NixOS configuration for HPC cluster https://docs.hpc.informatik.hs-fulda.de/
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
 
 
 

183 lines
5.0 KiB

{ pkgs, lib, config, inputs, mkCert, ... }:
with lib;
let
ldap-sync =
let
wrapped = pkgs.callPackage inputs.ldap-sync { };
env = pkgs.runCommand "ldap-sync-env" { } ''
mkdir -p $out
ln -s ${config.sops.secrets."ldap/sync/config".path} $out/ldap-sync.properties
'';
in
pkgs.runCommand "ldap-sync-wrapper"
{
nativeBuildInputs = [ pkgs.makeWrapper ];
} ''
mkdir -p $out/bin
makeWrapper "${wrapped}/bin/ldap-sync" $out/bin/ldap-sync \
--chdir "${env}"
'';
baseDN = concatMapStringsSep ","
(part: "dc=${part}")
(splitString "." config.networking.domain);
cert = mkCert "ldap.${config.networking.domain}";
cyrus_sasl = pkgs.cyrus_sasl.override {
enableLdap = true;
};
in
{
services.openldap = {
enable = true;
package = (pkgs.openldap.overrideAttrs (final: prev: {
configureFlags = prev.configureFlags ++ [
"--enable-overlays"
"--enable-remoteauth"
"--enable-spasswd"
"--with-cyrus-sasl"
];
})).override {
inherit cyrus_sasl;
};
urlList = [ "ldap:///" "ldaps:///" ];
settings = {
attrs = {
olcLogLevel = "config ACL stats stats2 trace";
olcTLSCACertificateFile = "${cert}/ca.pem";
olcTLSCertificateFile = "${cert}/cert.pem";
olcTLSCertificateKeyFile = "${cert}/key.pem";
olcTLSCRLCheck = "none";
olcTLSVerifyClient = "never";
olcTLSProtocolMin = "3.1";
#olcSecurity = "tls=1";
olcSaslHost = "localhost";
olcSaslSecProps = "none";
};
children = {
"cn=schema".includes = [
"${config.services.openldap.package}/etc/schema/core.ldif"
"${config.services.openldap.package}/etc/schema/cosine.ldif"
"${config.services.openldap.package}/etc/schema/inetorgperson.ldif"
"${config.services.openldap.package}/etc/schema/nis.ldif"
];
"olcDatabase={1}mdb" = {
attrs = {
objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
olcDatabase = "{1}mdb";
olcDbDirectory = "/var/lib/openldap/db";
olcSuffix = baseDN;
olcRootDN = "cn=root,${baseDN}";
olcRootPW.path = config.sops.secrets."ldap/root/password".path;
olcAccess = [
# Custom access rules for userPassword attributes
''{0}to attrs=userPassword
by self read
by anonymous auth
by * none
''
# Synced is managed by sync
''{1}to dn.subtree="ou=synced,ou=users,dc=hpc,dc=informatik,dc=hs-fulda,dc=de"
by dn.base="cn=sync,dc=hpc,dc=informatik,dc=hs-fulda,dc=de" manage
by * break
''
# Allow login to read users
''{2}to dn.subtree="ou=users,dc=hpc,dc=informatik,dc=hs-fulda,dc=de"
by dn.base="cn=login,dc=hpc,dc=informatik,dc=hs-fulda,dc=de" read
by self read
by * break
''
# Prevent access
''{3}to *
by * none
''
];
};
children = {
"olcOverlay={0}remoteauth" = {
attrs = {
objectClass = [ "olcOverlayConfig" "olcRemoteAuthCfg" ];
olcOverlay = "{0}remoteauth";
olcRemoteAuthTLS = "starttls=yes tls_cacert=\"/etc/ssl/certs/ca-certificates.crt\"";
olcRemoteAuthDNAttribute = "seeAlso";
olcRemoteAuthDomainAttribute = "associatedDomain";
olcRemoteAuthDefaultDomain = "upstream";
olcRemoteAuthDefaultRealm = "file://${config.sops.secrets."ldap/upstream/list".path}";
olcRemoteAuthRetryCount = "3";
olcRemoteAuthStore = "false";
};
};
};
};
};
};
};
systemd.services.openldap = {
environment = {
SASL_PATH = pkgs.writeTextFile {
name = "openldap-sasl-path";
destination = "/slapd.conf";
text = ''
pwcheck_method: saslauthd
saslauthd_path: /var/run/saslauthd/mux
mech_list: GSSAPI EXTERNAL PLAIN NTLM
'';
};
};
};
systemd.services."ldap-sync" = {
script = "${ldap-sync}/bin/ldap-sync";
startAt = "hourly";
# Flush caches
postStop = ''
${config.services.nscd.package}/bin/nscd --invalidate=group
${config.services.nscd.package}/bin/nscd --invalidate=passwd
'';
};
networking.firewall.allowedTCPPorts = [
389
636
];
sops.secrets."ldap/root/password" = {
owner = "openldap";
};
sops.secrets."ldap/sync/config" = {
format = "binary";
sopsFile = ./secrets/ldap-sync.conf;
};
sops.secrets."ldap/upstream/list" = {
format = "binary";
sopsFile = ./secrets/ldap-upstream.list;
owner = "openldap";
};
hpc.hostFile.aliases = [
"ldap.${config.networking.domain}"
];
}