···

       
4
       
 
       
  lib,

     

       
5
       
 
       
  ...

     

       
6
       
 
       
}:

     

       
7
       
-
       


     

       
8
       
-
       
with lib;

     

       
9
       
-
       


     

       
10
       
 
       
let

     

       
11
       
 
       
  cfg = config.services.hologram-server;

     

       
12
       
 
       


     
···

       
38
       
 
       
{

     

       
39
       
 
       
  options = {

     

       
40
       
 
       
    services.hologram-server = {

     

       
41
       
-
       
      enable = mkOption {

     

       
42
       
-
       
        type = types.bool;

     

       
43
       
 
       
        default = false;

     

       
44
       
 
       
        description = "Whether to enable the Hologram server for AWS instance credentials";

     

       
45
       
 
       
      };

     

       
46
       
 
       


     

       
47
       
-
       
      listenAddress = mkOption {

     

       
48
       
-
       
        type = types.str;

     

       
49
       
 
       
        default = "0.0.0.0:3100";

     

       
50
       
 
       
        description = "Address and port to listen on";

     

       
51
       
 
       
      };

     

       
52
       
 
       


     

       
53
       
-
       
      ldapHost = mkOption {

     

       
54
       
-
       
        type = types.str;

     

       
55
       
 
       
        description = "Address of the LDAP server to use";

     

       
56
       
 
       
      };

     

       
57
       
 
       


     

       
58
       
-
       
      ldapInsecure = mkOption {

     

       
59
       
-
       
        type = types.bool;

     

       
60
       
 
       
        default = false;

     

       
61
       
 
       
        description = "Whether to connect to LDAP over SSL or not";

     

       
62
       
 
       
      };

     

       
63
       
 
       


     

       
64
       
-
       
      ldapUserAttr = mkOption {

     

       
65
       
-
       
        type = types.str;

     

       
66
       
 
       
        default = "cn";

     

       
67
       
 
       
        description = "The LDAP attribute for usernames";

     

       
68
       
 
       
      };

     

       
69
       
 
       


     

       
70
       
-
       
      ldapBaseDN = mkOption {

     

       
71
       
-
       
        type = types.str;

     

       
72
       
 
       
        description = "The base DN for your Hologram users";

     

       
73
       
 
       
      };

     

       
74
       
 
       


     

       
75
       
-
       
      ldapBindDN = mkOption {

     

       
76
       
-
       
        type = types.str;

     

       
77
       
 
       
        description = "DN of account to use to query the LDAP server";

     

       
78
       
 
       
      };

     

       
79
       
 
       


     

       
80
       
-
       
      ldapBindPassword = mkOption {

     

       
81
       
-
       
        type = types.str;

     

       
82
       
 
       
        description = "Password of account to use to query the LDAP server";

     

       
83
       
 
       
      };

     

       
84
       
 
       


     

       
85
       
-
       
      enableLdapRoles = mkOption {

     

       
86
       
-
       
        type = types.bool;

     

       
87
       
 
       
        default = false;

     

       
88
       
 
       
        description = "Whether to assign user roles based on the user's LDAP group memberships";

     

       
89
       
 
       
      };

     

       
90
       
 
       


     

       
91
       
-
       
      groupClassAttr = mkOption {

     

       
92
       
-
       
        type = types.str;

     

       
93
       
 
       
        default = "groupOfNames";

     

       
94
       
 
       
        description = "The objectclass attribute to search for groups when enableLdapRoles is true";

     

       
95
       
 
       
      };

     

       
96
       
 
       


     

       
97
       
-
       
      roleAttr = mkOption {

     

       
98
       
-
       
        type = types.str;

     

       
99
       
 
       
        default = "businessCategory";

     

       
100
       
 
       
        description = "Which LDAP group attribute to search for authorized role ARNs";

     

       
101
       
 
       
      };

     

       
102
       
 
       


     

       
103
       
-
       
      awsAccount = mkOption {

     

       
104
       
-
       
        type = types.str;

     

       
105
       
 
       
        description = "AWS account number";

     

       
106
       
 
       
      };

     

       
107
       
 
       


     

       
108
       
-
       
      awsDefaultRole = mkOption {

     

       
109
       
-
       
        type = types.str;

     

       
110
       
 
       
        description = "AWS default role";

     

       
111
       
 
       
      };

     

       
112
       
 
       


     

       
113
       
-
       
      statsAddress = mkOption {

     

       
114
       
-
       
        type = types.str;

     

       
115
       
 
       
        default = "";

     

       
116
       
 
       
        description = "Address of statsd server";

     

       
117
       
 
       
      };

     

       
118
       
 
       


     

       
119
       
-
       
      cacheTimeoutSeconds = mkOption {

     

       
120
       
-
       
        type = types.int;

     

       
121
       
 
       
        default = 3600;

     

       
122
       
 
       
        description = "How often (in seconds) to refresh the LDAP cache";

     

       
123
       
 
       
      };

     

       
124
       
 
       
    };

     

       
125
       
 
       
  };

     

       
126
       
 
       


     

       
127
       
-
       
  config = mkIf cfg.enable {

     

       
128
       
 
       
    systemd.services.hologram-server = {

     

       
129
       
 
       
      description = "Provide EC2 instance credentials to machines outside of EC2";

     

       
130
       
 
       
      after = [ "network.target" ];

     

···

       
4
       
 
       
  lib,

     

       
5
       
 
       
  ...

     

       
6
       
 
       
}:

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
7
       
 
       
let

     

       
8
       
 
       
  cfg = config.services.hologram-server;

     

       
9
       
 
       


     
···

       
35
       
 
       
{

     

       
36
       
 
       
  options = {

     

       
37
       
 
       
    services.hologram-server = {

     

       
38
       
+
       
      enable = lib.mkOption {

     

       
39
       
+
       
        type = lib.types.bool;

     

       
40
       
 
       
        default = false;

     

       
41
       
 
       
        description = "Whether to enable the Hologram server for AWS instance credentials";

     

       
42
       
 
       
      };

     

       
43
       
 
       


     

       
44
       
+
       
      listenAddress = lib.mkOption {

     

       
45
       
+
       
        type = lib.types.str;

     

       
46
       
 
       
        default = "0.0.0.0:3100";

     

       
47
       
 
       
        description = "Address and port to listen on";

     

       
48
       
 
       
      };

     

       
49
       
 
       


     

       
50
       
+
       
      ldapHost = lib.mkOption {

     

       
51
       
+
       
        type = lib.types.str;

     

       
52
       
 
       
        description = "Address of the LDAP server to use";

     

       
53
       
 
       
      };

     

       
54
       
 
       


     

       
55
       
+
       
      ldapInsecure = lib.mkOption {

     

       
56
       
+
       
        type = lib.types.bool;

     

       
57
       
 
       
        default = false;

     

       
58
       
 
       
        description = "Whether to connect to LDAP over SSL or not";

     

       
59
       
 
       
      };

     

       
60
       
 
       


     

       
61
       
+
       
      ldapUserAttr = lib.mkOption {

     

       
62
       
+
       
        type = lib.types.str;

     

       
63
       
 
       
        default = "cn";

     

       
64
       
 
       
        description = "The LDAP attribute for usernames";

     

       
65
       
 
       
      };

     

       
66
       
 
       


     

       
67
       
+
       
      ldapBaseDN = lib.mkOption {

     

       
68
       
+
       
        type = lib.types.str;

     

       
69
       
 
       
        description = "The base DN for your Hologram users";

     

       
70
       
 
       
      };

     

       
71
       
 
       


     

       
72
       
+
       
      ldapBindDN = lib.mkOption {

     

       
73
       
+
       
        type = lib.types.str;

     

       
74
       
 
       
        description = "DN of account to use to query the LDAP server";

     

       
75
       
 
       
      };

     

       
76
       
 
       


     

       
77
       
+
       
      ldapBindPassword = lib.mkOption {

     

       
78
       
+
       
        type = lib.types.str;

     

       
79
       
 
       
        description = "Password of account to use to query the LDAP server";

     

       
80
       
 
       
      };

     

       
81
       
 
       


     

       
82
       
+
       
      enableLdapRoles = lib.mkOption {

     

       
83
       
+
       
        type = lib.types.bool;

     

       
84
       
 
       
        default = false;

     

       
85
       
 
       
        description = "Whether to assign user roles based on the user's LDAP group memberships";

     

       
86
       
 
       
      };

     

       
87
       
 
       


     

       
88
       
+
       
      groupClassAttr = lib.mkOption {

     

       
89
       
+
       
        type = lib.types.str;

     

       
90
       
 
       
        default = "groupOfNames";

     

       
91
       
 
       
        description = "The objectclass attribute to search for groups when enableLdapRoles is true";

     

       
92
       
 
       
      };

     

       
93
       
 
       


     

       
94
       
+
       
      roleAttr = lib.mkOption {

     

       
95
       
+
       
        type = lib.types.str;

     

       
96
       
 
       
        default = "businessCategory";

     

       
97
       
 
       
        description = "Which LDAP group attribute to search for authorized role ARNs";

     

       
98
       
 
       
      };

     

       
99
       
 
       


     

       
100
       
+
       
      awsAccount = lib.mkOption {

     

       
101
       
+
       
        type = lib.types.str;

     

       
102
       
 
       
        description = "AWS account number";

     

       
103
       
 
       
      };

     

       
104
       
 
       


     

       
105
       
+
       
      awsDefaultRole = lib.mkOption {

     

       
106
       
+
       
        type = lib.types.str;

     

       
107
       
 
       
        description = "AWS default role";

     

       
108
       
 
       
      };

     

       
109
       
 
       


     

       
110
       
+
       
      statsAddress = lib.mkOption {

     

       
111
       
+
       
        type = lib.types.str;

     

       
112
       
 
       
        default = "";

     

       
113
       
 
       
        description = "Address of statsd server";

     

       
114
       
 
       
      };

     

       
115
       
 
       


     

       
116
       
+
       
      cacheTimeoutSeconds = lib.mkOption {

     

       
117
       
+
       
        type = lib.types.int;

     

       
118
       
 
       
        default = 3600;

     

       
119
       
 
       
        description = "How often (in seconds) to refresh the LDAP cache";

     

       
120
       
 
       
      };

     

       
121
       
 
       
    };

     

       
122
       
 
       
  };

     

       
123
       
 
       


     

       
124
       
+
       
  config = lib.mkIf cfg.enable {

     

       
125
       
 
       
    systemd.services.hologram-server = {

     

       
126
       
 
       
      description = "Provide EC2 instance credentials to machines outside of EC2";

     

       
127
       
 
       
      after = [ "network.target" ];