ldap: a mostly working ldaish setup

machines/optimus.nix

@@ -24,6 +24,9 @@ in {
     ../applications/firewall.nix
     ../applications/dns.nix
     ../applications/games.nix
+
+    # for testing
+    ../applications/ldap.nix
   ];
 
   deployment = {
@@ -50,4 +53,60 @@ in {
     ];
   };
 
+# we use this to pass in teh relevent infomation to the
+  services.skynet_ldap = {
+    enable = true;
+
+    host = {
+      # pass in teh ip (used for firewall)
+      ip = ip_pub;
+
+      # the name is used for dns
+      name = name;
+    };
+  };
+
+  security.sudo.extraRules = [
+     { groups = [ "admin-skynet" ]; commands = [ { command = "ALL"; options = [ "NOPASSWD" ]; } ]; }
+  ];
+
+  services.sssd = {
+    enable = true;
+
+    # just for testing purposes, don't put this into the Nix store in production!
+    environmentFile = "${pkgs.writeText "ldap-root" "LDAP_BIND_PW=westwood"}";
+
+    sshAuthorizedKeysIntegration = true;
+
+    config = ''
+      [domain/skynet.ie]
+      id_provider = ldap
+      auth_provider = ldap
+      sudo_provider = ldap
+      ldap_uri = ldap://sso.skynet.ie
+      ldap_search_base = ou=users,dc=skynet,dc=ie
+      ldap_group_search_base = ou=posix-groups,dc=skynet,dc=ie
+      ldap_sudo_search_base = ou=admin-skynet,ou=posix-groups,dc=skynet,dc=ie
+      ldap_default_bind_dn = uid=portunus_service,ou=users,dc=skynet,dc=ie
+      ldap_default_authtok_type = password
+      ldap_default_authtok = $LDAP_BIND_PW
+      cache_credentials = false
+      simple_allow_groups = admin-skynet
+
+      [sssd]
+      config_file_version = 2
+      services = nss, pam, sudo, ssh
+      domains = skynet.ie
+
+      [nss]
+
+      [pam]
+
+      [sudo]
+
+      [autofs]
+
+    '';
+  };
+
 }