about summary refs log tree commit diff
path: root/ops/nixos/modules/tvl-slapd/default.nix
diff options
context:
space:
mode:
authorVincent Ambo <tazjin@google.com>2020-06-08T00·08+0100
committerVincent Ambo <tazjin@google.com>2020-06-11T21·13+0000
commit740b4b37fcfbe3d212c67ea855a8c3d3a0a2197b (patch)
treeb9d098657a94b5109d434324702eee9fe92ae3fd /ops/nixos/modules/tvl-slapd/default.nix
parentafe0841e9d696d3ac8ff447909c416c48ba90836 (diff)
feat(ops/nixos/modules): Add TVL slapd module r/898
This initialises an OpenLDAP server for tvl.fyi

This is the least annoying way to bootstrap Gerrit. Yep.
Diffstat (limited to 'ops/nixos/modules/tvl-slapd/default.nix')
-rw-r--r--ops/nixos/modules/tvl-slapd/default.nix30
1 files changed, 30 insertions, 0 deletions
diff --git a/ops/nixos/modules/tvl-slapd/default.nix b/ops/nixos/modules/tvl-slapd/default.nix
new file mode 100644
index 000000000000..294a6636d719
--- /dev/null
+++ b/ops/nixos/modules/tvl-slapd/default.nix
@@ -0,0 +1,30 @@
+# Configures an OpenLDAP instance for TVL
+#
+# TODO(tazjin): Configure ldaps://
+{ pkgs, config, ... }:
+
+{
+  services.openldap = {
+    enable = true;
+    dataDir = "/var/lib/openldap";
+    suffix = "dc=tvl,dc=fyi";
+    rootdn = "cn=admin,dc=tvl,dc=fyi";
+    rootpw = "{SSHA}yEEO6Ol2W3ritdiJzPSsjOtyPGxWF2JW";
+
+    # Contents are immutable at runtime, and adding user accounts etc.
+    # is done statically in the LDIF-formatted contents in this folder.
+    declarativeContents = builtins.readFile ./contents.ldif;
+
+    # ACL configuration
+    extraDatabaseConfig = ''
+      # Allow users to change their own password
+      access to attrs=userPassword
+        by self write
+        by anonymous auth
+        by users none
+
+      # Allow default read access to other directory elements
+      access to * by * read
+    '';
+  };
+}