Skynet/nixos
7
1
Fork 0
Code Issues 45 Pull requests 1 Projects Releases Packages Wiki Activity Actions

ldap: small bit of a cleanup

Browse source
This commit is contained in:
silver 2023-10-22 14:39:35 +01:00
parent cc99fb92ec
commit e03e27c894
2 changed files with 21 additions and 34 deletions
Download patch file Download diff file Expand all files Collapse all files

37
applications/ldap/server.nix
View file

@ -10,6 +10,7 @@ Gonna use a priper nixos module for this
}:
with lib; let
cfg = config.services.skynet_ldap;
domain = "${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}";
in {
# these are needed for teh program in question
imports = [
@ -79,7 +80,7 @@ in {
};
skynet_acme.domains = [
"${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}"
domain
];
skynet_dns.records = [
@ -97,7 +98,7 @@ in {
];
services.nginx.virtualHosts = {
"${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}" = {
${domain} = {
forceSSL = true;
useACMEHost = "skynet";
locations."/" = {
@ -190,29 +191,33 @@ in {
olcRootDN = "cn=admin,${cfg.base}";
olcRootPW.path = config.age.secrets.ldap_pw.path;
#olcOverlay = "memberof";
olcAccess = [
/*
custom access rules for userPassword attributes
*/
'' {0}to attrs=userPassword
by dn.exact="uid=ldap_api,ou=users,dc=skynet,dc=ie" manage
by self write
by anonymous auth
by * none''
''
{0}to attrs=userPassword
by dn.exact="uid=ldap_api,ou=users,dc=skynet,dc=ie" manage
by self write
by anonymous auth
by * none
''
'' {1}to attrs=mail,sshPublicKey,cn,sn,skDiscord
by dn.exact="uid=ldap_api,ou=users,dc=skynet,dc=ie" manage
by self write
by * read''
''
{1}to attrs=mail,sshPublicKey,cn,sn,skDiscord
by dn.exact="uid=ldap_api,ou=users,dc=skynet,dc=ie" manage
by self write
by * read
''
/*
allow read on anything else
*/
'' {2}to *
by dn.exact="uid=ldap_api,ou=users,dc=skynet,dc=ie" manage
by * read''
''
{2}to *
by dn.exact="uid=ldap_api,ou=users,dc=skynet,dc=ie" manage
by * read
''
];
};