infrastructure/modules/nixos/sssd/sssd.nix

{
  config,
  options,
  lib,
  gensokyo-zone,
  ...
}: let
  inherit (gensokyo-zone.lib) mkAlmostOptionDefault mapOptionDefaults;
  inherit (lib.options) mkOption mkEnableOption;
  inherit (lib.modules) mkIf mkMerge mkOptionDefault mkForce;
  inherit (lib.attrsets) mapAttrs filterAttrs attrNames attrValues listToAttrs mapAttrsToList nameValuePair;
  inherit (lib.lists) filter isList concatMap;
  inherit (lib.strings) toUpper concatMapStringsSep replaceStrings;
  inherit (lib.trivial) flip;
  inherit (lib) generators;
  cfg = config.services.sssd;
  mkValuePrimitive = value:
    if value == true then "True"
    else if value == false then "False"
    else toString value;
  toINI = generators.toINI {
    mkKeyValue = generators.mkKeyValueDefault {
      mkValueString = value:
        if isList value then concatMapStringsSep ", " mkValuePrimitive value
        else mkValuePrimitive value;
    } " = ";
  };
  primitiveType = with lib.types; oneOf [ str int bool ];
  valueType = with lib.types; oneOf [ primitiveType (listOf primitiveType) ];
  settingsType = lib.types.attrsOf valueType;
  serviceModule = { name, ... }: {
    options = with lib.types; {
      enable = mkEnableOption "${name} service";
      name = mkOption {
        type = str;
        default = name;
        readOnly = true;
      };
      settings = mkOption {
        type = settingsType;
        default = { };
      };
    };
  };
  nssModule = { nixosConfig, ... }: {
    options = {
      # TODO: passwd.enable = mkEnableOption "passwd" // { default = true; };
      shadow.enable = mkEnableOption "shadow" // { default = nixosConfig.services.sssd.services.pam.enable; };
      netgroup.enable = mkEnableOption "netgroup" // { default = true; };
    };
  };
  domainModule = { name, ... }: {
    options = with lib.types; {
      enable = mkEnableOption "domain" // {
        default = true;
      };
      domain = mkOption {
        type = str;
        default = name;
      };
      settings = mkOption {
        type = settingsType;
      };
    };
  };
  domainLdapModule = { config, ... }: let
    cfg = config.ldap;
  in {
    options.ldap = with lib.types; {
      extraAttrs.user = mkOption {
        type = attrsOf str;
        default = { };
      };
      authtok = {
        type = mkOption {
          type = enum [ "password" "obfuscated_password" ];
          default = "password";
        };
        password = mkOption {
          type = nullOr str;
          default = null;
        };
        passwordFile = mkOption {
          type = nullOr path;
          default = null;
        };
        passwordVar = mkOption {
          type = str;
          internal = true;
          default = "SSSD_AUTHTOK_" + replaceStrings [ "-" "." ] [ "_" "_" ] (toUpper config.domain);
        };
      };
    };
    config = let
      authtokConfig = mkIf (cfg.authtok.password != null || cfg.authtok.passwordFile != null) {
        ldap_default_authtok_type = mkOptionDefault cfg.authtok.type;
        ldap_default_authtok = mkOptionDefault (
          if cfg.authtok.passwordFile != null then "\$${cfg.authtok.passwordVar}"
          else cfg.authtok.password
        );
      };
      extraAttrsConfig = mkIf (cfg.extraAttrs.user != { }) {
        ldap_user_extra_attrs = let
          mkAttr = name: attr: "${name}:${attr}";
        in mapAttrsToList mkAttr cfg.extraAttrs.user;
      };
    in {
      settings = mkMerge [
        authtokConfig
        extraAttrsConfig
      ];
    };
  };
in {
  options.services.sssd = with lib.types; {
    debugLevel = mkOption {
      type = ints.between 16 65520;
      default = 16;
    };
    domains = mkOption {
      type = attrsOf (submoduleWith {
        modules = [ domainModule domainLdapModule ];
        specialArgs = {
          nixosConfig = config;
        };
      });
      default = {
        shadowutils.settings = mapOptionDefaults {
          id_provider = "proxy";
          proxy_lib_name = "files";
          auth_provider = "proxy";
          proxy_pam_target = "sssd-shadowutils";
          proxy_fast_alias = true;
        };
      };
    };
    services = let
      mkServiceOption = name: { modules ? [ ] }: mkOption {
        type = submoduleWith {
          modules = [ serviceModule ] ++ modules;
          specialArgs = {
            inherit name;
            nixosConfig = config;
          };
        };
      };
      services = {
        nss = { modules = [ nssModule ]; };
        pam = { };
        ifp = { };
        sudo = { };
        autofs = { };
        ssh = { };
        pac = { };
      };
    in mapAttrs mkServiceOption services;
    settings = mkOption {
      type = attrsOf settingsType;
    };
    configText = mkOption {
      type = nullOr lines;
    };
  };
  config.services.sssd = let
    enabledDomains = filter (domain: domain.enable) (attrValues cfg.domains);
    enabledServices = filterAttrs (_: service: service.enable) cfg.services;
  in {
    settings = let
      serviceSettings = mapAttrs (name: service: mapOptionDefaults service.settings) enabledServices;
      defaultSettings = {
        sssd = mapOptionDefaults {
          config_file_version = 2;
          debug_level = cfg.debugLevel;
          services = mapAttrsToList (_: service: service.name) enabledServices;
          domains = map (domain: domain.domain) enabledDomains;
        };
      };
      domainSettings = map (domain: {
        "domain/${domain.domain}" = mapAttrs (_: mkOptionDefault) domain.settings;
      }) enabledDomains;
      settings = [ defaultSettings serviceSettings ] ++ domainSettings;
    in mkMerge settings;
    services = {
      nss.enable = mkAlmostOptionDefault true;
      pam.enable = mkAlmostOptionDefault true;
      ifp.settings = let
        extraUserAttrs = listToAttrs (concatMap (domain: map (flip nameValuePair {}) (attrNames domain.ldap.extraAttrs.user)) enabledDomains);
        mkExtraAttr = name: _: "+${name}";
      in {
        user_attributes = mkIf (extraUserAttrs != { }) (mkOptionDefault (
          mapAttrsToList mkExtraAttr extraUserAttrs
        ));
      };
      sudo = { };
      autofs = { };
      ssh = { };
      pac = { };
    };
    configText = mkOptionDefault (toINI cfg.settings);
    config = mkIf (cfg.configText != null) (mkAlmostOptionDefault cfg.configText);
  };
  config.system.nssDatabases = let
    inherit (cfg.services) nss;
  in mkIf cfg.enable {
    ${if options ? system.nssDatabases.netgroup then "netgroup" else null} = mkIf (nss.enable && nss.netgroup.enable) [ "sss" ];
    shadow = mkIf (!nss.enable || !nss.shadow.enable) (
      mkForce [ "files" ]
    );
  };
}