forked from lukas/nixos-config
21 lines
625 B
Nix
21 lines
625 B
Nix
{ config, ... }:
|
|
{
|
|
services.lldap = {
|
|
enable = true;
|
|
settings = {
|
|
http_host = "0.0.0.0";
|
|
http_port = 17170;
|
|
ldap_base_dn = config.ldapBaseDN;
|
|
ldap_host = "0.0.0.0";
|
|
ldap_port = 3890;
|
|
ldap_user_dn = "admin";
|
|
ldap_user_mail = config.adminEmail;
|
|
ldap_user_pass_file = "/run/credentials/lldap.service/ldap-user-pass";
|
|
force_ldap_user_pass_reset = "always";
|
|
};
|
|
};
|
|
|
|
# systemd exposes the root-owned age secret only inside the LLDAP service.
|
|
systemd.services.lldap.serviceConfig.LoadCredential =
|
|
"ldap-user-pass:${config.age.secrets.lldapAdmin.path}";
|
|
}
|