148 lines
4 KiB
Nix
148 lines
4 KiB
Nix
{ config, lib, pkgs, ... }:
|
|
|
|
let
|
|
inherit (lib) types;
|
|
|
|
cfg = config.mine.lldap_provision;
|
|
|
|
# helpers
|
|
_configFile = {
|
|
user_attributes = lib.mapAttrsToList (n: v: v) cfg.user_attributes;
|
|
group_attributes = lib.mapAttrsToList (n: v: v) cfg.group_attributes;
|
|
users = lib.mapAttrsToList (n: v: v // {
|
|
user_id = if v ? user_id then v.user_id else n;
|
|
}) cfg.users;
|
|
groups = lib.mapAttrsToList (n: v: v // {
|
|
display_name = if v ? display_name then v.display_name else n;
|
|
}) cfg.groups;
|
|
};
|
|
configFile = (pkgs.formats.json {}).generate "lldap-declarative.json" _configFile;
|
|
|
|
# opts
|
|
optsAttributes = { name, config, ... }: {
|
|
options = {
|
|
name = lib.mkOption {
|
|
type = types.str;
|
|
default = name;
|
|
description = "The name of the attribute";
|
|
};
|
|
|
|
attributeType = lib.mkOption {
|
|
type = types.enum [ "STRING" "INTEGER" "JPEG_PHOTO" "DATE_TIME" ];
|
|
description = "Type of the attribute";
|
|
};
|
|
|
|
isList = lib.mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "Is this attribute a list (multiple values for this attribute)";
|
|
};
|
|
|
|
isEditable = lib.mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "Should the user be able to edit this value?";
|
|
};
|
|
|
|
isVisible = lib.mkOption {
|
|
type = types.bool;
|
|
default = false;
|
|
description = "Should the user be able to see this value?";
|
|
};
|
|
};
|
|
};
|
|
|
|
in {
|
|
options = {
|
|
mine.lldap_provision = {
|
|
enable = lib.mkEnableOption "LLDAP declarative setup";
|
|
|
|
url = lib.mkOption {
|
|
type = types.str;
|
|
default = config.services.lldap.settings.http_url;
|
|
description = "URL for the LLDAP instance";
|
|
|
|
};
|
|
|
|
username = lib.mkOption {
|
|
type = types.str;
|
|
description = "Username to use when signing into lldap";
|
|
};
|
|
|
|
passwordFile = lib.mkOption {
|
|
type = types.path;
|
|
description = "Path for the password file to authenticate the user";
|
|
};
|
|
|
|
group_attributes = lib.mkOption {
|
|
type = types.attrsOf (types.submodule optsAttributes);
|
|
default = {};
|
|
};
|
|
|
|
user_attributes = lib.mkOption {
|
|
type = types.attrsOf (types.submodule optsAttributes);
|
|
default = {};
|
|
};
|
|
|
|
users = lib.mkOption {
|
|
type = types.attrsOf types.anything;
|
|
default = {};
|
|
example = {
|
|
user1 = {
|
|
password = "env:LLDAP_USER1_PASSWORD";
|
|
mail = "something@something.dk";
|
|
|
|
foo = "value for user attribute foo";
|
|
bar = "value for user attribute bar";
|
|
groups = [ "group1" "group2" ];
|
|
};
|
|
user2 = { user_id = "superuserawesome"; };
|
|
};
|
|
};
|
|
|
|
groups = lib.mkOption {
|
|
type = types.attrsOf types.anything;
|
|
default = {};
|
|
example = {
|
|
base_member = {
|
|
foo = "value for group attribute foo";
|
|
bar = "value for group attribute bar";
|
|
};
|
|
system = {
|
|
display_name = "system_service - override display_name";
|
|
};
|
|
testgroup = {};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
systemd.services.lldapsetup = {
|
|
description = "setup lldap declaratively";
|
|
wantedBy = [ config.systemd.services.lldap.name "multi-user.target" ];
|
|
after = [ config.systemd.services.lldap.name ];
|
|
|
|
environment = {
|
|
LLDAP_URL = cfg.url;
|
|
LLDAP_USERNAME = cfg.username;
|
|
LLDAP_PASSWORD = "file:${cfg.passwordFile}";
|
|
};
|
|
|
|
path = with pkgs; [
|
|
lldap
|
|
];
|
|
|
|
script = let
|
|
pythonEnv = pkgs.python3.withPackages(ps: with ps; [ gql aiohttp requests ]);
|
|
pythonDir = pkgs.runCommand "lldap-bootstrap" {} ''
|
|
mkdir -p $out/bootstrap
|
|
cp -a ${./.}/. $out/bootstrap
|
|
'';
|
|
in ''
|
|
cd ${pythonDir}
|
|
${pythonEnv}/bin/python -m bootstrap.main ${configFile}
|
|
'';
|
|
};
|
|
};
|
|
}
|