nixpkgs/nixos/modules/services/databases/openldap.nix

{ config, lib, pkgs, ... }:

with lib;
let
  cfg = config.services.openldap;
  openldap = cfg.package;

  configFile = pkgs.writeText "slapd.conf" ((optionalString (cfg.defaultSchemas != null && cfg.defaultSchemas) ''
    include ${openldap}/etc/schema/core.schema
    include ${openldap}/etc/schema/cosine.schema
    include ${openldap}/etc/schema/inetorgperson.schema
    include ${openldap}/etc/schema/nis.schema
  '') + ''
    pidfile /run/slapd/slapd.pid
    ${if cfg.extraConfig != null then cfg.extraConfig else ""}
    database ${cfg.database}
    suffix ${cfg.suffix}
    rootdn ${cfg.rootdn}
    ${if (cfg.rootpw != null) then ''
      rootpw ${cfg.rootpw}
    '' else ''
      include ${cfg.rootpwFile}
    ''}
    directory ${cfg.dataDir}
    ${if cfg.extraDatabaseConfig != null then cfg.extraDatabaseConfig else ""}
  '');

  configDir = if cfg.configDir != null then cfg.configDir else "/etc/openldap/slapd.d";

  ldapValueType = let
    singleLdapValueType = types.oneOf [
      types.str
      (types.submodule {
        options = {
          path = mkOption {
            type = types.path;
            description = ''
              A path containing the LDAP attribute. This is included at run-time, so
              is recommended for storing secrets.
            '';
          };
        };
      })
      (types.submodule {
        options = {
          base64 = mkOption {
            type = types.str;
            description = ''
              A base64-encoded LDAP attribute. Useful for storing values which
              contain special characters (e.g. newlines) in LDIF files.
            '';
          };
        };
      })
    ];
  in types.either singleLdapValueType (types.listOf singleLdapValueType);

  ldapAttrsType =
    let
      options = {
        attrs = mkOption {
          type = types.attrsOf ldapValueType;
          default = {};
          description = "Attributes of the parent entry.";
        };
        children = mkOption {
          # Hide the child attributes, to avoid infinite recursion in e.g. documentation
          # Actual Nix evaluation is lazy, so this is not an issue there
          type = let
            hiddenOptions = lib.mapAttrs (name: attr: attr // { visible = false; }) options;
          in types.attrsOf (types.submodule { options = hiddenOptions; });
          default = {};
          description = "Child entries of the current entry, with recursively the same structure.";
          example = lib.literalExample ''
          {
            "cn=schema" = {
              # The attribute used in the DN must be defined
              attrs = { cn = "schema"; };
              children = {
                # This entry's DN is expanded to "cn=foo,cn=schema"
                "cn=foo" = { ... };
              };
              # These includes are inserted after "cn=schema", but before "cn=foo,cn=schema"
              includes = [ ... ];
            };
          }
        '';
        };
        includes = mkOption {
          type = types.listOf types.path;
          default = [];
          description = ''
          LDIF files to include after the parent's attributes but before its children.
        '';
        };
      };
    in types.submodule { inherit options; };

  valueToLdif = attr: values: let
    listValues = if lib.isList values then values else lib.singleton values;
  in map (value:
    if lib.isAttrs value then
      if lib.hasAttr "path" value
      then "${attr}:< file://${value.path}"
      else "${attr}:: ${value.base64}"
    else "${attr}: ${lib.replaceStrings [ "\n" ] [ "\n " ] value}"
  ) listValues;

  attrsToLdif = dn: { attrs, children, includes, ... }: [''
    dn: ${dn}
    ${lib.concatStringsSep "\n" (lib.flatten (lib.mapAttrsToList valueToLdif attrs))}
  ''] ++ (map (path: "include: file://${path}\n") includes) ++ (
    lib.flatten (lib.mapAttrsToList (name: value: attrsToLdif "${name},${dn}" value) children)
  );
in {
  options = {
    services.openldap = {
      enable = mkOption {
        type = types.bool;
        default = false;
        description = "
          Whether to enable the ldap server.
        ";
      };

      package = mkOption {
        type = types.package;
        default = pkgs.openldap;
        description = ''
          OpenLDAP package to use.

          This can be used to, for example, set an OpenLDAP package
          with custom overrides to enable modules or other
          functionality.
        '';
      };

      user = mkOption {
        type = types.str;
        default = "openldap";
        description = "User account under which slapd runs.";
      };

      group = mkOption {
        type = types.str;
        default = "openldap";
        description = "Group account under which slapd runs.";
      };

      urlList = mkOption {
        type = types.listOf types.str;
        default = [ "ldap:///" ];
        description = "URL list slapd should listen on.";
        example = [ "ldaps:///" ];
      };

      settings = mkOption {
        type = ldapAttrsType;
        description = "Configuration for OpenLDAP, in OLC format";
        example = lib.literalExample ''
          {
            attrs.olcLogLevel = [ "stats" ];
            children = {
              "cn=schema".includes = [
                 "\${pkgs.openldap}/etc/schema/core.ldif"
                 "\${pkgs.openldap}/etc/schema/cosine.ldif"
                 "\${pkgs.openldap}/etc/schema/inetorgperson.ldif"
              ];
              "olcDatabase={-1}frontend" = {
                attrs = {
                  objectClass = "olcDatabaseConfig";
                  olcDatabase = "{-1}frontend";
                  olcAccess = [ "{0}to * by dn.exact=uidNumber=0+gidNumber=0,cn=peercred,cn=external,cn=auth manage stop by * none stop" ];
                };
              };
              "olcDatabase={0}config" = {
                attrs = {
                  objectClass = "olcDatabaseConfig";
                  olcDatabase = "{0}config";
                  olcAccess = [ "{0}to * by * none break" ];
                };
              };
              "olcDatabase={1}mdb" = {
                attrs = {
                  objectClass = [ "olcDatabaseConfig" "olcMdbConfig" ];
                  olcDatabase = "{1}mdb";
                  olcDbDirectory = "/var/db/ldap";
                  olcDbIndex = [
                    "objectClass eq"
                    "cn pres,eq"
                    "uid pres,eq"
                    "sn pres,eq,subany"
                  ];
                  olcSuffix = "dc=example,dc=com";
                  olcAccess = [ "{0}to * by * read break" ];
                };
              };
            };
          };
        '';
      };

      # These options are translated into settings
      dataDir = mkOption {
        type = types.nullOr types.path;
        default = "/var/db/openldap";
        description = "The database directory.";
      };

      defaultSchemas = mkOption {
        type = types.nullOr types.bool;
        default = true;

        description = ''
          Include the default schemas core, cosine, inetorgperson and nis.
        '';
      };

      database = mkOption {
        type = types.nullOr types.str;
        default = "mdb";
        description = "Backend to use for the first database.";
      };

      suffix = mkOption {
        type = types.nullOr types.str;
        default = null;
        example = "dc=example,dc=org";
        description = ''
          Specify the DN suffix of queries that will be passed to the first
          backend database.
        '';
      };

      rootdn = mkOption {
        type = types.nullOr types.str;
        default = null;
        example = "cn=admin,dc=example,dc=org";
        description = ''
          Specify the distinguished name that is not subject to access control
          or administrative limit restrictions for operations on this database.
        '';
      };

      rootpw = mkOption {
        type = types.nullOr types.str;
        default = null;
        description = ''
          Password for the root user.Using this option will store the root
          password in plain text in the world-readable nix store. To avoid this
          the <literal>rootpwFile</literal> can be used.
        '';
      };

      rootpwFile = mkOption {
        type = types.nullOr types.str;
        default = null;
        description = ''
          Password file for the root user.

          If the deprecated <literal>extraConfig</literal> or
          <literal>extraDatabaseConfig</literal> options are set, this should
          contain <literal>rootpw</literal> followed by the password
          (e.g. <literal>rootpw thePasswordHere</literal>).

          Otherwise the file should contain only the password (no trailing
          newline or leading <literal>rootpw</literal>).
        '';
      };

      logLevel = mkOption {
        type = types.nullOr (types.coercedTo types.str (lib.splitString " ") (types.listOf types.str));
        default = null;
        example = literalExample "[ \"acl\" \"trace\" ]";
        description = "The log level.";
      };

      # This option overrides settings
      configDir = mkOption {
        type = types.nullOr types.path;
        default = null;
        description = ''
          Use this optional config directory instead of generating one from the
          <literal>settings</literal> option.
        '';
        example = "/var/db/slapd.d";
      };

      # These options are deprecated
      extraConfig = mkOption {
        type = types.lines;
        default = "";
        description = "
          slapd.conf configuration
        ";
        example = literalExample ''
            '''
            include ${openldap}/etc/schema/core.schema
            include ${openldap}/etc/schema/cosine.schema
            include ${openldap}/etc/schema/inetorgperson.schema
            include ${openldap}/etc/schema/nis.schema

            database bdb
            suffix dc=example,dc=org
            rootdn cn=admin,dc=example,dc=org
            # NOTE: change after first start
            rootpw secret
            directory /var/db/openldap
            '''
          '';
      };

      declarativeContents = mkOption {
        type = with types; either lines (attrsOf lines);
        default = {};
        description = ''
          Declarative contents for the first LDAP database, in LDIF format.

          Note a few facts when using it. First, the database
          <emphasis>must</emphasis> be stored in the directory defined by
          <code>dataDir</code>. Second, all <code>dataDir</code> will be erased
          when starting the LDAP server. Third, modifications to the database
          are not prevented, they are just dropped on the next reboot of the
          server. Finally, performance-wise the database and indexes are rebuilt
          on each server startup, so this will slow down server startup,
          especially with large databases.
        '';
        example = ''
          dn: dc=example,dc=org
          objectClass: domain
          dc: example

          dn: ou=users,dc=example,dc=org
          objectClass = organizationalUnit
          ou: users

          # ...
        '';
      };

      extraDatabaseConfig = mkOption {
        type = types.lines;
        default = "";
        description = ''
          slapd.conf configuration after the database option.
          This setting will be ignored if configDir is set.
        '';
        example = ''
          # Indices to maintain for this directory
          # unique id so equality match only
          index uid eq
          # allows general searching on commonname, givenname and email
          index cn,gn,mail eq,sub
          # allows multiple variants on surname searching
          index sn eq,sub
          # sub above includes subintial,subany,subfinal
          # optimise department searches
          index ou eq
          # if searches will include objectClass uncomment following
          # index objectClass eq
          # shows use of default index parameter
          index default eq,sub
          # indices missing - uses default eq,sub
          index telephonenumber

          # other database parameters
          # read more in slapd.conf reference section
          cachesize 10000
          checkpoint 128 15
        '';
      };

    };

  };

  meta = {
    maintainers = with lib.maintainters; [ mic92 kwohlfahrt ];
  };

  # TODO: Check that dataDir/declarativeContents/configDir all match
  # - deprecate declarativeContents = ''...'';
  # - no declarativeContents = ''...'' if dataDir == null;
  # - no declarativeContents = { ... } if configDir != null
  config = mkIf cfg.enable {
    warnings = let
      deprecations = [
        { old = "logLevel"; new = "attrs.olcLogLevel"; }
        { old = "defaultSchemas";
          new = "children.\"cn=schema\".includes";
          newValue = "[\n    ${lib.concatStringsSep "\n    " [
            "\${pkgs.openldap}/etc/schema/core.ldif"
            "\${pkgs.openldap}/etc/schema/cosine.ldif"
            "\${pkgs.openldap}/etc/schema/inetorgperson.ldif"
            "\${pkgs.openldap}/etc/schema/nis.ldif"
          ]}\n  ]"; }
        { old = "database"; new = "children.\"cn={1}${cfg.database}\""; newValue = "{ }"; }
        { old = "suffix"; new = "children.\"cn={1}${cfg.database}\".attrs.olcSuffix"; }
        { old = "dataDir"; new = "children.\"cn={1}${cfg.database}\".attrs.olcDbDirectory"; }
        { old = "rootdn"; new = "children.\"cn={1}${cfg.database}\".attrs.olcRootDN"; }
        { old = "rootpw"; new = "children.\"cn={1}${cfg.database}\".attrs.olcRootPW"; }
        { old = "rootpwFile";
          new = "children.\"cn={1}${cfg.database}\".attrs.olcRootPW";
          newValue = "{ path = \"${cfg.rootpwFile}\"; }";
          note = "The file should contain only the password (without \"rootpw \" as before)"; }
      ];
    in (optional (cfg.extraConfig != "" || cfg.extraDatabaseConfig != "") ''
      The options `extraConfig` and `extraDatabaseConfig` of `services.openldap`
      are deprecated. This is due to the deprecation of `slapd.conf`
      upstream. Please migrate to `services.openldap.settings`.

      After deploying this configuration, you can run:
        slapcat -F ${configDir} -n0 -H 'ldap:///???(!(objectClass=olcSchemaConfig))'
      on the same host to print your current configuration in LDIF format, which
      should be straightforward to convert into Nix settings. This does not show
      your schema configuration (as this is unnecessarily verbose users of the
      default schemas), so be sure to migrate that as well.
    '') ++ (flatten (map (args@{old, new, ...}: lib.optional ((lib.hasAttr old cfg) && (lib.getAttr old cfg) != null) ''
      The attribute `services.openldap.${old}` is deprecated. Please set it to
      `null` and use the following option instead:

        services.openldap.settings.${new} = ${args.newValue or (
          let oldValue = (getAttr old cfg);
          in if (isList oldValue) then "[ ${concatStringsSep " " oldValue} ]" else oldValue
        )}
    '') deprecations));

    assertions = [{
      assertion = !(cfg.rootpwFile != null && cfg.rootpw != null);
      message = "services.openldap: at most one of rootpw or rootpwFile must be set";
    }];

    environment.systemPackages = [ openldap ];

    # Literal attributes must always be set (even if other top-level attributres are deprecated)
    services.openldap.settings = {
      attrs = {
        objectClass = "olcGlobal";
        cn = "config";
        olcPidFile = "/run/slapd/slapd.pid";
      } // (lib.optionalAttrs (cfg.logLevel != null) {
        olcLogLevel = cfg.logLevel;
      });
      children = {
        "cn=schema" = {
          attrs = {
            cn = "schema";
            objectClass = "olcSchemaConfig";
          };
          includes = lib.optionals (cfg.defaultSchemas != null && cfg.defaultSchemas) [
            "${openldap}/etc/schema/core.ldif"
            "${openldap}/etc/schema/cosine.ldif"
            "${openldap}/etc/schema/inetorgperson.ldif"
            "${openldap}/etc/schema/nis.ldif"
          ];
        };
      } // (lib.optionalAttrs (cfg.database != null) {
        "olcDatabase={1}${cfg.database}".attrs = {
          # objectClass is case-insensitive, so don't need to capitalize ${database}
          objectClass = [ "olcdatabaseconfig" "olc${cfg.database}config" ];
          olcDatabase = "{1}${cfg.database}";
        } // (lib.optionalAttrs (cfg.suffix != null) {
          olcSuffix = cfg.suffix;
        }) // (lib.optionalAttrs (cfg.dataDir != null) {
          olcDbDirectory = cfg.dataDir;
        }) // (lib.optionalAttrs (cfg.rootdn != null) {
          olcRootDN = cfg.rootdn; # TODO: Optional
        }) // (lib.optionalAttrs (cfg.rootpw != null || cfg.rootpwFile != null) {
          olcRootPW = (if cfg.rootpwFile != null then { path = cfg.rootpwFile; } else cfg.rootpw); # TODO: Optional
        });
      });
    };

    systemd.services.openldap = {
      description = "LDAP server";
      wantedBy = [ "multi-user.target" ];
      after = [ "network.target" ];
      preStart = let
        dbSettings = lib.filterAttrs (name: value: lib.hasPrefix "olcDatabase=" name) cfg.settings.children;
        dataDirs = lib.mapAttrs' (name: value: lib.nameValuePair value.attrs.olcSuffix value.attrs.olcDbDirectory)
          (lib.filterAttrs (_: value: value.attrs ? olcDbDirectory) dbSettings);
        settingsFile = pkgs.writeText "config.ldif" (lib.concatStringsSep "\n" (attrsToLdif "cn=config" cfg.settings));
      in ''
        mkdir -p /run/slapd
        chown -R "${cfg.user}:${cfg.group}" /run/slapd

        mkdir -p ${lib.escapeShellArg configDir} ${lib.escapeShellArgs (lib.attrValues dataDirs)}
        chown "${cfg.user}:${cfg.group}" ${lib.escapeShellArg configDir} ${lib.escapeShellArgs (lib.attrValues dataDirs)}

        ${lib.optionalString (cfg.configDir == null) (
          if (cfg.extraConfig != "" || cfg.extraDatabaseConfig != "") then ''
            rm -Rf ${configDir}/*
            # -u disables config generation, so just ignore the return code
            ${openldap}/bin/slaptest -f ${configFile} -F ${configDir} || true
          '' else ''
            rm -Rf ${configDir}/*
            ${openldap}/bin/slapadd -F ${configDir} -bcn=config -l ${settingsFile}
          ''
        )}
        chown -R "${cfg.user}:${cfg.group}" ${lib.escapeShellArg configDir}

        ${if types.lines.check cfg.declarativeContents then (let
          dataFile = pkgs.writeText "ldap-contents.ldif" cfg.declarativeContents;
        in ''
          rm -rf ${lib.escapeShellArg cfg.dataDir}/*
          ${openldap}/bin/slapadd -F ${lib.escapeShellArg configDir} -l ${dataFile}
          chown -R "${cfg.user}:${cfg.group}" ${lib.escapeShellArg cfg.dataDir}
        '') else (let
          dataFiles = lib.mapAttrs (dn: contents: pkgs.writeText "${dn}.ldif" contents) cfg.declarativeContents;
        in ''
          ${lib.concatStrings (lib.mapAttrsToList (dn: file: let
            dataDir = lib.escapeShellArg (getAttr dn dataDirs);
          in ''
            rm -rf ${dataDir}/*
            ${openldap}/bin/slapadd -F ${lib.escapeShellArg configDir} -b ${dn} -l ${file}
            chown -R "${cfg.user}:${cfg.group}" ${dataDir}
          '') dataFiles)}
        '')}

        ${openldap}/bin/slaptest -u -F ${lib.escapeShellArg configDir}
      '';
      serviceConfig = {
        ExecStart = lib.escapeShellArgs ([
          "${openldap}/libexec/slapd" "-u" cfg.user "-g" cfg.group "-F" configDir
          "-h" (lib.concatStringsSep " " cfg.urlList)
        ]);
        Type = "forking";
        PIDFile = cfg.settings.attrs.olcPidFile;
      };
    };

    users.users = lib.optionalAttrs (cfg.user == "openldap") {
      openldap = {
        group = cfg.group;
        isSystemUser = true;
      };
    };

    users.groups = lib.optionalAttrs (cfg.group == "openldap") {
      openldap = {};
    };
  };
}