modules/private/environment.nix

   1 { config, lib, name, ... }:
   2 with lib;
   3 with types;
   4 with lists;
   5 let
   6   ldapOptions = {
   7     base = mkOption { description = "Base of the LDAP tree"; type = str; };
   8     host = mkOption { description = "Host to access LDAP"; type = str; };
   9     root_dn = mkOption { description = "DN of the root user"; type = str; };
  10     root_pw = mkOption { description = "Hashed password of the root user"; type = str; };
  11     replication_dn = mkOption { description = "DN of the user allowed to replicate the LDAP directory"; type = str; };
  12     replication_pw = mkOption { description = "Password of the user allowed to replicate the LDAP directory"; type = str; };
  13   };
  14   mkLdapOptions = name: more: mkOption {
  15     description = "${name} LDAP configuration";
  16     type = submodule {
  17       options = ldapOptions // {
  18         dn = mkOption { description = "DN of the ${name} user"; type = str; };
  19         password = mkOption { description = "password of the ${name} user"; type = str; };
  20         filter = mkOption { description = "Filter for ${name} users"; type = str; default = ""; };
  21       } // more;
  22     };
  23   };
  24   mysqlOptions = {
  25     host = mkOption { description = "Host to access Mysql"; type = str; };
  26     remoteHost = mkOption { description = "Host to access Mysql from outside"; type = str; };
  27     port = mkOption { description = "Port to access Mysql"; type = str; };
  28     socket = mkOption { description = "Socket to access Mysql"; type = path; };
  29     systemUsers = mkOption {
  30       description = "Attrs of user-passwords allowed to access mysql";
  31       type = attrsOf str;
  32     };
  33     pam = mkOption {
  34       description = "PAM configuration for mysql";
  35       type = submodule {
  36         options = {
  37           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  38           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  39           filter = mkOption { description = "filter to match users"; type = str; };
  40         };
  41       };
  42     };
  43   };
  44   mkMysqlOptions = name: more: mkOption {
  45     description = "${name} mysql configuration";
  46     type = submodule {
  47       options = mysqlOptions // {
  48         database = mkOption { description = "${name} database"; type = str; };
  49         user = mkOption { description = "${name} user"; type = str; };
  50         password = mkOption { description = "mysql password of the ${name} user"; type = str; };
  51       } // more;
  52     };
  53   };
  54   psqlOptions = {
  55     host = mkOption { description = "Host to access Postgresql"; type = str; };
  56     port = mkOption { description = "Port to access Postgresql"; type = str; };
  57     socket = mkOption { description = "Socket to access Postgresql"; type = path; };
  58     pam = mkOption {
  59       description = "PAM configuration for psql";
  60       type = submodule {
  61         options = {
  62           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  63           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  64           filter = mkOption { description = "filter to match users"; type = str; };
  65         };
  66       };
  67     };
  68   };
  69   mkPsqlOptions = name: mkOption {
  70     description = "${name} psql configuration";
  71     type = submodule {
  72       options = psqlOptions // {
  73         database = mkOption { description = "${name} database"; type = str; };
  74         schema = mkOption { description = "${name} schema"; type = nullOr str; default = null; };
  75         user = mkOption { description = "${name} user"; type = str; };
  76         password = mkOption { description = "psql password of the ${name} user"; type = str; };
  77       };
  78     };
  79   };
  80   redisOptions = {
  81     host = mkOption { description = "Host to access Redis"; type = str; };
  82     port = mkOption { description = "Port to access Redis"; type = str; };
  83     socket = mkOption { description = "Socket to access Redis"; type = path; };
  84     dbs = mkOption {
  85       description = "Attrs of db number. Each number should be unique to avoid collision!";
  86       type = attrsOf str;
  87     };
  88     spiped_key = mkOption {
  89       type = str;
  90       description = ''
  91         Key to use with spiped to make a secure channel to replication
  92         '';
  93     };
  94     predixy = mkOption {
  95       description = "Predixy configuration. Unused yet";
  96       type = submodule {
  97         options = {
  98           read = mkOption { type = str; description = "Read password"; };
  99         };
 100       };
 101     };
 102   };
 103   mkRedisOptions = name: mkOption {
 104     description = "${name} redis configuration";
 105     type = submodule {
 106       options = redisOptions // {
 107         db = mkOption { description = "${name} database"; type = str; };
 108       };
 109     };
 110   };
 111   smtpOptions = {
 112     host = mkOption { description = "Host to access SMTP"; type = str; };
 113     port = mkOption { description = "Port to access SMTP"; type = str; };
 114   };
 115   mkSmtpOptions = name: mkOption {
 116     description = "${name} smtp configuration";
 117     type = submodule {
 118       options = smtpOptions // {
 119         email = mkOption { description = "${name} email"; type = str; };
 120         password = mkOption { description = "SMTP password of the ${name} user"; type = str; };
 121       };
 122     };
 123   };
 124   hostEnv = submodule {
 125     options = {
 126       fqdn = mkOption {
 127         description = "Host FQDN";
 128         type = str;
 129       };
 130       users = mkOption {
 131         type = unspecified;
 132         default = pkgs: [];
 133         description = ''
 134           Sublist of users from realUsers. Function that takes pkgs as
 135           argument and gives an array as a result
 136         '';
 137       };
 138       emails = mkOption {
 139         default = [];
 140         description = "List of e-mails that the server can be a sender of";
 141         type = listOf str;
 142       };
 143       ldap = mkOption {
 144         description = ''
 145           LDAP credentials for the host
 146         '';
 147         type = submodule {
 148           options = {
 149             password = mkOption { type = str; description = "Password for the LDAP connection"; };
 150             dn = mkOption { type = str; description = "DN for the LDAP connection"; };
 151           };
 152         };
 153       };
 154       mx = mkOption {
 155         description = "subdomain and priority for MX server";
 156         default = { enable = false; };
 157         type = submodule {
 158           options = {
 159             enable = mkEnableOption "Enable MX";
 160             subdomain = mkOption { type = nullOr str; description = "Subdomain name (mx-*)"; };
 161             priority = mkOption { type = nullOr str; description = "Priority"; };
 162           };
 163         };
 164       };
 165       ips = mkOption {
 166         description = ''
 167           attrs of ip4/ip6 grouped by section
 168         '';
 169         type = attrsOf (submodule {
 170           options = {
 171             ip4 = mkOption {
 172               type = listOf str;
 173               default = [];
 174               description = ''
 175                 ip4 addresses of the host
 176               '';
 177             };
 178             ip6 = mkOption {
 179               type = listOf str;
 180               default = [];
 181               description = ''
 182                 ip6 addresses of the host
 183               '';
 184             };
 185           };
 186         });
 187       };
 188     };
 189   };
 190 in
 191 {
 192   options.myEnv = {
 193     servers = mkOption {
 194       description = ''
 195         Attrs of servers information in the cluster (not necessarily handled by nixops)
 196       '';
 197       default = {};
 198       type = attrsOf hostEnv;
 199     };
 200     hetznerCloud = mkOption {
 201       description = ''
 202         Hetzner Cloud credential information
 203       '';
 204       type = submodule {
 205         options = {
 206           authToken = mkOption {
 207             type = str;
 208             description = ''
 209               The API auth token.
 210             '';
 211           };
 212         };
 213       };
 214     };
 215     hetzner = mkOption {
 216       description = ''
 217         Hetzner credential information
 218       '';
 219       type = submodule {
 220         options = {
 221           user = mkOption { type = str; description = "User"; };
 222           pass = mkOption { type = str; description = "Password"; };
 223         };
 224       };
 225     };
 226     sshd = mkOption {
 227       description = ''
 228         sshd service credential information
 229       '';
 230       type = submodule {
 231         options = {
 232           rootKeys = mkOption { type = attrsOf str; description = "Keys of root users"; };
 233           ldap = mkOption {
 234             description = ''
 235               LDAP credentials for cn=ssh,ou=services,dc=immae,dc=eu dn
 236             '';
 237             type = submodule {
 238               options = {
 239                 password = mkOption { description = "Password"; type = str; };
 240               };
 241             };
 242           };
 243         };
 244       };
 245     };
 246     ports = mkOption {
 247       description = ''
 248         non-standard reserved ports. Must be unique!
 249       '';
 250       type = attrsOf port;
 251       default = {};
 252       apply = let
 253         noDupl = x: builtins.length (builtins.attrValues x) == builtins.length (unique (builtins.attrValues x));
 254       in
 255         x: if isAttrs x && noDupl x then x else throw "Non unique values for ports";
 256     };
 257     httpd = mkOption {
 258       description = ''
 259         httpd service credential information
 260       '';
 261       type = submodule {
 262         options = {
 263           ldap = mkOption {
 264             description = ''
 265               LDAP credentials for cn=httpd,ou=services,dc=immae,dc=eu dn
 266             '';
 267             type = submodule {
 268               options = {
 269                 password = mkOption { description = "Password"; type = str; };
 270               };
 271             };
 272           };
 273         };
 274       };
 275     };
 276     smtp = mkOption {
 277       type = submodule { options = smtpOptions; };
 278       description = "SMTP configuration";
 279     };
 280     ldap = mkOption {
 281       description = ''
 282         LDAP server configuration
 283         '';
 284       type = submodule {
 285         options = ldapOptions;
 286       };
 287     };
 288     databases = mkOption {
 289       description = "Databases configuration";
 290       type = submodule {
 291         options = {
 292           mysql = mkOption {
 293             type = submodule { options = mysqlOptions; };
 294             description = "Mysql configuration";
 295           };
 296           redis = mkOption {
 297             type = submodule { options = redisOptions; };
 298             description = "Redis configuration";
 299           };
 300           postgresql = mkOption {
 301             type = submodule { options = psqlOptions; };
 302             description = "Postgresql configuration";
 303           };
 304         };
 305       };
 306     };
 307     jabber = mkOption {
 308       description = "Jabber configuration";
 309       type = submodule {
 310         options = {
 311           postfix_user_filter = mkOption { type = str; description = "Postfix filter to get xmpp users"; };
 312           ldap = mkLdapOptions "Jabber" {};
 313           postgresql = mkPsqlOptions "Jabber";
 314         };
 315       };
 316     };
 317     realUsers = mkOption {
 318       description = ''
 319         Attrset of function taking pkgs as argument.
 320         Real users settings, should provide a subattr of users.users.<name>
 321         with at least: name, (hashed)Password, shell
 322       '';
 323       type = attrsOf unspecified;
 324     };
 325     users = mkOption {
 326       description = "System and regular users uid/gid";
 327       type = attrsOf (submodule {
 328         options = {
 329           uid = mkOption {
 330             description = "user uid";
 331             type = int;
 332           };
 333           gid = mkOption {
 334             description = "user gid";
 335             type = int;
 336           };
 337         };
 338       });
 339     };
 340     dns = mkOption {
 341       description = "DNS configuration";
 342       type = submodule {
 343         options = {
 344           soa = mkOption {
 345             description = "SOA information";
 346             type = submodule {
 347               options = {
 348                 serial = mkOption {
 349                   description = "Serial number. Should be incremented at each change and unique";
 350                   type = str;
 351                 };
 352                 refresh = mkOption {
 353                   description = "Refresh time";
 354                   type = str;
 355                 };
 356                 retry = mkOption {
 357                   description = "Retry time";
 358                   type = str;
 359                 };
 360                 expire = mkOption {
 361                   description = "Expire time";
 362                   type = str;
 363                 };
 364                 ttl = mkOption {
 365                   description = "Default TTL time";
 366                   type = str;
 367                 };
 368                 email = mkOption {
 369                   description = "hostmaster e-mail";
 370                   type = str;
 371                 };
 372                 primary = mkOption {
 373                   description = "Primary NS";
 374                   type = str;
 375                 };
 376               };
 377             };
 378           };
 379           ns = mkOption {
 380             description = "Attrs of NS servers group";
 381             example = {
 382               foo = {
 383                 "ns1.foo.com" = [ "198.51.100.10" "2001:db8:abcd::1" ];
 384                 "ns2.foo.com" = [ "198.51.100.15" "2001:db8:1234::1" ];
 385               };
 386             };
 387             type = attrsOf (attrsOf (listOf str));
 388           };
 389           keys = mkOption {
 390             default = {};
 391             description = "DNS keys";
 392             type = attrsOf (submodule {
 393               options = {
 394                 algorithm = mkOption { type = str; description = "Algorithm"; };
 395                 secret    = mkOption { type = str; description = "Secret"; };
 396               };
 397             });
 398           };
 399           slaveZones = mkOption {
 400             description = "List of slave zones";
 401             type = listOf (submodule {
 402               options = {
 403                 name = mkOption { type = str; description = "zone name"; };
 404                 masters = mkOption {
 405                   description = "NS master groups of this zone";
 406                   type = listOf str;
 407                 };
 408                 keys = mkOption {
 409                   default = [];
 410                   description = "Keys associated to the server";
 411                   type = listOf str;
 412                 };
 413               };
 414             });
 415           };
 416           masterZones = mkOption {
 417             description = "List of master zones";
 418             type = listOf (submodule {
 419               options = {
 420                 name = mkOption { type = str; description = "zone name"; };
 421                 withCAA = mkOption { type = nullOr str; description = "CAA entry"; default = null; };
 422                 slaves = mkOption {
 423                   description = "NS slave groups of this zone";
 424                   type = listOf str;
 425                 };
 426                 ns = mkOption {
 427                   description = "groups names that should have their NS entries listed here";
 428                   type = listOf str;
 429                 };
 430                 extra = mkOption {
 431                   description = "Extra zone configuration for bind";
 432                   example = ''
 433                     notify yes;
 434                     '';
 435                   type = lines;
 436                 };
 437                 entries = mkOption { type = lines; description = "Regular entries of the NS zone"; };
 438                 withEmail = mkOption {
 439                   description = "List of domains that should have mail entries (MX, dkim, SPF, ...)";
 440                   default = [];
 441                   type = listOf (submodule {
 442                     options = {
 443                       domain = mkOption { type = str; description = "Which subdomain is concerned"; };
 444                       send = mkOption { type = bool; description = "Whether there can be e-mails originating from the subdomain"; };
 445                       receive = mkOption { type = bool; description = "Whether there can be e-mails arriving to the subdomain"; };
 446                     };
 447                   });
 448                 };
 449               };
 450             });
 451           };
 452         };
 453       };
 454     };
 455     backup = mkOption {
 456       description = ''
 457         Remote backup with duplicity
 458         '';
 459       type = submodule {
 460         options = {
 461           password = mkOption { type = str; description = "Password for encrypting files"; };
 462           remotes = mkOption {
 463             type = attrsOf (submodule {
 464               options = {
 465                 remote = mkOption {
 466                   type = unspecified;
 467                   example = literalExample ''
 468                     bucket: "s3://some_host/${bucket}";
 469                     '';
 470                   description = ''
 471                     Function.
 472                     Takes a bucket name as argument and returns a url
 473                     '';
 474                 };
 475                 accessKeyId = mkOption { type = str; description = "Remote access-key"; };
 476                 secretAccessKey = mkOption { type = str; description = "Remote access secret"; };
 477               };
 478             });
 479           };
 480         };
 481       };
 482     };
 483     zrepl_backup = mkOption {
 484       type = submodule {
 485         options = {
 486           ssh_key = mkOption {
 487             description = "SSH key information";
 488             type = submodule {
 489               options = {
 490                 public = mkOption { type = str; description = "Public part of the key"; };
 491                 private = mkOption { type = lines; description = "Private part of the key"; };
 492               };
 493             };
 494           };
 495           mysql = mkMysqlOptions "Zrepl" {};
 496           certs = mkOption {
 497             description = "Certificates";
 498             type = attrsOf (submodule {
 499               options = {
 500                 key = mkOption { type = str; description = "Key"; };
 501                 certificate = mkOption { type = str; description = "Certificate"; };
 502               };
 503             });
 504           };
 505         };
 506       };
 507     };
 508     rsync_backup = mkOption {
 509       description  =''
 510         Rsync backup configuration from controlled host
 511         '';
 512       type = submodule {
 513         options = {
 514           ssh_key = mkOption {
 515             description = "SSH key information";
 516             type = submodule {
 517               options = {
 518                 public = mkOption { type = str; description = "Public part of the key"; };
 519                 private = mkOption { type = lines; description = "Private part of the key"; };
 520               };
 521             };
 522           };
 523           profiles = mkOption {
 524             description = "Attrs of profiles to backup";
 525             type = attrsOf (submodule {
 526               options = {
 527                 keep = mkOption { type = int; description = "Number of backups to keep"; };
 528                 check_command = mkOption { type = str; description = "command to check if backup needs to be done"; default = "backup"; };
 529                 login = mkOption { type = str; description = "Login to connect to host"; };
 530                 port = mkOption { type = str; default = "22"; description = "Port to connect to host"; };
 531                 host = mkOption { type = str; description = "Host to connect to"; };
 532                 host_key = mkOption { type = str; description = "Host key"; };
 533                 host_key_type = mkOption { type = str; description = "Host key type"; };
 534                 parts = mkOption {
 535                   description = "Parts to backup for this host";
 536                   type = attrsOf (submodule {
 537                     options = {
 538                       remote_folder = mkOption { type = path; description = "Remote folder to backup";};
 539                       exclude_from = mkOption {
 540                         type = listOf path;
 541                         default = [];
 542                         description = "List of folders/files to exclude from the backup";
 543                       };
 544                       files_from = mkOption {
 545                         type = listOf path;
 546                         default = [];
 547                         description = "List of folders/files to backup in the base folder";
 548                       };
 549                       args = mkOption {
 550                         type = nullOr str;
 551                         default = null;
 552                         description = "Extra arguments to pass to rsync";
 553                       };
 554                     };
 555                   });
 556                 };
 557               };
 558             });
 559           };
 560         };
 561       };
 562     };
 563     monitoring = mkOption {
 564       description = "Monitoring configuration";
 565       type = submodule {
 566         options = {
 567           status_url = mkOption { type = str; description = "URL to push status to"; };
 568           status_token = mkOption { type = str; description = "Token for the status url"; };
 569           http_user_password = mkOption { type = str; description = "HTTP credentials to check services behind wall"; };
 570           email = mkOption { type = str; description = "Admin E-mail"; };
 571           ssh_public_key = mkOption { type = str; description = "SSH public key"; };
 572           ssh_secret_key = mkOption { type = str; description = "SSH secret key"; };
 573           imap_login = mkOption { type = str; description = "IMAP login"; };
 574           imap_password = mkOption { type = str; description = "IMAP password"; };
 575           eriomem_keys = mkOption { type = listOf (listOf str); description = "Eriomem keys"; default = []; };
 576           ovh_sms = mkOption {
 577             description = "OVH credentials for sms script";
 578             type = submodule {
 579               options = {
 580                 endpoint = mkOption { type = str; default = "ovh-eu"; description = "OVH endpoint"; };
 581                 application_key = mkOption { type = str; description = "Application key"; };
 582                 application_secret = mkOption { type = str; description = "Application secret"; };
 583                 consumer_key = mkOption { type = str; description = "Consumer key"; };
 584                 account = mkOption { type = str; description = "Account"; };
 585               };
 586             };
 587           };
 588           nrdp_tokens = mkOption { type = listOf str; description = "Tokens allowed to push status update"; };
 589           slack_url = mkOption { type = str; description = "Slack webhook url to push status update"; };
 590           slack_channel = mkOption { type = str; description = "Slack channel to push status update"; };
 591           netdata_aggregator = mkOption { type = str; description = "Url where netdata information should be sent"; };
 592           netdata_keys = mkOption { type = attrsOf str; description = "netdata host keys"; };
 593           contacts = mkOption { type = attrsOf unspecified; description = "Contact dicts to fill naemon objects"; };
 594           email_check = mkOption {
 595             description = "Emails services to check";
 596             type = attrsOf (submodule {
 597               options = {
 598                 local = mkOption { type = bool; default = false; description = "Use local configuration"; };
 599                 port = mkOption { type = nullOr str; default = null; description = "Port to connect to ssh"; };
 600                 login = mkOption { type = nullOr str; default = null; description = "Login to connect to ssh"; };
 601                 targets = mkOption { type = listOf str; description = "Hosts to send E-mails to"; };
 602                 mail_address = mkOption { type = nullOr str; default = null; description = "E-mail recipient part to send e-mail to"; };
 603                 mail_domain = mkOption { type = nullOr str; default = null; description = "E-mail domain part to send e-mail to"; };
 604               };
 605             });
 606           };
 607         };
 608       };
 609     };
 610     mpd = mkOption {
 611       description = "MPD configuration";
 612       type = submodule {
 613         options = {
 614           folder = mkOption { type = str; description = "Folder to serve from the MPD instance"; };
 615           password = mkOption { type = str; description = "Password to connect to the MPD instance"; };
 616           host = mkOption { type = str; description = "Host to connect to the MPD instance"; };
 617           port = mkOption { type = str; description = "Port to connect to the MPD instance"; };
 618         };
 619       };
 620     };
 621     ftp = mkOption {
 622       description = "FTP configuration";
 623       type = submodule {
 624         options = {
 625           ldap = mkLdapOptions "FTP" {
 626             proftpd_filter = mkOption { type = str; description = "Filter for proftpd listing in LDAP"; };
 627             pure-ftpd_filter = mkOption { type = str; description = "Filter for pure-ftpd listing in LDAP"; };
 628           };
 629         };
 630       };
 631     };
 632     vpn = mkOption {
 633       description = "VPN configuration";
 634       type = attrsOf (submodule {
 635         options = {
 636           prefix = mkOption { type = str; description = "ipv6 prefix for the vpn subnet"; };
 637           privateKey = mkOption { type = str; description = "Private key for the host"; };
 638           publicKey = mkOption { type = str; description = "Public key for the host"; };
 639         };
 640       });
 641     };
 642     mail = mkOption {
 643       description = "Mail configuration";
 644       type = submodule {
 645         options = {
 646           dmarc = mkOption {
 647             description = "DMARC configuration";
 648             type = submodule {
 649               options = {
 650                 ignore_hosts = mkOption {
 651                   type = lines;
 652                   description = ''
 653                     Hosts to ignore when checking for dmarc
 654                     '';
 655                 };
 656               };
 657             };
 658           };
 659           dkim = mkOption {
 660             description = "DKIM configuration";
 661             type = attrsOf (submodule {
 662               options = {
 663                 public = mkOption {
 664                   type = str;
 665                   example = ''
 666                     ( "v=DKIM1; k=rsa; "
 667                               "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3w1a2aMxWw9+hdcmbqX4UevcVqr204y0K73Wdc7MPZiOOlUJQYsMNSYR1Y/SC7jmPKeitpcJCpQgn/cveJZbuikjjPLsDReHyFEYmC278ZLRTELHx6f1IXM8WE08JIRT69CfZiMi1rVcOh9qRT4F93PyjCauU8Y5hJjtg9ThsWwIDAQAB" )
 668                     '';
 669                   description = "Public entry to put in DNS TXT field";
 670                 };
 671                 private = mkOption { type = str; description = "Private key"; };
 672               };
 673             });
 674           };
 675           postfix = mkOption {
 676             description = "Postfix configuration";
 677             type = submodule {
 678               options = {
 679                 additional_mailbox_domains = mkOption {
 680                   description = ''
 681                     List of domains that are used as mailbox final destination, in addition to those defined in the DNS records
 682                   '';
 683                   type = listOf str;
 684                 };
 685                 mysql = mkMysqlOptions "Postfix" {
 686                   password_encrypt = mkOption { type = str; description = "Key to encrypt relay password in database"; };
 687                 };
 688                 backup_domains = mkOption {
 689                   description = ''
 690                     Domains that are accepted for relay as backup domain
 691                   '';
 692                   type = attrsOf (submodule {
 693                     options = {
 694                       domains = mkOption { type = listOf str; description = "Domains list"; };
 695                       relay_restrictions = mkOption {
 696                         type = lines;
 697                         description = ''
 698                           Restrictions for relaying the e-mails from the domains
 699                           '';
 700                       };
 701                       recipient_maps = mkOption {
 702                         description = ''
 703                           Recipient map to accept relay for.
 704                           Must be specified for domain, the rules apply to everyone!
 705                         '';
 706                         type = listOf (submodule {
 707                           options = {
 708                             type = mkOption {
 709                               type = enum [ "hash" ];
 710                               description = "Map type";
 711                             };
 712                             content = mkOption {
 713                               type = str;
 714                               description = "Map content";
 715                             };
 716                           };
 717                         });
 718                       };
 719                     };
 720                   });
 721                 };
 722               };
 723             };
 724           };
 725           dovecot = mkOption {
 726             description = "Dovecot configuration";
 727             type = submodule {
 728               options = {
 729                 ldap = mkLdapOptions "Dovecot" {
 730                   pass_attrs = mkOption { type = str; description = "Password attribute in LDAP"; };
 731                   user_attrs = mkOption { type = str; description = "User attribute mapping in LDAP"; };
 732                   iterate_attrs = mkOption { type = str; description = "User attribute mapping for listing in LDAP"; };
 733                   iterate_filter = mkOption { type = str; description = "User attribute filter for listing in LDAP"; };
 734                   postfix_mailbox_filter = mkOption { type = str; description = "Postfix filter to get mailboxes"; };
 735                 };
 736               };
 737             };
 738           };
 739           rspamd = mkOption {
 740             description = "rspamd configuration";
 741             type = submodule {
 742               options = {
 743                 redis = mkRedisOptions "Redis";
 744                 read_password_hashed = mkOption { type = str; description = "Hashed read password for rspamd"; };
 745                 write_password_hashed = mkOption { type = str; description = "Hashed write password for rspamd"; };
 746                 read_password = mkOption {
 747                   type = str;
 748                   description = "Read password for rspamd. Unused";
 749                   apply = x: "";
 750                 };
 751                 write_password = mkOption {
 752                   type = str;
 753                   description = "Write password for rspamd. Unused";
 754                   apply = x: "";
 755                 };
 756               };
 757             };
 758           };
 759           scripts = mkOption {
 760             description = "Mail script recipients";
 761             type = attrsOf (submodule {
 762               options = {
 763                 external = mkEnableOption "Create a script_<name>@mail.immae.eu external address";
 764                 src = mkOption {
 765                   description = ''
 766                     git source to fetch the script from.
 767                     It must have a default.nix file as its root accepting a scriptEnv parameter
 768                   '';
 769                   type = submodule {
 770                     options = {
 771                       url = mkOption { type = str; description = "git url to fetch"; };
 772                       rev = mkOption { type = str; description = "git reference to fetch"; };
 773                     };
 774                   };
 775                 };
 776                 env = mkOption {
 777                   description = "Variables to pass to the script";
 778                   type = unspecified;
 779                 };
 780               };
 781             });
 782           };
 783           sympa = mkOption {
 784             description = "Sympa configuration";
 785             type = submodule {
 786               options = {
 787                 listmasters = mkOption {
 788                   type = listOf str;
 789                   description = "Listmasters";
 790                 };
 791                 postgresql = mkPsqlOptions "Sympa";
 792                 data_sources = mkOption {
 793                   type = attrsOf str;
 794                   default = {};
 795                   description = "Data sources to make available to sympa";
 796                 };
 797                 scenari = mkOption {
 798                   type = attrsOf str;
 799                   default = {};
 800                   description = "Scenari to make available to sympa";
 801                 };
 802               };
 803             };
 804           };
 805         };
 806       };
 807     };
 808     coturn = mkOption {
 809       description = "Coturn configuration";
 810       type = submodule {
 811         options = {
 812           auth_access_key = mkOption { type = str; description = "key to access coturn"; };
 813         };
 814       };
 815     };
 816     buildbot = mkOption {
 817       description = "Buildbot configuration";
 818       type = submodule {
 819         options = {
 820           ssh_key = mkOption {
 821             description = "SSH key information";
 822             type = submodule {
 823               options = {
 824                 public = mkOption { type = str; description = "Public part of the key"; };
 825                 private = mkOption { type = lines; description = "Private part of the key"; };
 826               };
 827             };
 828           };
 829           workerPassword = mkOption { description = "Buildbot worker password"; type = str; };
 830           user = mkOption {
 831             description = "Buildbot user";
 832             type = submodule {
 833               options = {
 834                 uid = mkOption {
 835                   description = "user uid";
 836                   type = int;
 837                 };
 838                 gid = mkOption {
 839                   description = "user gid";
 840                   type = int;
 841                 };
 842               };
 843             };
 844           };
 845           ldap = mkOption {
 846             description = "Ldap configuration for buildbot";
 847             type = submodule {
 848               options = {
 849                 password = mkOption { type = str; description = "Buildbot password"; };
 850               };
 851             };
 852           };
 853           projects = mkOption {
 854             description = "Projects to make a buildbot for";
 855             type = attrsOf (submodule {
 856               options = {
 857                 name = mkOption { type = str; description = "Project name"; };
 858                 packages = mkOption {
 859                   type = unspecified;
 860                   example = literalExample ''
 861                     pkgs: [ pkgs.bash pkgs.git pkgs.gzip pkgs.openssh ];
 862                     '';
 863                   description = ''
 864                     Function.
 865                     Builds packages list to make available to buildbot project.
 866                     Takes pkgs as argument.
 867                   '';
 868                 };
 869                 pythonPackages = mkOption {
 870                   type = unspecified;
 871                   example = literalExample ''
 872                     p: pkgs: [ pkgs.python3Packages.pip ];
 873                     '';
 874                   description = ''
 875                     Function.
 876                     Builds python packages list to make available to buildbot project.
 877                     Takes buildbot python module as first argument and pkgs as second argument in order to augment the python modules list.
 878                     '';
 879                 };
 880                 pythonPathHome = mkOption { type = bool; description = "Whether to add project’s python home to python path"; };
 881                 workerPort = mkOption { type = port; description = "Port for the worker"; };
 882                 secrets = mkOption {
 883                   #type = attrsOf (either str (functionTo str));
 884                   type = attrsOf unspecified;
 885                   description = "Secrets for the project to dump as files. Might be a function that takes pkgs as argument";
 886                 };
 887                 environment = mkOption {
 888                   #type = attrsOf (either str (functionTo str));
 889                   type = attrsOf unspecified;
 890                   description = ''
 891                     Environment variables for the project. Might be a function that takes pkgs as argument.
 892                     BUILDBOT_ is prefixed to the variable names
 893                   '';
 894                 };
 895                 activationScript = mkOption {
 896                   type = lines;
 897                   description = ''
 898                     Activation script to run during deployment
 899                   '';
 900                 };
 901                 builderPaths = mkOption {
 902                   type = attrsOf unspecified;
 903                   default = {};
 904                   description = ''
 905                     Attrs of functions to make accessible specifically per builder.
 906                     Takes pkgs as argument and should return a single path containing binaries.
 907                     This path will be accessible as BUILDBOT_PATH_<attrskey>
 908                     '';
 909                 };
 910                 webhookTokens = mkOption {
 911                   type = nullOr (listOf str);
 912                   default = null;
 913                   description = ''
 914                     List of tokens allowed to push to project’s change_hook/base endpoint
 915                   '';
 916                 };
 917               };
 918             });
 919           };
 920         };
 921       };
 922     };
 923     tools = mkOption {
 924       description = "Tools configurations";
 925       type = submodule {
 926         options = {
 927           contact = mkOption { type = str; description = "Contact e-mail address"; };
 928           assets = mkOption {
 929             default = {};
 930             type = attrsOf (submodule {
 931               options = {
 932                 url = mkOption { type = str; description = "URL to fetch"; };
 933                 sha256 = mkOption { type = str; description = "Hash of the url"; };
 934               };
 935             });
 936             description = "Assets to provide on assets.immae.eu";
 937           };
 938           davical = mkOption {
 939             description = "Davical configuration";
 940             type = submodule {
 941               options = {
 942                 postgresql = mkPsqlOptions "Davical";
 943                 ldap = mkLdapOptions "Davical" {};
 944               };
 945             };
 946           };
 947           diaspora = mkOption {
 948             description = "Diaspora configuration";
 949             type = submodule {
 950               options = {
 951                 postgresql = mkPsqlOptions "Diaspora";
 952                 redis = mkRedisOptions "Diaspora";
 953                 ldap = mkLdapOptions "Diaspora" {};
 954                 secret_token = mkOption { type = str; description = "Secret token"; };
 955               };
 956             };
 957           };
 958           dmarc_reports = mkOption {
 959             description = "DMARC reports configuration";
 960             type = submodule {
 961               options = {
 962                 mysql = mkMysqlOptions "DMARC" {};
 963                 anonymous_key = mkOption { type = str; description = "Anonymous hashing key"; };
 964               };
 965             };
 966           };
 967           etherpad-lite = mkOption {
 968             description = "Etherpad configuration";
 969             type = submodule {
 970               options = {
 971                 postgresql = mkPsqlOptions "Etherpad";
 972                 ldap = mkLdapOptions "Etherpad" {
 973                   group_filter = mkOption { type = str; description = "Filter for groups"; };
 974                 };
 975                 adminPassword = mkOption { type = str; description = "Admin password for mypads / admin"; };
 976                 session_key = mkOption { type = str; description = "Session key"; };
 977                 api_key = mkOption { type = str; description = "API key"; };
 978               };
 979             };
 980           };
 981           gitolite = mkOption {
 982             description = "Gitolite configuration";
 983             type = submodule {
 984               options = {
 985                 ldap = mkLdapOptions "Gitolite" {};
 986                 ssh_key = mkOption {
 987                   description = "SSH key information";
 988                   type = submodule {
 989                     options = {
 990                       public = mkOption { type = str; description = "Public part of the key"; };
 991                       private = mkOption { type = lines; description = "Private part of the key"; };
 992                     };
 993                   };
 994                 };
 995               };
 996             };
 997           };
 998           kanboard = mkOption {
 999             description = "Kanboard configuration";
1000             type = submodule {
1001               options = {
1002                 postgresql = mkPsqlOptions "Kanboard";
1003                 ldap = mkLdapOptions "Kanboard" {
1004                   admin_dn = mkOption { type = str; description = "Admin DN"; };
1005                 };
1006               };
1007             };
1008           };
1009           mantisbt = mkOption {
1010             description = "Mantisbt configuration";
1011             type = submodule {
1012               options = {
1013                 postgresql = mkPsqlOptions "Mantisbt";
1014                 ldap = mkLdapOptions "Mantisbt" {};
1015                 master_salt = mkOption { type = str; description = "Master salt for password hash"; };
1016               };
1017             };
1018           };
1019           mastodon = mkOption {
1020             description = "Mastodon configuration";
1021             type = submodule {
1022               options = {
1023                 postgresql = mkPsqlOptions "Mastodon";
1024                 redis = mkRedisOptions "Mastodon";
1025                 ldap = mkLdapOptions "Mastodon" {};
1026                 paperclip_secret = mkOption { type = str; description = "Paperclip secret"; };
1027                 otp_secret = mkOption { type = str; description = "OTP secret"; };
1028                 secret_key_base = mkOption { type = str; description = "Secret key base"; };
1029                 vapid = mkOption {
1030                   description = "vapid key";
1031                   type = submodule {
1032                     options = {
1033                       private = mkOption { type = str; description = "Private key"; };
1034                       public = mkOption { type = str; description = "Public key"; };
1035                     };
1036                   };
1037                 };
1038               };
1039             };
1040           };
1041           mediagoblin = mkOption {
1042             description = "Mediagoblin configuration";
1043             type = submodule {
1044               options = {
1045                 postgresql = mkPsqlOptions "Mediagoblin";
1046                 redis = mkRedisOptions "Mediagoblin";
1047                 ldap = mkLdapOptions "Mediagoblin" {};
1048               };
1049             };
1050           };
1051           nextcloud = mkOption {
1052             description = "Nextcloud configuration";
1053             type = submodule {
1054               options = {
1055                 postgresql = mkPsqlOptions "Peertube";
1056                 redis = mkRedisOptions "Peertube";
1057                 password_salt = mkOption { type = str; description = "Password salt"; };
1058                 instance_id = mkOption { type = str; description = "Instance ID"; };
1059                 secret = mkOption { type = str; description = "App secret"; };
1060               };
1061             };
1062           };
1063           peertube = mkOption {
1064             description = "Peertube configuration";
1065             type = submodule {
1066               options = {
1067                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1068                 postgresql = mkPsqlOptions "Peertube";
1069                 redis = mkRedisOptions "Peertube";
1070                 ldap = mkLdapOptions "Peertube" {};
1071               };
1072             };
1073           };
1074           syden_peertube = mkOption {
1075             description = "Peertube Syden configuration";
1076             type = submodule {
1077               options = {
1078                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1079                 postgresql = mkPsqlOptions "Peertube";
1080                 redis = mkRedisOptions "Peertube";
1081               };
1082             };
1083           };
1084           phpldapadmin = mkOption {
1085             description = "phpLdapAdmin configuration";
1086             type = submodule {
1087               options = {
1088                 ldap = mkLdapOptions "phpldapadmin" {};
1089               };
1090             };
1091           };
1092           rompr = mkOption {
1093             description = "Rompr configuration";
1094             type = submodule {
1095               options = {
1096                 mpd = mkOption {
1097                   description = "MPD configuration";
1098                   type = submodule {
1099                     options = {
1100                       host = mkOption { type = str; description = "Host for MPD"; };
1101                       port = mkOption { type = port; description = "Port to access MPD host"; };
1102                     };
1103                   };
1104                 };
1105               };
1106             };
1107           };
1108           roundcubemail = mkOption {
1109             description = "Roundcubemail configuration";
1110             type = submodule {
1111               options = {
1112                 postgresql = mkPsqlOptions "TT-RSS";
1113                 secret = mkOption { type = str; description = "Secret"; };
1114               };
1115             };
1116           };
1117           shaarli = mkOption {
1118             description = "Shaarli configuration";
1119             type = submodule {
1120               options = {
1121                 ldap = mkLdapOptions "Shaarli" {};
1122               };
1123             };
1124           };
1125           status_engine = mkOption {
1126             description = "Status Engine configuration";
1127             type = submodule {
1128               options = {
1129                 mysql = mkMysqlOptions "StatusEngine" {};
1130                 ldap = mkLdapOptions "StatusEngine" {};
1131               };
1132             };
1133           };
1134           task = mkOption {
1135             description = "Taskwarrior configuration";
1136             type = submodule {
1137               options = {
1138                 ldap = mkLdapOptions "Taskwarrior" {};
1139                 taskwarrior-web = mkOption {
1140                   description = "taskwarrior-web profiles";
1141                   type = attrsOf (submodule {
1142                     options = {
1143                       uid = mkOption {
1144                         type = listOf str;
1145                         description = "List of ldap uids having access to this profile";
1146                       };
1147                       org = mkOption { type = str; description = "Taskd organisation"; };
1148                       key = mkOption { type = str; description = "Taskd key"; };
1149                       date = mkOption { type = str; description = "Preferred date format"; };
1150                     };
1151                   });
1152                 };
1153               };
1154             };
1155           };
1156           ttrss = mkOption {
1157             description = "TT-RSS configuration";
1158             type = submodule {
1159               options = {
1160                 postgresql = mkPsqlOptions "TT-RSS";
1161                 ldap = mkLdapOptions "TT-RSS" {};
1162               };
1163             };
1164           };
1165           wallabag = mkOption {
1166             description = "Wallabag configuration";
1167             type = submodule {
1168               options = {
1169                 postgresql = mkPsqlOptions "Wallabag";
1170                 ldap = mkLdapOptions "Wallabag" {
1171                   admin_filter = mkOption { type = str; description = "Admin users filter"; };
1172                 };
1173                 redis = mkRedisOptions "Wallabag";
1174                 secret = mkOption { type = str; description = "App secret"; };
1175               };
1176             };
1177           };
1178           webhooks = mkOption {
1179             type = attrsOf str;
1180             description = "Mapping 'name'.php => script for webhooks";
1181           };
1182           csp_reports = mkOption {
1183             description = "CSP report configuration";
1184             type = submodule {
1185               options = {
1186                 report_uri = mkOption { type = str; description = "URI to report CSP violations to"; };
1187                 policies = mkOption { type = attrsOf str; description = "CSP policies to apply"; };
1188               };
1189             };
1190           };
1191           commento = mkOption {
1192             description = "Commento configuration";
1193             type = submodule {
1194               options = {
1195                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1196                 postgresql = mkPsqlOptions "Commento";
1197                 smtp = mkSmtpOptions "Commento";
1198               };
1199             };
1200           };
1201           cryptpad = mkOption {
1202             description = "Cryptpad configuration";
1203             type = attrsOf (submodule {
1204               options = {
1205                 email = mkOption { type = str; description = "Admin e-mail"; };
1206                 admins = mkOption { type = listOf str; description = "Instance admin public keys"; };
1207                 port = mkOption { type = port; description = "Port to listen to"; };
1208               };
1209             });
1210           };
1211           ympd = mkOption {
1212             description = "Ympd configuration";
1213             type = submodule {
1214               options = {
1215                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1216                 mpd = mkOption {
1217                   description = "MPD configuration";
1218                   type = submodule {
1219                     options = {
1220                       password = mkOption { type = str; description = "Password to access MPD host"; };
1221                       host = mkOption { type = str; description = "Host for MPD"; };
1222                       port = mkOption { type = port; description = "Port to access MPD host"; };
1223                     };
1224                   };
1225                 };
1226               };
1227             };
1228           };
1229           umami = mkOption {
1230             description = "Umami configuration";
1231             type = submodule {
1232               options = {
1233                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1234                 postgresql = mkPsqlOptions "Umami";
1235                 hashSalt = mkOption { type = str; description = "Hash salt"; };
1236               };
1237             };
1238           };
1239           yourls = mkOption {
1240             description = "Yourls configuration";
1241             type = submodule {
1242               options = {
1243                 mysql = mkMysqlOptions "Yourls" {};
1244                 ldap = mkLdapOptions "Yourls" {};
1245                 cookieKey = mkOption { type = str; description = "Cookie key"; };
1246               };
1247             };
1248           };
1249         };
1250       };
1251     };
1252     serverSpecific = mkOption { type = attrsOf unspecified; description = "Server specific configuration"; };
1253     websites = mkOption {
1254       description = "Websites configurations";
1255       type = submodule {
1256         options = {
1257           christophe_carpentier = mkOption {
1258             description = "Christophe Carpentier configuration by environment";
1259             type = submodule {
1260               options = {
1261                 agorakit = mkOption {
1262                   description = "Agorakit configuration";
1263                   type = submodule {
1264                     options = {
1265                       mysql = mkMysqlOptions "Agorakit" {};
1266                       smtp = mkSmtpOptions "Agorakit";
1267                       appkey = mkOption { type = str; description = "App key"; };
1268                     };
1269                   };
1270                 };
1271               };
1272             };
1273           };
1274           immae = mkOption {
1275             description = "Immae configuration by environment";
1276             type = submodule {
1277               options = {
1278                 temp = mkOption {
1279                   description = "Temp configuration";
1280                   type = submodule {
1281                     options = {
1282                       ldap = mkLdapOptions "Immae temp" {
1283                         filter = mkOption { type = str; description = "Filter for user access"; };
1284                       };
1285                     };
1286                   };
1287                 };
1288               };
1289             };
1290           };
1291           isabelle = mkOption {
1292             description = "Isabelle configurations by environment";
1293             type =
1294               let
1295                 atenSubmodule = mkOption {
1296                   description = "environment configuration";
1297                   type = submodule {
1298                     options = {
1299                       environment = mkOption { type = str; description = "Symfony environment"; };
1300                       secret = mkOption { type = str; description = "Symfony App secret"; };
1301                       postgresql = mkPsqlOptions "Aten";
1302                     };
1303                   };
1304                 };
1305               in
1306                 submodule {
1307                   options = {
1308                     aten_production = atenSubmodule;
1309                     aten_integration = atenSubmodule;
1310                     iridologie = mkOption {
1311                       description = "environment configuration";
1312                       type = submodule {
1313                         options = {
1314                           environment = mkOption { type = str; description = "SPIP environment"; };
1315                           mysql = mkMysqlOptions "Iridologie" {};
1316                           ldap = mkLdapOptions "Iridologie" {};
1317                         };
1318                       };
1319                     };
1320                   };
1321                 };
1322           };
1323           chloe = mkOption {
1324             description = "Chloe configurations by environment";
1325             type =
1326               let
1327                 chloeSubmodule = mkOption {
1328                   description = "environment configuration";
1329                   type = submodule {
1330                     options = {
1331                       environment = mkOption { type = str; description = "SPIP environment"; };
1332                       mysql = mkMysqlOptions "Chloe" {};
1333                       ldap = mkLdapOptions "Chloe" {};
1334                     };
1335                   };
1336                 };
1337               in
1338                 submodule {
1339                   options = {
1340                     production = chloeSubmodule;
1341                     integration = chloeSubmodule;
1342                     new = mkOption {
1343                       description = "environment configuration";
1344                       type = submodule {
1345                         options = {
1346                           mysql = mkMysqlOptions "ChloeNew" {};
1347                           ldap = mkLdapOptions "ChloeNew" {};
1348                           secret = mkOption { type = str; description = "Symfony App secret"; };
1349                         };
1350                       };
1351                     };
1352                   };
1353                 };
1354           };
1355           connexionswing = mkOption {
1356             description = "Connexionswing configurations by environment";
1357             type =
1358               let
1359                 csSubmodule = mkOption {
1360                   description = "environment configuration";
1361                   type = submodule {
1362                     options = {
1363                       environment = mkOption { type = str; description = "Symfony environment"; };
1364                       mysql = mkMysqlOptions "Connexionswing" {};
1365                       secret = mkOption { type = str; description = "Symfony App secret"; };
1366                       email = mkOption { type = str; description = "Symfony email notification"; };
1367                     };
1368                   };
1369                 };
1370               in
1371                 submodule {
1372                   options = {
1373                     production = csSubmodule;
1374                     integration = csSubmodule;
1375                   };
1376                 };
1377           };
1378           jerome = mkOption {
1379             description = "Naturaloutil configuration";
1380             type = submodule {
1381               options = {
1382                 mysql = mkMysqlOptions "Naturaloutil" {};
1383                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1384               };
1385             };
1386           };
1387           telio_tortay = mkOption {
1388             description = "Telio Tortay configuration";
1389             type = submodule {
1390               options = {
1391                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1392               };
1393             };
1394           };
1395           ludivine = mkOption {
1396             description = "Ludivinecassal configurations by environment";
1397             type =
1398               let
1399                 lcSubmodule = mkOption {
1400                   description = "environment configuration";
1401                   type = submodule {
1402                     options = {
1403                       environment = mkOption { type = str; description = "Symfony environment"; };
1404                       mysql = mkMysqlOptions "LudivineCassal" {};
1405                       ldap = mkLdapOptions "LudivineCassal" {};
1406                       secret = mkOption { type = str; description = "Symfony App secret"; };
1407                     };
1408                   };
1409                 };
1410               in
1411                 submodule {
1412                   options = {
1413                     production = lcSubmodule;
1414                     integration = lcSubmodule;
1415                   };
1416                 };
1417           };
1418           nicecoop = mkOption {
1419             description = "Nicecoop configuration";
1420             type = submodule {
1421               options = {
1422                 odoo = {
1423                   port = mkOption { description = "Port to listen to"; type = port; };
1424                   longpoll_port = mkOption { description = "Port to listen to"; type = port; };
1425                   postgresql = mkPsqlOptions "Odoo";
1426                   admin_password = mkOption { type = str; description = "Admin password"; };
1427                 };
1428                 gestion-compte = {
1429                   smtp = mkSmtpOptions "GestionCompte";
1430                   mysql = mkMysqlOptions "gestion-compte" {};
1431                   secret = mkOption { type = str; description = "Application secret"; };
1432                   adminpassword = mkOption { type = str; description = "Admin password"; };
1433                 };
1434                 gestion-compte-integration = {
1435                   smtp = mkSmtpOptions "GestionCompte";
1436                   mysql = mkMysqlOptions "gestion-compte" {};
1437                   secret = mkOption { type = str; description = "Application secret"; };
1438                   adminpassword = mkOption { type = str; description = "Admin password"; };
1439                 };
1440                 copanier = {
1441                   smtp = mkSmtpOptions "Copanier";
1442                   staff = mkOption { type = listOf str; description = "List of staff members"; };
1443                 };
1444               };
1445             };
1446           };
1447           emilia = mkOption {
1448             description = "Emilia configuration";
1449             type = submodule {
1450               options = {
1451                 postgresql = mkPsqlOptions "Emilia";
1452               };
1453             };
1454           };
1455           florian = mkOption {
1456             description = "Florian configuration";
1457             type = submodule {
1458               options = {
1459                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1460               };
1461             };
1462           };
1463           nassime = mkOption {
1464             description = "Nassime configuration";
1465             type = submodule {
1466               options = {
1467                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1468               };
1469             };
1470           };
1471           piedsjaloux = mkOption {
1472             description = "Piedsjaloux configurations by environment";
1473             type =
1474               let
1475                 pjSubmodule = mkOption {
1476                   description = "environment configuration";
1477                   type = submodule {
1478                     options = {
1479                       environment = mkOption { type = str; description = "Symfony environment"; };
1480                       mysql = mkMysqlOptions "Piedsjaloux" {};
1481                       secret = mkOption { type = str; description = "Symfony App secret"; };
1482                     };
1483                   };
1484                 };
1485               in
1486                 submodule {
1487                   options = {
1488                     production = pjSubmodule;
1489                     integration = pjSubmodule;
1490                   };
1491                 };
1492           };
1493           richie = mkOption {
1494             description = "Europe Richie configurations by environment";
1495             type = submodule {
1496               options = {
1497                 mysql = mkMysqlOptions "Richie" {};
1498                 smtp_mailer = mkOption {
1499                   description = "SMTP mailer configuration";
1500                   type = submodule {
1501                     options = {
1502                       user = mkOption { type = str; description = "Username"; };
1503                       password = mkOption { type = str; description = "Password"; };
1504                     };
1505                   };
1506                 };
1507               };
1508             };
1509           };
1510           caldance = mkOption {
1511             description = "Caldance configurations by environment";
1512             type = submodule {
1513               options = {
1514                 integration = mkOption {
1515                   description = "environment configuration";
1516                   type = submodule {
1517                     options = {
1518                       password = mkOption { type = str; description = "Password file content for basic auth"; };
1519                     };
1520                   };
1521                 };
1522               };
1523             };
1524           };
1525           tellesflorian = mkOption {
1526             description = "Tellesflorian configurations by environment";
1527             type =
1528               let
1529                 tfSubmodule = mkOption {
1530                   description = "environment configuration";
1531                   type = submodule {
1532                     options = {
1533                       environment = mkOption { type = str; description = "Symfony environment"; };
1534                       mysql = mkMysqlOptions "Tellesflorian" {};
1535                       secret = mkOption { type = str; description = "Symfony App secret"; };
1536                       invite_passwords = mkOption { type = str; description = "Password basic auth"; };
1537                     };
1538                   };
1539                 };
1540               in
1541                 submodule {
1542                   options = {
1543                     integration = tfSubmodule;
1544                   };
1545                 };
1546           };
1547         };
1548       };
1549     };
1550   };
1551   options.hostEnv = mkOption {
1552     readOnly = true;
1553     type = hostEnv;
1554     default = config.myEnv.servers."${name}";
1555     description = "Host environment";
1556   };
1557 }