Oncall: Difference between revisions
Appearance
Update LDAP config |
mNo edit summary |
||
(3 intermediate revisions by the same user not shown) | |||
Line 2: | Line 2: | ||
== Setup == | == Setup == | ||
{{Warning|This setup example is for local and testing environments only. Please not that in this case secrets such as the passwords get copied into the Nix store and are globally readable.}} | {{Warning|This setup example is for local and testing environments only. Please not that in this case secrets such as the passwords get copied into the Nix store and are globally readable.}} | ||
Line 46: | Line 44: | ||
full_name = "cn"; | full_name = "cn"; | ||
email = "mail"; | email = "mail"; | ||
call = "telephoneNumber"; | |||
sms = "mobile"; | sms = "mobile"; | ||
}; | }; | ||
}; | }; | ||
}; | }; | ||
secretFile = "/etc/oncall-secrets.yml"; | |||
}; | }; | ||
Line 101: | Line 99: | ||
telephoneNumber: 012345678910 | telephoneNumber: 012345678910 | ||
mobile: 012345678910 | mobile: 012345678910 | ||
''; | ''; | ||
}; | }; |
Latest revision as of 09:15, 1 June 2025
Oncall is a web-app for shift planning, developed by LinkedIn.
Setup
⚠︎
Warning: This setup example is for local and testing environments only. Please not that in this case secrets such as the passwords get copied into the Nix store and are globally readable.
To enable and run Oncall add following line to your system configuration and apply it
{
pkgs,
lib,
...
}:
let
ldapDomain = "example.org";
ldapSuffix = "dc=example,dc=org";
ldapRootUser = "root";
ldapRootPassword = "foobar23";
testUser = "myuser";
testPassword = "foobar23";
in
{
environment.etc."oncall-secrets.yml".text = ''
auth:
ldap_bind_password: "${ldapRootPassword}"
'';
services.oncall = {
enable = true;
settings = {
auth = {
module = "oncall.auth.modules.ldap_import";
ldap_url = "ldap://localhost";
ldap_user_suffix = "";
ldap_bind_user = "cn=root,${ldapSuffix}";
ldap_base_dn = "ou=accounts,${ldapSuffix}";
ldap_search_filter = "(uid=%s)";
import_user = true;
attrs = {
username = "uid";
full_name = "cn";
email = "mail";
call = "telephoneNumber";
sms = "mobile";
};
};
};
secretFile = "/etc/oncall-secrets.yml";
};
services.openldap = {
enable = true;
settings = {
children = {
"cn=schema".includes = [
"${pkgs.openldap}/etc/schema/core.ldif"
"${pkgs.openldap}/etc/schema/cosine.ldif"
"${pkgs.openldap}/etc/schema/inetorgperson.ldif"
"${pkgs.openldap}/etc/schema/nis.ldif"
];
"olcDatabase={1}mdb" = {
attrs = {
objectClass = [
"olcDatabaseConfig"
"olcMdbConfig"
];
olcDatabase = "{1}mdb";
olcDbDirectory = "/var/lib/openldap/db";
olcSuffix = ldapSuffix;
olcRootDN = "cn=${ldapRootUser},${ldapSuffix}";
olcRootPW = ldapRootPassword;
};
};
};
};
declarativeContents = {
${ldapSuffix} = ''
dn: ${ldapSuffix}
objectClass: top
objectClass: dcObject
objectClass: organization
o: ${ldapDomain}
dn: ou=accounts,${ldapSuffix}
objectClass: top
objectClass: organizationalUnit
dn: uid=${testUser},ou=accounts,${ldapSuffix}
objectClass: top
objectClass: inetOrgPerson
uid: ${testUser}
userPassword: ${testPassword}
cn: Test User
sn: User
mail: test@example.org
telephoneNumber: 012345678910
mobile: 012345678910
'';
};
};
}
Go to http://localhost to access it. Login with the test user myuser
and the password foobar23
.