Raphaël Numbus
84 lines
2.4 KiB
Nix
84 lines
2.4 KiB
Nix
{ config, pkgs, lib, ... }:
|
|
|
|
with lib;
|
|
|
|
let
|
|
# Container config
|
|
name = "lldap";
|
|
# Version tagging
|
|
lldapVersion = "v0.6.2";
|
|
# Helper
|
|
helper = import ../service-helper.nix { inherit config pkgs lib; };
|
|
cfg = config.numbus-server.services.lldap;
|
|
# Derive Base DN from domain (e.g., example.com -> dc=example,dc=com)
|
|
domainParts = splitString "." config.numbus-server.services.domain;
|
|
baseDN = concatStringsSep "," (map (p: "dc=${p}") domainParts);
|
|
in
|
|
|
|
helper.mkPodmanService {
|
|
inherit name;
|
|
pod = "false";
|
|
description = "LLDAP, unified user management";
|
|
defaultPort = "17170";
|
|
dependencies = [
|
|
"sops-install-secrets.service"
|
|
"network-online.target"
|
|
];
|
|
middlewares = [
|
|
"secureHeaders"
|
|
];
|
|
dirPermissions = [
|
|
"100999:100 ${cfg.configDir}"
|
|
];
|
|
secrets = [
|
|
"lldap/jwt_secret"
|
|
"lldap/key_seed"
|
|
"lldap/admin_password"
|
|
];
|
|
|
|
composeText = ''
|
|
services:
|
|
lldap:
|
|
image: lldap/lldap:${lldapVersion}
|
|
container_name: lldap
|
|
hostname: lldap
|
|
user: '1000:1000'
|
|
networks:
|
|
lldap:
|
|
ipv4_address: 10.89.185.253
|
|
ports:
|
|
- "3890:3890"
|
|
- "${cfg.port}:17170"
|
|
volumes:
|
|
- ${cfg.configDir}:/data
|
|
environment:
|
|
- UID=1000
|
|
- GID=1000
|
|
- TZ=${config.time.timeZone}
|
|
- LLDAP_LDAP_BASE_DN=${baseDN}
|
|
- LLDAP_JWT_SECRET="${config.sops.placeholder."lldap/jwt_secret"}"
|
|
- LLDAP_KEY_SEED="${config.sops.placeholder."lldap/key_seed"}"
|
|
- LLDAP_LDAP_USER_PASS="${config.sops.placeholder."lldap/admin_password"}"
|
|
- LLDAP_SMTP_OPTIONS__ENABLE_PASSWORD_RESET=true
|
|
- LLDAP_SMTP_OPTIONS__SERVER=${config.numbus-server.mail.smtpServer}
|
|
- LLDAP_SMTP_OPTIONS__PORT=${config.numbus-server.mail.smtpPort}
|
|
- LLDAP_SMTP_OPTIONS__SMTP_ENCRYPTION=${config.numbus-server.mail.smtpEncryption}
|
|
- LLDAP_SMTP_OPTIONS__USER=${config.numbus-server.mail.smtpUsername}
|
|
- LLDAP_SMTP_OPTIONS__PASSWORD=${config.sops.placeholder."mail/smtpPassword"}
|
|
- LLDAP_SMTP_OPTIONS__FROM=no-reply <${config.numbus-server.mail.fromAddress}>
|
|
security_opt:
|
|
- no-new-privileges:true
|
|
cap_drop:
|
|
- NET_RAW
|
|
restart: unless-stopped
|
|
|
|
networks:
|
|
lldap:
|
|
driver: bridge
|
|
name: lldap
|
|
ipam:
|
|
config:
|
|
- subnet: "10.89.185.0/24"
|
|
gateway: "10.89.185.254"
|
|
'';
|
|
} |