]> git.immae.eu Git - perso/Immae/Config/Nix.git/blob - modules/private/environment.nix
00026227dba94172a7b14b484e5654f8472d72a9
[perso/Immae/Config/Nix.git] / modules / private / environment.nix
1 { config, lib, name, ... }:
2 with lib;
3 with types;
4 with lists;
5 let
6 ldapOptions = {
7 base = mkOption { description = "Base of the LDAP tree"; type = str; };
8 host = mkOption { description = "Host to access LDAP"; type = str; };
9 root_dn = mkOption { description = "DN of the root user"; type = str; };
10 root_pw = mkOption { description = "Hashed password of the root user"; type = str; };
11 replication_dn = mkOption { description = "DN of the user allowed to replicate the LDAP directory"; type = str; };
12 replication_pw = mkOption { description = "Password of the user allowed to replicate the LDAP directory"; type = str; };
13 };
14 mkLdapOptions = name: more: mkOption {
15 description = "${name} LDAP configuration";
16 type = submodule {
17 options = ldapOptions // {
18 dn = mkOption { description = "DN of the ${name} user"; type = str; };
19 password = mkOption { description = "password of the ${name} user"; type = str; };
20 filter = mkOption { description = "Filter for ${name} users"; type = str; default = ""; };
21 } // more;
22 };
23 };
24 mysqlOptions = {
25 host = mkOption { description = "Host to access Mysql"; type = str; };
26 remoteHost = mkOption { description = "Host to access Mysql from outside"; type = str; };
27 port = mkOption { description = "Port to access Mysql"; type = str; };
28 socket = mkOption { description = "Socket to access Mysql"; type = path; };
29 systemUsers = mkOption {
30 description = "Attrs of user-passwords allowed to access mysql";
31 type = attrsOf str;
32 };
33 pam = mkOption {
34 description = "PAM configuration for mysql";
35 type = submodule {
36 options = {
37 dn = mkOption { description = "DN to connect as to check users"; type = str; };
38 password = mkOption { description = "DN password to connect as to check users"; type = str; };
39 filter = mkOption { description = "filter to match users"; type = str; };
40 };
41 };
42 };
43 };
44 mkMysqlOptions = name: more: mkOption {
45 description = "${name} mysql configuration";
46 type = submodule {
47 options = mysqlOptions // {
48 database = mkOption { description = "${name} database"; type = str; };
49 user = mkOption { description = "${name} user"; type = str; };
50 password = mkOption { description = "mysql password of the ${name} user"; type = str; };
51 } // more;
52 };
53 };
54 psqlOptions = {
55 host = mkOption { description = "Host to access Postgresql"; type = str; };
56 port = mkOption { description = "Port to access Postgresql"; type = str; };
57 socket = mkOption { description = "Socket to access Postgresql"; type = path; };
58 pam = mkOption {
59 description = "PAM configuration for psql";
60 type = submodule {
61 options = {
62 dn = mkOption { description = "DN to connect as to check users"; type = str; };
63 password = mkOption { description = "DN password to connect as to check users"; type = str; };
64 filter = mkOption { description = "filter to match users"; type = str; };
65 };
66 };
67 };
68 };
69 mkPsqlOptions = name: mkOption {
70 description = "${name} psql configuration";
71 type = submodule {
72 options = psqlOptions // {
73 database = mkOption { description = "${name} database"; type = str; };
74 schema = mkOption { description = "${name} schema"; type = nullOr str; default = null; };
75 user = mkOption { description = "${name} user"; type = str; };
76 password = mkOption { description = "psql password of the ${name} user"; type = str; };
77 };
78 };
79 };
80 redisOptions = {
81 host = mkOption { description = "Host to access Redis"; type = str; };
82 port = mkOption { description = "Port to access Redis"; type = str; };
83 socket = mkOption { description = "Socket to access Redis"; type = path; };
84 dbs = mkOption {
85 description = "Attrs of db number. Each number should be unique to avoid collision!";
86 type = attrsOf str;
87 };
88 spiped_key = mkOption {
89 type = str;
90 description = ''
91 Key to use with spiped to make a secure channel to replication
92 '';
93 };
94 predixy = mkOption {
95 description = "Predixy configuration. Unused yet";
96 type = submodule {
97 options = {
98 read = mkOption { type = str; description = "Read password"; };
99 };
100 };
101 };
102 };
103 mkRedisOptions = name: mkOption {
104 description = "${name} redis configuration";
105 type = submodule {
106 options = redisOptions // {
107 db = mkOption { description = "${name} database"; type = str; };
108 };
109 };
110 };
111 hostEnv = submodule {
112 options = {
113 fqdn = mkOption {
114 description = "Host FQDN";
115 type = str;
116 };
117 users = mkOption {
118 type = unspecified;
119 default = pkgs: [];
120 description = ''
121 Sublist of users from realUsers. Function that takes pkgs as
122 argument and gives an array as a result
123 '';
124 };
125 emails = mkOption {
126 default = [];
127 description = "List of e-mails that the server can be a sender of";
128 type = listOf str;
129 };
130 ldap = mkOption {
131 description = ''
132 LDAP credentials for the host
133 '';
134 type = submodule {
135 options = {
136 password = mkOption { type = str; description = "Password for the LDAP connection"; };
137 dn = mkOption { type = str; description = "DN for the LDAP connection"; };
138 };
139 };
140 };
141 mx = mkOption {
142 description = "subdomain and priority for MX server";
143 default = { enable = false; };
144 type = submodule {
145 options = {
146 enable = mkEnableOption "Enable MX";
147 subdomain = mkOption { type = nullOr str; description = "Subdomain name (mx-*)"; };
148 priority = mkOption { type = nullOr str; description = "Priority"; };
149 };
150 };
151 };
152 ips = mkOption {
153 description = ''
154 attrs of ip4/ip6 grouped by section
155 '';
156 type = attrsOf (submodule {
157 options = {
158 ip4 = mkOption {
159 type = str;
160 description = ''
161 ip4 address of the host
162 '';
163 };
164 ip6 = mkOption {
165 type = listOf str;
166 default = [];
167 description = ''
168 ip6 addresses of the host
169 '';
170 };
171 };
172 });
173 };
174 };
175 };
176 in
177 {
178 options.myEnv = {
179 servers = mkOption {
180 description = ''
181 Attrs of servers information in the cluster (not necessarily handled by nixops)
182 '';
183 default = {};
184 type = attrsOf hostEnv;
185 };
186 hetznerCloud = mkOption {
187 description = ''
188 Hetzner Cloud credential information
189 '';
190 type = submodule {
191 options = {
192 authToken = mkOption {
193 type = str;
194 description = ''
195 The API auth token.
196 '';
197 };
198 };
199 };
200 };
201 hetzner = mkOption {
202 description = ''
203 Hetzner credential information
204 '';
205 type = submodule {
206 options = {
207 user = mkOption { type = str; description = "User"; };
208 pass = mkOption { type = str; description = "Password"; };
209 };
210 };
211 };
212 sshd = mkOption {
213 description = ''
214 sshd service credential information
215 '';
216 type = submodule {
217 options = {
218 ldap = mkOption {
219 description = ''
220 LDAP credentials for cn=ssh,ou=services,dc=immae,dc=eu dn
221 '';
222 type = submodule {
223 options = {
224 password = mkOption { description = "Password"; type = str; };
225 };
226 };
227 };
228 };
229 };
230 };
231 ports = mkOption {
232 description = ''
233 non-standard reserved ports. Must be unique!
234 '';
235 type = attrsOf port;
236 default = {};
237 apply = let
238 noDupl = x: builtins.length (builtins.attrValues x) == builtins.length (unique (builtins.attrValues x));
239 in
240 x: if isAttrs x && noDupl x then x else throw "Non unique values for ports";
241 };
242 httpd = mkOption {
243 description = ''
244 httpd service credential information
245 '';
246 type = submodule {
247 options = {
248 ldap = mkOption {
249 description = ''
250 LDAP credentials for cn=httpd,ou=services,dc=immae,dc=eu dn
251 '';
252 type = submodule {
253 options = {
254 password = mkOption { description = "Password"; type = str; };
255 };
256 };
257 };
258 };
259 };
260 };
261 ldap = mkOption {
262 description = ''
263 LDAP server configuration
264 '';
265 type = submodule {
266 options = ldapOptions;
267 };
268 };
269 databases = mkOption {
270 description = "Databases configuration";
271 type = submodule {
272 options = {
273 mysql = mkOption {
274 type = submodule { options = mysqlOptions; };
275 description = "Mysql configuration";
276 };
277 redis = mkOption {
278 type = submodule { options = redisOptions; };
279 description = "Redis configuration";
280 };
281 postgresql = mkOption {
282 type = submodule { options = psqlOptions; };
283 description = "Postgresql configuration";
284 };
285 };
286 };
287 };
288 jabber = mkOption {
289 description = "Jabber configuration";
290 type = submodule {
291 options = {
292 postfix_user_filter = mkOption { type = str; description = "Postfix filter to get xmpp users"; };
293 ldap = mkLdapOptions "Jabber" {};
294 postgresql = mkPsqlOptions "Jabber";
295 };
296 };
297 };
298 realUsers = mkOption {
299 description = ''
300 Attrset of function taking pkgs as argument.
301 Real users settings, should provide a subattr of users.users.<name>
302 with at least: name, (hashed)Password, shell
303 '';
304 type = attrsOf unspecified;
305 };
306 users = mkOption {
307 description = "System and regular users uid/gid";
308 type = attrsOf (submodule {
309 options = {
310 uid = mkOption {
311 description = "user uid";
312 type = int;
313 };
314 gid = mkOption {
315 description = "user gid";
316 type = int;
317 };
318 };
319 });
320 };
321 dns = mkOption {
322 description = "DNS configuration";
323 type = submodule {
324 options = {
325 soa = mkOption {
326 description = "SOA information";
327 type = submodule {
328 options = {
329 serial = mkOption {
330 description = "Serial number. Should be incremented at each change and unique";
331 type = str;
332 };
333 refresh = mkOption {
334 description = "Refresh time";
335 type = str;
336 };
337 retry = mkOption {
338 description = "Retry time";
339 type = str;
340 };
341 expire = mkOption {
342 description = "Expire time";
343 type = str;
344 };
345 ttl = mkOption {
346 description = "Default TTL time";
347 type = str;
348 };
349 email = mkOption {
350 description = "hostmaster e-mail";
351 type = str;
352 };
353 primary = mkOption {
354 description = "Primary NS";
355 type = str;
356 };
357 };
358 };
359 };
360 ns = mkOption {
361 description = "Attrs of NS servers group";
362 example = {
363 foo = {
364 "ns1.foo.com" = [ "198.51.100.10" "2001:db8:abcd::1" ];
365 "ns2.foo.com" = [ "198.51.100.15" "2001:db8:1234::1" ];
366 };
367 };
368 type = attrsOf (attrsOf (listOf str));
369 };
370 slaveZones = mkOption {
371 description = "List of slave zones";
372 type = listOf (submodule {
373 options = {
374 name = mkOption { type = str; description = "zone name"; };
375 masters = mkOption {
376 description = "NS master groups of this zone";
377 type = listOf str;
378 };
379 };
380 });
381 };
382 masterZones = mkOption {
383 description = "List of master zones";
384 type = listOf (submodule {
385 options = {
386 name = mkOption { type = str; description = "zone name"; };
387 slaves = mkOption {
388 description = "NS slave groups of this zone";
389 type = listOf str;
390 };
391 ns = mkOption {
392 description = "groups names that should have their NS entries listed here";
393 type = listOf str;
394 };
395 extra = mkOption {
396 description = "Extra zone configuration for bind";
397 example = ''
398 notify yes;
399 '';
400 type = lines;
401 };
402 entries = mkOption { type = lines; description = "Regular entries of the NS zone"; };
403 withEmail = mkOption {
404 description = "List of domains that should have mail entries (MX, dkim, SPF, ...)";
405 default = [];
406 type = listOf (submodule {
407 options = {
408 domain = mkOption { type = str; description = "Which subdomain is concerned"; };
409 send = mkOption { type = bool; description = "Whether there can be e-mails originating from the subdomain"; };
410 receive = mkOption { type = bool; description = "Whether there can be e-mails arriving to the subdomain"; };
411 };
412 });
413 };
414 };
415 });
416 };
417 };
418 };
419 };
420 backup = mkOption {
421 description = ''
422 Remote backup with duplicity
423 '';
424 type = submodule {
425 options = {
426 password = mkOption { type = str; description = "Password for encrypting files"; };
427 remote = mkOption { type = str; description = "Remote url access"; };
428 accessKeyId = mkOption { type = str; description = "Remote access-key"; };
429 secretAccessKey = mkOption { type = str; description = "Remote access secret"; };
430 };
431 };
432 };
433 rsync_backup = mkOption {
434 description =''
435 Rsync backup configuration from controlled host
436 '';
437 type = submodule {
438 options = {
439 ssh_key = mkOption {
440 description = "SSH key information";
441 type = submodule {
442 options = {
443 public = mkOption { type = str; description = "Public part of the key"; };
444 private = mkOption { type = lines; description = "Private part of the key"; };
445 };
446 };
447 };
448 profiles = mkOption {
449 description = "Attrs of profiles to backup";
450 type = attrsOf (submodule {
451 options = {
452 keep = mkOption { type = int; description = "Number of backups to keep"; };
453 login = mkOption { type = str; description = "Login to connect to host"; };
454 port = mkOption { type = str; default = "22"; description = "Port to connect to host"; };
455 host = mkOption { type = str; description = "Host to connect to"; };
456 host_key = mkOption { type = str; description = "Host key"; };
457 host_key_type = mkOption { type = str; description = "Host key type"; };
458 parts = mkOption {
459 description = "Parts to backup for this host";
460 type = attrsOf (submodule {
461 options = {
462 remote_folder = mkOption { type = path; description = "Remote folder to backup";};
463 exclude_from = mkOption {
464 type = listOf path;
465 default = [];
466 description = "List of folders/files to exclude from the backup";
467 };
468 files_from = mkOption {
469 type = listOf path;
470 default = [];
471 description = "List of folders/files to backup in the base folder";
472 };
473 args = mkOption {
474 type = nullOr str;
475 default = null;
476 description = "Extra arguments to pass to rsync";
477 };
478 };
479 });
480 };
481 };
482 });
483 };
484 };
485 };
486 };
487 monitoring = mkOption {
488 description = "Monitoring configuration";
489 type = submodule {
490 options = {
491 status_url = mkOption { type = str; description = "URL to push status to"; };
492 status_token = mkOption { type = str; description = "Token for the status url"; };
493 http_user_password = mkOption { type = str; description = "HTTP credentials to check services behind wall"; };
494 email = mkOption { type = str; description = "Admin E-mail"; };
495 ssh_public_key = mkOption { type = str; description = "SSH public key"; };
496 ssh_secret_key = mkOption { type = str; description = "SSH secret key"; };
497 imap_login = mkOption { type = str; description = "IMAP login"; };
498 imap_password = mkOption { type = str; description = "IMAP password"; };
499 eriomem_keys = mkOption { type = listOf (listOf str); description = "Eriomem keys"; default = []; };
500 ovh_sms = mkOption {
501 description = "OVH credentials for sms script";
502 type = submodule {
503 options = {
504 endpoint = mkOption { type = str; default = "ovh-eu"; description = "OVH endpoint"; };
505 application_key = mkOption { type = str; description = "Application key"; };
506 application_secret = mkOption { type = str; description = "Application secret"; };
507 consumer_key = mkOption { type = str; description = "Consumer key"; };
508 account = mkOption { type = str; description = "Account"; };
509 };
510 };
511 };
512 nrdp_tokens = mkOption { type = listOf str; description = "Tokens allowed to push status update"; };
513 slack_url = mkOption { type = str; description = "Slack webhook url to push status update"; };
514 slack_channel = mkOption { type = str; description = "Slack channel to push status update"; };
515 contacts = mkOption { type = attrsOf unspecified; description = "Contact dicts to fill naemon objects"; };
516 email_check = mkOption {
517 description = "Emails services to check";
518 type = attrsOf (submodule {
519 options = {
520 local = mkOption { type = bool; default = false; description = "Use local configuration"; };
521 port = mkOption { type = nullOr str; default = null; description = "Port to connect to ssh"; };
522 login = mkOption { type = nullOr str; default = null; description = "Login to connect to ssh"; };
523 targets = mkOption { type = listOf str; description = "Hosts to send E-mails to"; };
524 mail_address = mkOption { type = nullOr str; default = null; description = "E-mail recipient part to send e-mail to"; };
525 mail_domain = mkOption { type = nullOr str; default = null; description = "E-mail domain part to send e-mail to"; };
526 };
527 });
528 };
529 };
530 };
531 };
532 mpd = mkOption {
533 description = "MPD configuration";
534 type = submodule {
535 options = {
536 folder = mkOption { type = str; description = "Folder to serve from the MPD instance"; };
537 password = mkOption { type = str; description = "Password to connect to the MPD instance"; };
538 host = mkOption { type = str; description = "Host to connect to the MPD instance"; };
539 port = mkOption { type = str; description = "Port to connect to the MPD instance"; };
540 };
541 };
542 };
543 ftp = mkOption {
544 description = "FTP configuration";
545 type = submodule {
546 options = {
547 ldap = mkLdapOptions "FTP" {};
548 };
549 };
550 };
551 vpn = mkOption {
552 description = "VPN configuration";
553 type = attrsOf (submodule {
554 options = {
555 prefix = mkOption { type = str; description = "ipv6 prefix for the vpn subnet"; };
556 privateKey = mkOption { type = str; description = "Private key for the host"; };
557 publicKey = mkOption { type = str; description = "Public key for the host"; };
558 };
559 });
560 };
561 mail = mkOption {
562 description = "Mail configuration";
563 type = submodule {
564 options = {
565 dmarc = mkOption {
566 description = "DMARC configuration";
567 type = submodule {
568 options = {
569 ignore_hosts = mkOption {
570 type = lines;
571 description = ''
572 Hosts to ignore when checking for dmarc
573 '';
574 };
575 };
576 };
577 };
578 dkim = mkOption {
579 description = "DKIM configuration";
580 type = attrsOf (submodule {
581 options = {
582 public = mkOption {
583 type = str;
584 example = ''
585 ( "v=DKIM1; k=rsa; "
586 "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3w1a2aMxWw9+hdcmbqX4UevcVqr204y0K73Wdc7MPZiOOlUJQYsMNSYR1Y/SC7jmPKeitpcJCpQgn/cveJZbuikjjPLsDReHyFEYmC278ZLRTELHx6f1IXM8WE08JIRT69CfZiMi1rVcOh9qRT4F93PyjCauU8Y5hJjtg9ThsWwIDAQAB" )
587 '';
588 description = "Public entry to put in DNS TXT field";
589 };
590 private = mkOption { type = str; description = "Private key"; };
591 };
592 });
593 };
594 postfix = mkOption {
595 description = "Postfix configuration";
596 type = submodule {
597 options = {
598 additional_mailbox_domains = mkOption {
599 description = ''
600 List of domains that are used as mailbox final destination, in addition to those defined in the DNS records
601 '';
602 type = listOf str;
603 };
604 mysql = mkMysqlOptions "Postfix" {
605 password_encrypt = mkOption { type = str; description = "Key to encrypt relay password in database"; };
606 };
607 backup_domains = mkOption {
608 description = ''
609 Domains that are accepted for relay as backup domain
610 '';
611 type = attrsOf (submodule {
612 options = {
613 domains = mkOption { type = listOf str; description = "Domains list"; };
614 relay_restrictions = mkOption {
615 type = lines;
616 description = ''
617 Restrictions for relaying the e-mails from the domains
618 '';
619 };
620 recipient_maps = mkOption {
621 description = ''
622 Recipient map to accept relay for.
623 Must be specified for domain, the rules apply to everyone!
624 '';
625 type = listOf (submodule {
626 options = {
627 type = mkOption {
628 type = enum [ "hash" ];
629 description = "Map type";
630 };
631 content = mkOption {
632 type = str;
633 description = "Map content";
634 };
635 };
636 });
637 };
638 };
639 });
640 };
641 };
642 };
643 };
644 dovecot = mkOption {
645 description = "Dovecot configuration";
646 type = submodule {
647 options = {
648 ldap = mkLdapOptions "Dovecot" {
649 pass_attrs = mkOption { type = str; description = "Password attribute in LDAP"; };
650 user_attrs = mkOption { type = str; description = "User attribute mapping in LDAP"; };
651 iterate_attrs = mkOption { type = str; description = "User attribute mapping for listing in LDAP"; };
652 iterate_filter = mkOption { type = str; description = "User attribute filter for listing in LDAP"; };
653 };
654 };
655 };
656 };
657 rspamd = mkOption {
658 description = "rspamd configuration";
659 type = submodule {
660 options = {
661 redis = mkRedisOptions "Redis";
662 read_password_hashed = mkOption { type = str; description = "Hashed read password for rspamd"; };
663 write_password_hashed = mkOption { type = str; description = "Hashed write password for rspamd"; };
664 read_password = mkOption {
665 type = str;
666 description = "Read password for rspamd. Unused";
667 apply = x: "";
668 };
669 write_password = mkOption {
670 type = str;
671 description = "Write password for rspamd. Unused";
672 apply = x: "";
673 };
674 };
675 };
676 };
677 scripts = mkOption {
678 description = "Mail script recipients";
679 type = attrsOf (submodule {
680 options = {
681 external = mkEnableOption "Create a script_<name>@mail.immae.eu external address";
682 src = mkOption {
683 description = ''
684 git source to fetch the script from.
685 It must have a default.nix file as its root accepting a scriptEnv parameter
686 '';
687 type = submodule {
688 options = {
689 url = mkOption { type = str; description = "git url to fetch"; };
690 rev = mkOption { type = str; description = "git reference to fetch"; };
691 };
692 };
693 };
694 env = mkOption {
695 description = "Variables to pass to the script";
696 type = unspecified;
697 };
698 };
699 });
700 };
701 };
702 };
703 };
704 buildbot = mkOption {
705 description = "Buildbot configuration";
706 type = submodule {
707 options = {
708 user = mkOption {
709 description = "Buildbot user";
710 type = submodule {
711 options = {
712 uid = mkOption {
713 description = "user uid";
714 type = int;
715 };
716 gid = mkOption {
717 description = "user gid";
718 type = int;
719 };
720 };
721 };
722 };
723 ldap = mkOption {
724 description = "Ldap configuration for buildbot";
725 type = submodule {
726 options = {
727 password = mkOption { type = str; description = "Buildbot password"; };
728 };
729 };
730 };
731 projects = mkOption {
732 description = "Projects to make a buildbot for";
733 type = attrsOf (submodule {
734 options = {
735 name = mkOption { type = str; description = "Project name"; };
736 packages = mkOption {
737 type = unspecified;
738 example = literalExample ''
739 pkgs: [ pkgs.bash pkgs.git pkgs.gzip pkgs.openssh ];
740 '';
741 description = ''
742 Function.
743 Builds packages list to make available to buildbot project.
744 Takes pkgs as argument.
745 '';
746 };
747 pythonPackages = mkOption {
748 type = unspecified;
749 example = literalExample ''
750 p: pkgs: [ pkgs.python3Packages.pip ];
751 '';
752 description = ''
753 Function.
754 Builds python packages list to make available to buildbot project.
755 Takes buildbot python module as first argument and pkgs as second argument in order to augment the python modules list.
756 '';
757 };
758 pythonPathHome = mkOption { type = bool; description = "Whether to add project’s python home to python path"; };
759 secrets = mkOption {
760 type = attrsOf str;
761 description = "Secrets for the project to dump as files";
762 };
763 environment = mkOption {
764 type = attrsOf str;
765 description = ''
766 Environment variables for the project.
767 BUILDBOT_ is prefixed to the variable names
768 '';
769 };
770 activationScript = mkOption {
771 type = lines;
772 description = ''
773 Activation script to run during deployment
774 '';
775 };
776 builderPaths = mkOption {
777 type = attrsOf unspecified;
778 default = {};
779 description = ''
780 Attrs of functions to make accessible specifically per builder.
781 Takes pkgs as argument and should return a single path containing binaries.
782 This path will be accessible as BUILDBOT_PATH_<attrskey>
783 '';
784 };
785 webhookTokens = mkOption {
786 type = nullOr (listOf str);
787 default = null;
788 description = ''
789 List of tokens allowed to push to project’s change_hook/base endpoint
790 '';
791 };
792 };
793 });
794 };
795 };
796 };
797 };
798 tools = mkOption {
799 description = "Tools configurations";
800 type = submodule {
801 options = {
802 contact = mkOption { type = str; description = "Contact e-mail address"; };
803 davical = mkOption {
804 description = "Davical configuration";
805 type = submodule {
806 options = {
807 postgresql = mkPsqlOptions "Davical";
808 ldap = mkLdapOptions "Davical" {};
809 };
810 };
811 };
812 diaspora = mkOption {
813 description = "Diaspora configuration";
814 type = submodule {
815 options = {
816 postgresql = mkPsqlOptions "Diaspora";
817 redis = mkRedisOptions "Diaspora";
818 ldap = mkLdapOptions "Diaspora" {};
819 secret_token = mkOption { type = str; description = "Secret token"; };
820 };
821 };
822 };
823 dmarc_reports = mkOption {
824 description = "DMARC reports configuration";
825 type = submodule {
826 options = {
827 mysql = mkMysqlOptions "DMARC" {};
828 anonymous_key = mkOption { type = str; description = "Anonymous hashing key"; };
829 };
830 };
831 };
832 etherpad-lite = mkOption {
833 description = "Etherpad configuration";
834 type = submodule {
835 options = {
836 postgresql = mkPsqlOptions "Etherpad";
837 ldap = mkLdapOptions "Etherpad" {
838 group_filter = mkOption { type = str; description = "Filter for groups"; };
839 };
840 session_key = mkOption { type = str; description = "Session key"; };
841 api_key = mkOption { type = str; description = "API key"; };
842 redirects = mkOption { type = str; description = "Redirects for apache"; };
843 };
844 };
845 };
846 gitolite = mkOption {
847 description = "Gitolite configuration";
848 type = submodule {
849 options = {
850 ldap = mkLdapOptions "Gitolite" {};
851 };
852 };
853 };
854 kanboard = mkOption {
855 description = "Kanboard configuration";
856 type = submodule {
857 options = {
858 postgresql = mkPsqlOptions "Kanboard";
859 ldap = mkLdapOptions "Kanboard" {
860 admin_dn = mkOption { type = str; description = "Admin DN"; };
861 };
862 };
863 };
864 };
865 mantisbt = mkOption {
866 description = "Mantisbt configuration";
867 type = submodule {
868 options = {
869 postgresql = mkPsqlOptions "Mantisbt";
870 ldap = mkLdapOptions "Mantisbt" {};
871 master_salt = mkOption { type = str; description = "Master salt for password hash"; };
872 };
873 };
874 };
875 mastodon = mkOption {
876 description = "Mastodon configuration";
877 type = submodule {
878 options = {
879 postgresql = mkPsqlOptions "Mastodon";
880 redis = mkRedisOptions "Mastodon";
881 ldap = mkLdapOptions "Mastodon" {};
882 paperclip_secret = mkOption { type = str; description = "Paperclip secret"; };
883 otp_secret = mkOption { type = str; description = "OTP secret"; };
884 secret_key_base = mkOption { type = str; description = "Secret key base"; };
885 vapid = mkOption {
886 description = "vapid key";
887 type = submodule {
888 options = {
889 private = mkOption { type = str; description = "Private key"; };
890 public = mkOption { type = str; description = "Public key"; };
891 };
892 };
893 };
894 };
895 };
896 };
897 mediagoblin = mkOption {
898 description = "Mediagoblin configuration";
899 type = submodule {
900 options = {
901 postgresql = mkPsqlOptions "Mediagoblin";
902 redis = mkRedisOptions "Mediagoblin";
903 ldap = mkLdapOptions "Mediagoblin" {};
904 };
905 };
906 };
907 nextcloud = mkOption {
908 description = "Nextcloud configuration";
909 type = submodule {
910 options = {
911 postgresql = mkPsqlOptions "Peertube";
912 redis = mkRedisOptions "Peertube";
913 password_salt = mkOption { type = str; description = "Password salt"; };
914 instance_id = mkOption { type = str; description = "Instance ID"; };
915 secret = mkOption { type = str; description = "App secret"; };
916 };
917 };
918 };
919 peertube = mkOption {
920 description = "Peertube configuration";
921 type = submodule {
922 options = {
923 listenPort = mkOption { type = port; description = "Port to listen to"; };
924 postgresql = mkPsqlOptions "Peertube";
925 redis = mkRedisOptions "Peertube";
926 ldap = mkLdapOptions "Peertube" {};
927 };
928 };
929 };
930 syden_peertube = mkOption {
931 description = "Peertube Syden configuration";
932 type = submodule {
933 options = {
934 listenPort = mkOption { type = port; description = "Port to listen to"; };
935 postgresql = mkPsqlOptions "Peertube";
936 redis = mkRedisOptions "Peertube";
937 };
938 };
939 };
940 phpldapadmin = mkOption {
941 description = "phpLdapAdmin configuration";
942 type = submodule {
943 options = {
944 ldap = mkLdapOptions "phpldapadmin" {};
945 };
946 };
947 };
948 rompr = mkOption {
949 description = "Rompr configuration";
950 type = submodule {
951 options = {
952 mpd = mkOption {
953 description = "MPD configuration";
954 type = submodule {
955 options = {
956 host = mkOption { type = str; description = "Host for MPD"; };
957 port = mkOption { type = port; description = "Port to access MPD host"; };
958 };
959 };
960 };
961 };
962 };
963 };
964 roundcubemail = mkOption {
965 description = "Roundcubemail configuration";
966 type = submodule {
967 options = {
968 postgresql = mkPsqlOptions "TT-RSS";
969 secret = mkOption { type = str; description = "Secret"; };
970 };
971 };
972 };
973 shaarli = mkOption {
974 description = "Shaarli configuration";
975 type = submodule {
976 options = {
977 ldap = mkLdapOptions "Shaarli" {};
978 };
979 };
980 };
981 task = mkOption {
982 description = "Taskwarrior configuration";
983 type = submodule {
984 options = {
985 ldap = mkLdapOptions "Taskwarrior" {};
986 taskwarrior-web = mkOption {
987 description = "taskwarrior-web profiles";
988 type = attrsOf (submodule {
989 options = {
990 uid = mkOption {
991 type = listOf str;
992 description = "List of ldap uids having access to this profile";
993 };
994 org = mkOption { type = str; description = "Taskd organisation"; };
995 key = mkOption { type = str; description = "Taskd key"; };
996 date = mkOption { type = str; description = "Preferred date format"; };
997 };
998 });
999 };
1000 };
1001 };
1002 };
1003 ttrss = mkOption {
1004 description = "TT-RSS configuration";
1005 type = submodule {
1006 options = {
1007 postgresql = mkPsqlOptions "TT-RSS";
1008 ldap = mkLdapOptions "TT-RSS" {};
1009 };
1010 };
1011 };
1012 wallabag = mkOption {
1013 description = "Wallabag configuration";
1014 type = submodule {
1015 options = {
1016 postgresql = mkPsqlOptions "Wallabag";
1017 ldap = mkLdapOptions "Wallabag" {
1018 admin_filter = mkOption { type = str; description = "Admin users filter"; };
1019 };
1020 redis = mkRedisOptions "Wallabag";
1021 secret = mkOption { type = str; description = "App secret"; };
1022 };
1023 };
1024 };
1025 webhooks = mkOption {
1026 type = attrsOf str;
1027 description = "Mapping 'name'.php => script for webhooks";
1028 };
1029 ympd = mkOption {
1030 description = "Ympd configuration";
1031 type = submodule {
1032 options = {
1033 listenPort = mkOption { type = port; description = "Port to listen to"; };
1034 mpd = mkOption {
1035 description = "MPD configuration";
1036 type = submodule {
1037 options = {
1038 password = mkOption { type = str; description = "Password to access MPD host"; };
1039 host = mkOption { type = str; description = "Host for MPD"; };
1040 port = mkOption { type = port; description = "Port to access MPD host"; };
1041 };
1042 };
1043 };
1044 };
1045 };
1046 };
1047 yourls = mkOption {
1048 description = "Yourls configuration";
1049 type = submodule {
1050 options = {
1051 mysql = mkMysqlOptions "Yourls" {};
1052 ldap = mkLdapOptions "Yourls" {};
1053 cookieKey = mkOption { type = str; description = "Cookie key"; };
1054 };
1055 };
1056 };
1057 };
1058 };
1059 };
1060 websites = mkOption {
1061 description = "Websites configurations";
1062 type = submodule {
1063 options = {
1064 isabelle = mkOption {
1065 description = "Isabelle configurations by environment";
1066 type =
1067 let
1068 atenSubmodule = mkOption {
1069 description = "environment configuration";
1070 type = submodule {
1071 options = {
1072 environment = mkOption { type = str; description = "Symfony environment"; };
1073 secret = mkOption { type = str; description = "Symfony App secret"; };
1074 postgresql = mkPsqlOptions "Aten";
1075 };
1076 };
1077 };
1078 in
1079 submodule {
1080 options = {
1081 aten_production = atenSubmodule;
1082 aten_integration = atenSubmodule;
1083 iridologie = mkOption {
1084 description = "environment configuration";
1085 type = submodule {
1086 options = {
1087 environment = mkOption { type = str; description = "SPIP environment"; };
1088 mysql = mkMysqlOptions "Iridologie" {};
1089 ldap = mkLdapOptions "Iridologie" {};
1090 };
1091 };
1092 };
1093 };
1094 };
1095 };
1096 chloe = mkOption {
1097 description = "Chloe configurations by environment";
1098 type =
1099 let
1100 chloeSubmodule = mkOption {
1101 description = "environment configuration";
1102 type = submodule {
1103 options = {
1104 environment = mkOption { type = str; description = "SPIP environment"; };
1105 mysql = mkMysqlOptions "Chloe" {};
1106 ldap = mkLdapOptions "Chloe" {};
1107 };
1108 };
1109 };
1110 in
1111 submodule {
1112 options = {
1113 production = chloeSubmodule;
1114 integration = chloeSubmodule;
1115 };
1116 };
1117 };
1118 connexionswing = mkOption {
1119 description = "Connexionswing configurations by environment";
1120 type =
1121 let
1122 csSubmodule = mkOption {
1123 description = "environment configuration";
1124 type = submodule {
1125 options = {
1126 environment = mkOption { type = str; description = "Symfony environment"; };
1127 mysql = mkMysqlOptions "Connexionswing" {};
1128 secret = mkOption { type = str; description = "Symfony App secret"; };
1129 email = mkOption { type = str; description = "Symfony email notification"; };
1130 };
1131 };
1132 };
1133 in
1134 submodule {
1135 options = {
1136 production = csSubmodule;
1137 integration = csSubmodule;
1138 };
1139 };
1140 };
1141 jerome = mkOption {
1142 description = "Naturaloutil configuration";
1143 type = submodule {
1144 options = {
1145 mysql = mkMysqlOptions "Naturaloutil" {};
1146 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1147 };
1148 };
1149 };
1150 telio_tortay = mkOption {
1151 description = "Telio Tortay configuration";
1152 type = submodule {
1153 options = {
1154 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1155 };
1156 };
1157 };
1158 ludivine = mkOption {
1159 description = "Ludivinecassal configurations by environment";
1160 type =
1161 let
1162 lcSubmodule = mkOption {
1163 description = "environment configuration";
1164 type = submodule {
1165 options = {
1166 environment = mkOption { type = str; description = "Symfony environment"; };
1167 mysql = mkMysqlOptions "LudivineCassal" {};
1168 ldap = mkLdapOptions "LudivineCassal" {};
1169 secret = mkOption { type = str; description = "Symfony App secret"; };
1170 };
1171 };
1172 };
1173 in
1174 submodule {
1175 options = {
1176 production = lcSubmodule;
1177 integration = lcSubmodule;
1178 };
1179 };
1180 };
1181 emilia = mkOption {
1182 description = "Emilia configuration";
1183 type = submodule {
1184 options = {
1185 postgresql = mkPsqlOptions "Emilia";
1186 };
1187 };
1188 };
1189 florian = mkOption {
1190 description = "Florian configuration";
1191 type = submodule {
1192 options = {
1193 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1194 };
1195 };
1196 };
1197 nassime = mkOption {
1198 description = "Nassime configuration";
1199 type = submodule {
1200 options = {
1201 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1202 };
1203 };
1204 };
1205 piedsjaloux = mkOption {
1206 description = "Piedsjaloux configurations by environment";
1207 type =
1208 let
1209 pjSubmodule = mkOption {
1210 description = "environment configuration";
1211 type = submodule {
1212 options = {
1213 environment = mkOption { type = str; description = "Symfony environment"; };
1214 mysql = mkMysqlOptions "Piedsjaloux" {};
1215 secret = mkOption { type = str; description = "Symfony App secret"; };
1216 };
1217 };
1218 };
1219 in
1220 submodule {
1221 options = {
1222 production = pjSubmodule;
1223 integration = pjSubmodule;
1224 };
1225 };
1226 };
1227 richie = mkOption {
1228 description = "Europe Richie configurations by environment";
1229 type = submodule {
1230 options = {
1231 mysql = mkMysqlOptions "Richie" {};
1232 smtp_mailer = mkOption {
1233 description = "SMTP mailer configuration";
1234 type = submodule {
1235 options = {
1236 user = mkOption { type = str; description = "Username"; };
1237 password = mkOption { type = str; description = "Password"; };
1238 };
1239 };
1240 };
1241 };
1242 };
1243 };
1244 tellesflorian = mkOption {
1245 description = "Tellesflorian configurations by environment";
1246 type =
1247 let
1248 tfSubmodule = mkOption {
1249 description = "environment configuration";
1250 type = submodule {
1251 options = {
1252 environment = mkOption { type = str; description = "Symfony environment"; };
1253 mysql = mkMysqlOptions "Tellesflorian" {};
1254 secret = mkOption { type = str; description = "Symfony App secret"; };
1255 invite_passwords = mkOption { type = str; description = "Password basic auth"; };
1256 };
1257 };
1258 };
1259 in
1260 submodule {
1261 options = {
1262 integration = tfSubmodule;
1263 };
1264 };
1265 };
1266 };
1267 };
1268 };
1269
1270 privateFiles = mkOption {
1271 type = path;
1272 description = ''
1273 Path to secret files to make available during build
1274 '';
1275 };
1276 };
1277 options.hostEnv = mkOption {
1278 readOnly = true;
1279 type = hostEnv;
1280 default = config.myEnv.servers."${name}";
1281 description = "Host environment";
1282 };
1283 }