49 lines
2.5 KiB
Scheme
49 lines
2.5 KiB
Scheme
(define-module (metznet machines kerberos)
|
|
#:use-module (gnu)
|
|
#:use-module (gnu services certbot)
|
|
#:use-module (metznet system base-system)
|
|
#:use-module (metznet services kdc)
|
|
#:use-module (metznet packages kdc)
|
|
#:export (kerberos.metznet.ca kerberos-services))
|
|
|
|
;; Restored from metznet-channel commit 425b173's metznet/machines/kerberos.scm
|
|
;; (deleted there when system configs were split into a separate repo; that
|
|
;; repo's servers/kadmin.scm is a different, standalone kdb5_util-based
|
|
;; placeholder that was never actually deployed -- this LDAP-backed config
|
|
;; is what's really running).
|
|
(define %kerberos-dn
|
|
"uid=kerberos,ou=system,ou=accounts,dc=metznet,dc=ca")
|
|
|
|
(define-public kerberos-services
|
|
(append (list (service kdc-service-type
|
|
(kdc-configuration
|
|
(dbdefaults '("ldap_kerberos_container_dn = cn=kerberos,dc=metznet,dc=ca"))
|
|
(logging '("kdc = SYSLOG:DEBUG:DAEMON"))
|
|
(dbmodules (list (cons "openldap_ldapconf"
|
|
(kldap-configuration
|
|
(ldap_kdc_dn %kerberos-dn)
|
|
(ldap_kadmind_dn %kerberos-dn)
|
|
(ldap_servers "ldaps://ldap.metznet.ca")
|
|
(ldap_service_password_file
|
|
"/var/lib/kerberos/service.keyfile")))))
|
|
(realms (list (kdc-realm-configuration
|
|
(name "METZNET.CA")
|
|
(database_module "openldap_ldapconf")
|
|
(default_principal_flags "+preauth")
|
|
(acl_file (plain-file "kadm5.acl"
|
|
"*/admin@METZNET.CA *\n")))))))
|
|
(service certbot-service-type
|
|
(certbot-configuration
|
|
(email "admin@metznet.ca")
|
|
(certificates (list (certificate-configuration
|
|
(domains '("kerberos.metznet.ca"))))))))
|
|
%metznet-server-services))
|
|
|
|
(define-public kerberos.metznet.ca
|
|
(operating-system
|
|
(inherit %metznet-base-server-system)
|
|
(host-name "kerberos.metznet.ca")
|
|
(services kerberos-services)))
|
|
|
|
kerberos.metznet.ca
|