c0122d335b
In certain cases, for example when custom OpenLDAP modules are compiled into the binary, users may want to override the package used for OpenLDAP. This is especially common in setups where LDAP is the primary authentication source, as good password hashing mechanisms need to be enabled as extra modules.
300 lines
8.6 KiB
Nix
300 lines
8.6 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
|
|
cfg = config.services.openldap;
|
|
openldap = cfg.package;
|
|
|
|
dataFile = pkgs.writeText "ldap-contents.ldif" cfg.declarativeContents;
|
|
configFile = pkgs.writeText "slapd.conf" ((optionalString cfg.defaultSchemas ''
|
|
include ${openldap.out}/etc/schema/core.schema
|
|
include ${openldap.out}/etc/schema/cosine.schema
|
|
include ${openldap.out}/etc/schema/inetorgperson.schema
|
|
include ${openldap.out}/etc/schema/nis.schema
|
|
'') + ''
|
|
${cfg.extraConfig}
|
|
database ${cfg.database}
|
|
suffix ${cfg.suffix}
|
|
rootdn ${cfg.rootdn}
|
|
${if (cfg.rootpw != null) then ''
|
|
rootpw ${cfg.rootpw}
|
|
'' else ''
|
|
include ${cfg.rootpwFile}
|
|
''}
|
|
directory ${cfg.dataDir}
|
|
${cfg.extraDatabaseConfig}
|
|
'');
|
|
configOpts = if cfg.configDir == null then "-f ${configFile}"
|
|
else "-F ${cfg.configDir}";
|
|
in
|
|
|
|
{
|
|
|
|
###### interface
|
|
|
|
options = {
|
|
|
|
services.openldap = {
|
|
|
|
enable = mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "
|
|
Whether to enable the ldap server.
|
|
";
|
|
};
|
|
|
|
package = mkOption {
|
|
type = types.package;
|
|
default = pkgs.openldap;
|
|
description = ''
|
|
OpenLDAP package to use.
|
|
|
|
This can be used to, for example, set an OpenLDAP package
|
|
with custom overrides to enable modules or other
|
|
functionality.
|
|
'';
|
|
};
|
|
|
|
user = mkOption {
|
|
type = types.str;
|
|
default = "openldap";
|
|
description = "User account under which slapd runs.";
|
|
};
|
|
|
|
group = mkOption {
|
|
type = types.str;
|
|
default = "openldap";
|
|
description = "Group account under which slapd runs.";
|
|
};
|
|
|
|
urlList = mkOption {
|
|
type = types.listOf types.str;
|
|
default = [ "ldap:///" ];
|
|
description = "URL list slapd should listen on.";
|
|
example = [ "ldaps:///" ];
|
|
};
|
|
|
|
dataDir = mkOption {
|
|
type = types.path;
|
|
default = "/var/db/openldap";
|
|
description = "The database directory.";
|
|
};
|
|
|
|
defaultSchemas = mkOption {
|
|
type = types.bool;
|
|
default = true;
|
|
description = ''
|
|
Include the default schemas core, cosine, inetorgperson and nis.
|
|
This setting will be ignored if configDir is set.
|
|
'';
|
|
};
|
|
|
|
database = mkOption {
|
|
type = types.str;
|
|
default = "mdb";
|
|
description = ''
|
|
Database type to use for the LDAP.
|
|
This setting will be ignored if configDir is set.
|
|
'';
|
|
};
|
|
|
|
suffix = mkOption {
|
|
type = types.str;
|
|
example = "dc=example,dc=org";
|
|
description = ''
|
|
Specify the DN suffix of queries that will be passed to this backend
|
|
database.
|
|
This setting will be ignored if configDir is set.
|
|
'';
|
|
};
|
|
|
|
rootdn = mkOption {
|
|
type = types.str;
|
|
example = "cn=admin,dc=example,dc=org";
|
|
description = ''
|
|
Specify the distinguished name that is not subject to access control
|
|
or administrative limit restrictions for operations on this database.
|
|
This setting will be ignored if configDir is set.
|
|
'';
|
|
};
|
|
|
|
rootpw = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = ''
|
|
Password for the root user.
|
|
This setting will be ignored if configDir is set.
|
|
Using this option will store the root password in plain text in the
|
|
world-readable nix store. To avoid this the <literal>rootpwFile</literal> can be used.
|
|
'';
|
|
};
|
|
|
|
rootpwFile = mkOption {
|
|
type = types.nullOr types.str;
|
|
default = null;
|
|
description = ''
|
|
Password file for the root user.
|
|
The file should contain the string <literal>rootpw</literal> followed by the password.
|
|
e.g.: <literal>rootpw mysecurepassword</literal>
|
|
'';
|
|
};
|
|
|
|
logLevel = mkOption {
|
|
type = types.str;
|
|
default = "0";
|
|
example = "acl trace";
|
|
description = "The log level selector of slapd.";
|
|
};
|
|
|
|
configDir = mkOption {
|
|
type = types.nullOr types.path;
|
|
default = null;
|
|
description = "Use this optional config directory instead of using slapd.conf";
|
|
example = "/var/db/slapd.d";
|
|
};
|
|
|
|
extraConfig = mkOption {
|
|
type = types.lines;
|
|
default = "";
|
|
description = "
|
|
slapd.conf configuration
|
|
";
|
|
example = literalExample ''
|
|
'''
|
|
include ${openldap.out}/etc/schema/core.schema
|
|
include ${openldap.out}/etc/schema/cosine.schema
|
|
include ${openldap.out}/etc/schema/inetorgperson.schema
|
|
include ${openldap.out}/etc/schema/nis.schema
|
|
|
|
database bdb
|
|
suffix dc=example,dc=org
|
|
rootdn cn=admin,dc=example,dc=org
|
|
# NOTE: change after first start
|
|
rootpw secret
|
|
directory /var/db/openldap
|
|
'''
|
|
'';
|
|
};
|
|
|
|
declarativeContents = mkOption {
|
|
type = with types; nullOr lines;
|
|
default = null;
|
|
description = ''
|
|
Declarative contents for the LDAP database, in LDIF format.
|
|
|
|
Note a few facts when using it. First, the database
|
|
<emphasis>must</emphasis> be stored in the directory defined by
|
|
<code>dataDir</code>. Second, all <code>dataDir</code> will be erased
|
|
when starting the LDAP server. Third, modifications to the database
|
|
are not prevented, they are just dropped on the next reboot of the
|
|
server. Finally, performance-wise the database and indexes are rebuilt
|
|
on each server startup, so this will slow down server startup,
|
|
especially with large databases.
|
|
'';
|
|
example = ''
|
|
dn: dc=example,dc=org
|
|
objectClass: domain
|
|
dc: example
|
|
|
|
dn: ou=users,dc=example,dc=org
|
|
objectClass = organizationalUnit
|
|
ou: users
|
|
|
|
# ...
|
|
'';
|
|
};
|
|
|
|
extraDatabaseConfig = mkOption {
|
|
type = types.lines;
|
|
default = "";
|
|
description = ''
|
|
slapd.conf configuration after the database option.
|
|
This setting will be ignored if configDir is set.
|
|
'';
|
|
example = ''
|
|
# Indices to maintain for this directory
|
|
# unique id so equality match only
|
|
index uid eq
|
|
# allows general searching on commonname, givenname and email
|
|
index cn,gn,mail eq,sub
|
|
# allows multiple variants on surname searching
|
|
index sn eq,sub
|
|
# sub above includes subintial,subany,subfinal
|
|
# optimise department searches
|
|
index ou eq
|
|
# if searches will include objectClass uncomment following
|
|
# index objectClass eq
|
|
# shows use of default index parameter
|
|
index default eq,sub
|
|
# indices missing - uses default eq,sub
|
|
index telephonenumber
|
|
|
|
# other database parameters
|
|
# read more in slapd.conf reference section
|
|
cachesize 10000
|
|
checkpoint 128 15
|
|
'';
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
meta = {
|
|
maintainers = [ lib.maintainers.mic92 ];
|
|
};
|
|
|
|
|
|
###### implementation
|
|
|
|
config = mkIf cfg.enable {
|
|
assertions = [
|
|
{
|
|
assertion = cfg.configDir != null || cfg.rootpwFile != null || cfg.rootpw != null;
|
|
message = "services.openldap: Unless configDir is set, either rootpw or rootpwFile must be set";
|
|
}
|
|
];
|
|
|
|
environment.systemPackages = [ openldap ];
|
|
|
|
systemd.services.openldap = {
|
|
description = "LDAP server";
|
|
wantedBy = [ "multi-user.target" ];
|
|
after = [ "network.target" ];
|
|
preStart = ''
|
|
mkdir -p /run/slapd
|
|
chown -R "${cfg.user}:${cfg.group}" /run/slapd
|
|
${optionalString (cfg.declarativeContents != null) ''
|
|
rm -Rf "${cfg.dataDir}"
|
|
''}
|
|
mkdir -p "${cfg.dataDir}"
|
|
${optionalString (cfg.declarativeContents != null) ''
|
|
${openldap.out}/bin/slapadd ${configOpts} -l ${dataFile}
|
|
''}
|
|
chown -R "${cfg.user}:${cfg.group}" "${cfg.dataDir}"
|
|
|
|
${openldap}/bin/slaptest ${configOpts}
|
|
'';
|
|
serviceConfig.ExecStart =
|
|
"${openldap.out}/libexec/slapd -d '${cfg.logLevel}' " +
|
|
"-u '${cfg.user}' -g '${cfg.group}' " +
|
|
"-h '${concatStringsSep " " cfg.urlList}' " +
|
|
"${configOpts}";
|
|
};
|
|
|
|
users.users.openldap =
|
|
{ name = cfg.user;
|
|
group = cfg.group;
|
|
uid = config.ids.uids.openldap;
|
|
};
|
|
|
|
users.groups.openldap =
|
|
{ name = cfg.group;
|
|
gid = config.ids.gids.openldap;
|
|
};
|
|
|
|
};
|
|
}
|