile - sourcephile-nix.git/blob - install/logical/friot/openldap.nix
nsf: try to limit hardcoding.
[sourcephile-nix.git] / install / logical / friot / openldap.nix
1 {pkgs, lib, config, ...}:
2 let inherit (builtins) baseNameOf readFile;
3 inherit (lib) types;
4 inherit (pkgs.lib) unlinesAttrs;
5 inherit (config.services) openldap;
6 inherit (config.users) ldap;
7 copyFile = file: pkgs.writeText (baseNameOf file) (readFile file);
8 configLDIF = pkgs.writeText "cn=config.ldif" (''
9 dn: cn=config
10 objectClass: olcGlobal
11 #olcPidFile: /run/slapd/slapd.pid
12 # List of arguments that were passed to the server
13 #olcArgsFile: /run/slapd/slapd.args
14 # Read slapd-config(5) for possible values
15 olcLogLevel: none
16 # The tool-threads parameter sets the actual amount of cpu's
17 # that is used for indexing.
18 olcToolThreads: 1
19
20 dn: olcDatabase={-1}frontend,cn=config
21 objectClass: olcDatabaseConfig
22 objectClass: olcFrontendConfig
23 # The maximum number of entries that is returned for a search operation
24 olcSizeLimit: 500
25 # Allow unlimited access to local connection from the local root user
26 olcAccess: to *
27 by dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth manage
28 by * break
29 # Allow unauthenticated read access for schema and base DN autodiscovery
30 olcAccess: to dn.exact=""
31 by * read
32 olcAccess: to dn.base="cn=Subschema"
33 by * read
34
35 dn: olcDatabase=config,cn=config
36 objectClass: olcDatabaseConfig
37 olcRootDN: cn=admin,cn=config
38 # Access to cn=config, system root can be manager
39 # with SASL mechanism (-Y EXTERNAL) over unix socket (-H ldapi://)
40 olcAccess: to *
41 by dn.exact="gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" manage
42 by * break
43
44 dn: cn=schema,cn=config
45 objectClass: olcSchemaConfig
46
47 include: file://${pkgs.openldap}/etc/schema/core.ldif
48 include: file://${pkgs.openldap}/etc/schema/cosine.ldif
49 include: file://${pkgs.openldap}/etc/schema/nis.ldif
50 include: file://${pkgs.openldap}/etc/schema/inetorgperson.ldif
51 include: file://${copyFile openldap/schema/postfix-book.ldif}
52 include: file://${copyFile openldap/schema/postfix2.ldif}
53
54 dn: cn=module{0},cn=config
55 objectClass: olcModuleList
56 # Where the dynamically loaded modules are stored
57 #olcModulePath: /usr/lib/ldap
58 olcModuleLoad: back_mdb
59
60 '' + unlinesAttrs (olcSuffix: {conf, olcDbDirectory, ...}:
61 "include: file://" + pkgs.writeText "config.ldif" (conf + ''
62 olcSuffix: ${olcSuffix}
63 olcDbDirectory: ${olcDbDirectory}
64 '')
65 ) openldap.databases);
66 in
67 {
68 imports = [
69 openldap/commonsoft.coop.nix
70 ];
71 options.services.openldap.domainSuffix = lib.mkOption {
72 type = types.str;
73 default = "dc=${lib.concatStringsSep ",dc=" (lib.splitString "." config.networking.domain)}";
74 description = ''
75 LDAP suffix for config.networking.domain.
76 '';
77 };
78 options.services.openldap.databases = lib.mkOption {
79 type = types.attrsOf (types.submodule ({name, options, config, ...}: {
80 options = {
81 conf = lib.mkOption {
82 type = types.lines;
83 description = "The database's config in LDIF.";
84 };
85 data = lib.mkOption {
86 type = types.lines;
87 description = "The database's data in LDIF.";
88 };
89 olcDbDirectory = lib.mkOption {
90 type = types.str;
91 description = "The directory where the database is stored.";
92 default = "${openldap.dataDir}/${name}";
93 };
94 resetData = lib.mkOption {
95 type = types.bool;
96 description = "Whether to reset the data at each start of the slapd service.";
97 default = false;
98 };
99 };
100 }));
101 };
102 config = {
103 users.ldap = {
104 enable = true;
105 # FIXME: even with the correct LD_LIBRARY_PATH to libnss_ldap.so,
106 # passwd still does not work on LDAP accounts.
107 daemon = {
108 enable = true;
109 extraConfig = ''
110 sasl_mech EXTERNAL
111 '';
112 };
113 server = "ldapi:///";
114 base = "ou=posix,${openldap.domainSuffix}";
115 bind = {
116 #distinguishedName = "cn=admin,${openldap.domainSuffix}";
117 };
118 };
119 services.openldap = {
120 enable = true;
121 dataDir = "/var/db/ldap";
122 configDir = "/var/db/slapd";
123 urlList = [ "ldapi:///" ]; # UNIX socket
124 };
125 systemd.services.openldap = {
126 preStart = ''
127 # NOTE: slapd's config is always re-initialized.
128 rm -rf "${openldap.configDir}"/cn=config \
129 "${openldap.configDir}"/cn=config.ldif
130 install -D -d -m 0700 -o "${openldap.user}" -g "${openldap.group}" "${openldap.configDir}"
131 # NOTE: olcDbDirectory must be created before adding the config.
132 '' +
133 unlinesAttrs (olcSuffix: {data, olcDbDirectory, resetData, ...}:
134 lib.optionalString resetData ''
135 rm -rf "${olcDbDirectory}"
136 '' + ''
137 install -D -d -m 0700 -o "${openldap.user}" -g "${openldap.group}" "${olcDbDirectory}"
138 '') openldap.databases
139 + ''
140 # NOTE: slapd is supposed to be stopped while in preStart,
141 # hence slap* commands can safely be used.
142 umask 0077
143 ${pkgs.openldap}/bin/slapadd -n 0 \
144 -F "${openldap.configDir}" \
145 -l ${configLDIF}
146 chown -R "${openldap.user}:${openldap.group}" "${openldap.configDir}"
147 # NOTE: slapadd(8): To populate the config database slapd-config(5),
148 # use -n 0 as it is always the first database.
149 # It must physically exist on the filesystem prior to this, however.
150 '' +
151 unlinesAttrs (olcSuffix: {data, olcDbDirectory, resetData, ...}:
152 lib.optionalString resetData ''
153 ${pkgs.openldap}/bin/slapadd \
154 -F "${openldap.configDir}" \
155 -l ${pkgs.writeText "data.ldif" data}
156 '' + ''
157 test ! -e "${olcDbDirectory}" ||
158 chown -R "${openldap.user}:${openldap.group}" "${olcDbDirectory}"
159 '') openldap.databases;
160 };
161 };
162 }