Skynet/nixos
6
1
Fork 0
Code Issues 42 Pull requests 1 Projects Releases Packages Wiki Activity Actions

feat: added ldaps

Browse source
This commit is contained in:
silver 2023-05-21 12:17:06 +01:00
parent ad2c9dad6b
commit 81b41087fe
1 changed files with 28 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

32
applications/ldap.nix
View file

@ -31,9 +31,14 @@ Gonna use a priper nixos module for this
};
domain = {
tld = mkOption {
type = types.str;
default = "ie";
};
base = mkOption {
type = types.str;
default = "skynet.ie";
default = "skynet";
};
sub = mkOption {
@ -82,18 +87,37 @@ Gonna use a priper nixos module for this
# for ldap
389
636
];
# using https://nixos.wiki/wiki/OpenLDAP for base config
systemd.services.openldap = {
wants = [ "acme-${cfg.domain.base}.service" ];
after = [ "acme-${cfg.domain.base}.service" ];
};
users.groups.certs.members = [ "openldap" ];
services.openldap = {
enable = true;
/* enable plain connections only */
urlList = [ "ldap:///" ];
/* enable plain and secure connections */
urlList = [ "ldap:///" "ldaps:///" ];
settings = {
attrs = {
olcLogLevel = "conns config";
/* settings for acme ssl */
olcTLSCACertificateFile = "/var/lib/acme/${cfg.domain.base}/full.pem";
olcTLSCertificateFile = "/var/lib/acme/${cfg.domain.base}/cert.pem";
olcTLSCertificateKeyFile = "/var/lib/acme/${cfg.domain.base}/key.pem";
olcTLSCipherSuite = "HIGH:MEDIUM:+3DES:+RC4:+aNULL";
olcTLSCRLCheck = "none";
olcTLSVerifyClient = "never";
olcTLSProtocolMin = "3.1";
};
children = {
@ -161,7 +185,7 @@ Gonna use a priper nixos module for this
};
services.nginx.virtualHosts."${cfg.domain.sub}.${cfg.domain.base}" = {
services.nginx.virtualHosts."${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}" = {
forceSSL = true;
useACMEHost = "skynet";
locations."/".proxyPass = "http://localhost:${cfg.frontend.port}";