(define-module (metznet machines kerberos)
  #:use-module (gnu)
  #:use-module (gnu services certbot)
  #:use-module (metznet system base-system)
  #:use-module (metznet services kdc)
  #:use-module (metznet packages kdc)
  #:export (kerberos.metznet.ca kerberos-services))

;; Restored from metznet-channel commit 425b173's metznet/machines/kerberos.scm
;; (deleted there when system configs were split into a separate repo; that
;; repo's servers/kadmin.scm is a different, standalone kdb5_util-based
;; placeholder that was never actually deployed -- this LDAP-backed config
;; is what's really running).
(define %kerberos-dn
  "uid=kerberos,ou=system,ou=accounts,dc=metznet,dc=ca")

(define-public kerberos-services
  (append (list (service kdc-service-type
                         (kdc-configuration
                           (dbdefaults '("ldap_kerberos_container_dn = cn=kerberos,dc=metznet,dc=ca"))
                           (logging '("kdc = SYSLOG:DEBUG:DAEMON"))
                           (dbmodules (list (cons "openldap_ldapconf"
                                                   (kldap-configuration
                                                     (ldap_kdc_dn %kerberos-dn)
                                                     (ldap_kadmind_dn %kerberos-dn)
                                                     (ldap_servers "ldaps://ldap.metznet.ca")
                                                     (ldap_service_password_file
                                                       "/var/lib/kerberos/service.keyfile")))))
                           (realms (list (kdc-realm-configuration
                                           (name "METZNET.CA")
                                           (database_module "openldap_ldapconf")
                                           (default_principal_flags "+preauth")
                                           (acl_file (plain-file "kadm5.acl"
                                                                  "*/admin@METZNET.CA    *\n")))))))
                (service certbot-service-type
                         (certbot-configuration
                           (email "admin@metznet.ca")
                           (certificates (list (certificate-configuration
                                                  (domains '("kerberos.metznet.ca"))))))))
          %metznet-server-services))

(define-public kerberos.metznet.ca
  (operating-system
    (inherit %metznet-base-server-system)
    (host-name "kerberos.metznet.ca")
    (services kerberos-services)))

kerberos.metznet.ca