mirror of
https://github.com/foo-dogsquared/nixos-config.git
synced 2025-01-31 22:57:55 +00:00
Gabriel Arazas
2e7cdeacf3
It is more explicit and elegant but more of a pain to manage especially with the new function. It was structured that way for other hosts' secrets but it isn't really used in practice. We could just enforce a convention such as a `hosts` prefix to contain those secrets.
70 lines
2.1 KiB
Nix
70 lines
2.1 KiB
Nix
# The LDAP server of choice. Though, it really uses OpenLDAP as the backend so
|
|
# it's really more like a nice frontend for it so you don't have to experience
|
|
# the pain of managing an OpenLDAP server.
|
|
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
ldapDomain = "ldap.${config.networking.fqdn}";
|
|
portunusUser = config.users.users."${config.services.portunus.user}".name;
|
|
in
|
|
{
|
|
sops.secrets = lib.getSecrets ../../secrets/secrets.yaml {
|
|
"ldap/users/foodogsquared/password".owner = portunusUser;
|
|
};
|
|
|
|
services.portunus = {
|
|
enable = true;
|
|
|
|
port = 8168;
|
|
domain = ldapDomain;
|
|
|
|
ldap = {
|
|
searchUserName = "admin";
|
|
suffix = "dc=foodogsquared,dc=one";
|
|
};
|
|
|
|
seedPath =
|
|
let
|
|
seedData = {
|
|
groups = [
|
|
{
|
|
name = "admin-team";
|
|
long_name = "Portunus Administrators";
|
|
members = [ "foodogsquared" ];
|
|
permissions = {
|
|
portunus.is_admin = true;
|
|
ldap.can_read = true;
|
|
};
|
|
}
|
|
];
|
|
users = [
|
|
{
|
|
login_name = "foodogsquared";
|
|
given_name = "Gabriel";
|
|
family_name = "Arazas";
|
|
email = "foodogsquared@foodogsquared.one";
|
|
ssh_public_keys =
|
|
let
|
|
readFiles = list: lib.lists.map (path: lib.readFile path) list;
|
|
in
|
|
readFiles [
|
|
../../../../users/home-manager/foo-dogsquared/files/ssh-key.pub
|
|
../../../../users/home-manager/foo-dogsquared/files/ssh-key-2.pub
|
|
];
|
|
password.from_command = [ "${pkgs.coreutils}/bin/cat" config.sops.secrets."ldap/users/foodogsquared/password".path ];
|
|
}
|
|
];
|
|
};
|
|
settingsFormat = pkgs.formats.json { };
|
|
in
|
|
settingsFormat.generate "portunus-seed" seedData;
|
|
};
|
|
|
|
# Getting this to be accessible in the reverse proxy of choice.
|
|
services.nginx.virtualHosts."${ldapDomain}" = {
|
|
locations."/" = {
|
|
proxyPass = "http://localhost:${toString config.services.portunus.port}";
|
|
};
|
|
};
|
|
}
|