From c3134e1e586c5548ac41f12c35876d7fc3793355 Mon Sep 17 00:00:00 2001 From: Fugi Date: Wed, 18 Jan 2023 14:12:03 +0100 Subject: [PATCH] Synapse LDAP config, add Portunus search user, update flake --- config/portunus_seeds.json | 15 ++++++++++ flake.lock | 18 +++++------ modules/ldap.nix | 23 +++++++++----- modules/matrix.nix | 61 ++++++++++++++++++++++++-------------- secrets/quitte.yaml | 5 ++-- secrets/test.yaml | 5 ++-- 6 files changed, 83 insertions(+), 44 deletions(-) diff --git a/config/portunus_seeds.json b/config/portunus_seeds.json index 5b213fd..b73bf07 100644 --- a/config/portunus_seeds.json +++ b/config/portunus_seeds.json @@ -26,6 +26,15 @@ "portunus": { "is_admin": false }, "ldap": { "can_read": false } } + }, + { + "name": "search", + "long_name": "LDAP search group", + "members": ["search"], + "permissions": { + "portunus": { "is_admin": false }, + "ldap": { "can_read": true } + } } ], "users": [ @@ -34,6 +43,12 @@ "given_name": "admin", "family_name": "admin", "password": { "from_command": ["/usr/bin/env", "cat", "/run/secrets/portunus_admin"] } + }, + { + "login_name": "search", + "given_name": "search", + "family_name": "search", + "password": { "from_command": ["/usr/bin/env", "cat", "/run/secrets/portunus_search"] } } ] } diff --git a/flake.lock b/flake.lock index 714027c..84b48fd 100644 --- a/flake.lock +++ b/flake.lock @@ -71,11 +71,11 @@ }, "nixpkgs-stable": { "locked": { - "lastModified": 1670146390, - "narHash": "sha256-XrEoDpuloRHHbUkbPnhF2bQ0uwHllXq3NHxtuVe/QK4=", + "lastModified": 1673740915, + "narHash": "sha256-MMH8zONfqahgHly3K8/A++X34800rajA/XgZ2DzNL/M=", "owner": "NixOS", "repo": "nixpkgs", - "rev": "86370507cb20c905800527539fc049a2bf09c667", + "rev": "7c65528c3f8462b902e09d1ccca23bb9034665c2", "type": "github" }, "original": { @@ -87,11 +87,11 @@ }, "nixpkgs_2": { "locked": { - "lastModified": 1671215800, - "narHash": "sha256-2W54K41A7MefEaWzgL/TsaWlhKRK/RhWUybyOW4i0K8=", + "lastModified": 1673800717, + "narHash": "sha256-SFHraUqLSu5cC6IxTprex/nTsI81ZQAtDvlBvGDWfnA=", "owner": "nixos", "repo": "nixpkgs", - "rev": "9d692a724e74d2a49f7c985132972f991d144254", + "rev": "2f9fd351ec37f5d479556cd48be4ca340da59b8f", "type": "github" }, "original": { @@ -116,11 +116,11 @@ "nixpkgs-stable": "nixpkgs-stable" }, "locked": { - "lastModified": 1670149631, - "narHash": "sha256-rwmtlxx45PvOeZNP51wql/cWjY3rqzIR3Oj2Y+V7jM0=", + "lastModified": 1673752321, + "narHash": "sha256-EFfXY1ZHJq4FNaNQA9x0djtu/jiOhBbT0Xi+BT06cJw=", "owner": "Mic92", "repo": "sops-nix", - "rev": "da98a111623101c64474a14983d83dad8f09f93d", + "rev": "e18eefd2b133a58309475298052c341c08470717", "type": "github" }, "original": { diff --git a/modules/ldap.nix b/modules/ldap.nix index 20a8cc8..a1965a6 100644 --- a/modules/ldap.nix +++ b/modules/ldap.nix @@ -29,9 +29,15 @@ in members = [ "${ldapUser}" ]; }; - sops.secrets."portunus_admin" = { - owner = "${portunusUser}"; - group = "${portunusGroup}"; + sops.secrets = { + "portunus_admin" = { + owner = "${portunusUser}"; + group = "${portunusGroup}"; + }; + "portunus_search" = { + owner = "${portunusUser}"; + group = "${portunusGroup}"; + }; }; services.portunus = { @@ -40,10 +46,16 @@ in group = "${portunusGroup}"; domain = "${domain}"; port = 8081; + ldap = { user = "${ldapUser}"; group = "${ldapGroup}"; + suffix = "dc=ifsr,dc=de"; + searchUserName = "search"; + + # disables port 389, use 636 with tls + # `portunus.domain` resolves to localhost tls = true; }; @@ -60,9 +72,4 @@ in }; }; }; - - networking.firewall.allowedTCPPorts = [ - 80 # http - 443 # https - ]; } diff --git a/modules/matrix.nix b/modules/matrix.nix index be57b89..5648c1b 100644 --- a/modules/matrix.nix +++ b/modules/matrix.nix @@ -8,7 +8,6 @@ let base_url = "https://${domainServer}:443"; server_name = domainServer; }; - "m.identity_server" = { }; }; serverConfig = { "m.server" = "${domainServer}:443"; @@ -21,21 +20,17 @@ let ''; in { - # sops.secrets = { - # synapse_registration_secret = { - # owner = "matrix-synapse"; - # group = "matrix-synapse"; - # }; - # }; + sops.secrets.matrix_ldap_search = { + key = "portunus_search"; + owner = config.systemd.services.matrix-synapse.serviceConfig.User; + }; services = { postgresql = { enable = true; - ensureUsers = [ - { - name = "matrix-synapse"; - } - ]; + ensureUsers = [{ + name = "matrix-synapse"; + }]; }; nginx = { @@ -66,6 +61,7 @@ in root = pkgs.element-web.override { conf = { default_server_config = clientConfig; + disable_3pid_login = true; }; }; }; @@ -75,6 +71,10 @@ in matrix-synapse = { enable = true; + plugins = with config.services.matrix-synapse.package.plugins; [ + matrix-synapse-ldap3 + ]; + settings = { server_name = domainServer; @@ -89,17 +89,32 @@ in compress = false; }]; }]; - - # TODO: ldap - registration_shared_secret = "registration_shared_secret"; }; - # extraConfigFiles = [ - # (pkgs.writeTextFile { - # name = "matrix-synapse-extra-config.yml"; - # text = '' - # ''; - # }) - # ]; + + extraConfigFiles = [ + (pkgs.writeTextFile { + name = "matrix-synapse-extra-config.yml"; + text = '' + # `password_providers` is deprecated but `modules` is not supported yet. + password_providers: + - module: ldap_auth_provider.LdapAuthProvider + config: + enabled: true + # have to use fqdn here for tls (still connects to localhost) + uri: ldaps://auth.nix.fugi.dev:636 + base: ou=users,dc=ifsr,dc=de + # taken from kaki config + attributes: + uid: uid + mail: uid + name: cn + bind_dn: uid=search,ou=users,dc=ifsr,dc=de + # TODO: password file not yet supported - update matrix-synapse-ldap3 or use workaround + bind_password: portunus_search + # bind_password_file: ${config.sops.secrets.portunus_search.path} + ''; + }) + ]; }; }; @@ -113,7 +128,7 @@ in path = [ pkgs.sudo config.services.postgresql.package ]; - # create database for synapse. will silently fail if already exists + # create database for synapse. will silently fail if it already exists script = '' sudo -u ${config.services.postgresql.superUser} psql <