services: add kerberos

2 files changed, 43 insertions, 1 deletions

diff --git a/config/services/default.nix b/config/services/default.nix
index b0df600..a58f2a7 100644
--- a/config/services/default.nix
+++ b/config/services/default.nix
@@ -1,5 +1,8 @@
 { ... }:
 
 {
-  imports = [ ./git ];
+  imports = [
+    ./git
+    ./kerberos
+  ];
 }
diff --git a/config/services/kerberos/default.nix b/config/services/kerberos/default.nix
new file mode 100644
index 0000000..e36ab40
--- /dev/null
+++ b/config/services/kerberos/default.nix
@@ -0,0 +1,39 @@
+{
+  config,
+  ...
+}:
+let
+  realm = "aristote.mesh";
+in
+{
+  # client
+  security.krb5 = {
+    enable = true;
+    settings = {
+      libdefaults.default_realm = realm;
+      realms."${realm}" =
+        let
+          server = "${config.networking.hostName}.${realm}";
+        in
+        {
+          kdc = server;
+          admin_server = server;
+        };
+    };
+  };
+
+  # server
+  networking.firewall.allowedTCPPorts = [
+    88
+    749
+  ];
+  services.kerberos_server = {
+    enable = true;
+    settings.realms."${realm}" = { };
+    # initialization procedure
+    # https://github.com/NixOS/nixpkgs/issues/72722#issuecomment-557658883
+    # > kdb5_util create -s -r ${realm}
+    # > systemctl restart kadmind.service kdc.service
+  };
+
+}