},
"secrets": {
"locked": {
- "narHash": "sha256-aRHKDVHDpnqpmgGhLGQxXwyTwmPuhUJTVcOLBYtY2ks=",
+ "narHash": "sha256-w3u1bMEJHCg9SqErJ5Qi0sTX2xx7mk+HrHZXzpjQd1w=",
"path": "../../secrets",
"type": "path"
},
},
"secrets": {
"locked": {
- "narHash": "sha256-aRHKDVHDpnqpmgGhLGQxXwyTwmPuhUJTVcOLBYtY2ks=",
+ "narHash": "sha256-w3u1bMEJHCg9SqErJ5Qi0sTX2xx7mk+HrHZXzpjQd1w=",
"path": "../../secrets",
"type": "path"
},
config.secrets.fullPaths."opendmarc/ignore.hosts"
];
};
- secrets.keys = [
- {
- dest = "opendmarc/ignore.hosts";
+ secrets.keys = {
+ "opendmarc/ignore.hosts" = {
user = config.services.opendmarc.user;
group = config.services.opendmarc.group;
permissions = "0400";
builtins.concatStringsSep "\n" ([
config.myEnv.mail.dmarc.ignore_hosts
] ++ lib.mapAttrsToList (n: v: v.fqdn) mxes);
- }
- ];
+ };
+ };
};
};
in
nixosModule = { config, lib, pkgs, ... }: {
options.secrets = with lib; {
keys = mkOption {
- type = types.listOf types.unspecified;
- default = [];
- description = "Keys to upload to server";
+ type = types.attrsOf (types.submodule {
+ options = {
+ isTemplated = mkOption {
+ type = types.bool;
+ default = true;
+ description = "If the file is a gucci template that needs to be resolved";
+ };
+ isDir = mkOption {
+ type = types.bool;
+ default = false;
+ description = "If the entry is a directory";
+ };
+ group = mkOption {
+ type = types.str;
+ default = "root";
+ description = "Group to associate to the entry";
+ };
+ user = mkOption {
+ type = types.str;
+ default = "root";
+ description = "User to associate to the entry";
+ };
+ permissions = mkOption {
+ type = types.str;
+ default = "0600";
+ description = "Permissions to associate to the entry";
+ };
+ text = mkOption {
+ type = types.str;
+ description = "Content of the entry";
+ };
+ };
+ });
+ default = {};
+ description = "Keys attrs to upload to the server";
+ apply = lib.mapAttrsToList (dest: v: v // { inherit dest; });
};
gpgKeys = mkOption {
type = types.listOf types.path;
location = config.secrets.location;
keys = config.secrets.keys;
empty = pkgs.runCommand "empty" { preferLocalBuild = true; } "mkdir -p $out && touch $out/done";
- fpath = v: "secrets/${v.dest}${lib.optionalString (v.isTemplated or true) ".gucci.tpl"}";
+ fpath = v: "secrets/${v.dest}${lib.optionalString v.isTemplated ".gucci.tpl"}";
dumpKey = v:
- if v.isDir or false then
+ if v.isDir then
''
mkdir -p secrets/${v.dest}
cat >> mods <<EOF
- ${v.user or "root"} ${v.group or "root"} ${v.permissions or "0600"} secrets/${v.dest}
+ ${v.user} ${v.group} ${v.permissions} secrets/${v.dest}
EOF
''
else ''
mkdir -p secrets/$(dirname ${v.dest})
echo -n ${lib.strings.escapeShellArg v.text} > ${fpath v}
cat >> mods <<EOF
- ${v.user or "root"} ${v.group or "root"} ${v.permissions or "0600"} ${fpath v}
+ ${v.user} ${v.group} ${v.permissions} ${fpath v}
EOF
'';
secrets = pkgs.runCommand "secrets.tar.enc" {
'';
pathChmodExcl =
let
- dirs = builtins.filter (v: v.isDir or false) keys;
+ dirs = builtins.filter (v: v.isDir) keys;
exclPath = builtins.concatStringsSep " -o " (map (d: " -path $TMP/${d.dest}") dirs);
in
lib.optionalString (builtins.length dirs > 0) " -not \\( ${exclPath} \\) ";
system.activationScripts.backup = ''
install -m 0700 -o root -g root -d ${varDir} ${varDir}/caches
'';
- secrets.keys = lib.flatten (lib.mapAttrsToList (k: v:
+ secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (k: v:
map (remote: [
- {
+ (lib.nameValuePair "backup/${varName k remote}/conf" {
permissions = "0400";
- dest = "backup/${varName k remote}/conf";
text = duplyProfile v remote "${k}/";
- }
- {
+ })
+ (lib.nameValuePair "backup/${varName k remote}/exclude" {
permissions = "0400";
- dest = "backup/${varName k remote}/exclude";
text = v.excludeFile;
- }
- {
+ })
+ (lib.nameValuePair "backup/${varName k remote}" {
permissions = "0500";
- dest = "backup/${varName k remote}";
isDir = true;
- }
- ]) v.remotes) config.services.duplyBackup.profiles);
+ })
+ ]) v.remotes) config.services.duplyBackup.profiles));
services.cron = {
enable = true;
config = mkIf cfg.enable {
- secrets.keys = [
- {
- dest = "naemon/resources.cfg";
+ secrets.keys = {
+ "naemon/resources.cfg" = {
user = cfg.user;
group = cfg.group;
permissions = "0400";
$USER1$=${pkgs.monitoring-plugins}/libexec
${cfg.extraResource}
'';
- }
- ];
+ };
+ };
users.users = optionalAttrs (cfg.user == "naemon") {
naemon = {
'';
}) config.myEnv.buildbot.projects;
- secrets.keys = (
+ secrets.keys = lib.listToAttrs (
lib.lists.flatten (
lib.attrsets.mapAttrsToList (k: project:
lib.attrsets.mapAttrsToList (k: v:
- {
+ (lib.nameValuePair "buildbot/${project.name}/${k}" {
permissions = "0600";
user = "buildbot";
group = "buildbot";
text = v;
- dest = "buildbot/${project.name}/${k}";
- }
+ })
) project.secrets
++ [
- {
+ (lib.nameValuePair "buildbot/${project.name}/webhook-httpd-include" {
permissions = "0600";
user = "wwwrun";
group = "wwwrun";
text = lib.optionalString (project.webhookTokens != null) ''
Require expr "req('Access-Key') in { ${builtins.concatStringsSep ", " (map (x: "'${x}'") project.webhookTokens)} }"
'';
- dest = "buildbot/${project.name}/webhook-httpd-include";
- }
- {
+ })
+ (lib.nameValuePair "buildbot/${project.name}/environment_file" {
permissions = "0600";
user = "buildbot";
group = "buildbot";
- dest = "buildbot/${project.name}/environment_file";
text = let
project_env = with lib.attrsets;
mapAttrs' (k: v: nameValuePair "BUILDBOT_${k}" v) project.environment //
};
in builtins.concatStringsSep "\n"
(lib.mapAttrsToList (envK: envV: "${envK}=${envV}") project_env);
- }
+ })
]
) config.myEnv.buildbot.projects
)
- ) ++ [
- {
+ ) // {
+ "buildbot/ldap" = {
permissions = "0600";
user = "buildbot";
group = "buildbot";
text = config.myEnv.buildbot.ldap.password;
- dest = "buildbot/ldap";
- }
- {
+ };
+ "buildbot/worker_password" = {
permissions = "0600";
user = "buildbot";
group = "buildbot";
text = config.myEnv.buildbot.workerPassword;
- dest = "buildbot/worker_password";
- }
- {
+ };
+ "buildbot/ssh_key" = {
permissions = "0600";
user = "buildbot";
group = "buildbot";
text = config.myEnv.buildbot.ssh_key.private;
- dest = "buildbot/ssh_key";
- }
- ];
+ };
+ };
services.filesWatcher = lib.attrsets.mapAttrs' (k: project: lib.attrsets.nameValuePair "buildbot-${project.name}" {
restart = true;
'';
};
- secrets.keys = [
- {
- dest = "mysql/mysqldump";
+ secrets.keys = {
+ "mysql/mysqldump" = {
permissions = "0400";
user = "root";
group = "root";
user = root
password = ${cfg.credentials.root}
'';
- }
- {
- dest = "mysql/pam";
+ };
+ "mysql/pam" = {
permissions = "0400";
user = "mysql";
group = "mysql";
pam_filter ${filter}
ssl start_tls
'';
- }
- {
- dest = "mysql/pam_replication";
+ };
+ "mysql/pam_replication" = {
permissions = "0400";
user = "mysql";
group = "mysql";
pam_login_attribute cn
ssl start_tls
'';
- }
- ];
+ };
+ };
security.pam.services = let
pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
};
users.groups.mysql.gid = config.ids.gids.mysql;
- secrets.keys = lib.flatten (lib.mapAttrsToList (name: hcfg: [
- {
- dest = "mysql_replication/${name}/slave_init_commands";
+ secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (name: hcfg: [
+ (lib.nameValuePair "mysql_replication/${name}/slave_init_commands" {
user = "mysql";
group = "mysql";
permissions = "0400";
CHANGE MASTER TO master_host="${hcfg.host}", master_port=${hcfg.port}, master_user="${hcfg.user}", master_password="${hcfg.password}", master_ssl=1, master_use_gtid=slave_pos;
START SLAVE;
'';
- }
- {
- dest = "mysql_replication/${name}/mysqldump_remote";
+ })
+ (lib.nameValuePair "mysql_replication/${name}/mysqldump_remote" {
permissions = "0400";
user = "root";
group = "root";
user = ${hcfg.user}
password = ${hcfg.password}
'';
- }
- {
- dest = "mysql_replication/${name}/mysqldump";
+ })
+ (lib.nameValuePair "mysql_replication/${name}/mysqldump" {
permissions = "0400";
user = "root";
group = "root";
user = ${hcfg.dumpUser}
password = ${hcfg.dumpPassword}
'';
- }
- {
- dest = "mysql_replication/${name}/client";
+ })
+ (lib.nameValuePair "mysql_replication/${name}/client" {
permissions = "0400";
user = "mysql";
group = "mysql";
user = ${hcfg.dumpUser}
password = ${hcfg.dumpPassword}
'';
- }
- ]) cfg.hosts);
+ })
+ ]) cfg.hosts));
services.cron = {
enable = true;
};
config = lib.mkIf cfg.enable {
- secrets.keys = [
- {
- dest = "ldap/password";
+ secrets.keys = {
+ "ldap/password" = {
permissions = "0400";
user = "openldap";
group = "openldap";
text = "rootpw ${cfg.rootPw}";
- }
- {
- dest = "ldap/access";
+ };
+ "ldap/access" = {
permissions = "0400";
user = "openldap";
group = "openldap";
text = builtins.readFile cfg.accessFile;
- }
- {
- dest = "ldap";
+ };
+ "ldap" = {
permissions = "0500";
user = "openldap";
group = "openldap";
isDir = true;
- }
- ];
+ };
+ };
users.users.openldap.extraGroups = [ "keys" ];
networking.firewall.allowedTCPPorts = [ 636 389 ];
};
users.groups.openldap.gid = config.ids.gids.openldap;
- secrets.keys = lib.flatten (lib.mapAttrsToList (name: hcfg: [
- {
- dest = "openldap_replication/${name}/replication_config";
+ secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (name: hcfg: [
+ (lib.nameValuePair "openldap_replication/${name}/replication_config" {
user = "openldap";
group = "openldap";
permissions = "0400";
binddn="${hcfg.dn}"
credentials="${hcfg.password}"
'';
- }
- {
- dest = "openldap_replication/${name}/replication_password";
+ })
+ (lib.nameValuePair "openldap_replication/${name}/replication_password" {
user = "openldap";
group = "openldap";
permissions = "0400";
text = hcfg.password;
- }
- ]) cfg.hosts);
+ })
+ ]) cfg.hosts));
services.cron = {
enable = true;
'';
};
- secrets.keys = [
- {
- dest = "postgresql/pam";
+ secrets.keys = {
+ "postgresql/pam" = {
permissions = "0400";
group = "postgres";
user = "postgres";
pam_filter ${filter}
ssl start_tls
'';
- }
- {
- dest = "postgresql/pam_replication";
+ };
+ "postgresql/pam_replication" = {
permissions = "0400";
group = "postgres";
user = "postgres";
pam_login_attribute cn
ssl start_tls
'';
- }
- ];
+ };
+ };
security.pam.services = let
pam_ldap = "${pkgs.pam_ldap}/lib/security/pam_ldap.so";
users.groups.postgres.gid = config.ids.gids.postgres;
environment.systemPackages = [ cfg.mainPackage ];
- secrets.keys = lib.flatten (lib.mapAttrsToList (name: hcfg: [
- {
- dest = "postgresql_replication/${name}/recovery.conf";
+ secrets.keys = lib.listToAttrs (lib.flatten (lib.mapAttrsToList (name: hcfg: [
+ (lib.nameValuePair "postgresql_replication/${name}/recovery.conf" {
user = "postgres";
group = "postgres";
permissions = "0400";
primary_conninfo = '${hcfg.connection}?sslmode=require'
primary_slot_name = '${hcfg.slot}'
'';
- }
- {
- dest = "postgresql_replication/${name}/connection_string";
+ })
+ (lib.nameValuePair "postgresql_replication/${name}/connection_string" {
user = "postgres";
group = "postgres";
permissions = "0400";
text = hcfg.connection;
- }
- {
- dest = "postgresql_replication/${name}/postgresql.conf";
+ })
+ (lib.nameValuePair "postgresql_replication/${name}/postgresql.conf" {
user = "postgres";
group = "postgres";
permissions = "0400";
data_directory = '${dataDir}'
wal_level = logical
'';
- }
- ]) cfg.hosts);
+ })
+ ]) cfg.hosts));
services.cron = {
enable = true;
};
networking.firewall.allowedTCPPorts = [ 7617 16379 ];
- secrets.keys = [
- {
- dest = "redis/predixy.conf";
+ secrets.keys = {
+ "redis/predixy.conf" = {
user = "redis";
group = "redis";
permissions = "0400";
}
}
'';
- }
- {
- dest = "redis/spiped_keyfile";
+ };
+ "redis/spiped_keyfile" = {
user = "spiped";
group = "spiped";
permissions = "0400";
text = config.myEnv.databases.redis.spiped_key;
- }
- ];
+ };
+ };
systemd.slices.redis = {
description = "Redis slice";
};
};
- secrets.keys = lib.flatten (lib.mapAttrsToList (name: hcfg: [
- {
- dest = "redis_replication/${name}/config";
+ secrets.keys = lib.mapAttrs' (name: hcfg:
+ lib.nameValuePair "redis_replication/${name}/config" {
user = "redis";
group = "redis";
permissions = "0400";
maxclients 1024
'';
}
- ]) cfg.hosts) ++ [
- { # For eldiron only
- dest = "redis/spiped_eldiron_keyfile";
+ ) cfg.hosts // {
+ "redis/spiped_eldiron_keyfile" = { # For eldiron only
user = "spiped";
group = "spiped";
permissions = "0400";
text = config.myEnv.databases.redis.spiped_key;
- }
- ];
+ };
+ };
services.cron = {
enable = true;
networking.firewall.allowedUDPPorts = [ 53 ];
networking.firewall.allowedTCPPorts = [ 53 ];
users.users.named.extraGroups = [ "keys" ];
- secrets.keys = lib.mapAttrsToList (k: v:
- {
- dest = "bind/${k}.key";
+ secrets.keys = lib.mapAttrs' (k: v:
+ lib.nameValuePair "bind/${k}.key" {
permissions = "0400";
user = "named";
text = ''
systemd.services.ejabberd.postStop = ''
rm /var/log/ejabberd/erl_crash*.dump
'';
- secrets.keys = [
- {
- dest = "ejabberd/psql.yml";
+ secrets.keys = {
+ "ejabberd/psql.yml" = {
permissions = "0400";
user = "ejabberd";
group = "ejabberd";
sql_username: "${config.myEnv.jabber.postgresql.user}"
sql_password: "${config.myEnv.jabber.postgresql.password}"
'';
- }
- {
- dest = "ejabberd/host.yml";
+ };
+ "ejabberd/host.yml" = {
permissions = "0400";
user = "ejabberd";
group = "ejabberd";
immaeXmppUid: "%u"
ldap_filter: "${config.myEnv.jabber.ldap.filter}"
'';
- }
- ];
+ };
+ };
users.users.ejabberd.extraGroups = [ "keys" ];
services.ejabberd = {
package = pkgs.ejabberd.override { withPgsql = true; };
install -m 0755 -o ftp -g ftp -d /var/lib/ftp
'';
- secrets.keys = [{
- dest = "pure-ftpd-ldap";
+ secrets.keys."pure-ftpd-ldap" = {
permissions = "0400";
user = "ftp";
group = "ftp";
# Compile dans pure-ftpd directement avec immaeFtpUid / immaeFtpGid
LDAPHomeDir immaeFtpDirectory
'';
- }];
+ };
services.filesWatcher.pure-ftpd = {
restart = true;
};
networking.firewall.allowedTCPPorts = [ 9418 ];
- secrets.keys = [{
- dest = "gitolite/ldap_password";
+ secrets.keys."gitolite/ldap_password" = {
user = "gitolite";
group = "gitolite";
permissions = "0400";
text = config.myEnv.tools.gitolite.ldap.password;
- }];
+ };
services.gitDaemon = {
enable = true;
+ /var/lib/dhparams
+ /var/lib/dovecot
'';
- secrets.keys = [
- {
- dest = "dovecot/ldap";
- user = config.services.dovecot2.user;
- group = config.services.dovecot2.group;
- permissions = "0400";
- text = ''
- hosts = ${config.myEnv.mail.dovecot.ldap.host}
- tls = yes
+ secrets.keys."dovecot/ldap" = {
+ user = config.services.dovecot2.user;
+ group = config.services.dovecot2.group;
+ permissions = "0400";
+ text = ''
+ hosts = ${config.myEnv.mail.dovecot.ldap.host}
+ tls = yes
- dn = ${config.myEnv.mail.dovecot.ldap.dn}
- dnpass = ${config.myEnv.mail.dovecot.ldap.password}
+ dn = ${config.myEnv.mail.dovecot.ldap.dn}
+ dnpass = ${config.myEnv.mail.dovecot.ldap.password}
- auth_bind = yes
+ auth_bind = yes
- ldap_version = 3
+ ldap_version = 3
- base = ${config.myEnv.mail.dovecot.ldap.base}
- scope = subtree
+ base = ${config.myEnv.mail.dovecot.ldap.base}
+ scope = subtree
- pass_filter = ${config.myEnv.mail.dovecot.ldap.filter}
- pass_attrs = ${config.myEnv.mail.dovecot.ldap.pass_attrs}
+ pass_filter = ${config.myEnv.mail.dovecot.ldap.filter}
+ pass_attrs = ${config.myEnv.mail.dovecot.ldap.pass_attrs}
- user_attrs = ${config.myEnv.mail.dovecot.ldap.user_attrs}
- user_filter = ${config.myEnv.mail.dovecot.ldap.filter}
- iterate_attrs = ${config.myEnv.mail.dovecot.ldap.iterate_attrs}
- iterate_filter = ${config.myEnv.mail.dovecot.ldap.iterate_filter}
- '';
- }
- ];
+ user_attrs = ${config.myEnv.mail.dovecot.ldap.user_attrs}
+ user_filter = ${config.myEnv.mail.dovecot.ldap.filter}
+ iterate_attrs = ${config.myEnv.mail.dovecot.ldap.iterate_attrs}
+ iterate_filter = ${config.myEnv.mail.dovecot.ldap.iterate_filter}
+ '';
+ };
users.users.vhost = {
group = "vhost";
'';
};
config = lib.mkIf (config.myServices.mail.enable || config.myServices.mailBackup.enable) {
- secrets.keys = [
- {
- dest = "opendkim";
+ secrets.keys = {
+ "opendkim" = {
isDir = true;
user = config.services.opendkim.user;
group = config.services.opendkim.group;
permissions = "0550";
- }
- {
- dest = "opendkim/eldiron.private";
+ };
+ "opendkim/eldiron.private" = {
user = config.services.opendkim.user;
group = config.services.opendkim.group;
permissions = "0400";
text = config.myEnv.mail.dkim.eldiron.private;
- }
- {
- dest = "opendkim/eldiron.txt";
+ };
+ "opendkim/eldiron.txt" = {
user = config.services.opendkim.user;
group = config.services.opendkim.group;
permissions = "0444";
text = ''
eldiron._domainkey IN TXT ${config.myEnv.mail.dkim.eldiron.public}'';
- }
- ];
+ };
+ };
users.users."${config.services.opendkim.user}".extraGroups = [ "keys" ];
services.opendkim = {
enable = true;
{ lib, pkgs, config, name, ... }:
{
config = lib.mkIf config.myServices.mailRelay.enable {
- secrets.keys = [
- {
- dest = "opensmtpd/creds";
- user = "smtpd";
- group = "smtpd";
- permissions = "0400";
- text = ''
- eldiron ${name}:${config.hostEnv.ldap.password}
- '';
- }
- ];
+ secrets.keys."opensmtpd/creds" = {
+ user = "smtpd";
+ group = "smtpd";
+ permissions = "0400";
+ text = ''
+ eldiron ${name}:${config.hostEnv.ldap.password}
+ '';
+ };
users.users.smtpd.extraGroups = [ "keys" ];
services.opensmtpd = {
enable = true;
services.duplyBackup.profiles.mail.excludeFile = ''
+ /var/lib/postfix
'';
- secrets.keys = [
- {
- dest = "postfix/mysql_alias_maps";
+ secrets.keys = {
+ "postfix/mysql_alias_maps" = {
user = config.services.postfix.user;
group = config.services.postfix.group;
permissions = "0440";
FROM forwardings_blacklisted
WHERE source = '%s'
'';
- }
- {
- dest = "postfix/ldap_mailboxes";
+ };
+ "postfix/ldap_mailboxes" = {
user = config.services.postfix.user;
group = config.services.postfix.group;
permissions = "0440";
result_format = dummy
version = 3
'';
- }
- {
- dest = "postfix/mysql_sender_login_maps";
+ };
+ "postfix/mysql_sender_login_maps" = {
user = config.services.postfix.user;
group = config.services.postfix.group;
permissions = "0440";
AND active = 1
UNION SELECT CONCAT(SUBSTRING_INDEX('%u', '+', 1), '@%d') AS destination
'';
- }
- {
- dest = "postfix/mysql_sender_relays_maps";
+ };
+ "postfix/mysql_sender_relays_maps" = {
user = config.services.postfix.user;
group = config.services.postfix.group;
permissions = "0440";
((regex = 1 AND '%s' REGEXP CONCAT('^',`from`,'$') ) OR (regex = 0 AND `from` = '%s'))
AND active = 1
'';
- }
- {
- dest = "postfix/mysql_sender_relays_hosts";
+ };
+ "postfix/mysql_sender_relays_hosts" = {
user = config.services.postfix.user;
group = config.services.postfix.group;
permissions = "0440";
((regex = 1 AND '%s' REGEXP CONCAT('^',`from`,'$') ) OR (regex = 0 AND `from` = '%s'))
AND active = 1
'';
- }
- {
- dest = "postfix/mysql_sender_relays_creds";
+ };
+ "postfix/mysql_sender_relays_creds" = {
user = config.services.postfix.user;
group = config.services.postfix.group;
permissions = "0440";
((regex = 1 AND '%s' REGEXP CONCAT('^',`from`,'$') ) OR (regex = 0 AND `from` = '%s'))
AND active = 1
'';
- }
- {
- dest = "postfix/ldap_ejabberd_users_immae_fr";
+ };
+ "postfix/ldap_ejabberd_users_immae_fr" = {
user = config.services.postfix.user;
group = config.services.postfix.group;
permissions = "0440";
result_format = ejabberd@localhost
version = 3
'';
- }
- ] ++ (lib.mapAttrsToList (name: v: {
- dest = "postfix/scripts/${name}-env";
+ };
+ } // lib.mapAttrs' (name: v: lib.nameValuePair "postfix/scripts/${name}-env" {
user = "postfixscripts";
group = "root";
permissions = "0400";
text = builtins.toJSON v.env;
- }) config.myEnv.mail.scripts);
+ }) config.myEnv.mail.scripts;
networking.firewall.allowedTCPPorts = [ 25 465 587 ];
mxs = map (zone: "${config.myEnv.servers."${name}".mx.subdomain}.${zone.name}") zonesWithMx;
in builtins.listToAttrs (map (mx: lib.attrsets.nameValuePair mx null) mxs);
};
- secrets.keys = [
- {
- dest = "postfix/mysql_alias_maps";
+ secrets.keys = {
+ "postfix/mysql_alias_maps" = {
user = config.services.postfix.user;
group = config.services.postfix.group;
permissions = "0440";
FROM forwardings_blacklisted
WHERE source = '%s'
'';
- }
- {
- dest = "postfix/ldap_mailboxes";
+ };
+ "postfix/ldap_mailboxes" = {
user = config.services.postfix.user;
group = config.services.postfix.group;
permissions = "0440";
result_format = dummy
version = 3
'';
- }
- {
- dest = "postfix/sympa_mailbox_maps";
+ };
+ "postfix/sympa_mailbox_maps" = {
user = config.services.postfix.user;
group = config.services.postfix.group;
permissions = "0440";
CONCAT('abuse-feedback-report@', robot_list)
)
'';
- }
- {
- dest = "postfix/ldap_ejabberd_users_immae_fr";
+ };
+ "postfix/ldap_ejabberd_users_immae_fr" = {
user = config.services.postfix.user;
group = config.services.postfix.group;
permissions = "0440";
result_format = ejabberd@localhost
version = 3
'';
- }
- ];
+ };
+ };
networking.firewall.allowedTCPPorts = [ 25 ];
];
};
- secrets.keys = [
- {
- dest = "sympa/db_password";
+ secrets.keys = {
+ "sympa/db_password" = {
permissions = "0400";
group = "sympa";
user = "sympa";
text = sympaConfig.postgresql.password;
- }
- ]
- ++ lib.mapAttrsToList (n: v: {
- dest = "sympa/data_sources/${n}.incl"; permissions = "0400"; group = "sympa"; user = "sympa"; text = v;
+ };
+ }
+ // lib.mapAttrs' (n: v: lib.nameValuePair "sympa/data_sources/${n}.incl" {
+ permissions = "0400"; group = "sympa"; user = "sympa"; text = v;
}) sympaConfig.data_sources
- ++ lib.mapAttrsToList (n: v: {
- dest = "sympa/scenari/${n}"; permissions = "0400"; group = "sympa"; user = "sympa"; text = v;
+ // lib.mapAttrs' (n: v: lib.nameValuePair "sympa/scenari/${n}" {
+ permissions = "0400"; group = "sympa"; user = "sympa"; text = v;
}) sympaConfig.scenari;
users.users.sympa.extraGroups = [ "keys" ];
systemd.slices.mail-sympa = {
text = "MAILADDR ${config.myEnv.monitoring.email}";
};
- secrets.keys = [
- {
- dest = "naemon/id_rsa";
+ secrets.keys = {
+ "naemon/id_rsa" = {
user = "naemon";
group = "naemon";
permissions = "0400";
text = config.myEnv.monitoring.ssh_secret_key;
- }
- ] ++ lib.optionals cfg.master (
- lib.mapAttrsToList (k: v:
- {
- dest = "${k}_access_key";
+ };
+ } // lib.optionalAttrs cfg.master (
+ lib.mapAttrs' (k: v: lib.nameValuePair "${k}_access_key" {
user = "naemon";
group = "naemon";
permissions = "0400";
};
};
config = lib.mkIf config.myServices.status.enable {
- secrets.keys = [
- {
- dest = "naemon-status/environment";
- user = "naemon";
- group = "naemon";
- permission = "0400";
- text = ''
- TOKENS=${builtins.concatStringsSep " " config.myEnv.monitoring.nrdp_tokens}
- '';
- }
- ];
+ secrets.keys."naemon-status/environment" = {
+ user = "naemon";
+ group = "naemon";
+ permissions = "0400";
+ text = ''
+ TOKENS=${builtins.concatStringsSep " " config.myEnv.monitoring.nrdp_tokens}
+ '';
+ };
services.nginx = {
enable = true;
recommendedOptimisation = true;
};
};
- secrets.keys = [{
- dest = "status_engine";
+ secrets.keys."status_engine" = {
permissions = "0400";
user = "naemon";
group = "naemon";
disable_http_proxy: 1
'';
- }];
+ };
services.redis = rec {
enable = true;
services.duplyBackup.profiles.mpd = {
rootDir = "/var/lib/mpd";
};
- secrets.keys = [
- {
- dest = "mpd";
+ secrets.keys = {
+ "mpd" = {
permissions = "0400";
text = config.myEnv.mpd.password;
- }
- {
- dest = "mpd-config";
+ };
+ "mpd-config" = {
permissions = "0400";
user = "mpd";
group = "mpd";
text = ''
password "${config.myEnv.mpd.password}@read,add,control,admin"
'';
- }
- ];
+ };
+ };
networking.firewall.allowedTCPPorts = [ 6600 ];
users.users.mpd.extraGroups = [ "wwwrun" "keys" ];
systemd.services.mpd.serviceConfig.RuntimeDirectory = "mpd";
AuthorizedKeysCommandUser nobody
'';
- secrets.keys = [{
- dest = "ssh-ldap";
+ secrets.keys."ssh-ldap" = {
user = "nobody";
group = "nogroup";
permissions = "0400";
text = config.myEnv.sshd.ldap.password;
- }];
+ };
system.activationScripts.sshd = {
deps = [ "secrets" ];
text = ''
};
# ssh-keyscan backup-2 | nix-shell -p ssh-to-age --run ssh-to-age
secrets.ageKeys = [ "age1kk3nr27qu42j28mcfdag5lhq0zu2pky7gfanvne8l4z2ctevjpgskmw0sr" ];
- secrets.keys = [
- {
- dest = "rsync_backup/identity";
+ secrets.keys = {
+ "rsync_backup/identity" = {
user = "backup";
group = "backup";
permissions = "0400";
text = config.myEnv.rsync_backup.ssh_key.private;
- }
- {
- dest = "rsync_backup/identity.pub";
+ };
+ "rsync_backup/identity.pub" = {
user = "backup";
group = "backup";
permissions = "0444";
text = config.myEnv.rsync_backup.ssh_key.public;
- }
- ];
+ };
+ };
boot.kernelPackages = pkgs.linuxPackages_latest;
myEnv = import ../../../nixops/secrets/environment.nix;
services.netdata.config.web.mode = "none";
users.users."${config.services.netdata.user}".extraGroups = [ "keys" ];
environment.etc."netdata/stream.conf".source = config.secrets.fullPaths."netdata-stream.conf";
- secrets.keys = [
- {
- dest = "netdata-stream.conf";
+ secrets.keys = {
+ "netdata-stream.conf" = {
user = config.services.netdata.user;
group = config.services.netdata.group;
permissions = "0400";
destination = ${config.myEnv.monitoring.netdata_aggregator}
api key = ${config.myEnv.monitoring.netdata_keys.eldiron}
'';
- }
- {
- dest = "zrepl_backup/identity";
+ };
+ "zrepl_backup/identity" = {
user = "root";
group = "root";
permissions = "0400";
text = config.myEnv.zrepl_backup.ssh_key.private;
- }
- ];
+ };
+ };
programs.ssh.knownHosts.dilion = {
hostNames = ["dilion.immae.eu"];
publicKey = let
networking.firewall.allowedTCPPorts = [ 19999 ];
environment.etc."netdata/stream.conf".source = config.secrets.fullPaths."netdata-stream.conf";
- secrets.keys = [
- {
- dest = "netdata-stream.conf";
+ secrets.keys = {
+ "netdata-stream.conf" = {
user = config.services.netdata.user;
group = config.services.netdata.group;
permissions = "0400";
default memory = ram
health enabled by default = auto
'') config.myEnv.monitoring.netdata_keys);
- }
- ];
+ };
+ };
users.users."${config.services.netdata.user}".extraGroups = [ "keys" ];
# This value determines the NixOS release with which your system is
# to be compatible, in order to avoid breaking some software such as
'';
};
- secrets.keys = [
- {
- dest = "ldap/sync_password";
+ secrets.keys = {
+ "ldap/sync_password" = {
permissions = "0400";
text = serverSpecificConfig.ldap_sync_password;
- }
- {
- dest = "ldap/ldaptree.ldif";
+ };
+ "ldap/ldaptree.ldif" = {
permissions = "0400";
text = serverSpecificConfig.ldap_service_users
+ (builtins.concatStringsSep "\n" (lib.mapAttrsToList (n: v: ''
sn: ${n}
uid: ${n}
'') normalUsers));
- }
- ];
+ };
+ };
myServices.monitoring.enable = true;
myServices.certificates.enable = true;
services.postgresql.ensureUsers = [
{ name = "naemon"; }
];
- secrets.keys = [
- {
- dest = "ldap/password";
+ secrets.keys = {
+ "ldap/password" = {
permissions = "0400";
user = "openldap";
group = "openldap";
text = "rootpw ${serverSpecificConfig.ldap_root_pw}";
- }
- {
- dest = "webapps/tools-ldap";
+ };
+ "webapps/tools-ldap" = {
user = "wwwrun";
group = "wwwrun";
permissions = "0400";
$servers->setValue('login','attr','uid');
$servers->setValue('login','fallback_dn',true);
'';
- }
- ];
+ };
+ };
users.users.openldap.extraGroups = [ "keys" ];
services.openldap = {
'';
};
- secrets.keys = [
- {
- dest = "webapps/tools-taskwarrior-web";
+ secrets.keys = {
+ "webapps/tools-taskwarrior-web" = {
user = "wwwrun";
group = "wwwrun";
permissions = "0400";
SetEnv TASKD_LDAP_BASE "${env.ldap.base}"
SetEnv TASKD_LDAP_FILTER "${env.ldap.filter}"
'';
- }
- ] ++ (lib.mapAttrsToList (name: userConfig: {
- dest = "webapps/tools-taskwarrior/${name}-taskrc";
+ };
+ } // (lib.mapAttrs' (name: userConfig: lib.nameValuePair "webapps/tools-taskwarrior/${name}-taskrc" {
inherit user group;
permissions = "0400";
text = let
};
config = lib.mkIf cfg.enable {
- secrets.keys = [
- {
- dest = "tinc/key.priv";
+ secrets.keys = {
+ "tinc/key.priv" = {
user = "root";
group = "root";
permissions = "0400";
text = config.myEnv.vpn.eldiron.privateKey;
- }
- {
- dest = "tinc/key.pub";
+ };
+ "tinc/key.pub" = {
user = "root";
group = "root";
permissions = "0400";
text = config.myEnv.vpn.eldiron.publicKey;
- }
- ];
+ };
+ };
networking.firewall.allowedTCPPorts = [ 655 1194 ];
system.activationScripts.tinc = let
configFiles = pkgs.runCommand "tinc-files" {
config = lib.mkIf cfg.enable {
services.duplyBackup.profiles.chloe_integration.rootDir = app.varDir;
- secrets.keys = [
- {
- dest = "websites/chloe/integration";
- user = apacheUser;
- group = apacheGroup;
- permissions = "0400";
- text = ''
- SetEnv SPIP_CONFIG_DIR "${./config}"
- SetEnv SPIP_VAR_DIR "${app.varDir}"
- SetEnv SPIP_SITE "chloe-${app.environment}"
- SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu"
- SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu"
- SetEnv SPIP_LDAP_SEARCH_DN "${ccfg.ldap.dn}"
- SetEnv SPIP_LDAP_SEARCH_PW "${ccfg.ldap.password}"
- SetEnv SPIP_LDAP_SEARCH "${ccfg.ldap.filter}"
- SetEnv SPIP_MYSQL_HOST "${ccfg.mysql.host}"
- SetEnv SPIP_MYSQL_PORT "${ccfg.mysql.port}"
- SetEnv SPIP_MYSQL_DB "${ccfg.mysql.database}"
- SetEnv SPIP_MYSQL_USER "${ccfg.mysql.user}"
- SetEnv SPIP_MYSQL_PASSWORD "${ccfg.mysql.password}"
- '';
- }
- ];
+ secrets.keys."websites/chloe/integration" = {
+ user = apacheUser;
+ group = apacheGroup;
+ permissions = "0400";
+ text = ''
+ SetEnv SPIP_CONFIG_DIR "${./config}"
+ SetEnv SPIP_VAR_DIR "${app.varDir}"
+ SetEnv SPIP_SITE "chloe-${app.environment}"
+ SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu"
+ SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu"
+ SetEnv SPIP_LDAP_SEARCH_DN "${ccfg.ldap.dn}"
+ SetEnv SPIP_LDAP_SEARCH_PW "${ccfg.ldap.password}"
+ SetEnv SPIP_LDAP_SEARCH "${ccfg.ldap.filter}"
+ SetEnv SPIP_MYSQL_HOST "${ccfg.mysql.host}"
+ SetEnv SPIP_MYSQL_PORT "${ccfg.mysql.port}"
+ SetEnv SPIP_MYSQL_DB "${ccfg.mysql.database}"
+ SetEnv SPIP_MYSQL_USER "${ccfg.mysql.user}"
+ SetEnv SPIP_MYSQL_PASSWORD "${ccfg.mysql.password}"
+ '';
+ };
systemd.services.phpfpm-chloe_integration.after = lib.mkAfter [ "mysql.service" ];
systemd.services.phpfpm-chloe_integration.wants = [ "mysql.service" ];
services.phpfpm.pools.chloe_integration = {
config = lib.mkIf cfg.enable {
services.duplyBackup.profiles.chloe_production.rootDir = app.varDir;
services.duplyBackup.profiles.chloe_production.remotes = ["eriomem" "ovh"];
- secrets.keys = [
- {
- dest = "websites/chloe/production";
- user = apacheUser;
- group = apacheGroup;
- permissions = "0400";
- text = ''
- SetEnv SPIP_CONFIG_DIR "${./config}"
- SetEnv SPIP_VAR_DIR "${app.varDir}"
- SetEnv SPIP_SITE "chloe-${app.environment}"
- SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu"
- SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu"
- SetEnv SPIP_LDAP_SEARCH_DN "${ccfg.ldap.dn}"
- SetEnv SPIP_LDAP_SEARCH_PW "${ccfg.ldap.password}"
- SetEnv SPIP_LDAP_SEARCH "${ccfg.ldap.filter}"
- SetEnv SPIP_MYSQL_HOST "${ccfg.mysql.host}"
- SetEnv SPIP_MYSQL_PORT "${ccfg.mysql.port}"
- SetEnv SPIP_MYSQL_DB "${ccfg.mysql.database}"
- SetEnv SPIP_MYSQL_USER "${ccfg.mysql.user}"
- SetEnv SPIP_MYSQL_PASSWORD "${ccfg.mysql.password}"
- '';
- }
- ];
+ secrets.keys."websites/chloe/production" = {
+ user = apacheUser;
+ group = apacheGroup;
+ permissions = "0400";
+ text = ''
+ SetEnv SPIP_CONFIG_DIR "${./config}"
+ SetEnv SPIP_VAR_DIR "${app.varDir}"
+ SetEnv SPIP_SITE "chloe-${app.environment}"
+ SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu"
+ SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu"
+ SetEnv SPIP_LDAP_SEARCH_DN "${ccfg.ldap.dn}"
+ SetEnv SPIP_LDAP_SEARCH_PW "${ccfg.ldap.password}"
+ SetEnv SPIP_LDAP_SEARCH "${ccfg.ldap.filter}"
+ SetEnv SPIP_MYSQL_HOST "${ccfg.mysql.host}"
+ SetEnv SPIP_MYSQL_PORT "${ccfg.mysql.port}"
+ SetEnv SPIP_MYSQL_DB "${ccfg.mysql.database}"
+ SetEnv SPIP_MYSQL_USER "${ccfg.mysql.user}"
+ SetEnv SPIP_MYSQL_PASSWORD "${ccfg.mysql.password}"
+ '';
+ };
services.webstats.sites = [ { name = "osteopathe-cc.fr"; } ];
systemd.services.phpfpm-chloe_production.after = lib.mkAfter [ "mysql.service" ];
phpPackage = pkgs.php72;
};
- secrets.keys = [
- {
- dest = "websites/connexionswing/integration";
- user = config.services.httpd.Inte.user;
- group = config.services.httpd.Inte.group;
- permissions = "0400";
- text = ''
- # This file is auto-generated during the composer install
- parameters:
- database_host: ${secrets.mysql.host}
- database_port: ${secrets.mysql.port}
- database_name: ${secrets.mysql.database}
- database_user: ${secrets.mysql.user}
- database_password: ${secrets.mysql.password}
- database_server_version: ${pkgs.mariadb.mysqlVersion}
- mailer_transport: sendmail
- mailer_host: null
- mailer_user: null
- mailer_password: null
- subscription_email: ${secrets.email}
- allow_robots: true
- secret: ${secrets.secret}
- '';
- }
- ];
+ secrets.keys."websites/connexionswing/integration" = {
+ user = config.services.httpd.Inte.user;
+ group = config.services.httpd.Inte.group;
+ permissions = "0400";
+ text = ''
+ # This file is auto-generated during the composer install
+ parameters:
+ database_host: ${secrets.mysql.host}
+ database_port: ${secrets.mysql.port}
+ database_name: ${secrets.mysql.database}
+ database_user: ${secrets.mysql.user}
+ database_password: ${secrets.mysql.password}
+ database_server_version: ${pkgs.mariadb.mysqlVersion}
+ mailer_transport: sendmail
+ mailer_host: null
+ mailer_user: null
+ mailer_password: null
+ subscription_email: ${secrets.email}
+ allow_robots: true
+ secret: ${secrets.secret}
+ '';
+ };
services.websites.env.integration.vhostConfs.connexionswing_integration = {
certName = "integration";
phpPackage = pkgs.php72;
};
- secrets.keys = [
- {
- dest = "websites/connexionswing/production";
- user = config.services.httpd.Prod.user;
- group = config.services.httpd.Prod.group;
- permissions = "0400";
- text = ''
- # This file is auto-generated during the composer install
- parameters:
- database_host: ${secrets.mysql.host}
- database_port: ${secrets.mysql.port}
- database_name: ${secrets.mysql.database}
- database_user: ${secrets.mysql.user}
- database_password: ${secrets.mysql.password}
- database_server_version: ${pkgs.mariadb.mysqlVersion}
- mailer_transport: sendmail
- mailer_host: null
- mailer_user: null
- mailer_password: null
- subscription_email: ${secrets.email}
- allow_robots: true
- secret: ${secrets.secret}
- services:
- swiftmailer.mailer.default.transport:
- class: Swift_SendmailTransport
- arguments: ['/run/wrappers/bin/sendmail -bs']
- '';
- }
- ];
+ secrets.keys."websites/connexionswing/production" = {
+ user = config.services.httpd.Prod.user;
+ group = config.services.httpd.Prod.group;
+ permissions = "0400";
+ text = ''
+ # This file is auto-generated during the composer install
+ parameters:
+ database_host: ${secrets.mysql.host}
+ database_port: ${secrets.mysql.port}
+ database_name: ${secrets.mysql.database}
+ database_user: ${secrets.mysql.user}
+ database_password: ${secrets.mysql.password}
+ database_server_version: ${pkgs.mariadb.mysqlVersion}
+ mailer_transport: sendmail
+ mailer_host: null
+ mailer_user: null
+ mailer_password: null
+ subscription_email: ${secrets.email}
+ allow_robots: true
+ secret: ${secrets.secret}
+ services:
+ swiftmailer.mailer.default.transport:
+ class: Swift_SendmailTransport
+ arguments: ['/run/wrappers/bin/sendmail -bs']
+ '';
+ };
services.websites.env.production.vhostConfs.connexionswing_production = {
certName = "connexionswing";
users.users.wwwrun.extraGroups = [ "keys" ];
networking.firewall.allowedTCPPorts = [ 80 443 ];
- secrets.keys = [{
- dest = "apache-ldap";
+ secrets.keys."apache-ldap" = {
user = "wwwrun";
group = "wwwrun";
permissions = "0400";
</IfModule>
</Macro>
'';
- }];
+ };
system.activationScripts = {
httpd = ''
phpPackage = pkgs.php72;
};
- secrets.keys = [
- {
- dest = "websites/florian/app_passwords";
+ secrets.keys = {
+ "websites/florian/app_passwords" = {
user = config.services.httpd.Inte.user;
group = config.services.httpd.Inte.group;
permissions = "0400";
text = ''
invite:${secrets.invite_passwords}
'';
- }
- {
- dest = "websites/florian/app";
+ };
+ "websites/florian/app" = {
user = config.services.httpd.Inte.user;
group = config.services.httpd.Inte.group;
permissions = "0400";
mailer_password: null
secret: ${secrets.secret}
'';
- }
- ];
+ };
+ };
services.websites.env.integration.modules = adminer.apache.modules;
services.websites.env.integration.vhostConfs.florian_app = {
'' ];
};
- secrets.keys = [
- {
- dest = "webapps/surfer";
- permissions = "0400";
- user = "wwwrun";
- group = "wwwrun";
- text = ''
- CLOUDRON_LDAP_URL=ldaps://${env.ldap.host}
- CLOUDRON_LDAP_USERS_BASE_DN=${env.ldap.base}
- TOKENSTORE_FILE=/var/lib/surfer/tokens.json
- CLOUDRON_LDAP_BIND_DN=${env.ldap.dn}
- CLOUDRON_LDAP_BIND_PASSWORD=${env.ldap.password}
- CLOUDRON_LDAP_USERS_BASE_DN=${env.ldap.base}
- CLOUDRON_LDAP_FILTER="${env.ldap.filter}"
- LISTEN=/run/surfer/listen.sock
- '';
- }
- ];
+ secrets.keys."webapps/surfer" = {
+ permissions = "0400";
+ user = "wwwrun";
+ group = "wwwrun";
+ text = ''
+ CLOUDRON_LDAP_URL=ldaps://${env.ldap.host}
+ CLOUDRON_LDAP_USERS_BASE_DN=${env.ldap.base}
+ TOKENSTORE_FILE=/var/lib/surfer/tokens.json
+ CLOUDRON_LDAP_BIND_DN=${env.ldap.dn}
+ CLOUDRON_LDAP_BIND_PASSWORD=${env.ldap.password}
+ CLOUDRON_LDAP_USERS_BASE_DN=${env.ldap.base}
+ CLOUDRON_LDAP_FILTER="${env.ldap.filter}"
+ LISTEN=/run/surfer/listen.sock
+ '';
+ };
systemd.services.surfer = {
description = "Surfer";
phpPackage = pkgs.php72;
};
- secrets.keys = [{
- dest = "websites/isabelle/aten_integration";
+ secrets.keys."websites/isabelle/aten_integration" = {
user = config.services.httpd.Inte.user;
group = config.services.httpd.Inte.group;
permissions = "0400";
SetEnv APP_SECRET "${secrets.secret}"
SetEnv DATABASE_URL "${psql_url}"
'';
- }];
+ };
services.websites.env.integration.vhostConfs.isabelle_aten_integration = {
certName = "integration";
addToCerts = true;
phpPackage = pkgs.php72;
};
- secrets.keys = [{
- dest = "websites/isabelle/aten_production";
+ secrets.keys."websites/isabelle/aten_production" = {
user = config.services.httpd.Prod.user;
group = config.services.httpd.Prod.group;
permissions = "0400";
SetEnv APP_SECRET "${secrets.secret}"
SetEnv DATABASE_URL "${psql_url}"
'';
- }];
+ };
services.websites.env.production.vhostConfs.isabelle_aten_production = {
certName = "isabelle";
certMainHost = "aten.pro";
config = lib.mkIf cfg.enable {
services.duplyBackup.profiles.isabelle_iridologie.rootDir = app.varDir;
services.duplyBackup.profiles.isabelle_iridologie.remotes = ["eriomem" "ovh"];
- secrets.keys = [
- {
- dest = "websites/isabelle/iridologie";
- user = apacheUser;
- group = apacheGroup;
- permissions = "0400";
- text = ''
- SetEnv SPIP_CONFIG_DIR "${./config}"
- SetEnv SPIP_VAR_DIR "${app.varDir}"
- SetEnv SPIP_SITE "iridologie-${app.environment}"
- SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu"
- SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu"
- SetEnv SPIP_LDAP_SEARCH_DN "${icfg.ldap.dn}"
- SetEnv SPIP_LDAP_SEARCH_PW "${icfg.ldap.password}"
- SetEnv SPIP_LDAP_SEARCH "${icfg.ldap.filter}"
- SetEnv SPIP_MYSQL_HOST "${icfg.mysql.host}"
- SetEnv SPIP_MYSQL_PORT "${icfg.mysql.port}"
- SetEnv SPIP_MYSQL_DB "${icfg.mysql.database}"
- SetEnv SPIP_MYSQL_USER "${icfg.mysql.user}"
- SetEnv SPIP_MYSQL_PASSWORD "${icfg.mysql.password}"
- '';
- }
- ];
+ secrets.keys."websites/isabelle/iridologie" = {
+ user = apacheUser;
+ group = apacheGroup;
+ permissions = "0400";
+ text = ''
+ SetEnv SPIP_CONFIG_DIR "${./config}"
+ SetEnv SPIP_VAR_DIR "${app.varDir}"
+ SetEnv SPIP_SITE "iridologie-${app.environment}"
+ SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu"
+ SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu"
+ SetEnv SPIP_LDAP_SEARCH_DN "${icfg.ldap.dn}"
+ SetEnv SPIP_LDAP_SEARCH_PW "${icfg.ldap.password}"
+ SetEnv SPIP_LDAP_SEARCH "${icfg.ldap.filter}"
+ SetEnv SPIP_MYSQL_HOST "${icfg.mysql.host}"
+ SetEnv SPIP_MYSQL_PORT "${icfg.mysql.port}"
+ SetEnv SPIP_MYSQL_DB "${icfg.mysql.database}"
+ SetEnv SPIP_MYSQL_USER "${icfg.mysql.user}"
+ SetEnv SPIP_MYSQL_PASSWORD "${icfg.mysql.password}"
+ '';
+ };
services.webstats.sites = [ { name = "iridologie.icommandeur.org"; } ];
systemd.services.phpfpm-isabelle_iridologie.after = lib.mkAfter [ "mysql.service" ];
security.acme.certs."ftp".extraDomains."naturaloutil.immae.eu" = null;
- secrets.keys = [{
- dest = "websites/jerome/naturaloutil";
+ secrets.keys."websites/jerome/naturaloutil" = {
user = apacheUser;
group = apacheGroup;
permissions = "0400";
$database = connect_db($db, $mysql_server, $mysql_base, $mysql_user, $mysql_password);
?>
'';
- }];
+ };
system.activationScripts.jerome_naturaloutil = {
deps = [ "httpd" ];
text = ''
phpPackage = pkgs.php72;
};
- secrets.keys = [
- {
- dest = "websites/ludivine/integration";
- user = config.services.httpd.Inte.user;
- group = config.services.httpd.Inte.group;
- permissions = "0400";
- text = ''
- # This file is auto-generated during the composer install
- parameters:
- database_host: ${secrets.mysql.host}
- database_port: ${secrets.mysql.port}
- database_name: ${secrets.mysql.database}
- database_user: ${secrets.mysql.user}
- database_password: ${secrets.mysql.password}
- database_server_version: ${pkgs.mariadb.mysqlVersion}
- mailer_transport: smtp
- mailer_host: 127.0.0.1
- mailer_user: null
- mailer_password: null
- secret: ${secrets.secret}
- ldap_host: ldap.immae.eu
- ldap_port: 636
- ldap_version: 3
- ldap_ssl: true
- ldap_tls: false
- ldap_user_bind: 'uid={username},ou=users,dc=immae,dc=eu'
- ldap_base_dn: 'dc=immae,dc=eu'
- ldap_search_dn: '${secrets.ldap.dn}'
- ldap_search_password: '${secrets.ldap.password}'
- ldap_search_filter: '${secrets.ldap.filter}'
- leapt_im:
- binary_path: ${pkgs.imagemagick}/bin
- assetic:
- sass: ${pkgs.sass}/bin/sass
- ruby: ${pkgs.ruby}/bin/ruby
- '';
- }
- ];
+ secrets.keys."websites/ludivine/integration" = {
+ user = config.services.httpd.Inte.user;
+ group = config.services.httpd.Inte.group;
+ permissions = "0400";
+ text = ''
+ # This file is auto-generated during the composer install
+ parameters:
+ database_host: ${secrets.mysql.host}
+ database_port: ${secrets.mysql.port}
+ database_name: ${secrets.mysql.database}
+ database_user: ${secrets.mysql.user}
+ database_password: ${secrets.mysql.password}
+ database_server_version: ${pkgs.mariadb.mysqlVersion}
+ mailer_transport: smtp
+ mailer_host: 127.0.0.1
+ mailer_user: null
+ mailer_password: null
+ secret: ${secrets.secret}
+ ldap_host: ldap.immae.eu
+ ldap_port: 636
+ ldap_version: 3
+ ldap_ssl: true
+ ldap_tls: false
+ ldap_user_bind: 'uid={username},ou=users,dc=immae,dc=eu'
+ ldap_base_dn: 'dc=immae,dc=eu'
+ ldap_search_dn: '${secrets.ldap.dn}'
+ ldap_search_password: '${secrets.ldap.password}'
+ ldap_search_filter: '${secrets.ldap.filter}'
+ leapt_im:
+ binary_path: ${pkgs.imagemagick}/bin
+ assetic:
+ sass: ${pkgs.sass}/bin/sass
+ ruby: ${pkgs.ruby}/bin/ruby
+ '';
+ };
services.websites.env.integration.vhostConfs.ludivine_integration = {
certName = "integration";
phpPackage = pkgs.php72;
};
- secrets.keys = [
- {
- dest = "websites/ludivine/production";
- user = config.services.httpd.Prod.user;
- group = config.services.httpd.Prod.group;
- permissions = "0400";
- text = ''
- # This file is auto-generated during the composer install
- parameters:
- database_host: ${secrets.mysql.host}
- database_port: ${secrets.mysql.port}
- database_name: ${secrets.mysql.database}
- database_user: ${secrets.mysql.user}
- database_password: ${secrets.mysql.password}
- database_server_version: ${pkgs.mariadb.mysqlVersion}
- mailer_transport: smtp
- mailer_host: 127.0.0.1
- mailer_user: null
- mailer_password: null
- secret: ${secrets.secret}
- ldap_host: ldap.immae.eu
- ldap_port: 636
- ldap_version: 3
- ldap_ssl: true
- ldap_tls: false
- ldap_user_bind: 'uid={username},ou=users,dc=immae,dc=eu'
- ldap_base_dn: 'dc=immae,dc=eu'
- ldap_search_dn: '${secrets.ldap.dn}'
- ldap_search_password: '${secrets.ldap.password}'
- ldap_search_filter: '${secrets.ldap.filter}'
- leapt_im:
- binary_path: ${pkgs.imagemagick}/bin
- assetic:
- sass: ${pkgs.sass}/bin/sass
- ruby: ${pkgs.ruby}/bin/ruby
- '';
- }
- ];
+ secrets.keys."websites/ludivine/production" = {
+ user = config.services.httpd.Prod.user;
+ group = config.services.httpd.Prod.group;
+ permissions = "0400";
+ text = ''
+ # This file is auto-generated during the composer install
+ parameters:
+ database_host: ${secrets.mysql.host}
+ database_port: ${secrets.mysql.port}
+ database_name: ${secrets.mysql.database}
+ database_user: ${secrets.mysql.user}
+ database_password: ${secrets.mysql.password}
+ database_server_version: ${pkgs.mariadb.mysqlVersion}
+ mailer_transport: smtp
+ mailer_host: 127.0.0.1
+ mailer_user: null
+ mailer_password: null
+ secret: ${secrets.secret}
+ ldap_host: ldap.immae.eu
+ ldap_port: 636
+ ldap_version: 3
+ ldap_ssl: true
+ ldap_tls: false
+ ldap_user_bind: 'uid={username},ou=users,dc=immae,dc=eu'
+ ldap_base_dn: 'dc=immae,dc=eu'
+ ldap_search_dn: '${secrets.ldap.dn}'
+ ldap_search_password: '${secrets.ldap.password}'
+ ldap_search_filter: '${secrets.ldap.filter}'
+ leapt_im:
+ binary_path: ${pkgs.imagemagick}/bin
+ assetic:
+ sass: ${pkgs.sass}/bin/sass
+ ruby: ${pkgs.ruby}/bin/ruby
+ '';
+ };
services.websites.env.production.vhostConfs.ludivine_production = {
certName = "ludivine";
phpPackage = pkgs.php72;
};
- secrets.keys = [
- {
- dest = "websites/piedsjaloux/integration";
- user = config.services.httpd.Inte.user;
- group = config.services.httpd.Inte.group;
- permissions = "0400";
- text = ''
- # This file is auto-generated during the composer install
- parameters:
- database_host: ${secrets.mysql.host}
- database_port: ${secrets.mysql.port}
- database_name: ${secrets.mysql.database}
- database_user: ${secrets.mysql.user}
- database_password: ${secrets.mysql.password}
- database_server_version: ${pkgs.mariadb.mysqlVersion}
- mailer_transport: smtp
- mailer_host: 127.0.0.1
- mailer_user: null
- mailer_password: null
- secret: ${secrets.secret}
- pdflatex: "${texlive}/bin/pdflatex"
- leapt_im:
- binary_path: ${pkgs.imagemagick}/bin
- '';
- }
- ];
+ secrets.keys."websites/piedsjaloux/integration" = {
+ user = config.services.httpd.Inte.user;
+ group = config.services.httpd.Inte.group;
+ permissions = "0400";
+ text = ''
+ # This file is auto-generated during the composer install
+ parameters:
+ database_host: ${secrets.mysql.host}
+ database_port: ${secrets.mysql.port}
+ database_name: ${secrets.mysql.database}
+ database_user: ${secrets.mysql.user}
+ database_password: ${secrets.mysql.password}
+ database_server_version: ${pkgs.mariadb.mysqlVersion}
+ mailer_transport: smtp
+ mailer_host: 127.0.0.1
+ mailer_user: null
+ mailer_password: null
+ secret: ${secrets.secret}
+ pdflatex: "${texlive}/bin/pdflatex"
+ leapt_im:
+ binary_path: ${pkgs.imagemagick}/bin
+ '';
+ };
services.websites.env.integration.vhostConfs.piedsjaloux_integration = {
certName = "integration";
phpPackage = pkgs.php72;
};
- secrets.keys = [
- {
- dest = "websites/piedsjaloux/production";
- user = config.services.httpd.Prod.user;
- group = config.services.httpd.Prod.group;
- permissions = "0400";
- text = ''
- # This file is auto-generated during the composer install
- parameters:
- database_host: ${secrets.mysql.host}
- database_port: ${secrets.mysql.port}
- database_name: ${secrets.mysql.database}
- database_user: ${secrets.mysql.user}
- database_password: ${secrets.mysql.password}
- database_server_version: ${pkgs.mariadb.mysqlVersion}
- mailer_transport: smtp
- mailer_host: 127.0.0.1
- mailer_user: null
- mailer_password: null
- secret: ${secrets.secret}
- pdflatex: "${texlive}/bin/pdflatex"
- leapt_im:
- binary_path: ${pkgs.imagemagick}/bin
- '';
- }
- ];
+ secrets.keys."websites/piedsjaloux/production" = {
+ user = config.services.httpd.Prod.user;
+ group = config.services.httpd.Prod.group;
+ permissions = "0400";
+ text = ''
+ # This file is auto-generated during the composer install
+ parameters:
+ database_host: ${secrets.mysql.host}
+ database_port: ${secrets.mysql.port}
+ database_name: ${secrets.mysql.database}
+ database_user: ${secrets.mysql.user}
+ database_password: ${secrets.mysql.password}
+ database_server_version: ${pkgs.mariadb.mysqlVersion}
+ mailer_transport: smtp
+ mailer_host: 127.0.0.1
+ mailer_user: null
+ mailer_password: null
+ secret: ${secrets.secret}
+ pdflatex: "${texlive}/bin/pdflatex"
+ leapt_im:
+ binary_path: ${pkgs.imagemagick}/bin
+ '';
+ };
services.websites.env.production.vhostConfs.piedsjaloux_production = {
certName = "piedsjaloux";
services.duplyBackup.profiles.richie_production.remotes = ["eriomem" "ovh"];
services.webstats.sites = [ { name = "europe-richie.org"; } ];
- secrets.keys = [{
- dest = "websites/richie/production";
+ secrets.keys."websites/richie/production" = {
user = apacheUser;
group = apacheGroup;
permissions = "0400";
$smtp_mailer->Auth('${smtp_mailer.user}', '${smtp_mailer.password}');
?>
'';
- }];
+ };
services.websites.webappDirs.richie_production = richieSrc;
system.activationScripts.richie_production = {
deps = [ "httpd" ];
};
users.groups.peertube.gid = config.ids.gids.peertube;
- secrets.keys = [{
- dest = "websites/syden/peertube";
+ secrets.keys."websites/syden/peertube" = {
user = "peertube";
group = "peertube";
permissions = "0640";
plugins: '${dataDir}/storage/plugins/'
client_overrides: '${dataDir}/storage/client-overrides/'
'';
- }];
+ };
services.filesWatcher.syden_peertube = {
restart = true;
];
};
- secrets.keys = [{
- dest = "webapps/tools-nextcloud";
+ secrets.keys."webapps/tools-nextcloud" = {
user = "wwwrun";
group = "wwwrun";
permissions = "0600";
'has_rebuilt_cache' => true,
);
'';
- }];
+ };
users.users.root.packages = let
occ = pkgs.writeScriptBin "nextcloud-occ" ''
#! ${pkgs.stdenv.shell}
enable = lib.mkEnableOption "Enable commento website";
};
config = lib.mkIf cfg.enable {
- secrets.keys = [
- {
- dest = "commento/env";
- permission = "0400";
+ secrets.keys = {
+ "commento/env" = {
+ permissions = "0400";
text = ''
COMMENTO_ORIGIN=https://commento.immae.eu/
COMMENTO_PORT=${port}
COMMENTO_SMTP_PASSWORD=${env.smtp.password}
COMMENTO_SMTP_FROM_ADDRESS=${env.smtp.email}
'';
- }
- ];
+ };
+ };
services.websites.env.tools.vhostConfs.commento = {
certName = "eldiron";
install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/davical
'';
};
- keys = [{
- dest = "webapps/dav-davical";
+ keys."webapps/dav-davical" = {
user = apache.user;
group = apache.group;
permissions = "0400";
$c->do_not_sync_from_ldap = array('admin' => true);
include('drivers_ldap.php');
'';
- }];
+ };
webapp = davical.override { davical_config = config.secrets.fullPaths."webapps/dav-davical"; };
webRoot = "${webapp}/htdocs";
apache = rec {
};
users.users.diaspora.extraGroups = [ "keys" ];
- secrets.keys = [
- {
- dest = "webapps/diaspora";
+ secrets.keys = {
+ "webapps/diaspora" = {
isDir = true;
user = "diaspora";
group = "diaspora";
permissions = "0500";
- }
- {
- dest = "webapps/diaspora/diaspora.yml";
+ };
+ "webapps/diaspora/diaspora.yml" = {
user = "diaspora";
group = "diaspora";
permissions = "0400";
development:
environment:
'';
- }
- {
- dest = "webapps/diaspora/database.yml";
+ };
+ "webapps/diaspora/database.yml" = {
user = "diaspora";
group = "diaspora";
permissions = "0400";
<<: *combined
database: diaspora_integration2
'';
- }
- {
- dest = "webapps/diaspora/secret_token.rb";
+ };
+ "webapps/diaspora/secret_token.rb" = {
user = "diaspora";
group = "diaspora";
permissions = "0400";
text = ''
Diaspora::Application.config.secret_key_base = '${env.secret_token}'
'';
- }
- ];
+ };
+ };
services.diaspora = {
enable = true;
services.duplyBackup.profiles.etherpad-lite = {
rootDir = "/var/lib/private/etherpad-lite";
};
- secrets.keys = [
- {
- dest = "webapps/tools-etherpad-apikey";
+ secrets.keys = {
+ "webapps/tools-etherpad-apikey" = {
permissions = "0400";
text = env.api_key;
- }
- {
- dest = "webapps/tools-etherpad-sessionkey";
+ };
+ "webapps/tools-etherpad-sessionkey" = {
permissions = "0400";
text = env.session_key;
- }
- {
- dest = "webapps/tools-etherpad";
+ };
+ "webapps/tools-etherpad" = {
permissions = "0400";
text = ''
{
"logconfig" : { "appenders": [ { "type": "console" } ] }
}
'';
- }
- ];
+ };
+ };
services.etherpad-lite = {
enable = true;
package = pkgs.webapps.etherpad-lite.withModules (p: [
install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/mantisbt
'';
};
- keys = [{
- dest = "webapps/tools-mantisbt";
+ keys."webapps/tools-mantisbt" = {
user = apache.user;
group = apache.group;
permissions = "0400";
$g_ldap_realname_field = 'cn';
$g_ldap_organization = '${env.ldap.filter}';
'';
- }];
+ };
webRoot = (mantisbt_2.override { mantis_config = config.secrets.fullPaths."webapps/tools-mantisbt"; }).withPlugins (p: [p.slack p.source-integration]);
apache = rec {
user = "wwwrun";
install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
'';
};
- keys = [{
- dest = "webapps/tools-roundcube";
+ keys."webapps/tools-roundcube" = {
user = apache.user;
group = apache.group;
permissions = "0400";
$config['temp_dir'] = '${varDir}/cache';
$config['mime_types'] = '${apacheHttpd}/conf/mime.types';
'';
- }];
+ };
webRoot = (roundcubemail.override { roundcube_config = config.secrets.fullPaths."webapps/tools-roundcube"; }).withPlugins (p: [ p.automatic_addressbook p.carddav p.contextmenu p.contextmenu_folder p.html5_notifier p.ident_switch p.message_highlight p.thunderbird_labels ]);
apache = rec {
user = "wwwrun";
services.duplyBackup.profiles.mastodon = {
rootDir = mcfg.dataDir;
};
- secrets.keys = [{
- dest = "webapps/tools-mastodon";
+ secrets.keys."webapps/tools-mastodon" = {
user = "mastodon";
group = "mastodon";
permissions = "0400";
LDAP_UID="uid"
LDAP_SEARCH_FILTER="${env.ldap.filter}"
'';
- }];
+ };
services.mastodon = {
enable = true;
configFile = config.secrets.fullPaths."webapps/tools-mastodon";
services.duplyBackup.profiles.mgoblin = {
rootDir = mcfg.dataDir;
};
- secrets.keys = [{
- dest = "webapps/tools-mediagoblin";
+ secrets.keys."webapps/tools-mediagoblin" = {
user = "mediagoblin";
group = "mediagoblin";
permissions = "0400";
[[mediagoblin.media_types.image]]
[[mediagoblin.media_types.video]]
'';
- }];
+ };
users.users.mediagoblin.extraGroups = [ "keys" ];
};
users.users.peertube.extraGroups = [ "keys" ];
- secrets.keys = [{
- dest = "webapps/tools-peertube";
+ secrets.keys."webapps/tools-peertube" = {
user = "peertube";
group = "peertube";
permissions = "0640";
plugins: '${pcfg.dataDir}/storage/plugins/'
client_overrides: '${pcfg.dataDir}/storage/client-overrides/'
'';
- }];
+ };
services.websites.env.tools.modules = [
"headers" "proxy" "proxy_http" "proxy_wstunnel"
};
config = lib.mkIf cfg.enable {
- secrets.keys = [
- {
- dest = "status_engine_ui";
+ secrets.keys = {
+ status_engine_ui = {
permissions = "0400";
user = "wwwrun";
group = "wwwrun";
display_perfdata: 1
perfdata_backend: mysql
'';
- }
- ];
+ };
+ };
services.websites.env.tools.modules = [ "proxy_fcgi" ];
{
options.myServices.websites.tools.stats.enable = lib.mkEnableOption "Enable stats site";
config = lib.mkIf cfg.enable {
- secrets.keys = [
- {
- dest = "umami/env";
+ secrets.keys = {
+ "uami/env" = {
permission = "0400";
text = ''
PORT=${toString myCfg.listenPort}
DATABASE_URL=postgresql://${myCfg.postgresql.user}:${myCfg.postgresql.password}@localhost:${myCfg.postgresql.port}/${myCfg.postgresql.database}?sslmode=disable&host=${myCfg.postgresql.socket}
HASH_SALT=${myCfg.hashSalt}
'';
- }
- ];
+ };
+ };
services.websites.env.tools.vhostConfs.stats = {
certName = "eldiron";
{ env }:
rec {
- keys = [{
- dest = "webapps/tools-csp-reports.conf";
+ keys."webapps/tools-csp-reports.conf" = {
user = "wwwrun";
group = "wwwrun";
permissions = "0400";
text = with env.postgresql; ''
env[CSP_REPORT_URI] = "host=${socket} dbname=${database} user=${user} password=${password}"
'';
- }];
+ };
}
config = lib.mkIf cfg.enable {
secrets.keys =
kanboard.keys
- ++ ldap.keys
- ++ shaarli.keys
- ++ ttrss.keys
- ++ wallabag.keys
- ++ yourls.keys
- ++ dmarc-reports.keys
- ++ csp-reports.keys
- ++ webhooks.keys;
+ // ldap.keys
+ // shaarli.keys
+ // ttrss.keys
+ // wallabag.keys
+ // yourls.keys
+ // dmarc-reports.keys
+ // csp-reports.keys
+ // webhooks.keys;
services.duplyBackup.profiles = {
dokuwiki = dokuwiki.backups;
{ env, config }:
rec {
- keys = [{
- dest = "webapps/tools-dmarc-reports.php";
+ keys."webapps/tools-dmarc-reports.php" = {
user = "wwwrun";
group = "wwwrun";
permissions = "0400";
$anonymous_key = "${env.anonymous_key}";
?>
'';
- }];
+ };
webRoot = ./dmarc_reports;
apache = rec {
user = "wwwrun";
install -TDm644 ${webRoot}/dataold/web.config ${varDir}/data/web.config
'';
};
- keys = [{
- dest = "webapps/tools-kanboard";
+ keys."webapps/tools-kanboard" = {
user = apache.user;
group = apache.group;
permissions = "0400";
define('LDAP_GROUP_ADMIN_DN', '${env.ldap.admin_dn}');
?>
'';
- }];
+ };
webRoot = kanboard { kanboard_config = config.secrets.fullPaths."webapps/tools-kanboard"; };
apache = rec {
user = "wwwrun";
install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/phpldapadmin
'';
};
- keys = [{
- dest = "webapps/tools-ldap";
+ keys."webapps/tools-ldap" = {
user = apache.user;
group = apache.group;
permissions = "0400";
$servers->setValue('login','attr','uid');
$servers->setValue('login','fallback_dn',true);
'';
- }];
+ };
webRoot = phpldapadmin.override { config = config.secrets.fullPaths."webapps/tools-ldap"; };
apache = rec {
user = "wwwrun";
</Directory>
'';
};
- keys = [{
- dest = "webapps/tools-shaarli";
+ keys."webapps/tools-shaarli" = {
user = apache.user;
group = apache.group;
permissions = "0400";
SetEnv SHAARLI_LDAP_BASE "${env.ldap.base}"
SetEnv SHAARLI_LDAP_FILTER "${env.ldap.filter}"
'';
- }];
+ };
phpFpm = rec {
serviceDeps = [ "openldap.service" ];
basedir = builtins.concatStringsSep ":" [ webRoot varDir ];
install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
'';
};
- keys = [{
- dest = "webapps/tools-ttrss";
+ keys."webapps/tools-ttrss" = {
user = apache.user;
group = apache.group;
permissions = "0400";
define('LDAP_AUTH_LOG_ATTEMPTS', FALSE);
define('LDAP_AUTH_DEBUG', FALSE);
'';
- }];
+ };
webRoot = (ttrss.override { ttrss_config = config.secrets.fullPaths."webapps/tools-ttrss"; }).withPlugins (p: [
p.auth_ldap p.ff_instagram p.tumblr_gdpr_ua
(p.af_feedmod.override { patched = true; })
remotes = [ "eriomem" "ovh" ];
};
varDir = "/var/lib/wallabag";
- keys = [{
- dest = "webapps/tools-wallabag";
+ keys."webapps/tools-wallabag" = {
user = apache.user;
group = apache.group;
permissions = "0400";
class: Swift_SendmailTransport
arguments: ['/run/wrappers/bin/sendmail -bs']
'';
- }];
+ };
webappDir = wallabag.override { ldap = true; wallabag_config = config.secrets.fullPaths."webapps/tools-wallabag"; };
activationScript = ''
install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir} \
{ lib, env }:
{
- keys = lib.attrsets.mapAttrsToList (k: v: {
- dest = "webapps/webhooks/${k}.php";
+ keys = lib.attrsets.mapAttrs' (k: v:
+ lib.nameValuePair "webapps/webhooks/${k}.php" {
user = "wwwrun";
group = "wwwrun";
permissions = "0400";
text = v;
- }) env ++ [{
- dest = "webapps/webhooks";
- isDir = true;
- user = "wwwrun";
- group = "wwwrun";
- permissions = "0500";
- }];
+ }) env // {
+ "webapps/webhooks" = {
+ isDir = true;
+ user = "wwwrun";
+ group = "wwwrun";
+ permissions = "0500";
+ };
+ };
}
install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/yourls
'';
};
- keys = [{
- dest = "webapps/tools-yourls";
+ keys."webapps/tools-yourls" = {
user = apache.user;
group = apache.group;
permissions = "0400";
define( 'LDAPAUTH_USERCACHE_TYPE', 0);
'';
- }];
+ };
webRoot = (yourls.override { yourls_config = config.secrets.fullPaths."webapps/tools-yourls"; }).withPlugins (p: [p.ldap]);
apache = rec {
user = "wwwrun";
};
config = lib.mkIf cfg.enable {
- secrets.keys = [
- {
- dest = "zrepl/zrepl.yml";
+ secrets.keys = {
+ "zrepl/zrepl.yml" = {
permissions = "0400";
text = cfg.config;
user = config.systemd.services.zrepl.serviceConfig.User or "root";
group = config.systemd.services.zrepl.serviceConfig.Group or "root";
- }
- ];
+ };
+ };
services.filesWatcher.zrepl = {
restart = true;
paths = [ config.secrets.fullPaths."zrepl/zrepl.yml" ];
projects / perso / Immae / Config / Nix.git / commitdiff
