nixos/applications/ldap.nix

/*
Gonna use a priper nixos module for this
*/

{ config, pkgs, lib, ... }:
  with lib;
  let
    cfg = config.services.skynet_ldap;
    base = "dc=skynet,dc=ie";
  in {

  # these are needed for teh program in question
  imports = [
    ./acme.nix
    ./nginx.nix
  ];


  options.services.skynet_ldap = {
    # options that need to be passed in to make this work

    enable = mkEnableOption "Skynet LDAP service";

    host = {
      ip = mkOption {
        type = types.str;
      };

      name = mkOption {
        type = types.str;
      };
    };

    subdomain = mkOption {
      type = types.str;
      default = "sso";
    };

    port = mkOption {
      type = types.port;
      default = 8080;
    };
  };

  config = mkIf cfg.enable {
    # this is athe actual configuration that we need to do

    skynet_dns.records.cname = [
      "${cfg.subdomain}  CNAME   ${cfg.host.name}"
    ];

    # firewall on teh computer itself
    networking.firewall.allowedTCPPorts = [
      80
      443

      # for ldap
      389
      636
    ];

    services.openldap = {
      enable = true;

      /* enable plain connections only */
      urlList = [ "ldap:///" ];


      settings = {
        attrs = {
          olcLogLevel = "conns config";
        };

        children = {
          "cn=schema".includes = [
            "${pkgs.openldap}/etc/schema/core.ldif"
            "${pkgs.openldap}/etc/schema/cosine.ldif"
            "${pkgs.openldap}/etc/schema/inetorgperson.ldif"
            "${pkgs.openldap}/etc/schema/nis.ldif"
            ./ldap/openssh-lpk.ldif
          ];

          "olcDatabase={1}mdb".attrs = {
            objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];

            olcDatabase = "{1}mdb";
            olcDbDirectory = "/var/lib/openldap/data";

            olcSuffix = base;

            /* your admin account, do not use writeText on a production system */
            olcRootDN = "cn=admin,${base}";
            olcRootPW.path = pkgs.writeText "olcRootPW" "westwood";

            #olcOverlay =  "memberof";

            olcAccess = [
              /* custom access rules for userPassword attributes */
              ''{0}to attrs=userPassword
                  by self write
                  by anonymous auth
                  by * none''

              /* allow read on anything else */
              ''{1}to *
                  by * read''
            ];
          };
        };
      };
    };

  };
}