nixos/applications/ldap/ldap_backend.nix
Brendan Golden cfddc32424 fmt: directly access the inputs inside each machine.
This allows us to move the inputs to teh individual applications, making them more server agnostic.
2023-07-21 21:56:19 +01:00

90 lines
1.8 KiB
Nix

{ config, pkgs, lib, inputs, ... }:
with lib;
let
cfg = config.services.ldap_backend;
port_backend = "8087";
in {
imports = [
../acme.nix
../dns.nix
../nginx.nix
inputs.skynet_ldap_backend.nixosModule."x86_64-linux"
];
options.services.ldap_backend = {
enable = mkEnableOption "Skynet LDAP backend server";
host = {
ip = mkOption {
type = types.str;
};
name = mkOption {
type = types.str;
};
};
domain = {
tld = mkOption {
type = types.str;
default = "ie";
};
base = mkOption {
type = types.str;
default = "skynet";
};
sub = mkOption {
type = types.str;
default = "api.sso";
};
};
};
config = mkIf cfg.enable {
#backups = [ "/etc/silver_ul_ical/database.db" ];
age.secrets.ldap_self_service.file = ../../secrets/ldap/self_service.age;
skynet_dns.records = [
{record=cfg.domain.sub; r_type="CNAME"; value=cfg.host.name;}
];
services.nginx.virtualHosts."${cfg.domain.sub}.${cfg.domain.base}.${cfg.domain.tld}" = {
forceSSL = true;
useACMEHost = "skynet";
locations."/".proxyPass = "http://localhost:${port_backend}";
};
services.skynet_ldap_backend = {
enable = true;
# contains teh password in env form
envFile = config.age.secrets.ldap_self_service.path;
ldap = {
host = "ldaps://sso.skynet.ie";
admin = "cn=admin,dc=skynet,dc=ie";
};
users = {
admin = [
"silver"
"evanc"
"eoghanconlon73"
];
committee = [
"silver"
"eoghanconlon73"
];
lifetime = [];
banned = [];
};
host_port = "127.0.0.1:${port_backend}";
};
};
}