diff options
author | sefidel <contact@sefidel.net> | 2023-03-29 20:54:19 +0900 |
---|---|---|
committer | sefidel <contact@sefidel.net> | 2023-04-03 18:32:29 +0900 |
commit | ce06f43476863da90dc60dcee606d2b6c5a89a8e (patch) | |
tree | 5d14946330cb09ff0ebd97bee59407fccee4d860 /modules/services/ldap.nix | |
download | infra-ce06f43476863da90dc60dcee606d2b6c5a89a8e.tar.gz infra-ce06f43476863da90dc60dcee606d2b6c5a89a8e.zip |
project: initial commit
Diffstat (limited to 'modules/services/ldap.nix')
-rw-r--r-- | modules/services/ldap.nix | 76 |
1 files changed, 76 insertions, 0 deletions
diff --git a/modules/services/ldap.nix b/modules/services/ldap.nix new file mode 100644 index 0000000..ba19761 --- /dev/null +++ b/modules/services/ldap.nix @@ -0,0 +1,76 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + cfg = config.modules.services.ldap; +in +{ + options.modules.services.ldap = { + enable = mkEnableOption "OpenLDAP server"; + package = mkOption { type = types.package; default = pkgs.openldap; }; + dc = mkOption { type = types.str; }; + tld = mkOption { type = types.str; }; + tls.acmeHost = mkOption { type = types.str; default = "${cfg.dc}.${cfg.tld}"; }; + secrets.rootPass = mkOption { type = types.str; description = "path to the root password file"; }; + }; + + config = mkIf cfg.enable { + services.openldap = { + enable = true; + + urlList = [ "ldap:///" "ldaps:///" ]; + + settings = { + attrs = { + olcLogLevel = "conns config"; + + olcTLSCACertificateFile = "${config.security.acme.certs.${cfg.tls.acmeHost}.directory}/full.pem"; + olcTLSCertificateFile = "${config.security.acme.certs.${cfg.tls.acmeHost}.directory}/cert.pem"; + olcTLSCertificateKeyFile = "${config.security.acme.certs.${cfg.tls.acmeHost}.directory}/key.pem"; + olcTLSCipherSuite = "HIGH:MEDIUM:+3DES:+RC4:+aNULL"; + olcTLSCRLCheck = "none"; + olcTLSVerifyClient = "never"; + olcTLSProtocolMin = "3.1"; + }; + + children = { + "cn=schema".includes = [ + "${cfg.package}/etc/schema/core.ldif" + "${cfg.package}/etc/schema/cosine.ldif" + "${cfg.package}/etc/schema/inetorgperson.ldif" + ]; + + "olcDatabase={1}mdb".attrs = { + objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ]; + + olcDatabase = "{1}mdb"; + olcDbDirectory = "/var/lib/openldap/data"; + + olcSuffix = "dc=${cfg.dc},dc=${cfg.tld}"; + + olcRootDN = "cn=admin,dc=${cfg.dc},dc=${cfg.tld}"; + olcRootPW.path = cfg.secrets.rootPass; + + olcAccess = [ + # ''{0}to <changeme> + # by <changeme>'' + + ''{0}to * + by * none'' # Should be changed to {1} + ]; + }; + }; + }; + }; + + systemd.services.openldap = { + after = [ "acme-finished-${cfg.tls.acmeHost}.target" ]; + }; + + users.groups.acme.members = [ "openldap" ]; + + environment.persistence."/persist".directories = [ + "/var/lib/openldap" + ]; + }; +} |