Tons of changes, I guess?
This commit is contained in:
+49
-139
@@ -5,100 +5,7 @@ let
|
||||
|
||||
cfg = config.fudo.auth.ldap-server;
|
||||
|
||||
ldapSystemUserOpts = { name, ... }: {
|
||||
options = {
|
||||
description = mkOption {
|
||||
type = types.str;
|
||||
description = ''
|
||||
The description of this system user.
|
||||
'';
|
||||
};
|
||||
|
||||
hashed-password = mkOption {
|
||||
type = types.str;
|
||||
description = ''
|
||||
The password for this user, hashed with ldappasswd.
|
||||
'';
|
||||
default = "";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
ldapGroupOpts = { name, ... }: {
|
||||
options = {
|
||||
gid = mkOption {
|
||||
type = types.int;
|
||||
description = ''
|
||||
The GID number of this group.
|
||||
'';
|
||||
};
|
||||
|
||||
description = mkOption {
|
||||
type = types.str;
|
||||
description = ''
|
||||
The description of this group.
|
||||
'';
|
||||
};
|
||||
|
||||
members = mkOption {
|
||||
type = with types; listOf str;
|
||||
default = [ ];
|
||||
description = ''
|
||||
A list of usernames representing the members of this group.
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
ldapUserOpts = { name, ... }: {
|
||||
options = {
|
||||
|
||||
uid = mkOption {
|
||||
type = types.int;
|
||||
description = ''
|
||||
The UID number of this user.
|
||||
'';
|
||||
};
|
||||
|
||||
common-name = mkOption {
|
||||
type = types.str;
|
||||
description = ''
|
||||
The given name of this user.
|
||||
'';
|
||||
};
|
||||
|
||||
group = mkOption {
|
||||
type = types.str;
|
||||
description = ''
|
||||
The name of the user's primary group.
|
||||
'';
|
||||
};
|
||||
|
||||
login-shell = mkOption {
|
||||
type = types.str;
|
||||
default = "/bin/bash";
|
||||
description = ''
|
||||
The user's preferred shell. Default is /bin/bash.
|
||||
'';
|
||||
};
|
||||
|
||||
description = mkOption {
|
||||
type = types.str;
|
||||
default = "Fudo Member";
|
||||
description = ''
|
||||
The description of this user.
|
||||
'';
|
||||
};
|
||||
|
||||
hashed-password = mkOption {
|
||||
type = types.str;
|
||||
description = ''
|
||||
The password for this user, hashed with ldappasswd.
|
||||
'';
|
||||
default = "";
|
||||
};
|
||||
};
|
||||
};
|
||||
user-type = import ../types/user.nix { inherit lib; };
|
||||
|
||||
stringJoin = joiner: attrList:
|
||||
if (length attrList) == 0 then
|
||||
@@ -107,15 +14,15 @@ let
|
||||
foldr (lAttr: rAttr: "${lAttr}${joiner}${rAttr}") (last attrList)
|
||||
(init attrList);
|
||||
|
||||
getUserGidNumber = user: group-map: group-map.${user.group}.gid;
|
||||
getUserGidNumber = user: group-map: group-map.${user.primary-group}.gid;
|
||||
|
||||
attrOr = attrs: attr: value: if attrs ? ${attr} then attrs.${attr} else value;
|
||||
|
||||
mkHomeDir = username: user-opts:
|
||||
if (user-opts.group == "admin") then
|
||||
if (user-opts.primary-group == "admin") then
|
||||
"/home/${username}"
|
||||
else
|
||||
"/home/${user-opts.group}/${username}";
|
||||
"/home/${user-opts.primary-group}/${username}";
|
||||
|
||||
userLdif = base: name: group-map: opts: ''
|
||||
dn: uid=${name},ou=members,${base}
|
||||
@@ -131,7 +38,7 @@ let
|
||||
shadowLastChange: 12230
|
||||
shadowMax: 99999
|
||||
shadowWarning: 7
|
||||
userPassword: ${opts.hashed-password}
|
||||
userPassword: ${opts.ldap-hashed-passwd}
|
||||
'';
|
||||
|
||||
systemUserLdif = base: name: opts: ''
|
||||
@@ -140,7 +47,7 @@ let
|
||||
objectClass: simpleSecurityObject
|
||||
cn: ${name}
|
||||
description: ${opts.description}
|
||||
userPassword: ${opts.hashed-password}
|
||||
userPassword: ${opts.ldap-hashed-password}
|
||||
'';
|
||||
|
||||
toMemberList = userList:
|
||||
@@ -242,7 +149,7 @@ in {
|
||||
};
|
||||
|
||||
users = mkOption {
|
||||
type = attrsOf (submodule ldapUserOpts);
|
||||
type = attrsOf (submodule user-type.userOpts);
|
||||
example = {
|
||||
tester = {
|
||||
uid = 10099;
|
||||
@@ -258,7 +165,7 @@ in {
|
||||
|
||||
groups = mkOption {
|
||||
default = { };
|
||||
type = attrsOf (submodule ldapGroupOpts);
|
||||
type = attrsOf (submodule user-type.groupOpts);
|
||||
example = {
|
||||
admin = {
|
||||
gid = 1099;
|
||||
@@ -272,16 +179,19 @@ in {
|
||||
|
||||
system-users = mkOption {
|
||||
default = { };
|
||||
type = attrsOf (submodule ldapSystemUserOpts);
|
||||
type = attrsOf (submodule user-type.systemUserOpts);
|
||||
example = {
|
||||
replicator = {
|
||||
description = "System user for database sync";
|
||||
hashed-password = "<insert password hash>";
|
||||
ldap-hashed-password = "<insert password hash>";
|
||||
};
|
||||
};
|
||||
description = ''
|
||||
System users to be added to the Fudo LDAP database.
|
||||
'';
|
||||
description = "System users to be added to the Fudo LDAP database.";
|
||||
};
|
||||
|
||||
database-directory = mkOption {
|
||||
type = str;
|
||||
description = "Path at which to store the database.";
|
||||
};
|
||||
};
|
||||
};
|
||||
@@ -337,21 +247,19 @@ in {
|
||||
|
||||
services.openldap = {
|
||||
enable = true;
|
||||
suffix = cfg.base;
|
||||
rootdn = "cn=admin,${cfg.base}";
|
||||
rootpwFile = "${cfg.rootpw-file}";
|
||||
urlList = cfg.listen-uris;
|
||||
database = "mdb";
|
||||
|
||||
settings = let
|
||||
makeAccessLine = i: attrs: perm-map: let
|
||||
perm-strings = mapAttrs (dn: perm: "by ${dn} ${perm}") perm-map;
|
||||
perm-string = concatStringsSep " " perm-strings;
|
||||
in "${i}to ${attrs} ${perm-string}";
|
||||
makePermEntry = dn: perm: "by ${dn} ${perm}";
|
||||
|
||||
makeAccessLine = target: perm-map: let
|
||||
perm-entries = mapAttrsToList makePermEntry perm-map;
|
||||
in "to ${target} ${concatStringsSep " " perm-entries} done";
|
||||
|
||||
makeAccess = access-map: let
|
||||
pairs = mapAttrsToList (target: perm-map: [target perm-map]) access-map;
|
||||
in imap0 (i: pair: makeAccessLine i pair[0] pair[1]) pairs;
|
||||
access-lines = mapAttrsToList makeAccessLine;
|
||||
numbered-access-lines = imap0 (i: line: "{${toString i}}${line}");
|
||||
in numbered-access-lines (access-lines access-map);
|
||||
|
||||
in {
|
||||
attrs = {
|
||||
@@ -363,8 +271,8 @@ in {
|
||||
olcTLSCACertificateFile = cfg.ssl-ca-certificate;
|
||||
olcSaslSecProps = "noplain,noanonymous";
|
||||
olcAuthzRegexp = let
|
||||
authz-regex-entry = i: { regex, target}:
|
||||
"{${i}}\"${rx}\" \"${target}\"";
|
||||
authz-regex-entry = i: { regex, target }:
|
||||
"{${toString i}}\"${regex}\" \"${target}\"";
|
||||
in imap0 authz-regex-entry [
|
||||
{
|
||||
regex = "^uid=auth/([^.]+).fudo.org,cn=fudo.org,cn=gssapi,cn=auth$";
|
||||
@@ -396,7 +304,7 @@ in {
|
||||
olcAccess = makeAccess {
|
||||
"*" = {
|
||||
"dn.exact=gidNumber=0+uidNumber=0,cn=peercred,cn=external,cn=auth" = "manage";
|
||||
"dn.exact=cn=admin,dc=fudo,dc=org" = "manage";
|
||||
"dn.exact=cn=admin,${cfg.base}" = "manage";
|
||||
"*" = "none";
|
||||
};
|
||||
};
|
||||
@@ -462,30 +370,32 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
declarativeContents = ''
|
||||
dn: ${cfg.base}
|
||||
objectClass: top
|
||||
objectClass: dcObject
|
||||
objectClass: organization
|
||||
o: ${cfg.organization}
|
||||
declarativeContents = {
|
||||
"dc=fudo,dc=org" = ''
|
||||
dn: ${cfg.base}
|
||||
objectClass: top
|
||||
objectClass: dcObject
|
||||
objectClass: organization
|
||||
o: ${cfg.organization}
|
||||
|
||||
dn: ou=groups,${cfg.base}
|
||||
objectClass: organizationalUnit
|
||||
description: ${cfg.organization} groups
|
||||
dn: ou=groups,${cfg.base}
|
||||
objectClass: organizationalUnit
|
||||
description: ${cfg.organization} groups
|
||||
|
||||
dn: ou=members,${cfg.base}
|
||||
objectClass: organizationalUnit
|
||||
description: ${cfg.organization} members
|
||||
dn: ou=members,${cfg.base}
|
||||
objectClass: organizationalUnit
|
||||
description: ${cfg.organization} members
|
||||
|
||||
dn: cn=admin,${cfg.base}
|
||||
objectClass: organizationalRole
|
||||
cn: admin
|
||||
description: "Admin User"
|
||||
dn: cn=admin,${cfg.base}
|
||||
objectClass: organizationalRole
|
||||
cn: admin
|
||||
description: "Admin User"
|
||||
|
||||
${systemUsersLdif cfg.base cfg.system-users}
|
||||
${groupsLdif cfg.base cfg.groups}
|
||||
${usersLdif cfg.base cfg.groups cfg.users}
|
||||
'';
|
||||
${systemUsersLdif cfg.base cfg.system-users}
|
||||
${groupsLdif cfg.base cfg.groups}
|
||||
${usersLdif cfg.base cfg.groups cfg.users}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user