1 files changed, 15 insertions, 0 deletions
diff --git a/ops/nixos/tvl-slapd/default.nix b/ops/nixos/tvl-slapd/default.nix
index a85f9019ce..2c0f2fd5a1 100644
--- a/ops/nixos/tvl-slapd/default.nix
+++ b/ops/nixos/tvl-slapd/default.nix
@@ -98,6 +98,17 @@ let
     }
   ];
 in {
+  # Use our patched OpenLDAP derivation which enables stronger password hashing.
+  #
+  # Unfortunately the module for OpenLDAP has no package option, so we
+  # need to override it system-wide. Be aware that this triggers a
+  # *large* number of rebuilds of packages such as GPG and Python.
+  nixpkgs.overlays = [
+    (_: _: {
+      inherit (config.depot.third_party) openldap;
+    })
+  ];
+
   services.openldap = {
     enable = true;
     dataDir = "/var/lib/openldap";
@@ -117,6 +128,10 @@ in {
       access to * by * read
     '';
 
+    extraConfig = ''
+      moduleload pw-argon2
+    '';
+
     # Contents are immutable at runtime, and adding user accounts etc.
     # is done statically in the LDIF-formatted contents in this folder.
     declarativeContents = ''