Skynet/nixos
6
1
Fork 0
Code Issues 43 Pull requests 1 Projects Releases Packages Wiki Activity Actions

ldap: small bit of a cleanup

Browse source
This commit is contained in:
silver 2023-10-22 14:39:35 +01:00
parent cc99fb92ec
commit e03e27c894
2 changed files with 21 additions and 34 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

37
applications/ldap/server.nix
View file

@ -10,6 +10,7 @@ Gonna use a priper nixos module for this
}: }:
with lib; let with lib; let
cfg = config.services.skynet_ldap; cfg = config.services.skynet_ldap;
domain = "${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}";
in { in {
# these are needed for teh program in question # these are needed for teh program in question
imports = [ imports = [
@ -79,7 +80,7 @@ in {
}; };
skynet_acme.domains = [ skynet_acme.domains = [
"${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}" domain
]; ];
skynet_dns.records = [ skynet_dns.records = [
@ -97,7 +98,7 @@ in {
]; ];
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
"${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}" = { ${domain} = {
forceSSL = true; forceSSL = true;
useACMEHost = "skynet"; useACMEHost = "skynet";
locations."/" = { locations."/" = {
@ -190,29 +191,33 @@ in {
olcRootDN = "cn=admin,${cfg.base}"; olcRootDN = "cn=admin,${cfg.base}";
olcRootPW.path = config.age.secrets.ldap_pw.path; olcRootPW.path = config.age.secrets.ldap_pw.path;
#olcOverlay = "memberof";
olcAccess = [ olcAccess = [
/* /*
custom access rules for userPassword attributes custom access rules for userPassword attributes
*/ */
'' {0}to attrs=userPassword ''
by dn.exact="uid=ldap_api,ou=users,dc=skynet,dc=ie" manage {0}to attrs=userPassword
by self write by dn.exact="uid=ldap_api,ou=users,dc=skynet,dc=ie" manage
by anonymous auth by self write
by * none'' by anonymous auth
by * none
''
'' {1}to attrs=mail,sshPublicKey,cn,sn,skDiscord ''
by dn.exact="uid=ldap_api,ou=users,dc=skynet,dc=ie" manage {1}to attrs=mail,sshPublicKey,cn,sn,skDiscord
by self write by dn.exact="uid=ldap_api,ou=users,dc=skynet,dc=ie" manage
by * read'' by self write
by * read
''
/* /*
allow read on anything else allow read on anything else
*/ */
'' {2}to * ''
by dn.exact="uid=ldap_api,ou=users,dc=skynet,dc=ie" manage {2}to *
by * read'' by dn.exact="uid=ldap_api,ou=users,dc=skynet,dc=ie" manage
by * read
''
]; ];
}; };

18
applications/ldap/skMemberOf.ldif
View file

@ -24,24 +24,12 @@ olcAttributeTypes: ( 1.3.6.1.4.1.24441.1.4.1
EQUALITY caseIgnoreMatch EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
) )
olcAttributeTypes: ( 1.3.6.1.4.1.24441.1.5.1
NAME 'skDiscord'
DESC 'Discord username'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
)
olcAttributeTypes: ( 1.3.6.1.4.1.24441.1.6.1 olcAttributeTypes: ( 1.3.6.1.4.1.24441.1.6.1
NAME 'skCreated' NAME 'skCreated'
DESC 'When the account was created' DESC 'When the account was created'
EQUALITY caseIgnoreMatch EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15 SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
) )
#olcAttributeTypes: ( 1.3.6.1.4.1.24441.1.7.1
# NAME 'skEnabled'
# DESC 'TRUE/FALSE'
# EQUALITY booleanMatch
# SYNTAX 1.3.6.1.4.1.1466.115.121.1.7
# )
# https://github.com/variablenix/ldap-mail-schema/blob/master/quota.schema # https://github.com/variablenix/ldap-mail-schema/blob/master/quota.schema
olcAttributeTypes: ( 1.3.6.1.4.1.24441.1.8.1 olcAttributeTypes: ( 1.3.6.1.4.1.24441.1.8.1
NAME 'quotaEmail' NAME 'quotaEmail'
@ -55,12 +43,6 @@ olcAttributeTypes: ( 1.3.6.1.4.1.24441.1.9.1
EQUALITY caseIgnoreIA5Match EQUALITY caseIgnoreIA5Match
SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{255} SYNTAX 1.3.6.1.4.1.1466.115.121.1.26{255}
) )
olcAttributeTypes: ( 1.3.6.1.4.1.24441.1.10.1
NAME 'skSecure'
DESC '1 if secure'
EQUALITY caseIgnoreMatch
SYNTAX 1.3.6.1.4.1.1466.115.121.1.15
)
olcObjectClasses: ( 1.3.6.1.4.1.24441.1.1.1 olcObjectClasses: ( 1.3.6.1.4.1.24441.1.1.1
NAME 'skPerson' NAME 'skPerson'
DESC 'skynet person' DESC 'skynet person'