LLDAP Block

Defined in /modules/blocks/lldap.nix.

This block sets up an LLDAP service for user and group management across services.

Global Setup

shb.lldap = {
  enable = true;
  subdomain = "ldap";
  domain = "example.com";
  dcdomain = "dc=example,dc=com";

  ldapPort = 3890;
  webUIListenPort = 17170;

  jwtSecret.result = config.shb.sops.secret."lldap/jwt_secret".result;
  ldapUserPassword.result = config.shb.sops.secret."lldap/user_password".result;
};
shb.sops.secret."lldap/jwt_secret".request = config.shb.ldap.jwtSecret.request;
shb.sops.secret."lldap/user_password".request = config.shb.ldap.ldapUserPassword.request;

This assumes secrets are setup with SOPS as mentioned in the secrets setup section of the manual.

SSL

Using SSL is an important security practice, like always. Using the SSL block, the configuration to add to the one above is:

shb.certs.certs.letsencrypt.${domain}.extraDomains = [
  "${config.shb.lldap.subdomain}.${config.shb.lldap.domain}"
];

shb.ldap.ssl = config.shb.certs.certs.letsencrypt.${config.shb.lldap.domain};

Restrict Access By IP

For added security, you can restrict access to the LLDAP UI by adding the following line:

shb.lldap.restrictAccessIPRange = "192.168.50.0/24";

Manage Groups

The following snippet will create group named "family" if it does not exist yet. Also, all other groups will be deleted and only the "family" group will remain.

Note that the lldap_admin, lldap_password_manager and lldap_strict_readonly groups, which are internal to LLDAP, will always exist.

{
  shb.lldap.ensureGroups = {
   family = {};
  };
}

Changing the configuration to the following will add a new group "friends":

{
  shb.lldap.ensureGroups = {
    family = {};
    friends = {};
  };
}

Switching back the configuration to the previous one will delete the group "friends":

{
  shb.lldap.ensureGroups = {
    family = {};
  };
}

Custom fields can be added to groups as long as they are added to the ensureGroupFields field:

shb.lldap = {
  ensureGroupFields = {
    mygroupattribute = {
      attributeType = "STRING";
    };
  };

  ensureGroups = {
    family = {
      mygroupattribute = "Managed by NixOS";
    };
  };
};

Manage Users

The following snippet creates a user and makes it a member of the "family" group.

{
  shb.lldap.ensureUsers = {
    dad = {
      email = "dad@example.com";
      displayName = "Dad";
      firstName = "First Name";
      lastName = "Last Name";
      groups = [ "family" ];
      password.result = config.shb.sops.secret."dad".result;
    };
  };

  shb.sops.secret."dad".request =
    shb.ldap.ensureUsers.dad.password.request;
}

The password field assumes usage of the sops block to provide secrets although any blocks providing the secrets contract works too.

The user is still editable through the UI. That being said, any change will be overwritten next time the configuration is applied.

Troubleshooting

To increase logging verbosity and see the trace of the GraphQL queries, add:

shb.lldap.debug = true;

Note that verbosity is truly verbose here so you will want to revert this at some point.

To see the logs, then run journalctl -u lldap.service.

Tests

Specific integration tests are defined in /test/blocks/lldap.nix.

Options Reference

id-prefix: blocks-lldap-options-
list-id: selfhostblocks-block-lldap-options
source: @OPTIONS_JSON@

3.9 KiB Raw Blame History