3 nixosModule = self.nixosModules.environment;
4 nixosModules.environment = { config, lib, name, ... }:
10 base = mkOption { description = "Base of the LDAP tree"; type = str; };
11 host = mkOption { description = "Host to access LDAP"; type = str; };
12 root_dn = mkOption { description = "DN of the root user"; type = str; };
13 root_pw = mkOption { description = "Hashed password of the root user"; type = str; };
14 replication_dn = mkOption { description = "DN of the user allowed to replicate the LDAP directory"; type = str; };
15 replication_pw = mkOption { description = "Password of the user allowed to replicate the LDAP directory"; type = str; };
17 mkLdapOptions = name: more: mkOption {
18 description = "${name} LDAP configuration";
20 options = ldapOptions // {
21 dn = mkOption { description = "DN of the ${name} user"; type = str; };
22 password = mkOption { description = "password of the ${name} user"; type = str; };
23 filter = mkOption { description = "Filter for ${name} users"; type = str; default = ""; };
28 host = mkOption { description = "Host to access Mysql"; type = str; };
29 remoteHost = mkOption { description = "Host to access Mysql from outside"; type = str; };
30 port = mkOption { description = "Port to access Mysql"; type = int; };
31 socket = mkOption { description = "Socket to access Mysql"; type = path; };
32 systemUsers = mkOption {
33 description = "Attrs of user-passwords allowed to access mysql";
37 description = "PAM configuration for mysql";
40 dn = mkOption { description = "DN to connect as to check users"; type = str; };
41 password = mkOption { description = "DN password to connect as to check users"; type = str; };
42 filter = mkOption { description = "filter to match users"; type = str; };
47 mkMysqlOptions = name: more: mkOption {
48 description = "${name} mysql configuration";
50 options = mysqlOptions // {
51 database = mkOption { description = "${name} database"; type = str; };
52 user = mkOption { description = "${name} user"; type = str; };
53 password = mkOption { description = "mysql password of the ${name} user"; type = str; };
58 host = mkOption { description = "Host to access Postgresql"; type = str; };
59 port = mkOption { description = "Port to access Postgresql"; type = str; };
60 socket = mkOption { description = "Socket to access Postgresql"; type = path; };
62 description = "PAM configuration for psql";
65 dn = mkOption { description = "DN to connect as to check users"; type = str; };
66 password = mkOption { description = "DN password to connect as to check users"; type = str; };
67 filter = mkOption { description = "filter to match users"; type = str; };
72 mkPsqlOptions = name: mkOption {
73 description = "${name} psql configuration";
75 options = psqlOptions // {
76 database = mkOption { description = "${name} database"; type = str; };
77 schema = mkOption { description = "${name} schema"; type = nullOr str; default = null; };
78 user = mkOption { description = "${name} user"; type = str; };
79 password = mkOption { description = "psql password of the ${name} user"; type = str; };
84 host = mkOption { description = "Host to access Redis"; type = str; };
85 port = mkOption { description = "Port to access Redis"; type = str; };
86 socket = mkOption { description = "Socket to access Redis"; type = path; };
88 description = "Attrs of db number. Each number should be unique to avoid collision!";
91 spiped_key = mkOption {
94 Key to use with spiped to make a secure channel to replication
98 description = "Predixy configuration. Unused yet";
101 read = mkOption { type = str; description = "Read password"; };
106 mkRedisOptions = name: mkOption {
107 description = "${name} redis configuration";
109 options = redisOptions // {
110 db = mkOption { description = "${name} database"; type = str; };
115 host = mkOption { description = "Host to access SMTP"; type = str; };
116 port = mkOption { description = "Port to access SMTP"; type = str; };
118 mkSmtpOptions = name: mkOption {
119 description = "${name} smtp configuration";
121 options = smtpOptions // {
122 email = mkOption { description = "${name} email"; type = str; };
123 password = mkOption { description = "SMTP password of the ${name} user"; type = str; };
127 hostEnv = submodule {
130 description = "Host FQDN";
140 isVm = mkEnableOption "The host is a vm";
145 Sublist of users from realUsers. Function that takes pkgs as
146 argument and gives an array as a result
151 description = "List of e-mails that the server can be a sender of";
156 LDAP credentials for the host
160 password = mkOption { type = str; description = "Password for the LDAP connection"; };
161 dn = mkOption { type = str; description = "DN for the LDAP connection"; };
166 description = "subdomain and priority for MX server";
167 default = { enable = false; };
170 enable = mkEnableOption "Enable MX";
171 subdomain = mkOption { type = nullOr str; description = "Subdomain name (mx-*)"; };
172 priority = mkOption { type = nullOr int; description = "Priority"; };
178 attrs of ip4/ip6 grouped by section
180 type = attrsOf (submodule {
186 alias to use in DNS for that group
193 ip4 addresses of the host
200 ip6 addresses of the host
210 # Necessary for situations where flake gets included multiple times
211 key = builtins.hashString "sha256" (builtins.path { path = self.sourceInfo.outPath; name = "source"; });
216 Attrs of servers information in the cluster (not necessarily handled by nixops)
219 type = attrsOf hostEnv;
221 hetznerCloud = mkOption {
223 Hetzner Cloud credential information
227 authToken = mkOption {
238 Hetzner credential information
242 user = mkOption { type = str; description = "User"; };
243 pass = mkOption { type = str; description = "Password"; };
249 sshd service credential information
253 rootKeys = mkOption { type = attrsOf str; description = "Keys of root users"; };
256 LDAP credentials for cn=ssh,ou=services,dc=immae,dc=eu dn
260 password = mkOption { description = "Password"; type = str; };
266 PSQL credentials for immae_auth_read
270 password = mkOption { description = "Password"; type = str; };
279 non-standard reserved ports. Must be unique!
284 noDupl = x: builtins.length (builtins.attrValues x) == builtins.length (unique (builtins.attrValues x));
286 x: if isAttrs x && noDupl x then x else throw "Non unique values for ports";
290 httpd service credential information
296 LDAP credentials for cn=httpd,ou=services,dc=immae,dc=eu dn
300 password = mkOption { description = "Password"; type = str; };
308 type = submodule { options = smtpOptions; };
309 description = "SMTP configuration";
313 LDAP server configuration
316 options = ldapOptions;
319 databases = mkOption {
320 description = "Databases configuration";
324 type = submodule { options = mysqlOptions; };
325 description = "Mysql configuration";
328 type = submodule { options = redisOptions; };
329 description = "Redis configuration";
331 postgresql = mkOption {
332 type = submodule { options = psqlOptions; };
333 description = "Postgresql configuration";
339 description = "Jabber configuration";
342 postfix_user_filter = mkOption { type = str; description = "Postfix filter to get xmpp users"; };
343 ldap = mkLdapOptions "Jabber" {};
344 postgresql = mkPsqlOptions "Jabber";
348 realUsers = mkOption {
350 Attrset of function taking pkgs as argument.
351 Real users settings, should provide a subattr of users.users.<name>
352 with at least: name, (hashed)Password, shell
354 type = attrsOf unspecified;
357 description = "System and regular users uid/gid";
358 type = attrsOf (submodule {
361 description = "user uid";
365 description = "user gid";
372 description = "DNS configuration";
376 description = "Attrs of NS servers group";
379 "ns1.foo.com" = [ "198.51.100.10" "2001:db8:abcd::1" ];
380 "ns2.foo.com" = [ "198.51.100.15" "2001:db8:1234::1" ];
383 type = attrsOf (attrsOf (listOf str));
390 Remote backup with duplicity
394 password = mkOption { type = str; description = "Password for encrypting files"; };
396 type = attrsOf (submodule {
399 type = functionTo str;
400 example = literalExample ''
401 bucket: "s3://some_host/${bucket}";
405 Takes a bucket name as argument and returns a url
408 accessKeyId = mkOption { type = str; description = "Remote access-key"; };
409 secretAccessKey = mkOption { type = str; description = "Remote access secret"; };
416 zrepl_backup = mkOption {
420 description = "SSH key information";
423 public = mkOption { type = str; description = "Public part of the key"; };
424 private = mkOption { type = lines; description = "Private part of the key"; };
428 mysql = mkMysqlOptions "Zrepl" {};
430 description = "Certificates";
431 type = attrsOf (submodule {
433 key = mkOption { type = str; description = "Key"; };
434 certificate = mkOption { type = str; description = "Certificate"; };
441 rsync_backup = mkOption {
443 Rsync backup configuration from controlled host
448 description = "SSH key information";
451 public = mkOption { type = str; description = "Public part of the key"; };
452 private = mkOption { type = lines; description = "Private part of the key"; };
456 profiles = mkOption {
457 description = "Attrs of profiles to backup";
459 type = attrsOf (submodule {
461 keep = mkOption { type = int; description = "Number of backups to keep"; };
462 check_command = mkOption { type = str; description = "command to check if backup needs to be done"; default = "backup"; };
463 login = mkOption { type = str; description = "Login to connect to host"; };
464 port = mkOption { type = str; default = "22"; description = "Port to connect to host"; };
465 host = mkOption { type = str; description = "Host to connect to"; };
466 host_key = mkOption { type = str; description = "Host key"; };
467 host_key_type = mkOption { type = str; description = "Host key type"; };
469 description = "Parts to backup for this host";
470 type = attrsOf (submodule {
472 remote_folder = mkOption { type = path; description = "Remote folder to backup";};
473 exclude_from = mkOption {
476 description = "List of folders/files to exclude from the backup";
478 files_from = mkOption {
481 description = "List of folders/files to backup in the base folder";
486 description = "Extra arguments to pass to rsync";
497 monitoring = mkOption {
498 description = "Monitoring configuration";
501 status_url = mkOption { type = str; description = "URL to push status to"; };
502 status_token = mkOption { type = str; description = "Token for the status url"; };
503 http_user_password = mkOption { type = str; description = "HTTP credentials to check services behind wall"; };
504 email = mkOption { type = str; description = "Admin E-mail"; };
505 ssh_public_key = mkOption { type = str; description = "SSH public key"; };
506 ssh_secret_key = mkOption { type = str; description = "SSH secret key"; };
507 imap_login = mkOption { type = str; description = "IMAP login"; };
508 imap_password = mkOption { type = str; description = "IMAP password"; };
509 eriomem_keys = mkOption { type = listOf (listOf str); description = "Eriomem keys"; default = []; };
511 description = "OVH credentials for sms script";
514 endpoint = mkOption { type = str; default = "ovh-eu"; description = "OVH endpoint"; };
515 application_key = mkOption { type = str; description = "Application key"; };
516 application_secret = mkOption { type = str; description = "Application secret"; };
517 consumer_key = mkOption { type = str; description = "Consumer key"; };
518 account = mkOption { type = str; description = "Account"; };
522 nrdp_tokens = mkOption { type = listOf str; description = "Tokens allowed to push status update"; };
523 apprise_urls = mkOption { type = str; description = "Apprise space-separated urls to push status update"; };
524 netdata_aggregator = mkOption { type = str; description = "Url where netdata information should be sent"; };
525 netdata_keys = mkOption { type = attrsOf str; description = "netdata host keys"; };
526 immae_contact = mkOption { type = str; description = "Immae Contact e-mail"; };
527 email_check = mkOption {
528 description = "Emails services to check";
529 type = attrsOf (submodule {
531 local = mkOption { type = bool; default = false; description = "Use local configuration"; };
532 port = mkOption { type = nullOr str; default = null; description = "Port to connect to ssh"; };
533 login = mkOption { type = nullOr str; default = null; description = "Login to connect to ssh"; };
534 targets = mkOption { type = listOf str; description = "Hosts to send E-mails to"; };
535 mail_address = mkOption { type = nullOr str; default = null; description = "E-mail recipient part to send e-mail to"; };
536 mail_domain = mkOption { type = nullOr str; default = null; description = "E-mail domain part to send e-mail to"; };
544 description = "MPD configuration";
547 folder = mkOption { type = str; description = "Folder to serve from the MPD instance"; };
548 password = mkOption { type = str; description = "Password to connect to the MPD instance"; };
549 host = mkOption { type = str; description = "Host to connect to the MPD instance"; };
550 port = mkOption { type = str; description = "Port to connect to the MPD instance"; };
555 description = "FTP configuration";
558 ldap = mkLdapOptions "FTP" {
559 proftpd_filter = mkOption { type = str; description = "Filter for proftpd listing in LDAP"; };
560 pure-ftpd_filter = mkOption { type = str; description = "Filter for pure-ftpd listing in LDAP"; };
566 description = "VPN configuration";
567 type = attrsOf (submodule {
569 prefix = mkOption { type = str; description = "ipv6 prefix for the vpn subnet"; };
570 privateKey = mkOption { type = str; description = "Private key for the host"; };
571 publicKey = mkOption { type = str; description = "Public key for the host"; };
576 description = "Mail configuration";
580 description = "DMARC configuration";
583 ignore_hosts = mkOption {
586 Hosts to ignore when checking for dmarc
593 description = "DKIM configuration";
594 type = attrsOf (submodule {
598 example = literalExample ''
602 p = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3w1a2aMxWw9+hdcmbqX4UevcVqr204y0K73Wdc7MPZiOOlUJQYsMNSYR1Y/SC7jmPKeitpcJCpQgn/cveJZbuikjjPLsDReHyFEYmC278ZLRTELHx6f1IXM8WE08JIRT69CfZiMi1rVcOh9qRT4F93PyjCauU8Y5hJjtg9ThsWwIDAQAB";
605 description = "Public entry to put in DNS TXT field";
607 private = mkOption { type = nullOr str; default = null; description = "Private key"; };
612 description = "Postfix configuration";
615 mysql = mkMysqlOptions "Postfix" {
616 password_encrypt = mkOption { type = str; description = "Key to encrypt relay password in database"; };
620 List of admins meant to receive common aliases
624 common_aliases = mkOption {
626 List of aliases common to all hosts, to forward to admins
630 other_aliases = mkOption {
632 Other list of aliases, to forward to admins
640 description = "Dovecot configuration";
643 ldap = mkLdapOptions "Dovecot" {
644 pass_attrs = mkOption { type = str; description = "Password attribute in LDAP"; };
645 user_attrs = mkOption { type = str; description = "User attribute mapping in LDAP"; };
646 iterate_attrs = mkOption { type = str; description = "User attribute mapping for listing in LDAP"; };
647 iterate_filter = mkOption { type = str; description = "User attribute filter for listing in LDAP"; };
648 postfix_mailbox_filter = mkOption { type = str; description = "Postfix filter to get mailboxes"; };
654 description = "rspamd configuration";
657 redis = mkRedisOptions "Redis";
658 read_password_hashed = mkOption { type = str; description = "Hashed read password for rspamd"; };
659 write_password_hashed = mkOption { type = str; description = "Hashed write password for rspamd"; };
660 read_password = mkOption {
662 description = "Read password for rspamd. Unused";
665 write_password = mkOption {
667 description = "Write password for rspamd. Unused";
674 description = "Sympa configuration";
677 listmasters = mkOption {
679 description = "Listmasters";
681 postgresql = mkPsqlOptions "Sympa";
682 data_sources = mkOption {
685 description = "Data sources to make available to sympa";
690 description = "Scenari to make available to sympa";
699 description = "Coturn configuration";
702 auth_access_key = mkOption { type = str; description = "key to access coturn"; };
706 buildbot = mkOption {
707 description = "Buildbot configuration";
711 description = "SSH key information";
714 public = mkOption { type = str; description = "Public part of the key"; };
715 private = mkOption { type = lines; description = "Private part of the key"; };
719 workerPassword = mkOption { description = "Buildbot worker password"; type = str; };
721 description = "Buildbot user";
725 description = "user uid";
729 description = "user gid";
736 description = "Ldap configuration for buildbot";
739 password = mkOption { type = str; description = "Buildbot password"; };
743 projects = mkOption {
744 description = "Projects to make a buildbot for";
745 type = attrsOf (submodule {
747 name = mkOption { type = str; description = "Project name"; };
748 src = mkOption { type = path; description = "source of the project configuration"; };
749 packages = mkOption {
750 type = listOf package;
751 example = literalExample ''
752 [ pkgs.bash pkgs.git pkgs.gzip pkgs.openssh ];
755 Builds packages list to make available to buildbot project.
758 pythonPathHome = mkOption { type = bool; description = "Whether to add project’s python home to python path"; };
759 workerPort = mkOption { type = port; description = "Port for the worker"; };
761 type = attrsOf lines;
762 description = "Secrets for the project to dump as files";
764 secretsDeps = mkOption {
765 type = listOf package;
767 description = "Dependencies of file that will land in secrets";
769 environment = mkOption {
772 Environment variables for the project.
773 BUILDBOT_ is prefixed to the variable names
776 activationScript = mkOption {
779 Activation script to run during deployment
782 webhookTokens = mkOption {
783 type = nullOr (listOf str);
786 List of tokens allowed to push to project’s change_hook/base endpoint
796 description = "Tools configurations";
799 contact = mkOption { type = str; description = "Contact e-mail address"; };
802 type = attrsOf (submodule {
804 assetType = mkOption { type = enum ["tgz" "url" "googleFont"]; default = "url"; description = "Type of asset"; };
805 tgzRemoveComponents = mkOption { type = int; default = 0; description = "Remove components when extracting"; };
806 url = mkOption { type = str; description = "URL to fetch"; };
807 sha256 = mkOption { type = str; description = "Hash of the url"; };
810 description = "Assets to provide on assets.immae.eu";
813 description = "Davical configuration";
816 postgresql = mkPsqlOptions "Davical";
817 ldap = mkLdapOptions "Davical" {};
821 diaspora = mkOption {
822 description = "Diaspora configuration";
825 postgresql = mkPsqlOptions "Diaspora";
826 redis = mkRedisOptions "Diaspora";
827 ldap = mkLdapOptions "Diaspora" {};
828 secret_token = mkOption { type = str; description = "Secret token"; };
832 dmarc_reports = mkOption {
833 description = "DMARC reports configuration";
836 mysql = mkMysqlOptions "DMARC" {};
837 anonymous_key = mkOption { type = str; description = "Anonymous hashing key"; };
841 etherpad-lite = mkOption {
842 description = "Etherpad configuration";
845 postgresql = mkPsqlOptions "Etherpad";
846 ldap = mkLdapOptions "Etherpad" {
847 group_filter = mkOption { type = str; description = "Filter for groups"; };
849 adminPassword = mkOption { type = str; description = "Admin password for mypads / admin"; };
850 session_key = mkOption { type = str; description = "Session key"; };
851 api_key = mkOption { type = str; description = "API key"; };
855 gitolite = mkOption {
856 description = "Gitolite configuration";
859 ldap = mkLdapOptions "Gitolite" {};
861 description = "SSH key information";
864 public = mkOption { type = str; description = "Public part of the key"; };
865 private = mkOption { type = lines; description = "Private part of the key"; };
873 description = "Landing configuration";
876 postgresql = mkPsqlOptions "Landing";
880 kanboard = mkOption {
881 description = "Kanboard configuration";
884 postgresql = mkPsqlOptions "Kanboard";
885 ldap = mkLdapOptions "Kanboard" {
886 admin_dn = mkOption { type = str; description = "Admin DN"; };
891 mantisbt = mkOption {
892 description = "Mantisbt configuration";
895 postgresql = mkPsqlOptions "Mantisbt";
896 ldap = mkLdapOptions "Mantisbt" {};
897 master_salt = mkOption { type = str; description = "Master salt for password hash"; };
901 mastodon = mkOption {
902 description = "Mastodon configuration";
905 postgresql = mkPsqlOptions "Mastodon";
906 redis = mkRedisOptions "Mastodon";
907 ldap = mkLdapOptions "Mastodon" {};
908 paperclip_secret = mkOption { type = str; description = "Paperclip secret"; };
909 otp_secret = mkOption { type = str; description = "OTP secret"; };
910 secret_key_base = mkOption { type = str; description = "Secret key base"; };
912 description = "vapid key";
915 private = mkOption { type = str; description = "Private key"; };
916 public = mkOption { type = str; description = "Public key"; };
923 mediagoblin = mkOption {
924 description = "Mediagoblin configuration";
927 postgresql = mkPsqlOptions "Mediagoblin";
928 redis = mkRedisOptions "Mediagoblin";
929 ldap = mkLdapOptions "Mediagoblin" {};
933 nextcloud = mkOption {
934 description = "Nextcloud configuration";
937 postgresql = mkPsqlOptions "Nextcloud";
938 redis = mkRedisOptions "Nextcloud";
939 password_salt = mkOption { type = str; description = "Password salt"; };
940 instance_id = mkOption { type = str; description = "Instance ID"; };
941 secret = mkOption { type = str; description = "App secret"; };
945 peertube = mkOption {
946 description = "Peertube configuration";
949 listenPort = mkOption { type = port; description = "Port to listen to"; };
950 postgresql = mkPsqlOptions "Peertube";
951 redis = mkRedisOptions "Peertube";
952 ldap = mkLdapOptions "Peertube" {};
956 phpldapadmin = mkOption {
957 description = "phpLdapAdmin configuration";
960 ldap = mkLdapOptions "phpldapadmin" {};
965 description = "Rompr configuration";
969 description = "MPD configuration";
972 host = mkOption { type = str; description = "Host for MPD"; };
973 port = mkOption { type = port; description = "Port to access MPD host"; };
980 roundcubemail = mkOption {
981 description = "Roundcubemail configuration";
984 postgresql = mkPsqlOptions "TT-RSS";
985 secret = mkOption { type = str; description = "Secret"; };
990 description = "Shaarli configuration";
993 ldap = mkLdapOptions "Shaarli" {};
997 status_engine = mkOption {
998 description = "Status Engine configuration";
1001 mysql = mkMysqlOptions "StatusEngine" {};
1002 ldap = mkLdapOptions "StatusEngine" {};
1007 description = "Taskwarrior configuration";
1010 ldap = mkLdapOptions "Taskwarrior" {};
1011 taskwarrior-web = mkOption {
1012 description = "taskwarrior-web profiles";
1014 type = attrsOf (submodule {
1018 description = "List of ldap uids having access to this profile";
1020 org = mkOption { type = str; description = "Taskd organisation"; };
1021 key = mkOption { type = str; description = "Taskd key"; };
1022 date = mkOption { type = str; description = "Preferred date format"; };
1030 description = "TT-RSS configuration";
1033 postgresql = mkPsqlOptions "TT-RSS";
1034 ldap = mkLdapOptions "TT-RSS" {};
1038 wallabag = mkOption {
1039 description = "Wallabag configuration";
1042 postgresql = mkPsqlOptions "Wallabag";
1043 ldap = mkLdapOptions "Wallabag" {
1044 admin_filter = mkOption { type = str; description = "Admin users filter"; };
1046 redis = mkRedisOptions "Wallabag";
1047 secret = mkOption { type = str; description = "App secret"; };
1051 webhooks = mkOption {
1053 description = "Mapping 'name'.php => script for webhooks";
1055 csp_reports = mkOption {
1056 description = "CSP report configuration";
1059 report_uri = mkOption { type = str; description = "URI to report CSP violations to"; };
1060 policies = mkOption { type = attrsOf str; description = "CSP policies to apply"; };
1064 commento = mkOption {
1065 description = "Commento configuration";
1068 listenPort = mkOption { type = port; description = "Port to listen to"; };
1069 postgresql = mkPsqlOptions "Commento";
1070 smtp = mkSmtpOptions "Commento";
1074 cryptpad = mkOption {
1075 description = "Cryptpad configuration";
1078 email = mkOption { type = str; description = "Admin e-mail"; };
1079 admins = mkOption { type = listOf str; description = "Instance admin public keys"; };
1080 port = mkOption { type = port; description = "Port to listen to"; };
1085 description = "Ympd configuration";
1088 listenPort = mkOption { type = port; description = "Port to listen to"; };
1090 description = "MPD configuration";
1093 password = mkOption { type = str; description = "Password to access MPD host"; };
1094 host = mkOption { type = str; description = "Host for MPD"; };
1095 port = mkOption { type = port; description = "Port to access MPD host"; };
1103 description = "Umami configuration";
1106 listenPort = mkOption { type = port; description = "Port to listen to"; };
1107 postgresql = mkPsqlOptions "Umami";
1108 hashSalt = mkOption { type = str; description = "Hash salt"; };
1113 description = "Yourls configuration";
1116 mysql = mkMysqlOptions "Yourls" {};
1117 ldap = mkLdapOptions "Yourls" {};
1118 cookieKey = mkOption { type = str; description = "Cookie key"; };
1125 serverSpecific = mkOption { type = attrsOf unspecified; description = "Server specific configuration"; };
1127 options.hostEnv = mkOption {
1130 default = config.myEnv.servers."${name}";
1131 description = "Host environment";