]> git.immae.eu Git - perso/Immae/Config/Nix.git/blame - modules/private/environment.nix
projects / perso / Immae / Config / Nix.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Add dilion server
[perso/Immae/Config/Nix.git] / modules / private / environment.nix
CommitLineData
619e4f46 1{ config, lib, name, ... }:
ab8f306d
IB		 2with lib;
3with types;
4with lists;
5let
6 ldapOptions = {
7 base = mkOption { description = "Base of the LDAP tree"; type = str; };
8 host = mkOption { description = "Host to access LDAP"; type = str; };
9 root_dn = mkOption { description = "DN of the root user"; type = str; };
10 root_pw = mkOption { description = "Hashed password of the root user"; type = str; };
11 replication_dn = mkOption { description = "DN of the user allowed to replicate the LDAP directory"; type = str; };
12 replication_pw = mkOption { description = "Password of the user allowed to replicate the LDAP directory"; type = str; };
13 };
14 mkLdapOptions = name: more: mkOption {
15 description = "${name} LDAP configuration";
16 type = submodule {
17 options = ldapOptions // {
18 dn = mkOption { description = "DN of the ${name} user"; type = str; };
19 password = mkOption { description = "password of the ${name} user"; type = str; };
20 filter = mkOption { description = "Filter for ${name} users"; type = str; default = ""; };
21 } // more;
22 };
23 };
24 mysqlOptions = {
25 host = mkOption { description = "Host to access Mysql"; type = str; };
619e4f46 26 remoteHost = mkOption { description = "Host to access Mysql from outside"; type = str; };
ab8f306d
IB		 27 port = mkOption { description = "Port to access Mysql"; type = str; };
28 socket = mkOption { description = "Socket to access Mysql"; type = path; };
29 systemUsers = mkOption {
30 description = "Attrs of user-passwords allowed to access mysql";
31 type = attrsOf str;
32 };
33 pam = mkOption {
34 description = "PAM configuration for mysql";
35 type = submodule {
36 options = {
37 dn = mkOption { description = "DN to connect as to check users"; type = str; };
38 password = mkOption { description = "DN password to connect as to check users"; type = str; };
39 filter = mkOption { description = "filter to match users"; type = str; };
40 };
41 };
42 };
43 };
87a8bffd 44 mkMysqlOptions = name: more: mkOption {
ab8f306d
IB		 45 description = "${name} mysql configuration";
46 type = submodule {
47 options = mysqlOptions // {
48 database = mkOption { description = "${name} database"; type = str; };
49 user = mkOption { description = "${name} user"; type = str; };
50 password = mkOption { description = "mysql password of the ${name} user"; type = str; };
87a8bffd 51 } // more;
ab8f306d
IB		 52 };
53 };
54 psqlOptions = {
55 host = mkOption { description = "Host to access Postgresql"; type = str; };
56 port = mkOption { description = "Port to access Postgresql"; type = str; };
57 socket = mkOption { description = "Socket to access Postgresql"; type = path; };
58 pam = mkOption {
59 description = "PAM configuration for psql";
60 type = submodule {
61 options = {
62 dn = mkOption { description = "DN to connect as to check users"; type = str; };
63 password = mkOption { description = "DN password to connect as to check users"; type = str; };
64 filter = mkOption { description = "filter to match users"; type = str; };
65 };
66 };
67 };
68 };
69 mkPsqlOptions = name: mkOption {
70 description = "${name} psql configuration";
71 type = submodule {
72 options = psqlOptions // {
73 database = mkOption { description = "${name} database"; type = str; };
74 schema = mkOption { description = "${name} schema"; type = nullOr str; default = null; };
75 user = mkOption { description = "${name} user"; type = str; };
76 password = mkOption { description = "psql password of the ${name} user"; type = str; };
77 };
78 };
79 };
80 redisOptions = {
81 host = mkOption { description = "Host to access Redis"; type = str; };
82 port = mkOption { description = "Port to access Redis"; type = str; };
83 socket = mkOption { description = "Socket to access Redis"; type = path; };
84 dbs = mkOption {
85 description = "Attrs of db number. Each number should be unique to avoid collision!";
86 type = attrsOf str;
87 };
88 spiped_key = mkOption {
89 type = str;
90 description = ''
91 Key to use with spiped to make a secure channel to replication
92 '';
93 };
94 predixy = mkOption {
95 description = "Predixy configuration. Unused yet";
96 type = submodule {
97 options = {
98 read = mkOption { type = str; description = "Read password"; };
99 };
100 };
101 };
102 };
103 mkRedisOptions = name: mkOption {
104 description = "${name} redis configuration";
105 type = submodule {
106 options = redisOptions // {
107 db = mkOption { description = "${name} database"; type = str; };
108 };
109 };
110 };
619e4f46
IB		 111 hostEnv = submodule {
112 options = {
113 fqdn = mkOption {
114 description = "Host FQDN";
115 type = str;
116 };
8a304ef4
IB		 117 users = mkOption {
118 type = unspecified;
119 default = pkgs: [];
120 description = ''
121 Sublist of users from realUsers. Function that takes pkgs as
122 argument and gives an array as a result
123 '';
124 };
619e4f46
IB		 125 emails = mkOption {
126 default = [];
127 description = "List of e-mails that the server can be a sender of";
128 type = listOf str;
129 };
130 ldap = mkOption {
131 description = ''
132 LDAP credentials for the host
133 '';
134 type = submodule {
135 options = {
136 password = mkOption { type = string; description = "Password for the LDAP connection"; };
137 dn = mkOption { type = string; description = "DN for the LDAP connection"; };
138 };
139 };
140 };
141 mx = mkOption {
142 description = "subdomain and priority for MX server";
143 default = { enable = false; };
144 type = submodule {
145 options = {
146 enable = mkEnableOption "Enable MX";
147 subdomain = mkOption { type = nullOr str; description = "Subdomain name (mx-*)"; };
148 priority = mkOption { type = nullOr str; description = "Priority"; };
149 };
150 };
151 };
152 ips = mkOption {
153 description = ''
154 attrs of ip4/ip6 grouped by section
155 '';
156 type = attrsOf (submodule {
157 options = {
158 ip4 = mkOption {
159 type = string;
160 description = ''
161 ip4 address of the host
162 '';
163 };
164 ip6 = mkOption {
165 type = listOf string;
166 default = [];
167 description = ''
168 ip6 addresses of the host
169 '';
170 };
171 };
172 });
173 };
174 };
175 };
ab8f306d
IB		 176in
177{
178 options.myEnv = {
179 servers = mkOption {
180 description = ''
181 Attrs of servers information in the cluster (not necessarily handled by nixops)
182 '';
183 default = {};
619e4f46 184 type = attrsOf hostEnv;
ab8f306d
IB		 185 };
186 hetznerCloud = mkOption {
187 description = ''
188 Hetzner Cloud credential information
189 '';
190 type = submodule {
191 options = {
192 authToken = mkOption {
193 type = str;
194 description = ''
195 The API auth token.
196 '';
197 };
198 };
199 };
200 };
201 hetzner = mkOption {
202 description = ''
203 Hetzner credential information
204 '';
205 type = submodule {
206 options = {
207 user = mkOption { type = str; description = "User"; };
208 pass = mkOption { type = str; description = "Password"; };
209 };
210 };
211 };
212 sshd = mkOption {
213 description = ''
214 sshd service credential information
215 '';
216 type = submodule {
217 options = {
218 ldap = mkOption {
219 description = ''
220 LDAP credentials for cn=ssh,ou=services,dc=immae,dc=eu dn
221 '';
222 type = submodule {
223 options = {
224 password = mkOption { description = "Password"; type = str; };
225 };
226 };
227 };
228 };
229 };
230 };
231 ports = mkOption {
232 description = ''
233 non-standard reserved ports. Must be unique!
234 '';
235 type = attrsOf port;
236 default = {};
237 apply = let
238 noDupl = x: builtins.length (builtins.attrValues x) == builtins.length (unique (builtins.attrValues x));
239 in
240 x: if isAttrs x && noDupl x then x else throw "Non unique values for ports";
241 };
242 httpd = mkOption {
243 description = ''
244 httpd service credential information
245 '';
246 type = submodule {
247 options = {
248 ldap = mkOption {
249 description = ''
250 LDAP credentials for cn=httpd,ou=services,dc=immae,dc=eu dn
251 '';
252 type = submodule {
253 options = {
254 password = mkOption { description = "Password"; type = str; };
255 };
256 };
257 };
258 };
259 };
260 };
261 ldap = mkOption {
262 description = ''
263 LDAP server configuration
264 '';
265 type = submodule {
266 options = ldapOptions;
267 };
268 };
269 databases = mkOption {
270 description = "Databases configuration";
271 type = submodule {
272 options = {
273 mysql = mkOption {
274 type = submodule { options = mysqlOptions; };
275 description = "Mysql configuration";
276 };
277 redis = mkOption {
278 type = submodule { options = redisOptions; };
279 description = "Redis configuration";
280 };
281 postgresql = mkOption {
282 type = submodule { options = psqlOptions; };
283 description = "Postgresql configuration";
284 };
285 };
286 };
287 };
288 jabber = mkOption {
289 description = "Jabber configuration";
290 type = submodule {
291 options = {
5b53d86f 292 postfix_user_filter = mkOption { type = str; description = "Postfix filter to get xmpp users"; };
ab8f306d
IB		 293 ldap = mkLdapOptions "Jabber" {};
294 postgresql = mkPsqlOptions "Jabber";
295 };
296 };
297 };
8a304ef4
IB		 298 realUsers = mkOption {
299 description = ''
300 Attrset of function taking pkgs as argument.
301 Real users settings, should provide a subattr of users.users.<name>
302 with at least: name, (hashed)Password, shell
303 '';
304 type = attrsOf unspecified;
305 };
ab8f306d
IB		 306 users = mkOption {
307 description = "System and regular users uid/gid";
308 type = attrsOf (submodule {
309 options = {
310 uid = mkOption {
311 description = "user uid";
312 type = int;
313 };
314 gid = mkOption {
315 description = "user gid";
316 type = int;
317 };
318 };
319 });
320 };
321 dns = mkOption {
322 description = "DNS configuration";
323 type = submodule {
324 options = {
325 soa = mkOption {
326 description = "SOA information";
327 type = submodule {
328 options = {
329 serial = mkOption {
330 description = "Serial number. Should be incremented at each change and unique";
331 type = str;
332 };
333 refresh = mkOption {
334 description = "Refresh time";
335 type = str;
336 };
337 retry = mkOption {
338 description = "Retry time";
339 type = str;
340 };
341 expire = mkOption {
342 description = "Expire time";
343 type = str;
344 };
345 ttl = mkOption {
346 description = "Default TTL time";
347 type = str;
348 };
349 email = mkOption {
350 description = "hostmaster e-mail";
351 type = str;
352 };
353 primary = mkOption {
354 description = "Primary NS";
355 type = str;
356 };
357 };
358 };
359 };
360 ns = mkOption {
361 description = "Attrs of NS servers group";
362 example = {
363 foo = {
364 "ns1.foo.com" = [ "198.51.100.10" "2001:db8:abcd::1" ];
365 "ns2.foo.com" = [ "198.51.100.15" "2001:db8:1234::1" ];
366 };
367 };
368 type = attrsOf (attrsOf (listOf str));
369 };
370 slaveZones = mkOption {
371 description = "List of slave zones";
372 type = listOf (submodule {
373 options = {
374 name = mkOption { type = str; description = "zone name"; };
375 masters = mkOption {
376 description = "NS master groups of this zone";
377 type = listOf str;
378 };
379 };
380 });
381 };
382 masterZones = mkOption {
383 description = "List of master zones";
384 type = listOf (submodule {
385 options = {
386 name = mkOption { type = str; description = "zone name"; };
387 slaves = mkOption {
388 description = "NS slave groups of this zone";
389 type = listOf str;
390 };
391 ns = mkOption {
392 description = "groups names that should have their NS entries listed here";
393 type = listOf str;
394 };
395 extra = mkOption {
396 description = "Extra zone configuration for bind";
397 example = ''
398 notify yes;
399 '';
400 type = lines;
401 };
402 entries = mkOption { type = lines; description = "Regular entries of the NS zone"; };
403 withEmail = mkOption {
404 description = "List of domains that should have mail entries (MX, dkim, SPF, ...)";
405 default = [];
406 type = listOf (submodule {
407 options = {
408 domain = mkOption { type = str; description = "Which subdomain is concerned"; };
409 send = mkOption { type = bool; description = "Whether there can be e-mails originating from the subdomain"; };
410 receive = mkOption { type = bool; description = "Whether there can be e-mails arriving to the subdomain"; };
411 };
412 });
413 };
414 };
415 });
416 };
417 };
418 };
419 };
420 backup = mkOption {
421 description = ''
422 Remote backup with duplicity
423 '';
424 type = submodule {
425 options = {
426 password = mkOption { type = str; description = "Password for encrypting files"; };
427 remote = mkOption { type = str; description = "Remote url access"; };
428 accessKeyId = mkOption { type = str; description = "Remote access-key"; };
429 secretAccessKey = mkOption { type = str; description = "Remote access secret"; };
430 };
431 };
432 };
433 rsync_backup = mkOption {
434 description =''
435 Rsync backup configuration from controlled host
436 '';
437 type = submodule {
438 options = {
ab8f306d
IB		 439 ssh_key = mkOption {
440 description = "SSH key information";
441 type = submodule {
442 options = {
443 public = mkOption { type = str; description = "Public part of the key"; };
444 private = mkOption { type = lines; description = "Private part of the key"; };
445 };
446 };
447 };
448 profiles = mkOption {
449 description = "Attrs of profiles to backup";
450 type = attrsOf (submodule {
451 options = {
452 keep = mkOption { type = int; description = "Number of backups to keep"; };
453 login = mkOption { type = str; description = "Login to connect to host"; };
454 port = mkOption { type = str; default = "22"; description = "Port to connect to host"; };
455 host = mkOption { type = str; description = "Host to connect to"; };
456 host_key = mkOption { type = str; description = "Host key"; };
457 host_key_type = mkOption { type = str; description = "Host key type"; };
458 parts = mkOption {
459 description = "Parts to backup for this host";
460 type = attrsOf (submodule {
461 options = {
462 remote_folder = mkOption { type = path; description = "Remote folder to backup";};
463 exclude_from = mkOption {
464 type = listOf path;
465 default = [];
466 description = "List of folders/files to exclude from the backup";
467 };
468 files_from = mkOption {
469 type = listOf path;
470 default = [];
471 description = "List of folders/files to backup in the base folder";
472 };
473 args = mkOption {
474 type = nullOr str;
475 default = null;
476 description = "Extra arguments to pass to rsync";
477 };
478 };
479 });
480 };
481 };
482 });
483 };
484 };
485 };
486 };
487 monitoring = mkOption {
488 description = "Monitoring configuration";
489 type = submodule {
490 options = {
491 status_url = mkOption { type = str; description = "URL to push status to"; };
492 status_token = mkOption { type = str; description = "Token for the status url"; };
e820134d 493 http_user_password = mkOption { type = str; description = "HTTP credentials to check services behind wall"; };
ab8f306d 494 email = mkOption { type = str; description = "Admin E-mail"; };
e820134d
IB		 495 ssh_public_key = mkOption { type = str; description = "SSH public key"; };
496 ssh_secret_key = mkOption { type = str; description = "SSH secret key"; };
497 imap_login = mkOption { type = str; description = "IMAP login"; };
498 imap_password = mkOption { type = str; description = "IMAP password"; };
25844101 499 eriomem_keys = mkOption { type = listOf (listOf str); description = "Eriomem keys"; default = []; };
e820134d
IB		 500 nrdp_tokens = mkOption { type = listOf str; description = "Tokens allowed to push status update"; };
501 slack_url = mkOption { type = str; description = "Slack webhook url to push status update"; };
502 slack_channel = mkOption { type = str; description = "Slack channel to push status update"; };
503 contacts = mkOption { type = attrsOf unspecified; description = "Contact dicts to fill naemon objects"; };
71a2425e
IB		 504 email_check = mkOption {
505 description = "Emails services to check";
506 type = attrsOf (submodule {
507 options = {
508 local = mkOption { type = bool; default = false; description = "Use local configuration"; };
509 port = mkOption { type = nullOr str; default = null; description = "Port to connect to ssh"; };
510 login = mkOption { type = nullOr str; default = null; description = "Login to connect to ssh"; };
511 targets = mkOption { type = listOf str; description = "Hosts to send E-mails to"; };
ef0a9217
IB		 512 mail_address = mkOption { type = nullOr str; default = null; description = "E-mail recipient part to send e-mail to"; };
513 mail_domain = mkOption { type = nullOr str; default = null; description = "E-mail domain part to send e-mail to"; };
71a2425e
IB		 514 };
515 });
516 };
ab8f306d
IB		 517 };
518 };
519 };
520 mpd = mkOption {
521 description = "MPD configuration";
522 type = submodule {
523 options = {
524 folder = mkOption { type = str; description = "Folder to serve from the MPD instance"; };
525 password = mkOption { type = str; description = "Password to connect to the MPD instance"; };
526 host = mkOption { type = str; description = "Host to connect to the MPD instance"; };
527 port = mkOption { type = str; description = "Port to connect to the MPD instance"; };
528 };
529 };
530 };
531 ftp = mkOption {
532 description = "FTP configuration";
533 type = submodule {
534 options = {
535 ldap = mkLdapOptions "FTP" {};
536 };
537 };
538 };
539 mail = mkOption {
540 description = "Mail configuration";
541 type = submodule {
542 options = {
543 dmarc = mkOption {
544 description = "DMARC configuration";
545 type = submodule {
546 options = {
547 ignore_hosts = mkOption {
548 type = lines;
549 description = ''
550 Hosts to ignore when checking for dmarc
551 '';
552 };
553 };
554 };
555 };
556 dkim = mkOption {
557 description = "DKIM configuration";
558 type = attrsOf (submodule {
559 options = {
560 public = mkOption {
561 type = str;
562 example = ''
563 ( "v=DKIM1; k=rsa; "
564 "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3w1a2aMxWw9+hdcmbqX4UevcVqr204y0K73Wdc7MPZiOOlUJQYsMNSYR1Y/SC7jmPKeitpcJCpQgn/cveJZbuikjjPLsDReHyFEYmC278ZLRTELHx6f1IXM8WE08JIRT69CfZiMi1rVcOh9qRT4F93PyjCauU8Y5hJjtg9ThsWwIDAQAB" )
565 '';
566 description = "Public entry to put in DNS TXT field";
567 };
568 private = mkOption { type = str; description = "Private key"; };
569 };
570 });
571 };
572 postfix = mkOption {
573 description = "Postfix configuration";
574 type = submodule {
575 options = {
576 additional_mailbox_domains = mkOption {
577 description = ''
578 List of domains that are used as mailbox final destination, in addition to those defined in the DNS records
579 '';
580 type = listOf str;
581 };
87a8bffd
IB		 582 mysql = mkMysqlOptions "Postfix" {
583 password_encrypt = mkOption { type = str; description = "Key to encrypt relay password in database"; };
584 };
ab8f306d
IB		 585 backup_domains = mkOption {
586 description = ''
587 Domains that are accepted for relay as backup domain
588 '';
589 type = attrsOf (submodule {
590 options = {
591 domains = mkOption { type = listOf str; description = "Domains list"; };
592 relay_restrictions = mkOption {
593 type = lines;
594 description = ''
595 Restrictions for relaying the e-mails from the domains
596 '';
597 };
598 recipient_maps = mkOption {
599 description = ''
600 Recipient map to accept relay for.
601 Must be specified for domain, the rules apply to everyone!
602 '';
603 type = listOf (submodule {
604 options = {
605 type = mkOption {
606 type = enum [ "hash" ];
607 description = "Map type";
608 };
609 content = mkOption {
610 type = str;
611 description = "Map content";
612 };
613 };
614 });
615 };
616 };
617 });
618 };
619 };
620 };
621 };
622 dovecot = mkOption {
623 description = "Dovecot configuration";
624 type = submodule {
625 options = {
626 ldap = mkLdapOptions "Dovecot" {
627 pass_attrs = mkOption { type = str; description = "Password attribute in LDAP"; };
628 user_attrs = mkOption { type = str; description = "User attribute mapping in LDAP"; };
629 iterate_attrs = mkOption { type = str; description = "User attribute mapping for listing in LDAP"; };
630 iterate_filter = mkOption { type = str; description = "User attribute filter for listing in LDAP"; };
631 };
632 };
633 };
634 };
635 rspamd = mkOption {
636 description = "rspamd configuration";
637 type = submodule {
638 options = {
639 redis = mkRedisOptions "Redis";
640 read_password_hashed = mkOption { type = str; description = "Hashed read password for rspamd"; };
641 write_password_hashed = mkOption { type = str; description = "Hashed write password for rspamd"; };
642 read_password = mkOption {
643 type = str;
644 description = "Read password for rspamd. Unused";
645 apply = x: "";
646 };
647 write_password = mkOption {
648 type = str;
649 description = "Write password for rspamd. Unused";
650 apply = x: "";
651 };
652 };
653 };
654 };
655 scripts = mkOption {
656 description = "Mail script recipients";
657 type = attrsOf (submodule {
658 options = {
5b53d86f 659 external = mkEnableOption "Create a script_<name>@mail.immae.eu external address";
ab8f306d
IB		 660 src = mkOption {
661 description = ''
662 git source to fetch the script from.
663 It must have a default.nix file as its root accepting a scriptEnv parameter
664 '';
665 type = submodule {
666 options = {
667 url = mkOption { type = str; description = "git url to fetch"; };
668 rev = mkOption { type = str; description = "git reference to fetch"; };
669 };
670 };
671 };
672 env = mkOption {
673 description = "Variables to pass to the script";
674 type = unspecified;
675 };
676 };
677 });
678 };
679 };
680 };
681 };
682 buildbot = mkOption {
683 description = "Buildbot configuration";
684 type = submodule {
685 options = {
686 user = mkOption {
687 description = "Buildbot user";
688 type = submodule {
689 options = {
690 uid = mkOption {
691 description = "user uid";
692 type = int;
693 };
694 gid = mkOption {
695 description = "user gid";
696 type = int;
697 };
698 };
699 };
700 };
701 ldap = mkOption {
702 description = "Ldap configuration for buildbot";
703 type = submodule {
704 options = {
705 password = mkOption { type = str; description = "Buildbot password"; };
706 };
707 };
708 };
709 projects = mkOption {
710 description = "Projects to make a buildbot for";
711 type = attrsOf (submodule {
712 options = {
713 name = mkOption { type = str; description = "Project name"; };
714 packages = mkOption {
715 type = unspecified;
716 example = literalExample ''
717 pkgs: [ pkgs.bash pkgs.git pkgs.gzip pkgs.openssh ];
718 '';
719 description = ''
720 Function.
721 Builds packages list to make available to buildbot project.
722 Takes pkgs as argument.
723 '';
724 };
725 pythonPackages = mkOption {
726 type = unspecified;
727 example = literalExample ''
728 p: pkgs: [ pkgs.python3Packages.pip ];
729 '';
730 description = ''
731 Function.
732 Builds python packages list to make available to buildbot project.
733 Takes buildbot python module as first argument and pkgs as second argument in order to augment the python modules list.
734 '';
735 };
736 pythonPathHome = mkOption { type = bool; description = "Whether to add project’s python home to python path"; };
737 secrets = mkOption {
738 type = attrsOf str;
739 description = "Secrets for the project to dump as files";
740 };
741 environment = mkOption {
742 type = attrsOf str;
743 description = ''
744 Environment variables for the project.
745 BUILDBOT_ is prefixed to the variable names
746 '';
747 };
748 activationScript = mkOption {
749 type = lines;
750 description = ''
751 Activation script to run during deployment
752 '';
753 };
754 builderPaths = mkOption {
755 type = attrsOf unspecified;
756 default = {};
757 description = ''
758 Attrs of functions to make accessible specifically per builder.
759 Takes pkgs as argument and should return a single path containing binaries.
760 This path will be accessible as BUILDBOT_PATH_<attrskey>
761 '';
762 };
763 webhookTokens = mkOption {
764 type = nullOr (listOf str);
765 default = null;
766 description = ''
767 List of tokens allowed to push to project’s change_hook/base endpoint
768 '';
769 };
770 };
771 });
772 };
773 };
774 };
775 };
776 tools = mkOption {
777 description = "Tools configurations";
778 type = submodule {
779 options = {
780 davical = mkOption {
781 description = "Davical configuration";
782 type = submodule {
783 options = {
784 postgresql = mkPsqlOptions "Davical";
785 ldap = mkLdapOptions "Davical" {};
786 };
787 };
788 };
789 diaspora = mkOption {
790 description = "Diaspora configuration";
791 type = submodule {
792 options = {
793 postgresql = mkPsqlOptions "Diaspora";
794 redis = mkRedisOptions "Diaspora";
795 ldap = mkLdapOptions "Diaspora" {};
796 secret_token = mkOption { type = str; description = "Secret token"; };
797 };
798 };
799 };
800 etherpad-lite = mkOption {
801 description = "Etherpad configuration";
802 type = submodule {
803 options = {
804 postgresql = mkPsqlOptions "Etherpad";
805 ldap = mkLdapOptions "Etherpad" {
806 group_filter = mkOption { type = str; description = "Filter for groups"; };
807 };
808 session_key = mkOption { type = str; description = "Session key"; };
809 api_key = mkOption { type = str; description = "API key"; };
810 redirects = mkOption { type = str; description = "Redirects for apache"; };
811 };
812 };
813 };
814 gitolite = mkOption {
815 description = "Gitolite configuration";
816 type = submodule {
817 options = {
818 ldap = mkLdapOptions "Gitolite" {};
819 };
820 };
821 };
822 kanboard = mkOption {
823 description = "Kanboard configuration";
824 type = submodule {
825 options = {
826 postgresql = mkPsqlOptions "Kanboard";
827 ldap = mkLdapOptions "Kanboard" {
828 admin_dn = mkOption { type = str; description = "Admin DN"; };
829 };
830 };
831 };
832 };
833 mantisbt = mkOption {
834 description = "Mantisbt configuration";
835 type = submodule {
836 options = {
837 postgresql = mkPsqlOptions "Mantisbt";
838 ldap = mkLdapOptions "Mantisbt" {};
839 master_salt = mkOption { type = str; description = "Master salt for password hash"; };
840 };
841 };
842 };
843 mastodon = mkOption {
844 description = "Mastodon configuration";
845 type = submodule {
846 options = {
847 postgresql = mkPsqlOptions "Mastodon";
848 redis = mkRedisOptions "Mastodon";
849 ldap = mkLdapOptions "Mastodon" {};
850 paperclip_secret = mkOption { type = str; description = "Paperclip secret"; };
851 otp_secret = mkOption { type = str; description = "OTP secret"; };
852 secret_key_base = mkOption { type = str; description = "Secret key base"; };
853 vapid = mkOption {
854 description = "vapid key";
855 type = submodule {
856 options = {
857 private = mkOption { type = str; description = "Private key"; };
858 public = mkOption { type = str; description = "Public key"; };
859 };
860 };
861 };
862 };
863 };
864 };
865 mediagoblin = mkOption {
866 description = "Mediagoblin configuration";
867 type = submodule {
868 options = {
869 postgresql = mkPsqlOptions "Mediagoblin";
870 redis = mkRedisOptions "Mediagoblin";
871 ldap = mkLdapOptions "Mediagoblin" {};
872 };
873 };
874 };
875 nextcloud = mkOption {
876 description = "Nextcloud configuration";
877 type = submodule {
878 options = {
879 postgresql = mkPsqlOptions "Peertube";
880 redis = mkRedisOptions "Peertube";
881 password_salt = mkOption { type = str; description = "Password salt"; };
882 instance_id = mkOption { type = str; description = "Instance ID"; };
883 secret = mkOption { type = str; description = "App secret"; };
884 };
885 };
886 };
887 peertube = mkOption {
888 description = "Peertube configuration";
889 type = submodule {
890 options = {
891 listenPort = mkOption { type = port; description = "Port to listen to"; };
892 postgresql = mkPsqlOptions "Peertube";
893 redis = mkRedisOptions "Peertube";
894 ldap = mkLdapOptions "Peertube" {};
895 };
896 };
897 };
898 phpldapadmin = mkOption {
899 description = "phpLdapAdmin configuration";
900 type = submodule {
901 options = {
902 ldap = mkLdapOptions "phpldapadmin" {};
903 };
904 };
905 };
906 rompr = mkOption {
907 description = "Rompr configuration";
908 type = submodule {
909 options = {
910 mpd = mkOption {
911 description = "MPD configuration";
912 type = submodule {
913 options = {
914 host = mkOption { type = str; description = "Host for MPD"; };
915 port = mkOption { type = port; description = "Port to access MPD host"; };
916 };
917 };
918 };
919 };
920 };
921 };
922 roundcubemail = mkOption {
923 description = "Roundcubemail configuration";
924 type = submodule {
925 options = {
926 postgresql = mkPsqlOptions "TT-RSS";
927 secret = mkOption { type = str; description = "Secret"; };
928 };
929 };
930 };
931 shaarli = mkOption {
932 description = "Shaarli configuration";
933 type = submodule {
934 options = {
935 ldap = mkLdapOptions "Shaarli" {};
936 };
937 };
938 };
939 task = mkOption {
940 description = "Taskwarrior configuration";
941 type = submodule {
942 options = {
943 ldap = mkLdapOptions "Taskwarrior" {};
944 taskwarrior-web = mkOption {
945 description = "taskwarrior-web profiles";
946 type = attrsOf (submodule {
947 options = {
948 uid = mkOption {
949 type = listOf str;
950 description = "List of ldap uids having access to this profile";
951 };
952 org = mkOption { type = str; description = "Taskd organisation"; };
953 key = mkOption { type = str; description = "Taskd key"; };
954 date = mkOption { type = str; description = "Preferred date format"; };
955 };
956 });
957 };
958 };
959 };
960 };
961 ttrss = mkOption {
962 description = "TT-RSS configuration";
963 type = submodule {
964 options = {
965 postgresql = mkPsqlOptions "TT-RSS";
966 ldap = mkLdapOptions "TT-RSS" {};
967 };
968 };
969 };
970 wallabag = mkOption {
971 description = "Wallabag configuration";
972 type = submodule {
973 options = {
974 postgresql = mkPsqlOptions "Wallabag";
975 ldap = mkLdapOptions "Wallabag" {
976 admin_filter = mkOption { type = str; description = "Admin users filter"; };
977 };
978 redis = mkRedisOptions "Wallabag";
979 secret = mkOption { type = str; description = "App secret"; };
980 };
981 };
982 };
983 ympd = mkOption {
984 description = "Ympd configuration";
985 type = submodule {
986 options = {
987 listenPort = mkOption { type = port; description = "Port to listen to"; };
988 mpd = mkOption {
989 description = "MPD configuration";
990 type = submodule {
991 options = {
992 password = mkOption { type = str; description = "Password to access MPD host"; };
993 host = mkOption { type = str; description = "Host for MPD"; };
994 port = mkOption { type = port; description = "Port to access MPD host"; };
995 };
996 };
997 };
998 };
999 };
1000 };
1001 yourls = mkOption {
1002 description = "Yourls configuration";
1003 type = submodule {
1004 options = {
87a8bffd 1005 mysql = mkMysqlOptions "Yourls" {};
ab8f306d
IB		 1006 ldap = mkLdapOptions "Yourls" {};
1007 cookieKey = mkOption { type = str; description = "Cookie key"; };
1008 };
1009 };
1010 };
1011 };
1012 };
1013 };
1014 websites = mkOption {
1015 description = "Websites configurations";
1016 type = submodule {
1017 options = {
829ef7f1
IB		 1018 isabelle = mkOption {
1019 description = "Isabelle configurations by environment";
ab8f306d
IB		 1020 type =
1021 let
1022 atenSubmodule = mkOption {
1023 description = "environment configuration";
1024 type = submodule {
1025 options = {
1026 environment = mkOption { type = str; description = "Symfony environment"; };
1027 secret = mkOption { type = str; description = "Symfony App secret"; };
1028 postgresql = mkPsqlOptions "Aten";
1029 };
1030 };
1031 };
1032 in
1033 submodule {
1034 options = {
829ef7f1
IB		 1035 aten_production = atenSubmodule;
1036 aten_integration = atenSubmodule;
423c3f1c
IB		 1037 iridologie = mkOption {
1038 description = "environment configuration";
1039 type = submodule {
1040 options = {
1041 environment = mkOption { type = str; description = "SPIP environment"; };
1042 mysql = mkMysqlOptions "Iridologie" {};
1043 ldap = mkLdapOptions "Iridologie" {};
1044 };
1045 };
1046 };
ab8f306d
IB		 1047 };
1048 };
1049 };
1050 chloe = mkOption {
1051 description = "Chloe configurations by environment";
1052 type =
1053 let
1054 chloeSubmodule = mkOption {
1055 description = "environment configuration";
1056 type = submodule {
1057 options = {
423c3f1c 1058 environment = mkOption { type = str; description = "SPIP environment"; };
87a8bffd 1059 mysql = mkMysqlOptions "Chloe" {};
ab8f306d
IB		 1060 ldap = mkLdapOptions "Chloe" {};
1061 };
1062 };
1063 };
1064 in
1065 submodule {
1066 options = {
1067 production = chloeSubmodule;
1068 integration = chloeSubmodule;
1069 };
1070 };
1071 };
1072 connexionswing = mkOption {
1073 description = "Connexionswing configurations by environment";
1074 type =
1075 let
1076 csSubmodule = mkOption {
1077 description = "environment configuration";
1078 type = submodule {
1079 options = {
1080 environment = mkOption { type = str; description = "Symfony environment"; };
87a8bffd 1081 mysql = mkMysqlOptions "Connexionswing" {};
ab8f306d
IB		 1082 secret = mkOption { type = str; description = "Symfony App secret"; };
1083 email = mkOption { type = str; description = "Symfony email notification"; };
1084 };
1085 };
1086 };
1087 in
1088 submodule {
1089 options = {
1090 production = csSubmodule;
1091 integration = csSubmodule;
1092 };
1093 };
1094 };
1095 jerome = mkOption {
1096 description = "Naturaloutil configuration";
1097 type = submodule {
1098 options = {
87a8bffd 1099 mysql = mkMysqlOptions "Naturaloutil" {};
ab8f306d
IB		 1100 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1101 };
1102 };
1103 };
1104 telioTortay = mkOption {
1105 description = "Telio Tortay configuration";
1106 type = submodule {
1107 options = {
1108 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1109 };
1110 };
1111 };
1112 ludivinecassal = mkOption {
1113 description = "Ludivinecassal configurations by environment";
1114 type =
1115 let
1116 lcSubmodule = mkOption {
1117 description = "environment configuration";
1118 type = submodule {
1119 options = {
1120 environment = mkOption { type = str; description = "Symfony environment"; };
87a8bffd 1121 mysql = mkMysqlOptions "LudivineCassal" {};
ab8f306d
IB		 1122 ldap = mkLdapOptions "LudivineCassal" {};
1123 secret = mkOption { type = str; description = "Symfony App secret"; };
1124 };
1125 };
1126 };
1127 in
1128 submodule {
1129 options = {
1130 production = lcSubmodule;
1131 integration = lcSubmodule;
1132 };
1133 };
1134 };
1135 emilia = mkOption {
1136 description = "Emilia configuration";
1137 type = submodule {
1138 options = {
1139 postgresql = mkPsqlOptions "Emilia";
1140 };
1141 };
1142 };
1143 florian = mkOption {
1144 description = "Florian configuration";
1145 type = submodule {
1146 options = {
1147 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1148 };
1149 };
1150 };
1151 nassime = mkOption {
1152 description = "Nassime configuration";
1153 type = submodule {
1154 options = {
1155 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1156 };
1157 };
1158 };
1159 piedsjaloux = mkOption {
1160 description = "Piedsjaloux configurations by environment";
1161 type =
1162 let
1163 pjSubmodule = mkOption {
1164 description = "environment configuration";
1165 type = submodule {
1166 options = {
1167 environment = mkOption { type = str; description = "Symfony environment"; };
87a8bffd 1168 mysql = mkMysqlOptions "Piedsjaloux" {};
ab8f306d
IB		 1169 secret = mkOption { type = str; description = "Symfony App secret"; };
1170 };
1171 };
1172 };
1173 in
1174 submodule {
1175 options = {
1176 production = pjSubmodule;
1177 integration = pjSubmodule;
1178 };
1179 };
1180 };
91b75ffe
IB		 1181 richie = mkOption {
1182 description = "Europe Richie configurations by environment";
1183 type = submodule {
1184 options = {
87a8bffd 1185 mysql = mkMysqlOptions "Richie" {};
91b75ffe
IB		 1186 smtp_mailer = mkOption {
1187 description = "SMTP mailer configuration";
1188 type = submodule {
1189 options = {
1190 user = mkOption { type = str; description = "Username"; };
1191 password = mkOption { type = str; description = "Password"; };
1192 };
1193 };
1194 };
1195 };
1196 };
1197 };
ab8f306d
IB		 1198 tellesflorian = mkOption {
1199 description = "Tellesflorian configurations by environment";
1200 type =
1201 let
1202 tfSubmodule = mkOption {
1203 description = "environment configuration";
1204 type = submodule {
1205 options = {
1206 environment = mkOption { type = str; description = "Symfony environment"; };
87a8bffd 1207 mysql = mkMysqlOptions "Tellesflorian" {};
ab8f306d
IB		 1208 secret = mkOption { type = str; description = "Symfony App secret"; };
1209 invite_passwords = mkOption { type = str; description = "Password basic auth"; };
1210 };
1211 };
1212 };
1213 in
1214 submodule {
1215 options = {
1216 integration = tfSubmodule;
1217 };
1218 };
1219 };
1220 };
1221 };
1222 };
1223
1224 privateFiles = mkOption {
1225 type = path;
1226 description = ''
1227 Path to secret files to make available during build
1228 '';
1229 };
1230 };
619e4f46
IB		 1231 options.hostEnv = mkOption {
1232 readOnly = true;
1233 type = hostEnv;
1234 default = config.myEnv.servers."${name}";
1235 description = "Host environment";
ab8f306d
IB		 1236 };
1237}
My infrastructure configuration