Ajout script auto.fs

hosts/vm/nextcloud/default.nix

@@ -1,4 +1,4 @@
-{ pkgs, ... }:
+{ pkgs, config, ... }:
 
 {
   imports = [
@@ -28,11 +28,78 @@
     resticClient.enable = false;
   };
 
-  services.autofs = {
+  services.autofs =
+    let
+      autoMaster = pkgs.writeScript "home-nextcloud" ''
+        #!/usr/bin/env bash
+        USER=$(echo $1 | sed "s/_[1-9]*$//")
+
+        UHOME=/home-adh/$USER
+
+        USERID=$(ldapsearch -LLL -b "dc=crans,dc=org" -H ldap://172.16.10.157 -D "cn=admin,dc=crans,dc=org" -y ${config.age.secrets.nextcloud_ldap_pass.path} "uid=$USER" uidNumber | grep uidNumber | awk '{print $2}')
+        UGROUP=$(ldapsearch -LLL -b "dc=crans,dc=org" -H ldap://172.16.10.157 -D "cn=admin,dc=crans,dc=org" -y ${config.age.secrets.nextcloud_ldap_pass.path} "uid=$USER" gidNumber | grep gidNumber | awk '{print $2}')
+
+        # On quitte si l'utilisateur $USER n'existe pas
+        if [ -z "$USERID" ]; then
+            logger -p local0.error -t autofs "user $USER n'existe pas"
+            exit 1
+        fi
+
+        # Rafraîchi les stats du dossier
+        ls ''\${UHOME}/NextCloud/ &>/dev/null || /bin/ls ''\${UHOME} &>/dev/null
+
+        # Création du lien symbolique Nextcloud s'il n'existe pas
+        if [ ! -e "''\${UHOME}/NextCloud" ] || ! (
+            find ''\${UHOME}/NextCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} |
+            grep -q ''\${UHOME}/NextCloud/
+        ); then
+            if [ ! -e "''\${UHOME}/NextCloud" ]; then
+                ln -fs OwnCloud ''\${UHOME}/NextCloud
+            fi
+
+            if [ ! -e "''\${UHOME}/NextCloud" ] || ! (
+                find ''\${UHOME}/NextCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} |
+                grep -q ''\${UHOME}/NextCloud/
+            ); then
+                logger -p local0.error -t autofs "impossible de créer le lien symbolique ''\${UHOME}/NextCloud"
+                exit 1
+            fi
+
+            logger -p local0.info -t autofs "Lien symbolique ''\${UHOME}/NextCloud -> ''\${UHOME}/OwnCloud créé"
+        fi
+
+        # Création du dossier OwnCloud s'il n'existe pas ou n'appartient pas a l'utilisateur
+        if [ ! -d "''\${UHOME}/OwnCloud" ] || ! (
+            find ''\${UHOME}/OwnCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} |
+            grep -q ''\${UHOME}/OwnCloud/
+        ); then
+            if [ ! -d "''\${UHOME}/OwnCloud" ]; then
+                mkdir ''\${UHOME}/OwnCloud
+            fi
+            chmod 700 ''\${UHOME}/OwnCloud &&
+            chown $USERID:''\${UGROUP} ''\${UHOME}/OwnCloud
+
+            if [ ! -d "''\${UHOME}/OwnCloud" ] || ! (
+                find ''\${UHOME}/OwnCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} |
+                grep -q ''\${UHOME}/OwnCloud/
+            ); then
+                logger -p local0.error -t autofs "impossible de créer le dossier ''\${UHOME}/OwnCloud"
+                exit 1
+            fi
+
+            logger -p local0.info -t autofs "Dossier ''\${UHOME}/OwnCloud créé"
+        fi
+
+        chmod 750 /home-nextcloud &&
+        chown nextcloud:nextcloud /home-nextcloud &&
+        echo "-fstype=fuse.bindfs,map=$USERID/nextcloud:@$UGROUP/@nextcloud,resolve-symlinks,allow_other :''\${UHOME}/NextCloud"
+      '';
+    in
+    {
       enable = true;
 
       autoMaster = ''
-      /home-nextcloud /etc/auto.master.d/home-nextcloud.sh -t60
+        /home-nextcloud ${autoMaster} -t60
       '';
     };
 

hosts/vm/nextcloud/nextcloud.nix

@@ -12,6 +12,9 @@
       owner = "nextcloud";
       group = "nextcloud";
     };
+    nextcloud_ldap_pass = {
+      file = ../../../secrets/nextcloud/nextcloud_ldap_pass.age;
+    };
   };
 
   services.nextcloud = {
@@ -41,6 +44,8 @@
       trusted_proxies = [
         # hodaur
         "172.16.10.145"
+        # reverseproxy
+        "172.16.10.151"
       ];
 
       mail_domain = "crans.org";

secrets/nextcloud/nextcloud_ldap_pass.age

@@ -0,0 +1,34 @@
+age-encryption.org/v1
+-> ssh-ed25519 APVFfA fL5Pu7eaaIaEXvmU0IMAi09iqYfd3jUzWTSjJohj8R8
+DIK3kfFZRrCWjHnphBqtAKanvsX5s5IR+KBqgRg12yY
+-> piv-p256 ewCc3w Aj0Lf5GPZAdHDKKw47MZ5s3FjikxN4Cd7gtv2h6rVV63
+2Ml0ZA/rS+yp6Bg2H9mhZAxLZdcs1iAiC0JKI+mFcCw
+-> piv-p256 6CL/Pw A3z/96JwMoCKX0Gm3JDCa4cSfKmvYm4f+6FsEY+6LmLz
+dh+ksufqr0KXDNYnZ2AUOF324Asp+oVpMHOM5oVhAdw
+-> ssh-ed25519 eOAUSg 8yuY7bBFYdqGo06axuKiBOcPu0az2nM/MFhDa9xl9C8
+gfPbBZNUiT3Ax94npu1qNmO5v66+6ouMobO0RNs90dY
+-> ssh-rsa REaZBA
+EtJT0echOhz7t1bJuAR+/7R0VP81a1HH3XdO/Bn+N+EY4QBeYkqS2b7jBVsrllzW
+iEL5AqKUz/yMg5iouwLR3YKb8+k6lbxK5liNOmebF1W1l8vK+e05RuNB9cNLYpcB
+t5cXB9FID6fg+Gl6uc9aEuKwSEAd+V67M0IEoTNN2GuoAUr27Dawr7Zk3kIqoDUL
+M6WoMwUVS9z6fyHqWtqnu8czamw6rTyHbMQD+lQQjruMSpPhI4HxbRWoX00T9Iu+
+FEniGLJLYwreRxqhedNNhTAOfkfVOGymjE8ZpAVGoS4Nxxg+u+5OMK+fhlPRt43M
+MI4nr8gbvBWaNTEi4fBZkyCBkYt7XATbPVHeQS9W7tcAXvHBD7EgQ6cDYbZmJwZK
+pdxV6vOjenOD73WmYo5rsGbZD3UzsGKBoe0mK6kZDA4ZGuPy03Y9F0lwf+AT6zS4
+G9hq4WOLQgaLhmgI6qtFkv9GtMVRRsGd4FnLBERNhQ3F2rB+TJggPAXfxaUToLbu
+
+-> ssh-ed25519 J/iReg ud0671a019HkCCQZCV1YqnG6nYH/ziIVGy+e+i9L8Xw
+d++NdfUVxcl5NW3LH1ZbfxNe2kehPkZYA4RZMGWc8nU
+-> ssh-ed25519 GNhSGw KiHYxkz+hIFnzdIDN/+UN6YAHru7SP/29HKSUFn0zTQ
+kQvPDAeGW1GnZE+EQl784b4l2vCW9aepqhanXvCFlxY
+-> ssh-ed25519 eXMAtA 8fVRDZkpYH2OyNvbnv5PxoNx8LsqagNYUPMfVXu4RD0
+P9VNb8AyM2R7EB1TFznL+CbDCxDYKvi3K/PYT8C8BP0
+-> ssh-ed25519 5hXocQ 7PqwxuOo6n/KeuXCYHkU/gaYV9qpkVLU/EQ2GBmD5y8
+NIX/Pxp/UW14iJf4oqaDlIyXhiGmgKRnqyyFjLfNKaA
+-> ssh-ed25519 bRHVVA btmYmpxdOPeE/lL4J3stGX+rm2WM/vNumh81PGtv8D4
+X5ibu1gAoM7Gf89rLL9Bj54iJpOrkGSE74axOKQvqfw
+-> ssh-ed25519 HgW9eA BbHGdYZYkip537IxufeKJoLaxbgijBDd9WXafwrEEQM
+ArZJKVOCtrM8+1tlMe+U9CJJWAeV34ph+Gjeea32FEI
+--- uXR+zL5hHC92bgFa7hAU33FZ2KBllilBFmjsERtEQ3U
+sê¯ËŽý<>0
+6©ý£E–;èÉõ{ÐKÉÌøË2Rx9V¿ÉÑÓ0á½à