Mostly stuff for selby forum
This commit is contained in:
root
+3
-2
@@ -6,7 +6,7 @@
|
||||
./backplane-client.nix
|
||||
./bash.nix
|
||||
./common.nix
|
||||
./dns.nix
|
||||
# ./dns.nix
|
||||
./groups.nix
|
||||
./instance.nix
|
||||
# ./kerberos.nix
|
||||
@@ -15,7 +15,8 @@
|
||||
./user-config.nix
|
||||
./wireless-networks.nix
|
||||
|
||||
./service/auth.nix
|
||||
./service/dns.nix
|
||||
./service/fudo-auth.nix
|
||||
./service/jabber.nix
|
||||
];
|
||||
}
|
||||
|
||||
@@ -66,12 +66,6 @@
|
||||
opengl = {
|
||||
driSupport = true;
|
||||
driSupport32Bit = true;
|
||||
extraPackages = with pkgs; [
|
||||
rocm-opencl-icd
|
||||
rocm-opencl-runtime
|
||||
amdvlk
|
||||
driversi686Linux.amdvlk
|
||||
];
|
||||
setLdLibraryPath = true;
|
||||
};
|
||||
|
||||
|
||||
@@ -11,7 +11,7 @@ let
|
||||
|
||||
local-packages = with pkgs; [ ldns.examples ];
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
host-secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
|
||||
in {
|
||||
networking = {
|
||||
@@ -61,12 +61,6 @@ in {
|
||||
hosts.legatus.external-interfaces = [ "extif0" ];
|
||||
|
||||
services = {
|
||||
jabber = {
|
||||
enable = true;
|
||||
hostname = "jabber.fudo.org";
|
||||
ldap.servers = [ "nutboy3.fudo.org" ];
|
||||
state-directory = "/state/ejabberd";
|
||||
};
|
||||
auth = {
|
||||
ldap.state-directory = "/state/auth/ldap";
|
||||
kerberos = {
|
||||
@@ -98,7 +92,7 @@ in {
|
||||
user = config.fudo.auth.kdc.user;
|
||||
};
|
||||
|
||||
hemidal-ipropd-keytab = {
|
||||
heimdal-ipropd-keytab = {
|
||||
source-file = files.service-keytabs.legatus.ipropd;
|
||||
target-file = "/run/heimdal/ipropd.keytab";
|
||||
user = config.fudo.auth.kdc.user;
|
||||
@@ -136,93 +130,5 @@ in {
|
||||
};
|
||||
|
||||
dns.state-directory = "/state/nsd";
|
||||
|
||||
# mail-server = {
|
||||
# enable = true;
|
||||
# debug = true;
|
||||
|
||||
# domain = domain-name;
|
||||
# mail-hostname = "${host-fqdn}";
|
||||
# monitoring = false;
|
||||
# mail-user = "mailuser";
|
||||
# mail-user-id = 525;
|
||||
# mail-group = "mailgroup";
|
||||
# clamav.enable = true;
|
||||
# dkim.signing = true;
|
||||
|
||||
# dovecot = {
|
||||
# ssl-certificate = acme-certificate "imap.${domain-name}";
|
||||
# ssl-private-key = acme-private-key "imap.${domain-name}";
|
||||
# };
|
||||
|
||||
# postfix = {
|
||||
# ssl-certificate = acme-certificate "smtp.${domain-name}";
|
||||
# ssl-private-key = acme-private-key "smtp.${domain-name}";
|
||||
# };
|
||||
|
||||
# # This should NOT include the primary domain
|
||||
# local-domains = [ host-fqdn "smtp.${domain-name}" ];
|
||||
|
||||
# mail-directory = "/srv/mailserver/mail";
|
||||
# state-directory = "/srv/mailserver/state";
|
||||
|
||||
# trusted-networks = [ "172.86.179.16/29" "127.0.0.0/16" ];
|
||||
|
||||
# alias-users = {
|
||||
# root = [ "niten" ];
|
||||
# postmaster = [ "niten" ];
|
||||
# hostmaster = [ "niten" ];
|
||||
# webmaster = [ "niten" ];
|
||||
# system = [ "niten" ];
|
||||
# admin = [ "niten" ];
|
||||
# dmarc-report = [ "niten" ];
|
||||
# };
|
||||
# };
|
||||
|
||||
# postgresql = {
|
||||
# enable = true;
|
||||
# ssl-certificate = (acme-certificate host-fqdn);
|
||||
# ssl-private-key = (acme-private-key host-fqdn);
|
||||
# keytab = secrets.postgres-keytab.target-file;
|
||||
# local-networks = local-networks;
|
||||
|
||||
# users = {
|
||||
# gituser = {
|
||||
# password-file =
|
||||
# secrets.gitea-database-password.target-file;
|
||||
# databases = {
|
||||
# git = {
|
||||
# access = "CONNECT";
|
||||
# entity-access = {
|
||||
# "ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
|
||||
# "ALL SEQUENCES IN SCHEMA public" = "SELECT, UPDATE";
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
# };
|
||||
|
||||
# databases = { git = { users = [ "niten" ]; }; };
|
||||
# };
|
||||
|
||||
# git = {
|
||||
# enable = true;
|
||||
# hostname = "git.informis.land";
|
||||
# site-name = "informis git";
|
||||
# user = "gituser";
|
||||
# repository-dir = /srv/git/repo;
|
||||
# state-dir = /srv/git/state;
|
||||
# database = {
|
||||
# user = "gituser";
|
||||
# password-file =
|
||||
# secrets.gitea-database-password.target-file;
|
||||
# hostname = "127.0.0.1";
|
||||
# name = "git";
|
||||
# };
|
||||
# ssh = {
|
||||
# listen-ip = host-ipv4;
|
||||
# listen-port = 2222;
|
||||
# };
|
||||
# };
|
||||
};
|
||||
}
|
||||
|
||||
@@ -12,7 +12,7 @@ let
|
||||
|
||||
local-packages = with pkgs; [ ldns.examples ];
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
host-secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
|
||||
postgresql-user =
|
||||
config.systemd.services.postgresql.serviceConfig.User;
|
||||
@@ -23,6 +23,10 @@ let
|
||||
|
||||
in {
|
||||
|
||||
imports = [
|
||||
./nutboy3/forum_selby_ca.nix
|
||||
];
|
||||
|
||||
config = {
|
||||
networking = {
|
||||
nameservers = [ "1.1.1.1" ];
|
||||
@@ -37,9 +41,7 @@ in {
|
||||
}];
|
||||
};
|
||||
|
||||
systemd.tmpfiles.rules = [
|
||||
"L /etc/adjtime - - - - /state/etc/adjtime"
|
||||
];
|
||||
systemd.tmpfiles.rules = [ "L /etc/adjtime - - - - /state/etc/adjtime" ];
|
||||
|
||||
environment.systemPackages = local-packages;
|
||||
|
||||
@@ -68,17 +70,19 @@ in {
|
||||
};
|
||||
};
|
||||
|
||||
acme.host-domains.${hostname}.${host-fqdn}.local-copies = {
|
||||
openldap = {
|
||||
user = config.services.openldap.user;
|
||||
dependent-services = [ "openldap.service" ];
|
||||
part-of = [ config.fudo.auth.ldap-server.systemd-target ];
|
||||
};
|
||||
acme.host-domains.${hostname} = {
|
||||
${host-fqdn}.local-copies = {
|
||||
openldap = {
|
||||
user = config.services.openldap.user;
|
||||
dependent-services = [ "openldap.service" ];
|
||||
part-of = [ config.fudo.auth.ldap-server.systemd-target ];
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
user = postgresql-user;
|
||||
dependent-services = [ "postgresql.service" ];
|
||||
part-of = [ config.fudo.postgresql.systemd-target ];
|
||||
postgresql = {
|
||||
user = postgresql-user;
|
||||
dependent-services = [ "postgresql.service" ];
|
||||
part-of = [ config.fudo.postgresql.systemd-target ];
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -89,11 +93,19 @@ in {
|
||||
external-interface = "extif0";
|
||||
};
|
||||
|
||||
services.auth = {
|
||||
ldap.state-directory = "/state/auth/ldap";
|
||||
kerberos = {
|
||||
state-directory = "/state/auth/kerberos";
|
||||
master-key-file = host-secrets.heimdal-master-key.target-file;
|
||||
services = {
|
||||
jabber = {
|
||||
enable = true;
|
||||
hostname = "jabber.fudo.org";
|
||||
ldap.servers = [ "nutboy3.fudo.org" ];
|
||||
state-directory = "/state/ejabberd";
|
||||
};
|
||||
auth = {
|
||||
ldap.state-directory = "/state/auth/ldap";
|
||||
kerberos = {
|
||||
state-directory = "/state/auth/kerberos";
|
||||
master-key-file = host-secrets.heimdal-master-key.target-file;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -142,16 +154,15 @@ in {
|
||||
# };
|
||||
|
||||
postgresql = let
|
||||
cert-copy =
|
||||
config.fudo.acme.host-domains.${hostname}.${host-fqdn}.local-copies.postgresql;
|
||||
cert-copy = acme-copies.${host-fqdn}.local-copies.postgresql;
|
||||
in {
|
||||
enable = true;
|
||||
ssl-certificate = cert-copy.full-certificate;
|
||||
ssl-private-key = cert-copy.private-key;
|
||||
keytab = secrets.postgresql-keytab.target-file;
|
||||
keytab = host-secrets.postgresql-keytab.target-file;
|
||||
local-networks = config.instance.local-networks;
|
||||
state-directory = "/state/postgresql";
|
||||
required-services = [ cert-copy.service ];
|
||||
required-services = [ cert-copy.service config.fudo.secrets.secret-target ];
|
||||
};
|
||||
|
||||
# git = {
|
||||
@@ -164,7 +175,7 @@ in {
|
||||
# database = {
|
||||
# user = "gituser";
|
||||
# password-file =
|
||||
# secrets.gitea-database-password.target-file;
|
||||
# host-secrets.gitea-database-password.target-file;
|
||||
# hostname = "127.0.0.1";
|
||||
# name = "git";
|
||||
# };
|
||||
|
||||
@@ -0,0 +1,194 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
site = "forum.test.selby.ca";
|
||||
hostname = config.instance.hostname;
|
||||
host-secrets = config.fudo.secrets.host-secrets.${hostname};
|
||||
|
||||
discourse-user = config.systemd.services.discourse.serviceConfig.User;
|
||||
|
||||
database-name = "forum_selby_ca";
|
||||
database-user = "forum_selby_ca";
|
||||
|
||||
state-directory = "/state/selby/forum";
|
||||
|
||||
password-injector-sql = csv-file: pkgs.stdenv.mkDerivation {
|
||||
name = "${site}-password-injector-sql";
|
||||
phases = [ "installPhase" ];
|
||||
buildInputs = [ pkgs.ruby ];
|
||||
installPhase = ''
|
||||
${password-convert-script csv-file}
|
||||
'';
|
||||
};
|
||||
|
||||
password-convert-script = csv-file: pkgs.writeScript "vanilla-forum-password-convert.rb" ''
|
||||
#!${pkgs.ruby}/bin/ruby
|
||||
|
||||
require 'csv'
|
||||
|
||||
data = CSV::readlines("${csv-file}")
|
||||
File::open(ENV["out"], "w") { |sql|
|
||||
data.each { |row|
|
||||
sql.puts("UPDATE users SET import_pass='#{row[2]}' FROM user_emails WHERE users.id = user_emails.user_id AND user_emails.email = '#{row[1]}';")
|
||||
}
|
||||
}
|
||||
'';
|
||||
|
||||
in {
|
||||
config = {
|
||||
services.discourse = {
|
||||
enable = true;
|
||||
hostname = site;
|
||||
enableACME = true;
|
||||
plugins = with config.services.discourse.package.plugins; [
|
||||
discourse-migratepassword
|
||||
];
|
||||
|
||||
admin = {
|
||||
username = "admin";
|
||||
fullName = "Admin";
|
||||
email = "admin@selby.ca";
|
||||
passwordFile = host-secrets.selby-discourse-admin.target-file;
|
||||
};
|
||||
|
||||
database = {
|
||||
name = database-name;
|
||||
host = "localhost";
|
||||
username = database-user;
|
||||
passwordFile =
|
||||
host-secrets.selby-discourse-database-passwd.target-file;
|
||||
};
|
||||
};
|
||||
|
||||
fudo = {
|
||||
secrets.host-secrets.${hostname} = let
|
||||
selby-discourse-db-password =
|
||||
pkgs.lib.passwd.stablerandom-passwd-file
|
||||
"selby-discourse-database-password"
|
||||
"selby-discourse-database-password-${config.instance.build-seed}";
|
||||
|
||||
files = config.fudo.secrets.files;
|
||||
in {
|
||||
selby-discourse-database-passwd = {
|
||||
source-file = selby-discourse-db-password;
|
||||
target-file = "/run/selby/forum/database.passwd";
|
||||
user = discourse-user;
|
||||
};
|
||||
|
||||
postgresql-selby-discourse-password = {
|
||||
source-file = selby-discourse-db-password;
|
||||
target-file = "/run/postgres/selby-discourse.passwd";
|
||||
user = config.services.postgresql.superUser;
|
||||
};
|
||||
|
||||
selby-discourse-admin = {
|
||||
source-file = pkgs.lib.passwd.stablerandom-passwd-file
|
||||
"selby-discourse-admin"
|
||||
"selby-discourse-admin-${config.instance.build-seed}";
|
||||
target-file = "/run/selby/forum/admin.passwd";
|
||||
user = discourse-user;
|
||||
};
|
||||
|
||||
selby-forum-data = {
|
||||
source-file = files.blobs."selby-forum-2021-12-14.clean";
|
||||
target-file = "/run/selby/forum/forum-data.txt";
|
||||
user = discourse-user;
|
||||
};
|
||||
|
||||
selby-forum-passwords-sql = {
|
||||
source-file = "${password-injector-sql files.blobs."forum_selby_ca-passwd.csv"}";
|
||||
target-file = "/run/postgres/selby/forum-passwords.sql";
|
||||
user = config.services.postgresql.superUser;
|
||||
};
|
||||
};
|
||||
|
||||
postgresql = {
|
||||
databases.${database-name}.users = [ "niten" ];
|
||||
users.${database-user} = {
|
||||
password-file = host-secrets.postgresql-selby-discourse-password.target-file;
|
||||
databases.${database-name} = {
|
||||
access = "CONNECT,CREATE";
|
||||
entity-access = {
|
||||
"ALL TABLES IN SCHEMA public" = "SELECT,INSERT,UPDATE,DELETE";
|
||||
"ALL SEQUENCES IN SCHEMA public" = "SELECT,UPDATE";
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
security.acme.certs.${site}.email = "admin@selby.ca";
|
||||
|
||||
systemd = {
|
||||
tmpfiles.rules = [
|
||||
"d ${state-directory} 750 ${discourse-user} - - -"
|
||||
"L /var/lib/discourse - - - - ${state-directory}"
|
||||
];
|
||||
|
||||
services = {
|
||||
discourse = {
|
||||
bindsTo = [ "postgresql.service" ];
|
||||
after = [
|
||||
config.fudo.postgresql.systemd-target
|
||||
"postgresql.service"
|
||||
];
|
||||
};
|
||||
|
||||
discourse-prepare = {
|
||||
description = "Do discourse's superuser-requiring database work for it.";
|
||||
wantedBy = [ "discourse.service" ];
|
||||
before = [ "discourse.service" ];
|
||||
requires = [ config.fudo.postgresql.systemd-target ];
|
||||
after = [ config.fudo.postgresql.systemd-target ];
|
||||
path = with pkgs; [ postgresql ];
|
||||
serviceConfig = {
|
||||
User = config.services.postgresql.superUser;
|
||||
ExecStart = pkgs.writeShellScript "discourse-prepare.sh" ''
|
||||
psql -d ${database-name} -c "CREATE EXTENSION IF NOT EXISTS hstore;"
|
||||
psql -d ${database-name} -c "CREATE EXTENSION IF NOT EXISTS pg_trgm;"
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
discourse-import-vanilla = let
|
||||
env-without-path =
|
||||
filterAttrs (attr: _: attr != "PATH")
|
||||
config.systemd.services.discourse.environment;
|
||||
selby-forum-data = host-secrets.selby-forum-data.target-file;
|
||||
in {
|
||||
description = "One-off job to import Vanilla forum.";
|
||||
path = config.systemd.services.discourse.path;
|
||||
environment = env-without-path;
|
||||
serviceConfig = {
|
||||
User = config.systemd.services.discourse.serviceConfig.User;
|
||||
Group = config.systemd.services.discourse.serviceConfig.Group;
|
||||
Type = "oneshot";
|
||||
WorkingDirectory = config.systemd.services.discourse.serviceConfig.WorkingDirectory;
|
||||
ExecStart = pkgs.writeShellScript "import-vanilla-forum.sh" ''
|
||||
ruby script/import_scripts/vanilla.rb ${selby-forum-data}
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
discourse-add-password-hash = let
|
||||
alter-user-script = pkgs.writeText "create-password-column.sql" ''
|
||||
ALTER TABLE users ADD COLUMN IF NOT EXISTS import_pass VARCHAR (64);
|
||||
'';
|
||||
in {
|
||||
description = "One-off job to add user password hashes from Vanilla forum.";
|
||||
path = with pkgs; [ postgresql ];
|
||||
wantedBy = [ "discourse.service" ];
|
||||
serviceConfig = {
|
||||
User = config.services.postgresql.superUser;
|
||||
Type = "oneshot";
|
||||
ExecStart = pkgs.writeShellScript "import-vanilla-passwords.sh" ''
|
||||
psql -d ${database-name} -f ${alter-user-script}
|
||||
psql -d ${database-name} -f ${host-secrets.selby-forum-passwords-sql.target-file}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -17,7 +17,7 @@ let
|
||||
|
||||
local-packages = with pkgs; [ ldns.examples ];
|
||||
|
||||
secrets = config.fudo.secrets.host-secrets.procul;
|
||||
host-secrets = config.fudo.secrets.host-secrets.procul;
|
||||
|
||||
passwd = pkgs.lib.fudo.passwd;
|
||||
|
||||
@@ -65,20 +65,35 @@ in {
|
||||
groups = { acme = { members = [ "nginx" ]; }; };
|
||||
};
|
||||
|
||||
informis.cl-gemini = {
|
||||
enable = true;
|
||||
informis = {
|
||||
cl-gemini = {
|
||||
enable = true;
|
||||
|
||||
hostname = "gemini.informis.land";
|
||||
server-ip = host-ipv4;
|
||||
document-root = "/srv/gemini/root";
|
||||
textfiles-archive = "${pkgs.textfiles}";
|
||||
slynk-port = 4005;
|
||||
hostname = "gemini.informis.land";
|
||||
server-ip = host-ipv4;
|
||||
document-root = "/srv/gemini/root";
|
||||
textfiles-archive = "${pkgs.textfiles}";
|
||||
slynk-port = 4005;
|
||||
|
||||
feeds = {
|
||||
viator = {
|
||||
title = "viator's phlog";
|
||||
path = "/home/viator/gemini-public/feed/";
|
||||
url = "gemini://informis.land/user/viator/feed/";
|
||||
feeds = {
|
||||
viator = {
|
||||
title = "viator's phlog";
|
||||
path = "/home/viator/gemini-public/feed/";
|
||||
url = "gemini://informis.land/user/viator/feed/";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
chute = {
|
||||
enable = true;
|
||||
stages = {
|
||||
staging = {
|
||||
package = pkgs.chuteUnstable;
|
||||
credential-file = host-secrets.chute-staging-credentials.target-file;
|
||||
currencies = {
|
||||
btc.stop-percentile = 98;
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
@@ -135,6 +150,12 @@ in {
|
||||
target-file = "/run/heimdal/master-key";
|
||||
user = config.fudo.auth.kdc.user;
|
||||
};
|
||||
|
||||
chute-staging-credentials = {
|
||||
source-file = files.service-secrets.procul."chute-staging.env";
|
||||
target-file = "/run/chute/staging/credentials.env";
|
||||
user = "root";
|
||||
};
|
||||
};
|
||||
|
||||
client.dns = {
|
||||
@@ -144,7 +165,14 @@ in {
|
||||
external-interface = "extif0";
|
||||
};
|
||||
|
||||
auth.kdc.master-key-file = secrets.heimdal-master-key.target-file;
|
||||
services = {
|
||||
auth = {
|
||||
kerberos = {
|
||||
state-directory = "/var/lib/kerberos";
|
||||
master-key-file = host-secrets.heimdal-master-key.target-file;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
secure-dns-proxy = {
|
||||
enable = true;
|
||||
@@ -210,13 +238,13 @@ in {
|
||||
enable = true;
|
||||
ssl-certificate = cert-copy.full-certificate;
|
||||
ssl-private-key = cert-copy.private-key;
|
||||
keytab = secrets.postgres-keytab.target-file;
|
||||
keytab = host-secrets.postgres-keytab.target-file;
|
||||
local-networks = local-networks;
|
||||
|
||||
users = {
|
||||
gituser = {
|
||||
password-file =
|
||||
secrets.gitea-database-password.target-file;
|
||||
host-secrets.gitea-database-password.target-file;
|
||||
databases = {
|
||||
git = {
|
||||
access = "CONNECT";
|
||||
@@ -242,7 +270,7 @@ in {
|
||||
database = {
|
||||
user = "gituser";
|
||||
password-file =
|
||||
secrets.gitea-database-password.target-file;
|
||||
host-secrets.gitea-database-password.target-file;
|
||||
hostname = "127.0.0.1";
|
||||
name = "git";
|
||||
};
|
||||
|
||||
@@ -0,0 +1,59 @@
|
||||
{ config, lib, pkgs, ... }:
|
||||
|
||||
with lib;
|
||||
let
|
||||
hostname = config.instance.hostname;
|
||||
domain-name = config.instance.local-domain;
|
||||
domain = config.fudo.domains.${domain-name};
|
||||
|
||||
served-domain = domain.primary-nameserver != null;
|
||||
|
||||
is-primary-nameserver = hostname == domain.primary-nameserver;
|
||||
|
||||
primary-nameserver = domain.primary-nameserver;
|
||||
primary-nameserver-ip = pkgs.lib.network.host-ipv4 config primary-nameserver;
|
||||
|
||||
in {
|
||||
config = mkIf (served-domain) {
|
||||
fudo.dns = {
|
||||
enable = is-primary-nameserver;
|
||||
|
||||
identity = "${hostname}.${domain-name}.";
|
||||
|
||||
nameservers = {
|
||||
ns1 = {
|
||||
ipv4-address = primary-nameserver-ip;
|
||||
description = "Primary ${domain-name} nameserver";
|
||||
};
|
||||
};
|
||||
|
||||
listen-ips = optionals is-primary-nameserver
|
||||
(pkgs.lib.network.host-ips config hostname);
|
||||
|
||||
domains = {
|
||||
${domain-name} = {
|
||||
dnssec = true;
|
||||
default-host = primary-nameserver-ip;
|
||||
gssapi-realm = domain.gssapi-realm;
|
||||
mx = optional (domain.primary-mailserver != null)
|
||||
domain.primary-mailserver;
|
||||
dmarc-report-address = "dmarc-report@${domain-name}";
|
||||
|
||||
zone-definition = let
|
||||
zone = config.fudo.zones.${domain-name};
|
||||
|
||||
make-dns-srv-record = hostname: {
|
||||
port = 53;
|
||||
host = hostname;
|
||||
};
|
||||
in zone // {
|
||||
srv-records = {
|
||||
tcp.domain = map make-dns-srv-record [ "ns1.${domain-name}" ];
|
||||
udp.domain = map make-dns-srv-record [ "ns1.${domain-name}" ];
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
};
|
||||
}
|
||||
@@ -3,7 +3,7 @@
|
||||
with lib;
|
||||
let
|
||||
hostname = config.instance.hostname;
|
||||
domain-name = config.instance.local-domain;
|
||||
domain-name = config.fudo.services.auth.domain;
|
||||
domain = config.fudo.domains.${domain-name};
|
||||
|
||||
ldap-server = elem hostname domain.ldap-servers;
|
||||
@@ -13,8 +13,18 @@ let
|
||||
|
||||
kerberized-domain = domain.kerberos-master != null;
|
||||
|
||||
optionalOrNull = pred: val: if pred then val else null;
|
||||
|
||||
cfg = config.fudo.services.auth;
|
||||
|
||||
in {
|
||||
options.fudo.services.auth = with types; {
|
||||
domain = mkOption {
|
||||
type = str;
|
||||
description = "Domain for which authentication server will operate.";
|
||||
default = config.fudo.hosts.${hostname}.domain;
|
||||
};
|
||||
|
||||
ldap = {
|
||||
hostname = mkOption {
|
||||
type = str;
|
||||
@@ -44,12 +54,17 @@ in {
|
||||
type = str;
|
||||
description = "Path (on the build server) to the KDC master key file.";
|
||||
};
|
||||
|
||||
ipropd-keytab = mkOption {
|
||||
type = nullOr str;
|
||||
description = "ipropd keytab for kerberos database propagation.";
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
config.fudo = {
|
||||
acme.host-domains.${hostname} = mkIf (ldap-server) {
|
||||
${cfg.hostname}.local-copies.openldap = {
|
||||
${cfg.ldap.hostname}.local-copies.openldap = {
|
||||
user = config.services.openldap.user;
|
||||
part-of = [ config.fudo.auth.ldap-server.systemd-target ];
|
||||
};
|
||||
@@ -59,7 +74,7 @@ in {
|
||||
ldap-server = mkIf (ldap-server)
|
||||
(let
|
||||
ldap-cert-copy =
|
||||
config.fudo.acme.host-domains.${hostname}.${cfg.hostname}.local-copies.openldap;
|
||||
config.fudo.acme.host-domains.${hostname}.${cfg.ldap.hostname}.local-copies.openldap;
|
||||
in {
|
||||
enable = ldap-server;
|
||||
base = "dc=fudo,dc=org";
|
||||
@@ -72,7 +87,7 @@ in {
|
||||
groups = config.fudo.groups;
|
||||
system-users = config.fudo.system-users;
|
||||
|
||||
state-directory = "${cfg.state-directory}/ldap";
|
||||
state-directory = "${cfg.ldap.state-directory}";
|
||||
|
||||
ssl-chain = ldap-cert-copy.chain;
|
||||
ssl-certificate = ldap-cert-copy.certificate;
|
||||
@@ -86,9 +101,11 @@ in {
|
||||
bind-addresses =
|
||||
(pkgs.lib.network.host-ips config hostname) ++
|
||||
[ "127.0.0.1" ] ++ (optional config.networking.enableIPv6 "::1");
|
||||
state-directory = cfg.kerberos.state-directory;
|
||||
master-key-file = cfg.kerberos.master-key-file;
|
||||
master-config = mkIf (kerberos-master) {
|
||||
acl = let
|
||||
admin-entries = genAttrs cfg.local-admins
|
||||
admin-entries = genAttrs config.instance.local-admins
|
||||
(admin: {
|
||||
perms = [ "add" "change-password" "list" ];
|
||||
});
|
||||
@@ -98,7 +115,7 @@ in {
|
||||
};
|
||||
slave-config = mkIf (kerberos-slave) {
|
||||
master-host = domain.kerberos-master;
|
||||
# TODO: Provide the keytab yourself...
|
||||
ipropd-keytab = cfg.kerberos.ipropd-keytab;
|
||||
};
|
||||
};
|
||||
};
|
||||
@@ -124,16 +141,16 @@ in {
|
||||
in {
|
||||
zone-definition.srv-records = {
|
||||
tcp = {
|
||||
kerberos = map (create-srv-record 88) kerberos-servers;
|
||||
kerberos-adm = map (create-srv-record 749) kerberos-masters;
|
||||
ldap = map (create-srv-record 389) ldap-servers;
|
||||
ldaps = map (create-srv-record 636) ldap-servers;
|
||||
kerberos = map (make-srv-record 88) kerberos-servers;
|
||||
kerberos-adm = map (make-srv-record 749) kerberos-masters;
|
||||
ldap = map (make-srv-record 389) ldap-servers;
|
||||
ldaps = map (make-srv-record 636) ldap-servers;
|
||||
};
|
||||
|
||||
udp = {
|
||||
kerberos = map (create-srv-record 88) kerberos-servers;
|
||||
kerberos-master = map (create-srv-record 88) kerberos-masters;
|
||||
kpasswd = map (create-srv-record 464) kerberos-masters;
|
||||
kerberos = map (make-srv-record 88) kerberos-servers;
|
||||
kerberos-master = map (make-srv-record 88) kerberos-masters;
|
||||
kpasswd = map (make-srv-record 464) kerberos-masters;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
@@ -74,7 +74,7 @@ in {
|
||||
site-config = {
|
||||
auth_method = "ldap";
|
||||
ldap_servers = cfg.ldap.servers;
|
||||
ldap_port = 636;
|
||||
ldap_port = 389;
|
||||
ldap_rootdn = "cn=${cfg.ldap.user},dc=fudo,dc=org";
|
||||
ldap_password = "__LDAP_PASSWORD__";
|
||||
ldap_base = "ou=members,dc=fudo,dc=org";
|
||||
|
||||
Reference in New Issue
Block a user