46b136c22e
Use the new module settings which apply configuration in cn=config instead of slapd.conf. The module performed this update via lib.mkChangedModuleOption, I've applied the transformations contained therein manually. Note that some of the settings were already in place, which means that the `suffix` and `database` options seemingly disappear into the void. Fixes b/105. Change-Id: I8a968c1eb8cb7827618cb732cdb46006a5d011f9 Reviewed-on: https://cl.tvl.fyi/c/depot/+/3157 Tested-by: BuildkiteCI Reviewed-by: sterni <sternenseemann@systemli.org>
91 lines
2.5 KiB
Nix
91 lines
2.5 KiB
Nix
# Configures an OpenLDAP instance for TVL
|
|
#
|
|
# TODO(tazjin): Configure ldaps://
|
|
{ depot, lib, pkgs, ... }:
|
|
|
|
with depot.nix.yants;
|
|
|
|
let
|
|
user = struct {
|
|
username = string;
|
|
email = string;
|
|
password = string;
|
|
displayName = option string;
|
|
};
|
|
|
|
toLdif = defun [ user string ] (u: ''
|
|
dn: cn=${u.username},ou=users,dc=tvl,dc=fyi
|
|
objectClass: organizationalPerson
|
|
objectClass: inetOrgPerson
|
|
sn: ${u.username}
|
|
cn: ${u.username}
|
|
displayName: ${u.displayName or u.username}
|
|
mail: ${u.email}
|
|
userPassword: ${u.password}
|
|
'');
|
|
|
|
inherit (depot.ops) users;
|
|
|
|
in {
|
|
# Use our patched OpenLDAP derivation which enables stronger password hashing.
|
|
#
|
|
# Unfortunately the module for OpenLDAP has no package option, so we
|
|
# need to override it system-wide. Be aware that this triggers a
|
|
# *large* number of rebuilds of packages such as GPG and Python.
|
|
nixpkgs.overlays = [
|
|
(_: _: {
|
|
inherit (depot.third_party) openldap;
|
|
})
|
|
];
|
|
|
|
services.openldap = {
|
|
enable = true;
|
|
|
|
settings.children = {
|
|
"olcDatabase={1}mdb".attrs = {
|
|
objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
|
|
olcDatabase = "{1}mdb";
|
|
olcDbDirectory = "/var/lib/openldap";
|
|
olcSuffix = "dc=tvl,dc=fyi";
|
|
olcAccess = "to * by * read";
|
|
olcRootDN = "cn=admin,dc=tvl,dc=fyi";
|
|
olcRootPW = "{ARGON2}$argon2id$v=19$m=65536,t=2,p=1$OfcgkOQ96VQ3aJj7NfA9vQ$oS6HQOkYl/bUYg4SejpltQYy7kvqx/RUxvoR4zo1vXU";
|
|
};
|
|
|
|
"cn=module{0}".attrs = {
|
|
objectClass = "olcModuleList";
|
|
olcModuleLoad = "pw-argon2";
|
|
};
|
|
|
|
"cn=schema".includes =
|
|
map (schema: "${depot.third_party.openldap}/etc/schema/${schema}.ldif")
|
|
[ "core" "cosine" "inetorgperson" "nis" ];
|
|
};
|
|
|
|
# Contents are immutable at runtime, and adding user accounts etc.
|
|
# is done statically in the LDIF-formatted contents in this folder.
|
|
declarativeContents."dc=tvl,dc=fyi" = ''
|
|
dn: dc=tvl,dc=fyi
|
|
dc: tvl
|
|
o: TVL LDAP server
|
|
description: Root entry for tvl.fyi
|
|
objectClass: top
|
|
objectClass: dcObject
|
|
objectClass: organization
|
|
|
|
dn: ou=users,dc=tvl,dc=fyi
|
|
ou: users
|
|
description: All users in TVL
|
|
objectClass: top
|
|
objectClass: organizationalUnit
|
|
|
|
dn: ou=groups,dc=tvl,dc=fyi
|
|
ou: groups
|
|
description: All groups in TVL
|
|
objectClass: top
|
|
objectClass: organizationalUnit
|
|
|
|
${lib.concatStringsSep "\n" (map toLdif users)}
|
|
'';
|
|
};
|
|
}
|