modules/private/environment.nix

   1 { config, lib, name, ... }:
   2 with lib;
   3 with types;
   4 with lists;
   5 let
   6   ldapOptions = {
   7     base = mkOption { description = "Base of the LDAP tree"; type = str; };
   8     host = mkOption { description = "Host to access LDAP"; type = str; };
   9     root_dn = mkOption { description = "DN of the root user"; type = str; };
  10     root_pw = mkOption { description = "Hashed password of the root user"; type = str; };
  11     replication_dn = mkOption { description = "DN of the user allowed to replicate the LDAP directory"; type = str; };
  12     replication_pw = mkOption { description = "Password of the user allowed to replicate the LDAP directory"; type = str; };
  13   };
  14   mkLdapOptions = name: more: mkOption {
  15     description = "${name} LDAP configuration";
  16     type = submodule {
  17       options = ldapOptions // {
  18         dn = mkOption { description = "DN of the ${name} user"; type = str; };
  19         password = mkOption { description = "password of the ${name} user"; type = str; };
  20         filter = mkOption { description = "Filter for ${name} users"; type = str; default = ""; };
  21       } // more;
  22     };
  23   };
  24   mysqlOptions = {
  25     host = mkOption { description = "Host to access Mysql"; type = str; };
  26     remoteHost = mkOption { description = "Host to access Mysql from outside"; type = str; };
  27     port = mkOption { description = "Port to access Mysql"; type = str; };
  28     socket = mkOption { description = "Socket to access Mysql"; type = path; };
  29     systemUsers = mkOption {
  30       description = "Attrs of user-passwords allowed to access mysql";
  31       type = attrsOf str;
  32     };
  33     pam = mkOption {
  34       description = "PAM configuration for mysql";
  35       type = submodule {
  36         options = {
  37           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  38           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  39           filter = mkOption { description = "filter to match users"; type = str; };
  40         };
  41       };
  42     };
  43   };
  44   mkMysqlOptions = name: more: mkOption {
  45     description = "${name} mysql configuration";
  46     type = submodule {
  47       options = mysqlOptions // {
  48         database = mkOption { description = "${name} database"; type = str; };
  49         user = mkOption { description = "${name} user"; type = str; };
  50         password = mkOption { description = "mysql password of the ${name} user"; type = str; };
  51       } // more;
  52     };
  53   };
  54   psqlOptions = {
  55     host = mkOption { description = "Host to access Postgresql"; type = str; };
  56     port = mkOption { description = "Port to access Postgresql"; type = str; };
  57     socket = mkOption { description = "Socket to access Postgresql"; type = path; };
  58     pam = mkOption {
  59       description = "PAM configuration for psql";
  60       type = submodule {
  61         options = {
  62           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  63           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  64           filter = mkOption { description = "filter to match users"; type = str; };
  65         };
  66       };
  67     };
  68   };
  69   mkPsqlOptions = name: mkOption {
  70     description = "${name} psql configuration";
  71     type = submodule {
  72       options = psqlOptions // {
  73         database = mkOption { description = "${name} database"; type = str; };
  74         schema = mkOption { description = "${name} schema"; type = nullOr str; default = null; };
  75         user = mkOption { description = "${name} user"; type = str; };
  76         password = mkOption { description = "psql password of the ${name} user"; type = str; };
  77       };
  78     };
  79   };
  80   redisOptions = {
  81     host = mkOption { description = "Host to access Redis"; type = str; };
  82     port = mkOption { description = "Port to access Redis"; type = str; };
  83     socket = mkOption { description = "Socket to access Redis"; type = path; };
  84     dbs = mkOption {
  85       description = "Attrs of db number. Each number should be unique to avoid collision!";
  86       type = attrsOf str;
  87     };
  88     spiped_key = mkOption {
  89       type = str;
  90       description = ''
  91         Key to use with spiped to make a secure channel to replication
  92         '';
  93     };
  94     predixy = mkOption {
  95       description = "Predixy configuration. Unused yet";
  96       type = submodule {
  97         options = {
  98           read = mkOption { type = str; description = "Read password"; };
  99         };
 100       };
 101     };
 102   };
 103   mkRedisOptions = name: mkOption {
 104     description = "${name} redis configuration";
 105     type = submodule {
 106       options = redisOptions // {
 107         db = mkOption { description = "${name} database"; type = str; };
 108       };
 109     };
 110   };
 111   smtpOptions = {
 112     host = mkOption { description = "Host to access SMTP"; type = str; };
 113     port = mkOption { description = "Port to access SMTP"; type = str; };
 114   };
 115   mkSmtpOptions = name: mkOption {
 116     description = "${name} smtp configuration";
 117     type = submodule {
 118       options = smtpOptions // {
 119         email = mkOption { description = "${name} email"; type = str; };
 120         password = mkOption { description = "SMTP password of the ${name} user"; type = str; };
 121       };
 122     };
 123   };
 124   hostEnv = submodule {
 125     options = {
 126       fqdn = mkOption {
 127         description = "Host FQDN";
 128         type = str;
 129       };
 130       users = mkOption {
 131         type = unspecified;
 132         default = pkgs: [];
 133         description = ''
 134           Sublist of users from realUsers. Function that takes pkgs as
 135           argument and gives an array as a result
 136         '';
 137       };
 138       emails = mkOption {
 139         default = [];
 140         description = "List of e-mails that the server can be a sender of";
 141         type = listOf str;
 142       };
 143       ldap = mkOption {
 144         description = ''
 145           LDAP credentials for the host
 146         '';
 147         type = submodule {
 148           options = {
 149             password = mkOption { type = str; description = "Password for the LDAP connection"; };
 150             dn = mkOption { type = str; description = "DN for the LDAP connection"; };
 151           };
 152         };
 153       };
 154       mx = mkOption {
 155         description = "subdomain and priority for MX server";
 156         default = { enable = false; };
 157         type = submodule {
 158           options = {
 159             enable = mkEnableOption "Enable MX";
 160             subdomain = mkOption { type = nullOr str; description = "Subdomain name (mx-*)"; };
 161             priority = mkOption { type = nullOr str; description = "Priority"; };
 162           };
 163         };
 164       };
 165       ips = mkOption {
 166         description = ''
 167           attrs of ip4/ip6 grouped by section
 168         '';
 169         type = attrsOf (submodule {
 170           options = {
 171             ip4 = mkOption {
 172               type = listOf str;
 173               default = [];
 174               description = ''
 175                 ip4 addresses of the host
 176               '';
 177             };
 178             ip6 = mkOption {
 179               type = listOf str;
 180               default = [];
 181               description = ''
 182                 ip6 addresses of the host
 183               '';
 184             };
 185           };
 186         });
 187       };
 188     };
 189   };
 190 in
 191 {
 192   options.myEnv = {
 193     servers = mkOption {
 194       description = ''
 195         Attrs of servers information in the cluster (not necessarily handled by nixops)
 196       '';
 197       default = {};
 198       type = attrsOf hostEnv;
 199     };
 200     hetznerCloud = mkOption {
 201       description = ''
 202         Hetzner Cloud credential information
 203       '';
 204       type = submodule {
 205         options = {
 206           authToken = mkOption {
 207             type = str;
 208             description = ''
 209               The API auth token.
 210             '';
 211           };
 212         };
 213       };
 214     };
 215     hetzner = mkOption {
 216       description = ''
 217         Hetzner credential information
 218       '';
 219       type = submodule {
 220         options = {
 221           user = mkOption { type = str; description = "User"; };
 222           pass = mkOption { type = str; description = "Password"; };
 223         };
 224       };
 225     };
 226     sshd = mkOption {
 227       description = ''
 228         sshd service credential information
 229       '';
 230       type = submodule {
 231         options = {
 232           rootKeys = mkOption { type = attrsOf str; description = "Keys of root users"; };
 233           ldap = mkOption {
 234             description = ''
 235               LDAP credentials for cn=ssh,ou=services,dc=immae,dc=eu dn
 236             '';
 237             type = submodule {
 238               options = {
 239                 password = mkOption { description = "Password"; type = str; };
 240               };
 241             };
 242           };
 243         };
 244       };
 245     };
 246     ports = mkOption {
 247       description = ''
 248         non-standard reserved ports. Must be unique!
 249       '';
 250       type = attrsOf port;
 251       default = {};
 252       apply = let
 253         noDupl = x: builtins.length (builtins.attrValues x) == builtins.length (unique (builtins.attrValues x));
 254       in
 255         x: if isAttrs x && noDupl x then x else throw "Non unique values for ports";
 256     };
 257     httpd = mkOption {
 258       description = ''
 259         httpd service credential information
 260       '';
 261       type = submodule {
 262         options = {
 263           ldap = mkOption {
 264             description = ''
 265               LDAP credentials for cn=httpd,ou=services,dc=immae,dc=eu dn
 266             '';
 267             type = submodule {
 268               options = {
 269                 password = mkOption { description = "Password"; type = str; };
 270               };
 271             };
 272           };
 273         };
 274       };
 275     };
 276     smtp = mkOption {
 277       type = submodule { options = smtpOptions; };
 278       description = "SMTP configuration";
 279     };
 280     ldap = mkOption {
 281       description = ''
 282         LDAP server configuration
 283         '';
 284       type = submodule {
 285         options = ldapOptions;
 286       };
 287     };
 288     databases = mkOption {
 289       description = "Databases configuration";
 290       type = submodule {
 291         options = {
 292           mysql = mkOption {
 293             type = submodule { options = mysqlOptions; };
 294             description = "Mysql configuration";
 295           };
 296           redis = mkOption {
 297             type = submodule { options = redisOptions; };
 298             description = "Redis configuration";
 299           };
 300           postgresql = mkOption {
 301             type = submodule { options = psqlOptions; };
 302             description = "Postgresql configuration";
 303           };
 304         };
 305       };
 306     };
 307     jabber = mkOption {
 308       description = "Jabber configuration";
 309       type = submodule {
 310         options = {
 311           postfix_user_filter = mkOption { type = str; description = "Postfix filter to get xmpp users"; };
 312           ldap = mkLdapOptions "Jabber" {};
 313           postgresql = mkPsqlOptions "Jabber";
 314         };
 315       };
 316     };
 317     realUsers = mkOption {
 318       description = ''
 319         Attrset of function taking pkgs as argument.
 320         Real users settings, should provide a subattr of users.users.<name>
 321         with at least: name, (hashed)Password, shell
 322       '';
 323       type = attrsOf unspecified;
 324     };
 325     users = mkOption {
 326       description = "System and regular users uid/gid";
 327       type = attrsOf (submodule {
 328         options = {
 329           uid = mkOption {
 330             description = "user uid";
 331             type = int;
 332           };
 333           gid = mkOption {
 334             description = "user gid";
 335             type = int;
 336           };
 337         };
 338       });
 339     };
 340     dns = mkOption {
 341       description = "DNS configuration";
 342       type = submodule {
 343         options = {
 344           soa = mkOption {
 345             description = "SOA information";
 346             type = submodule {
 347               options = {
 348                 serial = mkOption {
 349                   description = "Serial number. Should be incremented at each change and unique";
 350                   type = str;
 351                 };
 352                 refresh = mkOption {
 353                   description = "Refresh time";
 354                   type = str;
 355                 };
 356                 retry = mkOption {
 357                   description = "Retry time";
 358                   type = str;
 359                 };
 360                 expire = mkOption {
 361                   description = "Expire time";
 362                   type = str;
 363                 };
 364                 ttl = mkOption {
 365                   description = "Default TTL time";
 366                   type = str;
 367                 };
 368                 email = mkOption {
 369                   description = "hostmaster e-mail";
 370                   type = str;
 371                 };
 372                 primary = mkOption {
 373                   description = "Primary NS";
 374                   type = str;
 375                 };
 376               };
 377             };
 378           };
 379           ns = mkOption {
 380             description = "Attrs of NS servers group";
 381             example = {
 382               foo = {
 383                 "ns1.foo.com" = [ "198.51.100.10" "2001:db8:abcd::1" ];
 384                 "ns2.foo.com" = [ "198.51.100.15" "2001:db8:1234::1" ];
 385               };
 386             };
 387             type = attrsOf (attrsOf (listOf str));
 388           };
 389           keys = mkOption {
 390             default = {};
 391             description = "DNS keys";
 392             type = attrsOf (submodule {
 393               options = {
 394                 algorithm = mkOption { type = str; description = "Algorithm"; };
 395                 secret    = mkOption { type = str; description = "Secret"; };
 396               };
 397             });
 398           };
 399           slaveZones = mkOption {
 400             description = "List of slave zones";
 401             type = listOf (submodule {
 402               options = {
 403                 name = mkOption { type = str; description = "zone name"; };
 404                 masters = mkOption {
 405                   description = "NS master groups of this zone";
 406                   type = listOf str;
 407                 };
 408                 keys = mkOption {
 409                   default = [];
 410                   description = "Keys associated to the server";
 411                   type = listOf str;
 412                 };
 413               };
 414             });
 415           };
 416           masterZones = mkOption {
 417             description = "List of master zones";
 418             type = listOf (submodule {
 419               options = {
 420                 name = mkOption { type = str; description = "zone name"; };
 421                 withCAA = mkOption { type = nullOr str; description = "CAA entry"; default = null; };
 422                 slaves = mkOption {
 423                   description = "NS slave groups of this zone";
 424                   type = listOf str;
 425                 };
 426                 ns = mkOption {
 427                   description = "groups names that should have their NS entries listed here";
 428                   type = listOf str;
 429                 };
 430                 extra = mkOption {
 431                   description = "Extra zone configuration for bind";
 432                   example = ''
 433                     notify yes;
 434                     '';
 435                   type = lines;
 436                 };
 437                 entries = mkOption { type = lines; description = "Regular entries of the NS zone"; };
 438                 withEmail = mkOption {
 439                   description = "List of domains that should have mail entries (MX, dkim, SPF, ...)";
 440                   default = [];
 441                   type = listOf (submodule {
 442                     options = {
 443                       domain = mkOption { type = str; description = "Which subdomain is concerned"; };
 444                       send = mkOption { type = bool; description = "Whether there can be e-mails originating from the subdomain"; };
 445                       receive = mkOption { type = bool; description = "Whether there can be e-mails arriving to the subdomain"; };
 446                     };
 447                   });
 448                 };
 449               };
 450             });
 451           };
 452         };
 453       };
 454     };
 455     backup = mkOption {
 456       description = ''
 457         Remote backup with duplicity
 458         '';
 459       type = submodule {
 460         options = {
 461           password = mkOption { type = str; description = "Password for encrypting files"; };
 462           remotes = mkOption {
 463             type = attrsOf (submodule {
 464               options = {
 465                 remote = mkOption {
 466                   type = unspecified;
 467                   example = literalExample ''
 468                     bucket: "s3://some_host/${bucket}";
 469                     '';
 470                   description = ''
 471                     Function.
 472                     Takes a bucket name as argument and returns a url
 473                     '';
 474                 };
 475                 accessKeyId = mkOption { type = str; description = "Remote access-key"; };
 476                 secretAccessKey = mkOption { type = str; description = "Remote access secret"; };
 477               };
 478             });
 479           };
 480         };
 481       };
 482     };
 483     zrepl_backup = mkOption {
 484       type = submodule {
 485         options = {
 486           ssh_key = mkOption {
 487             description = "SSH key information";
 488             type = submodule {
 489               options = {
 490                 public = mkOption { type = str; description = "Public part of the key"; };
 491                 private = mkOption { type = lines; description = "Private part of the key"; };
 492               };
 493             };
 494           };
 495           mysql = mkMysqlOptions "Zrepl" {};
 496         };
 497       };
 498     };
 499     rsync_backup = mkOption {
 500       description  =''
 501         Rsync backup configuration from controlled host
 502         '';
 503       type = submodule {
 504         options = {
 505           ssh_key = mkOption {
 506             description = "SSH key information";
 507             type = submodule {
 508               options = {
 509                 public = mkOption { type = str; description = "Public part of the key"; };
 510                 private = mkOption { type = lines; description = "Private part of the key"; };
 511               };
 512             };
 513           };
 514           profiles = mkOption {
 515             description = "Attrs of profiles to backup";
 516             type = attrsOf (submodule {
 517               options = {
 518                 keep = mkOption { type = int; description = "Number of backups to keep"; };
 519                 check_command = mkOption { type = str; description = "command to check if backup needs to be done"; default = "backup"; };
 520                 login = mkOption { type = str; description = "Login to connect to host"; };
 521                 port = mkOption { type = str; default = "22"; description = "Port to connect to host"; };
 522                 host = mkOption { type = str; description = "Host to connect to"; };
 523                 host_key = mkOption { type = str; description = "Host key"; };
 524                 host_key_type = mkOption { type = str; description = "Host key type"; };
 525                 parts = mkOption {
 526                   description = "Parts to backup for this host";
 527                   type = attrsOf (submodule {
 528                     options = {
 529                       remote_folder = mkOption { type = path; description = "Remote folder to backup";};
 530                       exclude_from = mkOption {
 531                         type = listOf path;
 532                         default = [];
 533                         description = "List of folders/files to exclude from the backup";
 534                       };
 535                       files_from = mkOption {
 536                         type = listOf path;
 537                         default = [];
 538                         description = "List of folders/files to backup in the base folder";
 539                       };
 540                       args = mkOption {
 541                         type = nullOr str;
 542                         default = null;
 543                         description = "Extra arguments to pass to rsync";
 544                       };
 545                     };
 546                   });
 547                 };
 548               };
 549             });
 550           };
 551         };
 552       };
 553     };
 554     monitoring = mkOption {
 555       description = "Monitoring configuration";
 556       type = submodule {
 557         options = {
 558           status_url = mkOption { type = str; description = "URL to push status to"; };
 559           status_token = mkOption { type = str; description = "Token for the status url"; };
 560           http_user_password = mkOption { type = str; description = "HTTP credentials to check services behind wall"; };
 561           email = mkOption { type = str; description = "Admin E-mail"; };
 562           ssh_public_key = mkOption { type = str; description = "SSH public key"; };
 563           ssh_secret_key = mkOption { type = str; description = "SSH secret key"; };
 564           imap_login = mkOption { type = str; description = "IMAP login"; };
 565           imap_password = mkOption { type = str; description = "IMAP password"; };
 566           eriomem_keys = mkOption { type = listOf (listOf str); description = "Eriomem keys"; default = []; };
 567           ovh_sms = mkOption {
 568             description = "OVH credentials for sms script";
 569             type = submodule {
 570               options = {
 571                 endpoint = mkOption { type = str; default = "ovh-eu"; description = "OVH endpoint"; };
 572                 application_key = mkOption { type = str; description = "Application key"; };
 573                 application_secret = mkOption { type = str; description = "Application secret"; };
 574                 consumer_key = mkOption { type = str; description = "Consumer key"; };
 575                 account = mkOption { type = str; description = "Account"; };
 576               };
 577             };
 578           };
 579           nrdp_tokens = mkOption { type = listOf str; description = "Tokens allowed to push status update"; };
 580           slack_url = mkOption { type = str; description = "Slack webhook url to push status update"; };
 581           slack_channel = mkOption { type = str; description = "Slack channel to push status update"; };
 582           netdata_aggregator = mkOption { type = str; description = "Url where netdata information should be sent"; };
 583           netdata_keys = mkOption { type = attrsOf str; description = "netdata host keys"; };
 584           contacts = mkOption { type = attrsOf unspecified; description = "Contact dicts to fill naemon objects"; };
 585           email_check = mkOption {
 586             description = "Emails services to check";
 587             type = attrsOf (submodule {
 588               options = {
 589                 local = mkOption { type = bool; default = false; description = "Use local configuration"; };
 590                 port = mkOption { type = nullOr str; default = null; description = "Port to connect to ssh"; };
 591                 login = mkOption { type = nullOr str; default = null; description = "Login to connect to ssh"; };
 592                 targets = mkOption { type = listOf str; description = "Hosts to send E-mails to"; };
 593                 mail_address = mkOption { type = nullOr str; default = null; description = "E-mail recipient part to send e-mail to"; };
 594                 mail_domain = mkOption { type = nullOr str; default = null; description = "E-mail domain part to send e-mail to"; };
 595               };
 596             });
 597           };
 598         };
 599       };
 600     };
 601     mpd = mkOption {
 602       description = "MPD configuration";
 603       type = submodule {
 604         options = {
 605           folder = mkOption { type = str; description = "Folder to serve from the MPD instance"; };
 606           password = mkOption { type = str; description = "Password to connect to the MPD instance"; };
 607           host = mkOption { type = str; description = "Host to connect to the MPD instance"; };
 608           port = mkOption { type = str; description = "Port to connect to the MPD instance"; };
 609         };
 610       };
 611     };
 612     ftp = mkOption {
 613       description = "FTP configuration";
 614       type = submodule {
 615         options = {
 616           ldap = mkLdapOptions "FTP" {
 617             proftpd_filter = mkOption { type = str; description = "Filter for proftpd listing in LDAP"; };
 618             pure-ftpd_filter = mkOption { type = str; description = "Filter for pure-ftpd listing in LDAP"; };
 619           };
 620         };
 621       };
 622     };
 623     vpn = mkOption {
 624       description = "VPN configuration";
 625       type = attrsOf (submodule {
 626         options = {
 627           prefix = mkOption { type = str; description = "ipv6 prefix for the vpn subnet"; };
 628           privateKey = mkOption { type = str; description = "Private key for the host"; };
 629           publicKey = mkOption { type = str; description = "Public key for the host"; };
 630         };
 631       });
 632     };
 633     mail = mkOption {
 634       description = "Mail configuration";
 635       type = submodule {
 636         options = {
 637           dmarc = mkOption {
 638             description = "DMARC configuration";
 639             type = submodule {
 640               options = {
 641                 ignore_hosts = mkOption {
 642                   type = lines;
 643                   description = ''
 644                     Hosts to ignore when checking for dmarc
 645                     '';
 646                 };
 647               };
 648             };
 649           };
 650           dkim = mkOption {
 651             description = "DKIM configuration";
 652             type = attrsOf (submodule {
 653               options = {
 654                 public = mkOption {
 655                   type = str;
 656                   example = ''
 657                     ( "v=DKIM1; k=rsa; "
 658                               "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3w1a2aMxWw9+hdcmbqX4UevcVqr204y0K73Wdc7MPZiOOlUJQYsMNSYR1Y/SC7jmPKeitpcJCpQgn/cveJZbuikjjPLsDReHyFEYmC278ZLRTELHx6f1IXM8WE08JIRT69CfZiMi1rVcOh9qRT4F93PyjCauU8Y5hJjtg9ThsWwIDAQAB" )
 659                     '';
 660                   description = "Public entry to put in DNS TXT field";
 661                 };
 662                 private = mkOption { type = str; description = "Private key"; };
 663               };
 664             });
 665           };
 666           postfix = mkOption {
 667             description = "Postfix configuration";
 668             type = submodule {
 669               options = {
 670                 additional_mailbox_domains = mkOption {
 671                   description = ''
 672                     List of domains that are used as mailbox final destination, in addition to those defined in the DNS records
 673                   '';
 674                   type = listOf str;
 675                 };
 676                 mysql = mkMysqlOptions "Postfix" {
 677                   password_encrypt = mkOption { type = str; description = "Key to encrypt relay password in database"; };
 678                 };
 679                 backup_domains = mkOption {
 680                   description = ''
 681                     Domains that are accepted for relay as backup domain
 682                   '';
 683                   type = attrsOf (submodule {
 684                     options = {
 685                       domains = mkOption { type = listOf str; description = "Domains list"; };
 686                       relay_restrictions = mkOption {
 687                         type = lines;
 688                         description = ''
 689                           Restrictions for relaying the e-mails from the domains
 690                           '';
 691                       };
 692                       recipient_maps = mkOption {
 693                         description = ''
 694                           Recipient map to accept relay for.
 695                           Must be specified for domain, the rules apply to everyone!
 696                         '';
 697                         type = listOf (submodule {
 698                           options = {
 699                             type = mkOption {
 700                               type = enum [ "hash" ];
 701                               description = "Map type";
 702                             };
 703                             content = mkOption {
 704                               type = str;
 705                               description = "Map content";
 706                             };
 707                           };
 708                         });
 709                       };
 710                     };
 711                   });
 712                 };
 713               };
 714             };
 715           };
 716           dovecot = mkOption {
 717             description = "Dovecot configuration";
 718             type = submodule {
 719               options = {
 720                 ldap = mkLdapOptions "Dovecot" {
 721                   pass_attrs = mkOption { type = str; description = "Password attribute in LDAP"; };
 722                   user_attrs = mkOption { type = str; description = "User attribute mapping in LDAP"; };
 723                   iterate_attrs = mkOption { type = str; description = "User attribute mapping for listing in LDAP"; };
 724                   iterate_filter = mkOption { type = str; description = "User attribute filter for listing in LDAP"; };
 725                   postfix_mailbox_filter = mkOption { type = str; description = "Postfix filter to get mailboxes"; };
 726                 };
 727               };
 728             };
 729           };
 730           rspamd = mkOption {
 731             description = "rspamd configuration";
 732             type = submodule {
 733               options = {
 734                 redis = mkRedisOptions "Redis";
 735                 read_password_hashed = mkOption { type = str; description = "Hashed read password for rspamd"; };
 736                 write_password_hashed = mkOption { type = str; description = "Hashed write password for rspamd"; };
 737                 read_password = mkOption {
 738                   type = str;
 739                   description = "Read password for rspamd. Unused";
 740                   apply = x: "";
 741                 };
 742                 write_password = mkOption {
 743                   type = str;
 744                   description = "Write password for rspamd. Unused";
 745                   apply = x: "";
 746                 };
 747               };
 748             };
 749           };
 750           scripts = mkOption {
 751             description = "Mail script recipients";
 752             type = attrsOf (submodule {
 753               options = {
 754                 external = mkEnableOption "Create a script_<name>@mail.immae.eu external address";
 755                 src = mkOption {
 756                   description = ''
 757                     git source to fetch the script from.
 758                     It must have a default.nix file as its root accepting a scriptEnv parameter
 759                   '';
 760                   type = submodule {
 761                     options = {
 762                       url = mkOption { type = str; description = "git url to fetch"; };
 763                       rev = mkOption { type = str; description = "git reference to fetch"; };
 764                     };
 765                   };
 766                 };
 767                 env = mkOption {
 768                   description = "Variables to pass to the script";
 769                   type = unspecified;
 770                 };
 771               };
 772             });
 773           };
 774           sympa = mkOption {
 775             description = "Sympa configuration";
 776             type = submodule {
 777               options = {
 778                 listmasters = mkOption {
 779                   type = listOf str;
 780                   description = "Listmasters";
 781                 };
 782                 postgresql = mkPsqlOptions "Sympa";
 783                 data_sources = mkOption {
 784                   type = attrsOf str;
 785                   default = {};
 786                   description = "Data sources to make available to sympa";
 787                 };
 788                 scenari = mkOption {
 789                   type = attrsOf str;
 790                   default = {};
 791                   description = "Scenari to make available to sympa";
 792                 };
 793               };
 794             };
 795           };
 796         };
 797       };
 798     };
 799     coturn = mkOption {
 800       description = "Coturn configuration";
 801       type = submodule {
 802         options = {
 803           auth_access_key = mkOption { type = str; description = "key to access coturn"; };
 804         };
 805       };
 806     };
 807     buildbot = mkOption {
 808       description = "Buildbot configuration";
 809       type = submodule {
 810         options = {
 811           ssh_key = mkOption {
 812             description = "SSH key information";
 813             type = submodule {
 814               options = {
 815                 public = mkOption { type = str; description = "Public part of the key"; };
 816                 private = mkOption { type = lines; description = "Private part of the key"; };
 817               };
 818             };
 819           };
 820           workerPassword = mkOption { description = "Buildbot worker password"; type = str; };
 821           user = mkOption {
 822             description = "Buildbot user";
 823             type = submodule {
 824               options = {
 825                 uid = mkOption {
 826                   description = "user uid";
 827                   type = int;
 828                 };
 829                 gid = mkOption {
 830                   description = "user gid";
 831                   type = int;
 832                 };
 833               };
 834             };
 835           };
 836           ldap = mkOption {
 837             description = "Ldap configuration for buildbot";
 838             type = submodule {
 839               options = {
 840                 password = mkOption { type = str; description = "Buildbot password"; };
 841               };
 842             };
 843           };
 844           projects = mkOption {
 845             description = "Projects to make a buildbot for";
 846             type = attrsOf (submodule {
 847               options = {
 848                 name = mkOption { type = str; description = "Project name"; };
 849                 packages = mkOption {
 850                   type = unspecified;
 851                   example = literalExample ''
 852                     pkgs: [ pkgs.bash pkgs.git pkgs.gzip pkgs.openssh ];
 853                     '';
 854                   description = ''
 855                     Function.
 856                     Builds packages list to make available to buildbot project.
 857                     Takes pkgs as argument.
 858                   '';
 859                 };
 860                 pythonPackages = mkOption {
 861                   type = unspecified;
 862                   example = literalExample ''
 863                     p: pkgs: [ pkgs.python3Packages.pip ];
 864                     '';
 865                   description = ''
 866                     Function.
 867                     Builds python packages list to make available to buildbot project.
 868                     Takes buildbot python module as first argument and pkgs as second argument in order to augment the python modules list.
 869                     '';
 870                 };
 871                 pythonPathHome = mkOption { type = bool; description = "Whether to add project’s python home to python path"; };
 872                 workerPort = mkOption { type = port; description = "Port for the worker"; };
 873                 secrets = mkOption {
 874                   #type = attrsOf (either str (functionTo str));
 875                   type = attrsOf unspecified;
 876                   description = "Secrets for the project to dump as files. Might be a function that takes pkgs as argument";
 877                 };
 878                 environment = mkOption {
 879                   #type = attrsOf (either str (functionTo str));
 880                   type = attrsOf unspecified;
 881                   description = ''
 882                     Environment variables for the project. Might be a function that takes pkgs as argument.
 883                     BUILDBOT_ is prefixed to the variable names
 884                   '';
 885                 };
 886                 activationScript = mkOption {
 887                   type = lines;
 888                   description = ''
 889                     Activation script to run during deployment
 890                   '';
 891                 };
 892                 builderPaths = mkOption {
 893                   type = attrsOf unspecified;
 894                   default = {};
 895                   description = ''
 896                     Attrs of functions to make accessible specifically per builder.
 897                     Takes pkgs as argument and should return a single path containing binaries.
 898                     This path will be accessible as BUILDBOT_PATH_<attrskey>
 899                     '';
 900                 };
 901                 webhookTokens = mkOption {
 902                   type = nullOr (listOf str);
 903                   default = null;
 904                   description = ''
 905                     List of tokens allowed to push to project’s change_hook/base endpoint
 906                   '';
 907                 };
 908               };
 909             });
 910           };
 911         };
 912       };
 913     };
 914     tools = mkOption {
 915       description = "Tools configurations";
 916       type = submodule {
 917         options = {
 918           contact = mkOption { type = str; description = "Contact e-mail address"; };
 919           assets = mkOption {
 920             default = {};
 921             type = attrsOf (submodule {
 922               options = {
 923                 url = mkOption { type = str; description = "URL to fetch"; };
 924                 sha256 = mkOption { type = str; description = "Hash of the url"; };
 925               };
 926             });
 927             description = "Assets to provide on assets.immae.eu";
 928           };
 929           davical = mkOption {
 930             description = "Davical configuration";
 931             type = submodule {
 932               options = {
 933                 postgresql = mkPsqlOptions "Davical";
 934                 ldap = mkLdapOptions "Davical" {};
 935               };
 936             };
 937           };
 938           diaspora = mkOption {
 939             description = "Diaspora configuration";
 940             type = submodule {
 941               options = {
 942                 postgresql = mkPsqlOptions "Diaspora";
 943                 redis = mkRedisOptions "Diaspora";
 944                 ldap = mkLdapOptions "Diaspora" {};
 945                 secret_token = mkOption { type = str; description = "Secret token"; };
 946               };
 947             };
 948           };
 949           dmarc_reports = mkOption {
 950             description = "DMARC reports configuration";
 951             type = submodule {
 952               options = {
 953                 mysql = mkMysqlOptions "DMARC" {};
 954                 anonymous_key = mkOption { type = str; description = "Anonymous hashing key"; };
 955               };
 956             };
 957           };
 958           etherpad-lite = mkOption {
 959             description = "Etherpad configuration";
 960             type = submodule {
 961               options = {
 962                 postgresql = mkPsqlOptions "Etherpad";
 963                 ldap = mkLdapOptions "Etherpad" {
 964                   group_filter = mkOption { type = str; description = "Filter for groups"; };
 965                 };
 966                 adminPassword = mkOption { type = str; description = "Admin password for mypads / admin"; };
 967                 session_key = mkOption { type = str; description = "Session key"; };
 968                 api_key = mkOption { type = str; description = "API key"; };
 969               };
 970             };
 971           };
 972           gitolite = mkOption {
 973             description = "Gitolite configuration";
 974             type = submodule {
 975               options = {
 976                 ldap = mkLdapOptions "Gitolite" {};
 977                 ssh_key = mkOption {
 978                   description = "SSH key information";
 979                   type = submodule {
 980                     options = {
 981                       public = mkOption { type = str; description = "Public part of the key"; };
 982                       private = mkOption { type = lines; description = "Private part of the key"; };
 983                     };
 984                   };
 985                 };
 986               };
 987             };
 988           };
 989           kanboard = mkOption {
 990             description = "Kanboard configuration";
 991             type = submodule {
 992               options = {
 993                 postgresql = mkPsqlOptions "Kanboard";
 994                 ldap = mkLdapOptions "Kanboard" {
 995                   admin_dn = mkOption { type = str; description = "Admin DN"; };
 996                 };
 997               };
 998             };
 999           };
1000           mantisbt = mkOption {
1001             description = "Mantisbt configuration";
1002             type = submodule {
1003               options = {
1004                 postgresql = mkPsqlOptions "Mantisbt";
1005                 ldap = mkLdapOptions "Mantisbt" {};
1006                 master_salt = mkOption { type = str; description = "Master salt for password hash"; };
1007               };
1008             };
1009           };
1010           mastodon = mkOption {
1011             description = "Mastodon configuration";
1012             type = submodule {
1013               options = {
1014                 postgresql = mkPsqlOptions "Mastodon";
1015                 redis = mkRedisOptions "Mastodon";
1016                 ldap = mkLdapOptions "Mastodon" {};
1017                 paperclip_secret = mkOption { type = str; description = "Paperclip secret"; };
1018                 otp_secret = mkOption { type = str; description = "OTP secret"; };
1019                 secret_key_base = mkOption { type = str; description = "Secret key base"; };
1020                 vapid = mkOption {
1021                   description = "vapid key";
1022                   type = submodule {
1023                     options = {
1024                       private = mkOption { type = str; description = "Private key"; };
1025                       public = mkOption { type = str; description = "Public key"; };
1026                     };
1027                   };
1028                 };
1029               };
1030             };
1031           };
1032           mediagoblin = mkOption {
1033             description = "Mediagoblin configuration";
1034             type = submodule {
1035               options = {
1036                 postgresql = mkPsqlOptions "Mediagoblin";
1037                 redis = mkRedisOptions "Mediagoblin";
1038                 ldap = mkLdapOptions "Mediagoblin" {};
1039               };
1040             };
1041           };
1042           nextcloud = mkOption {
1043             description = "Nextcloud configuration";
1044             type = submodule {
1045               options = {
1046                 postgresql = mkPsqlOptions "Peertube";
1047                 redis = mkRedisOptions "Peertube";
1048                 password_salt = mkOption { type = str; description = "Password salt"; };
1049                 instance_id = mkOption { type = str; description = "Instance ID"; };
1050                 secret = mkOption { type = str; description = "App secret"; };
1051               };
1052             };
1053           };
1054           peertube = mkOption {
1055             description = "Peertube configuration";
1056             type = submodule {
1057               options = {
1058                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1059                 postgresql = mkPsqlOptions "Peertube";
1060                 redis = mkRedisOptions "Peertube";
1061                 ldap = mkLdapOptions "Peertube" {};
1062               };
1063             };
1064           };
1065           syden_peertube = mkOption {
1066             description = "Peertube Syden configuration";
1067             type = submodule {
1068               options = {
1069                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1070                 postgresql = mkPsqlOptions "Peertube";
1071                 redis = mkRedisOptions "Peertube";
1072               };
1073             };
1074           };
1075           phpldapadmin = mkOption {
1076             description = "phpLdapAdmin configuration";
1077             type = submodule {
1078               options = {
1079                 ldap = mkLdapOptions "phpldapadmin" {};
1080               };
1081             };
1082           };
1083           rompr = mkOption {
1084             description = "Rompr configuration";
1085             type = submodule {
1086               options = {
1087                 mpd = mkOption {
1088                   description = "MPD configuration";
1089                   type = submodule {
1090                     options = {
1091                       host = mkOption { type = str; description = "Host for MPD"; };
1092                       port = mkOption { type = port; description = "Port to access MPD host"; };
1093                     };
1094                   };
1095                 };
1096               };
1097             };
1098           };
1099           roundcubemail = mkOption {
1100             description = "Roundcubemail configuration";
1101             type = submodule {
1102               options = {
1103                 postgresql = mkPsqlOptions "TT-RSS";
1104                 secret = mkOption { type = str; description = "Secret"; };
1105               };
1106             };
1107           };
1108           shaarli = mkOption {
1109             description = "Shaarli configuration";
1110             type = submodule {
1111               options = {
1112                 ldap = mkLdapOptions "Shaarli" {};
1113               };
1114             };
1115           };
1116           status_engine = mkOption {
1117             description = "Status Engine configuration";
1118             type = submodule {
1119               options = {
1120                 mysql = mkMysqlOptions "StatusEngine" {};
1121                 ldap = mkLdapOptions "StatusEngine" {};
1122               };
1123             };
1124           };
1125           task = mkOption {
1126             description = "Taskwarrior configuration";
1127             type = submodule {
1128               options = {
1129                 ldap = mkLdapOptions "Taskwarrior" {};
1130                 taskwarrior-web = mkOption {
1131                   description = "taskwarrior-web profiles";
1132                   type = attrsOf (submodule {
1133                     options = {
1134                       uid = mkOption {
1135                         type = listOf str;
1136                         description = "List of ldap uids having access to this profile";
1137                       };
1138                       org = mkOption { type = str; description = "Taskd organisation"; };
1139                       key = mkOption { type = str; description = "Taskd key"; };
1140                       date = mkOption { type = str; description = "Preferred date format"; };
1141                     };
1142                   });
1143                 };
1144               };
1145             };
1146           };
1147           ttrss = mkOption {
1148             description = "TT-RSS configuration";
1149             type = submodule {
1150               options = {
1151                 postgresql = mkPsqlOptions "TT-RSS";
1152                 ldap = mkLdapOptions "TT-RSS" {};
1153               };
1154             };
1155           };
1156           wallabag = mkOption {
1157             description = "Wallabag configuration";
1158             type = submodule {
1159               options = {
1160                 postgresql = mkPsqlOptions "Wallabag";
1161                 ldap = mkLdapOptions "Wallabag" {
1162                   admin_filter = mkOption { type = str; description = "Admin users filter"; };
1163                 };
1164                 redis = mkRedisOptions "Wallabag";
1165                 secret = mkOption { type = str; description = "App secret"; };
1166               };
1167             };
1168           };
1169           webhooks = mkOption {
1170             type = attrsOf str;
1171             description = "Mapping 'name'.php => script for webhooks";
1172           };
1173           csp_reports = mkOption {
1174             description = "CSP report configuration";
1175             type = submodule {
1176               options = {
1177                 report_uri = mkOption { type = str; description = "URI to report CSP violations to"; };
1178                 policies = mkOption { type = attrsOf str; description = "CSP policies to apply"; };
1179               };
1180             };
1181           };
1182           commento = mkOption {
1183             description = "Commento configuration";
1184             type = submodule {
1185               options = {
1186                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1187                 postgresql = mkPsqlOptions "Commento";
1188                 smtp = mkSmtpOptions "Commento";
1189               };
1190             };
1191           };
1192           cryptpad = mkOption {
1193             description = "Cryptpad configuration";
1194             type = attrsOf (submodule {
1195               options = {
1196                 email = mkOption { type = str; description = "Admin e-mail"; };
1197                 admins = mkOption { type = listOf str; description = "Instance admin public keys"; };
1198                 port = mkOption { type = port; description = "Port to listen to"; };
1199               };
1200             });
1201           };
1202           ympd = mkOption {
1203             description = "Ympd configuration";
1204             type = submodule {
1205               options = {
1206                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1207                 mpd = mkOption {
1208                   description = "MPD configuration";
1209                   type = submodule {
1210                     options = {
1211                       password = mkOption { type = str; description = "Password to access MPD host"; };
1212                       host = mkOption { type = str; description = "Host for MPD"; };
1213                       port = mkOption { type = port; description = "Port to access MPD host"; };
1214                     };
1215                   };
1216                 };
1217               };
1218             };
1219           };
1220           umami = mkOption {
1221             description = "Umami configuration";
1222             type = submodule {
1223               options = {
1224                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1225                 postgresql = mkPsqlOptions "Umami";
1226                 hashSalt = mkOption { type = str; description = "Hash salt"; };
1227               };
1228             };
1229           };
1230           yourls = mkOption {
1231             description = "Yourls configuration";
1232             type = submodule {
1233               options = {
1234                 mysql = mkMysqlOptions "Yourls" {};
1235                 ldap = mkLdapOptions "Yourls" {};
1236                 cookieKey = mkOption { type = str; description = "Cookie key"; };
1237               };
1238             };
1239           };
1240         };
1241       };
1242     };
1243     serverSpecific = mkOption { type = attrsOf unspecified; description = "Server specific configuration"; };
1244     websites = mkOption {
1245       description = "Websites configurations";
1246       type = submodule {
1247         options = {
1248           christophe_carpentier = mkOption {
1249             description = "Christophe Carpentier configuration by environment";
1250             type = submodule {
1251               options = {
1252                 agorakit = mkOption {
1253                   description = "Agorakit configuration";
1254                   type = submodule {
1255                     options = {
1256                       mysql = mkMysqlOptions "Agorakit" {};
1257                       smtp = mkSmtpOptions "Agorakit";
1258                       appkey = mkOption { type = str; description = "App key"; };
1259                     };
1260                   };
1261                 };
1262               };
1263             };
1264           };
1265           immae = mkOption {
1266             description = "Immae configuration by environment";
1267             type = submodule {
1268               options = {
1269                 temp = mkOption {
1270                   description = "Temp configuration";
1271                   type = submodule {
1272                     options = {
1273                       ldap = mkLdapOptions "Immae temp" {
1274                         filter = mkOption { type = str; description = "Filter for user access"; };
1275                       };
1276                     };
1277                   };
1278                 };
1279               };
1280             };
1281           };
1282           isabelle = mkOption {
1283             description = "Isabelle configurations by environment";
1284             type =
1285               let
1286                 atenSubmodule = mkOption {
1287                   description = "environment configuration";
1288                   type = submodule {
1289                     options = {
1290                       environment = mkOption { type = str; description = "Symfony environment"; };
1291                       secret = mkOption { type = str; description = "Symfony App secret"; };
1292                       postgresql = mkPsqlOptions "Aten";
1293                     };
1294                   };
1295                 };
1296               in
1297                 submodule {
1298                   options = {
1299                     aten_production = atenSubmodule;
1300                     aten_integration = atenSubmodule;
1301                     iridologie = mkOption {
1302                       description = "environment configuration";
1303                       type = submodule {
1304                         options = {
1305                           environment = mkOption { type = str; description = "SPIP environment"; };
1306                           mysql = mkMysqlOptions "Iridologie" {};
1307                           ldap = mkLdapOptions "Iridologie" {};
1308                         };
1309                       };
1310                     };
1311                   };
1312                 };
1313           };
1314           chloe = mkOption {
1315             description = "Chloe configurations by environment";
1316             type =
1317               let
1318                 chloeSubmodule = mkOption {
1319                   description = "environment configuration";
1320                   type = submodule {
1321                     options = {
1322                       environment = mkOption { type = str; description = "SPIP environment"; };
1323                       mysql = mkMysqlOptions "Chloe" {};
1324                       ldap = mkLdapOptions "Chloe" {};
1325                     };
1326                   };
1327                 };
1328               in
1329                 submodule {
1330                   options = {
1331                     production = chloeSubmodule;
1332                     integration = chloeSubmodule;
1333                     new = mkOption {
1334                       description = "environment configuration";
1335                       type = submodule {
1336                         options = {
1337                           mysql = mkMysqlOptions "ChloeNew" {};
1338                           ldap = mkLdapOptions "ChloeNew" {};
1339                           secret = mkOption { type = str; description = "Symfony App secret"; };
1340                         };
1341                       };
1342                     };
1343                   };
1344                 };
1345           };
1346           connexionswing = mkOption {
1347             description = "Connexionswing configurations by environment";
1348             type =
1349               let
1350                 csSubmodule = mkOption {
1351                   description = "environment configuration";
1352                   type = submodule {
1353                     options = {
1354                       environment = mkOption { type = str; description = "Symfony environment"; };
1355                       mysql = mkMysqlOptions "Connexionswing" {};
1356                       secret = mkOption { type = str; description = "Symfony App secret"; };
1357                       email = mkOption { type = str; description = "Symfony email notification"; };
1358                     };
1359                   };
1360                 };
1361               in
1362                 submodule {
1363                   options = {
1364                     production = csSubmodule;
1365                     integration = csSubmodule;
1366                   };
1367                 };
1368           };
1369           jerome = mkOption {
1370             description = "Naturaloutil configuration";
1371             type = submodule {
1372               options = {
1373                 mysql = mkMysqlOptions "Naturaloutil" {};
1374                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1375               };
1376             };
1377           };
1378           telio_tortay = mkOption {
1379             description = "Telio Tortay configuration";
1380             type = submodule {
1381               options = {
1382                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1383               };
1384             };
1385           };
1386           ludivine = mkOption {
1387             description = "Ludivinecassal configurations by environment";
1388             type =
1389               let
1390                 lcSubmodule = mkOption {
1391                   description = "environment configuration";
1392                   type = submodule {
1393                     options = {
1394                       environment = mkOption { type = str; description = "Symfony environment"; };
1395                       mysql = mkMysqlOptions "LudivineCassal" {};
1396                       ldap = mkLdapOptions "LudivineCassal" {};
1397                       secret = mkOption { type = str; description = "Symfony App secret"; };
1398                     };
1399                   };
1400                 };
1401               in
1402                 submodule {
1403                   options = {
1404                     production = lcSubmodule;
1405                     integration = lcSubmodule;
1406                   };
1407                 };
1408           };
1409           nicecoop = mkOption {
1410             description = "Nicecoop configuration";
1411             type = submodule {
1412               options = {
1413                 odoo = {
1414                   port = mkOption { description = "Port to listen to"; type = port; };
1415                   longpoll_port = mkOption { description = "Port to listen to"; type = port; };
1416                   postgresql = mkPsqlOptions "Odoo";
1417                   admin_password = mkOption { type = str; description = "Admin password"; };
1418                 };
1419                 gestion-compte = {
1420                   smtp = mkSmtpOptions "GestionCompte";
1421                   mysql = mkMysqlOptions "gestion-compte" {};
1422                   secret = mkOption { type = str; description = "Application secret"; };
1423                   adminpassword = mkOption { type = str; description = "Admin password"; };
1424                 };
1425                 gestion-compte-integration = {
1426                   smtp = mkSmtpOptions "GestionCompte";
1427                   mysql = mkMysqlOptions "gestion-compte" {};
1428                   secret = mkOption { type = str; description = "Application secret"; };
1429                   adminpassword = mkOption { type = str; description = "Admin password"; };
1430                 };
1431                 copanier = {
1432                   smtp = mkSmtpOptions "Copanier";
1433                   staff = mkOption { type = listOf str; description = "List of staff members"; };
1434                 };
1435               };
1436             };
1437           };
1438           emilia = mkOption {
1439             description = "Emilia configuration";
1440             type = submodule {
1441               options = {
1442                 postgresql = mkPsqlOptions "Emilia";
1443               };
1444             };
1445           };
1446           florian = mkOption {
1447             description = "Florian configuration";
1448             type = submodule {
1449               options = {
1450                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1451               };
1452             };
1453           };
1454           nassime = mkOption {
1455             description = "Nassime configuration";
1456             type = submodule {
1457               options = {
1458                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1459               };
1460             };
1461           };
1462           piedsjaloux = mkOption {
1463             description = "Piedsjaloux configurations by environment";
1464             type =
1465               let
1466                 pjSubmodule = mkOption {
1467                   description = "environment configuration";
1468                   type = submodule {
1469                     options = {
1470                       environment = mkOption { type = str; description = "Symfony environment"; };
1471                       mysql = mkMysqlOptions "Piedsjaloux" {};
1472                       secret = mkOption { type = str; description = "Symfony App secret"; };
1473                     };
1474                   };
1475                 };
1476               in
1477                 submodule {
1478                   options = {
1479                     production = pjSubmodule;
1480                     integration = pjSubmodule;
1481                   };
1482                 };
1483           };
1484           richie = mkOption {
1485             description = "Europe Richie configurations by environment";
1486             type = submodule {
1487               options = {
1488                 mysql = mkMysqlOptions "Richie" {};
1489                 smtp_mailer = mkOption {
1490                   description = "SMTP mailer configuration";
1491                   type = submodule {
1492                     options = {
1493                       user = mkOption { type = str; description = "Username"; };
1494                       password = mkOption { type = str; description = "Password"; };
1495                     };
1496                   };
1497                 };
1498               };
1499             };
1500           };
1501           caldance = mkOption {
1502             description = "Caldance configurations by environment";
1503             type = submodule {
1504               options = {
1505                 integration = mkOption {
1506                   description = "environment configuration";
1507                   type = submodule {
1508                     options = {
1509                       password = mkOption { type = str; description = "Password file content for basic auth"; };
1510                     };
1511                   };
1512                 };
1513               };
1514             };
1515           };
1516           tellesflorian = mkOption {
1517             description = "Tellesflorian configurations by environment";
1518             type =
1519               let
1520                 tfSubmodule = mkOption {
1521                   description = "environment configuration";
1522                   type = submodule {
1523                     options = {
1524                       environment = mkOption { type = str; description = "Symfony environment"; };
1525                       mysql = mkMysqlOptions "Tellesflorian" {};
1526                       secret = mkOption { type = str; description = "Symfony App secret"; };
1527                       invite_passwords = mkOption { type = str; description = "Password basic auth"; };
1528                     };
1529                   };
1530                 };
1531               in
1532                 submodule {
1533                   options = {
1534                     integration = tfSubmodule;
1535                   };
1536                 };
1537           };
1538         };
1539       };
1540     };
1541   };
1542   options.hostEnv = mkOption {
1543     readOnly = true;
1544     type = hostEnv;
1545     default = config.myEnv.servers."${name}";
1546     description = "Host environment";
1547   };
1548 }