feat(monorepo-gerrit): Configure Gerrit for LDAP authentication r/899

1 files changed, 15 insertions, 0 deletions

diff --git a/ops/nixos/modules/monorepo-gerrit.nix b/ops/nixos/modules/monorepo-gerrit.nix
index 2b8e5e7738..6721b1c5fd 100644
--- a/ops/nixos/modules/monorepo-gerrit.nix
+++ b/ops/nixos/modules/monorepo-gerrit.nix
@@ -11,6 +11,21 @@
       log.jsonLogging = true;
       log.textLogging = false;
       # TODO: gitweb config
+
+      # Configures integration with the locally running OpenLDAP
+      auth.type = "LDAP";
+      ldap = {
+        server = "ldap://localhost";
+        accountBase = "ou=users,dc=tvl,dc=fyi";
+        accountPattern = "(&(objectClass=organizationalPerson)(cn=\${username}))";
+        accountFullName = "cn";
+        accountEmailAddress = "mail";
+        groupBase = "ou=groups,dc=tvl,dc=fyi";
+        gerrit.canonicalWebUrl = "https://cl.tvl.fyi";
+
+        # TODO(tazjin): Assuming this is what we'll be doing ...
+        groupMemberPattern = "(&(objectClass=group)(member=\${dn}))";
+      };
     };
   };
 }