nixcfg/machines/manager/ldap.nix

{ pkgs, lib, config, inputs, mkCert, ... }:

with lib;

let
  ldap-sync =
    let
      wrapped = pkgs.callPackage inputs.ldap-sync { };
      env = pkgs.runCommand "ldap-sync-env" { } ''
        mkdir -p $out
        ln -s ${config.sops.secrets."ldap/sync/config".path} $out/ldap-sync.properties
      '';
    in
    pkgs.runCommand "ldap-sync-wrapper"
      {
        nativeBuildInputs = [ pkgs.makeWrapper ];
      } ''
      mkdir -p $out/bin
      makeWrapper "${wrapped}/bin/ldap-sync" $out/bin/ldap-sync \
        --chdir "${env}"
    '';

  baseDN = concatMapStringsSep ","
    (part: "dc=${part}")
    (splitString "." config.networking.domain);

  cert = mkCert "ldap.${config.networking.domain}";

  cyrus_sasl = pkgs.cyrus_sasl.override {
    enableLdap = true;
  };
in
{
  services.openldap = {
    enable = true;
    package = (pkgs.openldap.overrideAttrs (final: prev: {
      configureFlags = prev.configureFlags ++ [
        "--enable-overlays"
        "--enable-remoteauth"
        "--enable-spasswd"
        "--with-cyrus-sasl"
      ];
    })).override {
      inherit cyrus_sasl;
    };

    urlList = [ "ldap:///" "ldaps:///" ];

    settings = {
      attrs = {
        olcLogLevel = "config ACL stats stats2 trace";

        olcTLSCACertificateFile = "${cert}/ca.pem";
        olcTLSCertificateFile = "${cert}/cert.pem";
        olcTLSCertificateKeyFile = "${cert}/key.pem";
        olcTLSCRLCheck = "none";
        olcTLSVerifyClient = "never";
        olcTLSProtocolMin = "3.1";

        #olcSecurity = "tls=1";

        olcSaslHost = "localhost";
        olcSaslSecProps = "none";
      };

      children = {
        "cn=schema".includes = [
          "${config.services.openldap.package}/etc/schema/core.ldif"
          "${config.services.openldap.package}/etc/schema/cosine.ldif"
          "${config.services.openldap.package}/etc/schema/inetorgperson.ldif"
          "${config.services.openldap.package}/etc/schema/nis.ldif"
        ];
        "olcDatabase={1}mdb" = {
          attrs = {
            objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];

            olcDatabase = "{1}mdb";
            olcDbDirectory = "/var/lib/openldap/db";

            olcSuffix = baseDN;

            olcRootDN = "cn=root,${baseDN}";
            olcRootPW.path = config.sops.secrets."ldap/root/password".path;

            olcDbIndex = [
              "uid,uidNumber pres,eq"
              "cn,sn pres,eq,sub"
              "objectClass eq"
            ];

            olcAccess = [
              # Custom access rules for userPassword attributes
              ''{0}to attrs=userPassword
                  by self read
                  by anonymous auth
                  by * none
              ''

              # Synced is managed by sync
              ''{1}to dn.subtree="ou=synced,ou=users,dc=hpc,dc=informatik,dc=hs-fulda,dc=de"
                  by dn.base="cn=sync,dc=hpc,dc=informatik,dc=hs-fulda,dc=de" manage
                  by * break
              ''

              # Allow login to read users
              ''{2}to dn.subtree="ou=users,dc=hpc,dc=informatik,dc=hs-fulda,dc=de"
                  by dn.base="cn=login,dc=hpc,dc=informatik,dc=hs-fulda,dc=de" read
                  by self read
                  by * break
              ''

              # Prevent access
              ''{3}to *
                  by * none
              ''
            ];
          };

          children = {
            "olcOverlay={0}remoteauth" = {
              attrs = {
                objectClass = [ "olcOverlayConfig" "olcRemoteAuthCfg" ];

                olcOverlay = "{0}remoteauth";

                olcRemoteAuthTLS = "starttls=yes tls_cacert=\"/etc/ssl/certs/ca-certificates.crt\"";
                olcRemoteAuthDNAttribute = "seeAlso";
                olcRemoteAuthDomainAttribute = "associatedDomain";
                olcRemoteAuthDefaultDomain = "upstream";
                olcRemoteAuthDefaultRealm = "file://${config.sops.secrets."ldap/upstream/list".path}";
                olcRemoteAuthRetryCount = "3";
                olcRemoteAuthStore = "false";
              };
            };
          };
        };
      };
    };
  };

  systemd.services.openldap = {
    environment = {
      SASL_PATH = pkgs.writeTextFile {
        name = "openldap-sasl-path";
        destination = "/slapd.conf";
        text = ''
          pwcheck_method: saslauthd
          saslauthd_path: /var/run/saslauthd/mux
          mech_list: GSSAPI EXTERNAL PLAIN NTLM
        '';
      };
    };
  };

  systemd.services."ldap-sync" = {
    script = "${ldap-sync}/bin/ldap-sync";
    startAt = "hourly";

    # Flush caches
    postStop = ''
      ${config.services.nscd.package}/bin/nscd --invalidate=group
      ${config.services.nscd.package}/bin/nscd --invalidate=passwd
    '';
  };

  networking.firewall.allowedTCPPorts = [
    389
    636
  ];

  sops.secrets."ldap/root/password" = {
    owner = "openldap";
  };

  sops.secrets."ldap/sync/config" = {
    format = "binary";
    sopsFile = ./secrets/ldap-sync.conf;
  };

  sops.secrets."ldap/upstream/list" = {
    format = "binary";
    sopsFile = ./secrets/ldap-upstream.list;
    owner = "openldap";
  };

  hpc.hostFile.aliases = [
    "ldap.${config.networking.domain}"
  ];
}