nixos/applications/ldap.nix

216 lines
5.2 KiB
Nix
Raw Normal View History

2023-05-16 21:23:04 +00:00
/*
Gonna use a priper nixos module for this
*/
2023-05-18 20:59:23 +00:00
{ config, pkgs, lib, ... }:
2023-05-16 21:23:04 +00:00
with lib;
let
cfg = config.services.skynet_ldap;
in {
# these are needed for teh program in question
imports = [
./acme.nix
./nginx.nix
];
options.services.skynet_ldap = {
# options that need to be passed in to make this work
enable = mkEnableOption "Skynet LDAP service";
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
2023-05-21 11:08:26 +00:00
domain = {
2023-05-21 11:17:06 +00:00
tld = mkOption {
type = types.str;
default = "ie";
};
2023-05-21 11:08:26 +00:00
base = mkOption {
type = types.str;
2023-05-21 11:17:06 +00:00
default = "skynet";
2023-05-21 11:08:26 +00:00
};
sub = mkOption {
type = types.str;
default = "sso";
};
2023-05-16 21:23:04 +00:00
};
2023-05-21 11:05:19 +00:00
frontend.port = mkOption {
2023-05-16 21:23:04 +00:00
type = types.port;
2023-05-21 11:05:19 +00:00
default = 8888;
2023-05-16 21:23:04 +00:00
};
2023-05-21 11:02:52 +00:00
base = mkOption {
type = types.str;
default = "dc=skynet,dc=ie";
};
2023-05-16 21:23:04 +00:00
};
config = mkIf cfg.enable {
# this is athe actual configuration that we need to do
# after changing teh password openldap.service has to be restarted
age.secrets.ldap_pw = {
file = ../secrets/ldap/pw.age;
mode = "440";
owner = "openldap";
group = "openldap";
};
# openldap
age.secrets.ldap_self_service = {
file = ../secrets/ldap/self_service.age;
# not ideal but non admins should never be on this system
mode = "444";
};
2023-05-16 21:23:04 +00:00
skynet_dns.records.cname = [
2023-05-21 11:08:26 +00:00
"${cfg.domain.sub} CNAME ${cfg.host.name}"
2023-05-16 21:23:04 +00:00
];
# firewall on teh computer itself
networking.firewall.allowedTCPPorts = [
80
443
2023-05-18 20:59:23 +00:00
# for ldap
389
2023-05-21 11:17:06 +00:00
636
2023-05-16 21:23:04 +00:00
];
2023-05-21 11:17:06 +00:00
# using https://nixos.wiki/wiki/OpenLDAP for base config
systemd.services.openldap = {
wants = [ "acme-${cfg.domain.base}.service" ];
after = [ "acme-${cfg.domain.base}.service" ];
};
users.groups.certs.members = [ "openldap" ];
services.openldap = {
enable = true;
2023-05-16 21:23:04 +00:00
2023-05-21 11:17:06 +00:00
/* enable plain and secure connections */
urlList = [ "ldap:///" "ldaps:///" ];
2023-05-16 21:23:04 +00:00
settings = {
attrs = {
olcLogLevel = "conns config";
2023-05-21 11:17:06 +00:00
/* settings for acme ssl */
olcTLSCACertificateFile = "/var/lib/acme/${cfg.domain.base}/full.pem";
olcTLSCertificateFile = "/var/lib/acme/${cfg.domain.base}/cert.pem";
olcTLSCertificateKeyFile = "/var/lib/acme/${cfg.domain.base}/key.pem";
olcTLSCipherSuite = "HIGH:MEDIUM:+3DES:+RC4:+aNULL";
olcTLSCRLCheck = "none";
olcTLSVerifyClient = "never";
olcTLSProtocolMin = "3.1";
};
2023-05-16 21:23:04 +00:00
children = {
"cn=schema".includes = [
"${pkgs.openldap}/etc/schema/core.ldif"
"${pkgs.openldap}/etc/schema/cosine.ldif"
"${pkgs.openldap}/etc/schema/inetorgperson.ldif"
"${pkgs.openldap}/etc/schema/nis.ldif"
./ldap/openssh-lpk.ldif
./ldap/skMemberOf.ldif
];
"cn=modules".attrs = {
objectClass = [ "olcModuleList" ];
cn = "modules";
olcModuleLoad = ["dynlist" "memberof"];
};
"olcDatabase={1}mdb" = {
attrs = {
objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
olcDatabase = "{1}mdb";
olcDbDirectory = "/var/lib/openldap/data";
2023-05-21 11:02:52 +00:00
olcSuffix = cfg.base;
/* your admin account, do not use writeText on a production system */
2023-05-21 11:02:52 +00:00
olcRootDN = "cn=admin,${cfg.base}";
olcRootPW.path = config.age.secrets.ldap_pw.path;
#olcOverlay = "memberof";
olcAccess = [
/* custom access rules for userPassword attributes */
''{0}to attrs=userPassword
by self write
by anonymous auth
by * none''
/* allow read on anything else */
''{1}to *
by * read''
];
};
# https://blog.oddbit.com/post/2013-07-22-generating-a-membero/
children = {
"olcOverlay=dynlist".attrs = {
objectClass = [ "olcOverlayConfig" "olcDynamicList" ];
olcOverlay = "dynlist";
olcDlAttrSet = "skPerson labeledURI skMemberOf";
};
};
};
};
2023-05-18 20:59:23 +00:00
};
2023-05-16 21:23:04 +00:00
};
2023-05-21 11:17:06 +00:00
services.nginx.virtualHosts."${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}" = {
forceSSL = true;
useACMEHost = "skynet";
2023-05-21 11:23:57 +00:00
locations."/".proxyPass = "http://localhost:${toString cfg.frontend.port}";
};
virtualisation.arion = {
backend = "docker";
projects = {
ldap_reset.settings.services.ldap_reset.service = {
user = "root";
image = "docker.io/ltbproject/self-service-password:1.5.3";
# setting these here as they arent special
# where the config files are stored
volumes = [
"${config.age.secrets.ldap_self_service.path}:/var/www/conf/config.inc.local.php"
];
ports = [
2023-05-21 11:23:57 +00:00
"${toString cfg.frontend.port}:80/tcp"
];
};
};
};
2023-05-16 21:23:04 +00:00
};
}