1 files changed, 47 insertions, 5 deletions
diff --git a/os/srv/lldap.nix b/os/srv/lldap.nix
index 1cf43e4..1463ab6 100644
--- a/os/srv/lldap.nix
+++ b/os/srv/lldap.nix
@@ -1,6 +1,15 @@
-{ config, lib, ... }:
+{
+  config,
+  lib,
+  masterDomain,
+  securityTemplates,
+  ...
+}:
 let
   cfg = config.os.srv.lldap;
+  computedBaseDN = lib.concatStringsSep "," (
+    map (domainPart: "dc=${domainPart}") (lib.splitString "." masterDomain)
+  );
 in
 {
   options.os.srv.lldap.enable = lib.mkEnableOption "enables lldap scanning";
@@ -10,15 +19,48 @@ in
         assertion = config.os.srv.sops.enable;
         message = "Required for password secure password storing";
       }
+      {
+        assertion = config.os.core.network.enableFirewall;
+        message = "Requires firewall";
+      }
     ];
+
+    sops.secrets = {
+      "lldap/password" = {
+        owner = "lldap";
+        group = "lldap";
+      };
+      "lldap/env_file" = {
+        owner = "lldap";
+        group = "lldap";
+      };
+    };
+
     services.lldap = {
       enable = true;
       settings = {
-        ldap_base_dn = "dc=example,dc=com";
-        ldap_port = 3890;
-        http_port = 17170;
+        ldap_base_dn = computedBaseDN;
+        http_host = "127.0.0.1";
+        http_url = "https://lldap.${masterDomain}";
+        ldap_user_email = "adikro@disroot.org";
+        ldap_user_pass_file = config.sops.secrets."lldap/password".path;
+        silenceForceUserPassResetWarning = true;
+      };
+      environmentFile = config.sops.secrets."lldap/env_file".path;
+    };
+
+    os.cluster.nginxProxies."lldap.${masterDomain}" = {
+      enableACME = true;
+      forceSSL = true;
+
+      locations."/" = {
+        proxyPass = "http://${config.os.core.network.ips.gateway-vm}:17170";
+        extraConfig = securityTemplates.restrictToInternal;
       };
-      environmentFile = config.sops.secrets."lldap/env".path;
     };
+
+    networking.firewall.extraInputRules = ''
+      ip saddr 10.0.0.0/24 tcp dport 3890 accept
+    '';
   };
 }