]> git.immae.eu Git - perso/Immae/Config/Nix.git/blame - modules/private/environment.nix
projects / perso / Immae / Config / Nix.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Add Tinc VPN
[perso/Immae/Config/Nix.git] / modules / private / environment.nix
CommitLineData
619e4f46 1{ config, lib, name, ... }:
ab8f306d
IB		 2with lib;
3with types;
4with lists;
5let
6 ldapOptions = {
7 base = mkOption { description = "Base of the LDAP tree"; type = str; };
8 host = mkOption { description = "Host to access LDAP"; type = str; };
9 root_dn = mkOption { description = "DN of the root user"; type = str; };
10 root_pw = mkOption { description = "Hashed password of the root user"; type = str; };
11 replication_dn = mkOption { description = "DN of the user allowed to replicate the LDAP directory"; type = str; };
12 replication_pw = mkOption { description = "Password of the user allowed to replicate the LDAP directory"; type = str; };
13 };
14 mkLdapOptions = name: more: mkOption {
15 description = "${name} LDAP configuration";
16 type = submodule {
17 options = ldapOptions // {
18 dn = mkOption { description = "DN of the ${name} user"; type = str; };
19 password = mkOption { description = "password of the ${name} user"; type = str; };
20 filter = mkOption { description = "Filter for ${name} users"; type = str; default = ""; };
21 } // more;
22 };
23 };
24 mysqlOptions = {
25 host = mkOption { description = "Host to access Mysql"; type = str; };
619e4f46 26 remoteHost = mkOption { description = "Host to access Mysql from outside"; type = str; };
ab8f306d
IB		 27 port = mkOption { description = "Port to access Mysql"; type = str; };
28 socket = mkOption { description = "Socket to access Mysql"; type = path; };
29 systemUsers = mkOption {
30 description = "Attrs of user-passwords allowed to access mysql";
31 type = attrsOf str;
32 };
33 pam = mkOption {
34 description = "PAM configuration for mysql";
35 type = submodule {
36 options = {
37 dn = mkOption { description = "DN to connect as to check users"; type = str; };
38 password = mkOption { description = "DN password to connect as to check users"; type = str; };
39 filter = mkOption { description = "filter to match users"; type = str; };
40 };
41 };
42 };
43 };
87a8bffd 44 mkMysqlOptions = name: more: mkOption {
ab8f306d
IB		 45 description = "${name} mysql configuration";
46 type = submodule {
47 options = mysqlOptions // {
48 database = mkOption { description = "${name} database"; type = str; };
49 user = mkOption { description = "${name} user"; type = str; };
50 password = mkOption { description = "mysql password of the ${name} user"; type = str; };
87a8bffd 51 } // more;
ab8f306d
IB		 52 };
53 };
54 psqlOptions = {
55 host = mkOption { description = "Host to access Postgresql"; type = str; };
56 port = mkOption { description = "Port to access Postgresql"; type = str; };
57 socket = mkOption { description = "Socket to access Postgresql"; type = path; };
58 pam = mkOption {
59 description = "PAM configuration for psql";
60 type = submodule {
61 options = {
62 dn = mkOption { description = "DN to connect as to check users"; type = str; };
63 password = mkOption { description = "DN password to connect as to check users"; type = str; };
64 filter = mkOption { description = "filter to match users"; type = str; };
65 };
66 };
67 };
68 };
69 mkPsqlOptions = name: mkOption {
70 description = "${name} psql configuration";
71 type = submodule {
72 options = psqlOptions // {
73 database = mkOption { description = "${name} database"; type = str; };
74 schema = mkOption { description = "${name} schema"; type = nullOr str; default = null; };
75 user = mkOption { description = "${name} user"; type = str; };
76 password = mkOption { description = "psql password of the ${name} user"; type = str; };
77 };
78 };
79 };
80 redisOptions = {
81 host = mkOption { description = "Host to access Redis"; type = str; };
82 port = mkOption { description = "Port to access Redis"; type = str; };
83 socket = mkOption { description = "Socket to access Redis"; type = path; };
84 dbs = mkOption {
85 description = "Attrs of db number. Each number should be unique to avoid collision!";
86 type = attrsOf str;
87 };
88 spiped_key = mkOption {
89 type = str;
90 description = ''
91 Key to use with spiped to make a secure channel to replication
92 '';
93 };
94 predixy = mkOption {
95 description = "Predixy configuration. Unused yet";
96 type = submodule {
97 options = {
98 read = mkOption { type = str; description = "Read password"; };
99 };
100 };
101 };
102 };
103 mkRedisOptions = name: mkOption {
104 description = "${name} redis configuration";
105 type = submodule {
106 options = redisOptions // {
107 db = mkOption { description = "${name} database"; type = str; };
108 };
109 };
110 };
619e4f46
IB		 111 hostEnv = submodule {
112 options = {
113 fqdn = mkOption {
114 description = "Host FQDN";
115 type = str;
116 };
8a304ef4
IB		 117 users = mkOption {
118 type = unspecified;
119 default = pkgs: [];
120 description = ''
121 Sublist of users from realUsers. Function that takes pkgs as
122 argument and gives an array as a result
123 '';
124 };
619e4f46
IB		 125 emails = mkOption {
126 default = [];
127 description = "List of e-mails that the server can be a sender of";
128 type = listOf str;
129 };
130 ldap = mkOption {
131 description = ''
132 LDAP credentials for the host
133 '';
134 type = submodule {
135 options = {
136 password = mkOption { type = string; description = "Password for the LDAP connection"; };
137 dn = mkOption { type = string; description = "DN for the LDAP connection"; };
138 };
139 };
140 };
141 mx = mkOption {
142 description = "subdomain and priority for MX server";
143 default = { enable = false; };
144 type = submodule {
145 options = {
146 enable = mkEnableOption "Enable MX";
147 subdomain = mkOption { type = nullOr str; description = "Subdomain name (mx-*)"; };
148 priority = mkOption { type = nullOr str; description = "Priority"; };
149 };
150 };
151 };
152 ips = mkOption {
153 description = ''
154 attrs of ip4/ip6 grouped by section
155 '';
156 type = attrsOf (submodule {
157 options = {
158 ip4 = mkOption {
159 type = string;
160 description = ''
161 ip4 address of the host
162 '';
163 };
164 ip6 = mkOption {
165 type = listOf string;
166 default = [];
167 description = ''
168 ip6 addresses of the host
169 '';
170 };
171 };
172 });
173 };
174 };
175 };
ab8f306d
IB		 176in
177{
178 options.myEnv = {
179 servers = mkOption {
180 description = ''
181 Attrs of servers information in the cluster (not necessarily handled by nixops)
182 '';
183 default = {};
619e4f46 184 type = attrsOf hostEnv;
ab8f306d
IB		 185 };
186 hetznerCloud = mkOption {
187 description = ''
188 Hetzner Cloud credential information
189 '';
190 type = submodule {
191 options = {
192 authToken = mkOption {
193 type = str;
194 description = ''
195 The API auth token.
196 '';
197 };
198 };
199 };
200 };
201 hetzner = mkOption {
202 description = ''
203 Hetzner credential information
204 '';
205 type = submodule {
206 options = {
207 user = mkOption { type = str; description = "User"; };
208 pass = mkOption { type = str; description = "Password"; };
209 };
210 };
211 };
212 sshd = mkOption {
213 description = ''
214 sshd service credential information
215 '';
216 type = submodule {
217 options = {
218 ldap = mkOption {
219 description = ''
220 LDAP credentials for cn=ssh,ou=services,dc=immae,dc=eu dn
221 '';
222 type = submodule {
223 options = {
224 password = mkOption { description = "Password"; type = str; };
225 };
226 };
227 };
228 };
229 };
230 };
231 ports = mkOption {
232 description = ''
233 non-standard reserved ports. Must be unique!
234 '';
235 type = attrsOf port;
236 default = {};
237 apply = let
238 noDupl = x: builtins.length (builtins.attrValues x) == builtins.length (unique (builtins.attrValues x));
239 in
240 x: if isAttrs x && noDupl x then x else throw "Non unique values for ports";
241 };
242 httpd = mkOption {
243 description = ''
244 httpd service credential information
245 '';
246 type = submodule {
247 options = {
248 ldap = mkOption {
249 description = ''
250 LDAP credentials for cn=httpd,ou=services,dc=immae,dc=eu dn
251 '';
252 type = submodule {
253 options = {
254 password = mkOption { description = "Password"; type = str; };
255 };
256 };
257 };
258 };
259 };
260 };
261 ldap = mkOption {
262 description = ''
263 LDAP server configuration
264 '';
265 type = submodule {
266 options = ldapOptions;
267 };
268 };
269 databases = mkOption {
270 description = "Databases configuration";
271 type = submodule {
272 options = {
273 mysql = mkOption {
274 type = submodule { options = mysqlOptions; };
275 description = "Mysql configuration";
276 };
277 redis = mkOption {
278 type = submodule { options = redisOptions; };
279 description = "Redis configuration";
280 };
281 postgresql = mkOption {
282 type = submodule { options = psqlOptions; };
283 description = "Postgresql configuration";
284 };
285 };
286 };
287 };
288 jabber = mkOption {
289 description = "Jabber configuration";
290 type = submodule {
291 options = {
5b53d86f 292 postfix_user_filter = mkOption { type = str; description = "Postfix filter to get xmpp users"; };
ab8f306d
IB		 293 ldap = mkLdapOptions "Jabber" {};
294 postgresql = mkPsqlOptions "Jabber";
295 };
296 };
297 };
8a304ef4
IB		 298 realUsers = mkOption {
299 description = ''
300 Attrset of function taking pkgs as argument.
301 Real users settings, should provide a subattr of users.users.<name>
302 with at least: name, (hashed)Password, shell
303 '';
304 type = attrsOf unspecified;
305 };
ab8f306d
IB		 306 users = mkOption {
307 description = "System and regular users uid/gid";
308 type = attrsOf (submodule {
309 options = {
310 uid = mkOption {
311 description = "user uid";
312 type = int;
313 };
314 gid = mkOption {
315 description = "user gid";
316 type = int;
317 };
318 };
319 });
320 };
321 dns = mkOption {
322 description = "DNS configuration";
323 type = submodule {
324 options = {
325 soa = mkOption {
326 description = "SOA information";
327 type = submodule {
328 options = {
329 serial = mkOption {
330 description = "Serial number. Should be incremented at each change and unique";
331 type = str;
332 };
333 refresh = mkOption {
334 description = "Refresh time";
335 type = str;
336 };
337 retry = mkOption {
338 description = "Retry time";
339 type = str;
340 };
341 expire = mkOption {
342 description = "Expire time";
343 type = str;
344 };
345 ttl = mkOption {
346 description = "Default TTL time";
347 type = str;
348 };
349 email = mkOption {
350 description = "hostmaster e-mail";
351 type = str;
352 };
353 primary = mkOption {
354 description = "Primary NS";
355 type = str;
356 };
357 };
358 };
359 };
360 ns = mkOption {
361 description = "Attrs of NS servers group";
362 example = {
363 foo = {
364 "ns1.foo.com" = [ "198.51.100.10" "2001:db8:abcd::1" ];
365 "ns2.foo.com" = [ "198.51.100.15" "2001:db8:1234::1" ];
366 };
367 };
368 type = attrsOf (attrsOf (listOf str));
369 };
370 slaveZones = mkOption {
371 description = "List of slave zones";
372 type = listOf (submodule {
373 options = {
374 name = mkOption { type = str; description = "zone name"; };
375 masters = mkOption {
376 description = "NS master groups of this zone";
377 type = listOf str;
378 };
379 };
380 });
381 };
382 masterZones = mkOption {
383 description = "List of master zones";
384 type = listOf (submodule {
385 options = {
386 name = mkOption { type = str; description = "zone name"; };
387 slaves = mkOption {
388 description = "NS slave groups of this zone";
389 type = listOf str;
390 };
391 ns = mkOption {
392 description = "groups names that should have their NS entries listed here";
393 type = listOf str;
394 };
395 extra = mkOption {
396 description = "Extra zone configuration for bind";
397 example = ''
398 notify yes;
399 '';
400 type = lines;
401 };
402 entries = mkOption { type = lines; description = "Regular entries of the NS zone"; };
403 withEmail = mkOption {
404 description = "List of domains that should have mail entries (MX, dkim, SPF, ...)";
405 default = [];
406 type = listOf (submodule {
407 options = {
408 domain = mkOption { type = str; description = "Which subdomain is concerned"; };
409 send = mkOption { type = bool; description = "Whether there can be e-mails originating from the subdomain"; };
410 receive = mkOption { type = bool; description = "Whether there can be e-mails arriving to the subdomain"; };
411 };
412 });
413 };
414 };
415 });
416 };
417 };
418 };
419 };
420 backup = mkOption {
421 description = ''
422 Remote backup with duplicity
423 '';
424 type = submodule {
425 options = {
426 password = mkOption { type = str; description = "Password for encrypting files"; };
427 remote = mkOption { type = str; description = "Remote url access"; };
428 accessKeyId = mkOption { type = str; description = "Remote access-key"; };
429 secretAccessKey = mkOption { type = str; description = "Remote access secret"; };
430 };
431 };
432 };
433 rsync_backup = mkOption {
434 description =''
435 Rsync backup configuration from controlled host
436 '';
437 type = submodule {
438 options = {
ab8f306d
IB		 439 ssh_key = mkOption {
440 description = "SSH key information";
441 type = submodule {
442 options = {
443 public = mkOption { type = str; description = "Public part of the key"; };
444 private = mkOption { type = lines; description = "Private part of the key"; };
445 };
446 };
447 };
448 profiles = mkOption {
449 description = "Attrs of profiles to backup";
450 type = attrsOf (submodule {
451 options = {
452 keep = mkOption { type = int; description = "Number of backups to keep"; };
453 login = mkOption { type = str; description = "Login to connect to host"; };
454 port = mkOption { type = str; default = "22"; description = "Port to connect to host"; };
455 host = mkOption { type = str; description = "Host to connect to"; };
456 host_key = mkOption { type = str; description = "Host key"; };
457 host_key_type = mkOption { type = str; description = "Host key type"; };
458 parts = mkOption {
459 description = "Parts to backup for this host";
460 type = attrsOf (submodule {
461 options = {
462 remote_folder = mkOption { type = path; description = "Remote folder to backup";};
463 exclude_from = mkOption {
464 type = listOf path;
465 default = [];
466 description = "List of folders/files to exclude from the backup";
467 };
468 files_from = mkOption {
469 type = listOf path;
470 default = [];
471 description = "List of folders/files to backup in the base folder";
472 };
473 args = mkOption {
474 type = nullOr str;
475 default = null;
476 description = "Extra arguments to pass to rsync";
477 };
478 };
479 });
480 };
481 };
482 });
483 };
484 };
485 };
486 };
487 monitoring = mkOption {
488 description = "Monitoring configuration";
489 type = submodule {
490 options = {
491 status_url = mkOption { type = str; description = "URL to push status to"; };
492 status_token = mkOption { type = str; description = "Token for the status url"; };
e820134d 493 http_user_password = mkOption { type = str; description = "HTTP credentials to check services behind wall"; };
ab8f306d 494 email = mkOption { type = str; description = "Admin E-mail"; };
e820134d
IB		 495 ssh_public_key = mkOption { type = str; description = "SSH public key"; };
496 ssh_secret_key = mkOption { type = str; description = "SSH secret key"; };
497 imap_login = mkOption { type = str; description = "IMAP login"; };
498 imap_password = mkOption { type = str; description = "IMAP password"; };
25844101 499 eriomem_keys = mkOption { type = listOf (listOf str); description = "Eriomem keys"; default = []; };
e820134d
IB		 500 nrdp_tokens = mkOption { type = listOf str; description = "Tokens allowed to push status update"; };
501 slack_url = mkOption { type = str; description = "Slack webhook url to push status update"; };
502 slack_channel = mkOption { type = str; description = "Slack channel to push status update"; };
503 contacts = mkOption { type = attrsOf unspecified; description = "Contact dicts to fill naemon objects"; };
71a2425e
IB		 504 email_check = mkOption {
505 description = "Emails services to check";
506 type = attrsOf (submodule {
507 options = {
508 local = mkOption { type = bool; default = false; description = "Use local configuration"; };
509 port = mkOption { type = nullOr str; default = null; description = "Port to connect to ssh"; };
510 login = mkOption { type = nullOr str; default = null; description = "Login to connect to ssh"; };
511 targets = mkOption { type = listOf str; description = "Hosts to send E-mails to"; };
ef0a9217
IB		 512 mail_address = mkOption { type = nullOr str; default = null; description = "E-mail recipient part to send e-mail to"; };
513 mail_domain = mkOption { type = nullOr str; default = null; description = "E-mail domain part to send e-mail to"; };
71a2425e
IB		 514 };
515 });
516 };
ab8f306d
IB		 517 };
518 };
519 };
520 mpd = mkOption {
521 description = "MPD configuration";
522 type = submodule {
523 options = {
524 folder = mkOption { type = str; description = "Folder to serve from the MPD instance"; };
525 password = mkOption { type = str; description = "Password to connect to the MPD instance"; };
526 host = mkOption { type = str; description = "Host to connect to the MPD instance"; };
527 port = mkOption { type = str; description = "Port to connect to the MPD instance"; };
528 };
529 };
530 };
531 ftp = mkOption {
532 description = "FTP configuration";
533 type = submodule {
534 options = {
535 ldap = mkLdapOptions "FTP" {};
536 };
537 };
538 };
ea9c6fe8
IB		 539 vpn = mkOption {
540 description = "VPN configuration";
541 type = attrsOf (submodule {
542 options = {
543 prefix = mkOption { type = str; description = "ipv6 prefix for the vpn subnet"; };
544 privateKey = mkOption { type = str; description = "Private key for the host"; };
545 publicKey = mkOption { type = str; description = "Public key for the host"; };
546 };
547 });
548 };
ab8f306d
IB		 549 mail = mkOption {
550 description = "Mail configuration";
551 type = submodule {
552 options = {
553 dmarc = mkOption {
554 description = "DMARC configuration";
555 type = submodule {
556 options = {
557 ignore_hosts = mkOption {
558 type = lines;
559 description = ''
560 Hosts to ignore when checking for dmarc
561 '';
562 };
563 };
564 };
565 };
566 dkim = mkOption {
567 description = "DKIM configuration";
568 type = attrsOf (submodule {
569 options = {
570 public = mkOption {
571 type = str;
572 example = ''
573 ( "v=DKIM1; k=rsa; "
574 "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3w1a2aMxWw9+hdcmbqX4UevcVqr204y0K73Wdc7MPZiOOlUJQYsMNSYR1Y/SC7jmPKeitpcJCpQgn/cveJZbuikjjPLsDReHyFEYmC278ZLRTELHx6f1IXM8WE08JIRT69CfZiMi1rVcOh9qRT4F93PyjCauU8Y5hJjtg9ThsWwIDAQAB" )
575 '';
576 description = "Public entry to put in DNS TXT field";
577 };
578 private = mkOption { type = str; description = "Private key"; };
579 };
580 });
581 };
582 postfix = mkOption {
583 description = "Postfix configuration";
584 type = submodule {
585 options = {
586 additional_mailbox_domains = mkOption {
587 description = ''
588 List of domains that are used as mailbox final destination, in addition to those defined in the DNS records
589 '';
590 type = listOf str;
591 };
87a8bffd
IB		 592 mysql = mkMysqlOptions "Postfix" {
593 password_encrypt = mkOption { type = str; description = "Key to encrypt relay password in database"; };
594 };
ab8f306d
IB		 595 backup_domains = mkOption {
596 description = ''
597 Domains that are accepted for relay as backup domain
598 '';
599 type = attrsOf (submodule {
600 options = {
601 domains = mkOption { type = listOf str; description = "Domains list"; };
602 relay_restrictions = mkOption {
603 type = lines;
604 description = ''
605 Restrictions for relaying the e-mails from the domains
606 '';
607 };
608 recipient_maps = mkOption {
609 description = ''
610 Recipient map to accept relay for.
611 Must be specified for domain, the rules apply to everyone!
612 '';
613 type = listOf (submodule {
614 options = {
615 type = mkOption {
616 type = enum [ "hash" ];
617 description = "Map type";
618 };
619 content = mkOption {
620 type = str;
621 description = "Map content";
622 };
623 };
624 });
625 };
626 };
627 });
628 };
629 };
630 };
631 };
632 dovecot = mkOption {
633 description = "Dovecot configuration";
634 type = submodule {
635 options = {
636 ldap = mkLdapOptions "Dovecot" {
637 pass_attrs = mkOption { type = str; description = "Password attribute in LDAP"; };
638 user_attrs = mkOption { type = str; description = "User attribute mapping in LDAP"; };
639 iterate_attrs = mkOption { type = str; description = "User attribute mapping for listing in LDAP"; };
640 iterate_filter = mkOption { type = str; description = "User attribute filter for listing in LDAP"; };
641 };
642 };
643 };
644 };
645 rspamd = mkOption {
646 description = "rspamd configuration";
647 type = submodule {
648 options = {
649 redis = mkRedisOptions "Redis";
650 read_password_hashed = mkOption { type = str; description = "Hashed read password for rspamd"; };
651 write_password_hashed = mkOption { type = str; description = "Hashed write password for rspamd"; };
652 read_password = mkOption {
653 type = str;
654 description = "Read password for rspamd. Unused";
655 apply = x: "";
656 };
657 write_password = mkOption {
658 type = str;
659 description = "Write password for rspamd. Unused";
660 apply = x: "";
661 };
662 };
663 };
664 };
665 scripts = mkOption {
666 description = "Mail script recipients";
667 type = attrsOf (submodule {
668 options = {
5b53d86f 669 external = mkEnableOption "Create a script_<name>@mail.immae.eu external address";
ab8f306d
IB		 670 src = mkOption {
671 description = ''
672 git source to fetch the script from.
673 It must have a default.nix file as its root accepting a scriptEnv parameter
674 '';
675 type = submodule {
676 options = {
677 url = mkOption { type = str; description = "git url to fetch"; };
678 rev = mkOption { type = str; description = "git reference to fetch"; };
679 };
680 };
681 };
682 env = mkOption {
683 description = "Variables to pass to the script";
684 type = unspecified;
685 };
686 };
687 });
688 };
689 };
690 };
691 };
692 buildbot = mkOption {
693 description = "Buildbot configuration";
694 type = submodule {
695 options = {
696 user = mkOption {
697 description = "Buildbot user";
698 type = submodule {
699 options = {
700 uid = mkOption {
701 description = "user uid";
702 type = int;
703 };
704 gid = mkOption {
705 description = "user gid";
706 type = int;
707 };
708 };
709 };
710 };
711 ldap = mkOption {
712 description = "Ldap configuration for buildbot";
713 type = submodule {
714 options = {
715 password = mkOption { type = str; description = "Buildbot password"; };
716 };
717 };
718 };
719 projects = mkOption {
720 description = "Projects to make a buildbot for";
721 type = attrsOf (submodule {
722 options = {
723 name = mkOption { type = str; description = "Project name"; };
724 packages = mkOption {
725 type = unspecified;
726 example = literalExample ''
727 pkgs: [ pkgs.bash pkgs.git pkgs.gzip pkgs.openssh ];
728 '';
729 description = ''
730 Function.
731 Builds packages list to make available to buildbot project.
732 Takes pkgs as argument.
733 '';
734 };
735 pythonPackages = mkOption {
736 type = unspecified;
737 example = literalExample ''
738 p: pkgs: [ pkgs.python3Packages.pip ];
739 '';
740 description = ''
741 Function.
742 Builds python packages list to make available to buildbot project.
743 Takes buildbot python module as first argument and pkgs as second argument in order to augment the python modules list.
744 '';
745 };
746 pythonPathHome = mkOption { type = bool; description = "Whether to add project’s python home to python path"; };
747 secrets = mkOption {
748 type = attrsOf str;
749 description = "Secrets for the project to dump as files";
750 };
751 environment = mkOption {
752 type = attrsOf str;
753 description = ''
754 Environment variables for the project.
755 BUILDBOT_ is prefixed to the variable names
756 '';
757 };
758 activationScript = mkOption {
759 type = lines;
760 description = ''
761 Activation script to run during deployment
762 '';
763 };
764 builderPaths = mkOption {
765 type = attrsOf unspecified;
766 default = {};
767 description = ''
768 Attrs of functions to make accessible specifically per builder.
769 Takes pkgs as argument and should return a single path containing binaries.
770 This path will be accessible as BUILDBOT_PATH_<attrskey>
771 '';
772 };
773 webhookTokens = mkOption {
774 type = nullOr (listOf str);
775 default = null;
776 description = ''
777 List of tokens allowed to push to project’s change_hook/base endpoint
778 '';
779 };
780 };
781 });
782 };
783 };
784 };
785 };
786 tools = mkOption {
787 description = "Tools configurations";
788 type = submodule {
789 options = {
790 davical = mkOption {
791 description = "Davical configuration";
792 type = submodule {
793 options = {
794 postgresql = mkPsqlOptions "Davical";
795 ldap = mkLdapOptions "Davical" {};
796 };
797 };
798 };
799 diaspora = mkOption {
800 description = "Diaspora configuration";
801 type = submodule {
802 options = {
803 postgresql = mkPsqlOptions "Diaspora";
804 redis = mkRedisOptions "Diaspora";
805 ldap = mkLdapOptions "Diaspora" {};
806 secret_token = mkOption { type = str; description = "Secret token"; };
807 };
808 };
809 };
810 etherpad-lite = mkOption {
811 description = "Etherpad configuration";
812 type = submodule {
813 options = {
814 postgresql = mkPsqlOptions "Etherpad";
815 ldap = mkLdapOptions "Etherpad" {
816 group_filter = mkOption { type = str; description = "Filter for groups"; };
817 };
818 session_key = mkOption { type = str; description = "Session key"; };
819 api_key = mkOption { type = str; description = "API key"; };
820 redirects = mkOption { type = str; description = "Redirects for apache"; };
821 };
822 };
823 };
824 gitolite = mkOption {
825 description = "Gitolite configuration";
826 type = submodule {
827 options = {
828 ldap = mkLdapOptions "Gitolite" {};
829 };
830 };
831 };
832 kanboard = mkOption {
833 description = "Kanboard configuration";
834 type = submodule {
835 options = {
836 postgresql = mkPsqlOptions "Kanboard";
837 ldap = mkLdapOptions "Kanboard" {
838 admin_dn = mkOption { type = str; description = "Admin DN"; };
839 };
840 };
841 };
842 };
843 mantisbt = mkOption {
844 description = "Mantisbt configuration";
845 type = submodule {
846 options = {
847 postgresql = mkPsqlOptions "Mantisbt";
848 ldap = mkLdapOptions "Mantisbt" {};
849 master_salt = mkOption { type = str; description = "Master salt for password hash"; };
850 };
851 };
852 };
853 mastodon = mkOption {
854 description = "Mastodon configuration";
855 type = submodule {
856 options = {
857 postgresql = mkPsqlOptions "Mastodon";
858 redis = mkRedisOptions "Mastodon";
859 ldap = mkLdapOptions "Mastodon" {};
860 paperclip_secret = mkOption { type = str; description = "Paperclip secret"; };
861 otp_secret = mkOption { type = str; description = "OTP secret"; };
862 secret_key_base = mkOption { type = str; description = "Secret key base"; };
863 vapid = mkOption {
864 description = "vapid key";
865 type = submodule {
866 options = {
867 private = mkOption { type = str; description = "Private key"; };
868 public = mkOption { type = str; description = "Public key"; };
869 };
870 };
871 };
872 };
873 };
874 };
875 mediagoblin = mkOption {
876 description = "Mediagoblin configuration";
877 type = submodule {
878 options = {
879 postgresql = mkPsqlOptions "Mediagoblin";
880 redis = mkRedisOptions "Mediagoblin";
881 ldap = mkLdapOptions "Mediagoblin" {};
882 };
883 };
884 };
885 nextcloud = mkOption {
886 description = "Nextcloud configuration";
887 type = submodule {
888 options = {
889 postgresql = mkPsqlOptions "Peertube";
890 redis = mkRedisOptions "Peertube";
891 password_salt = mkOption { type = str; description = "Password salt"; };
892 instance_id = mkOption { type = str; description = "Instance ID"; };
893 secret = mkOption { type = str; description = "App secret"; };
894 };
895 };
896 };
897 peertube = mkOption {
898 description = "Peertube configuration";
899 type = submodule {
900 options = {
901 listenPort = mkOption { type = port; description = "Port to listen to"; };
902 postgresql = mkPsqlOptions "Peertube";
903 redis = mkRedisOptions "Peertube";
904 ldap = mkLdapOptions "Peertube" {};
905 };
906 };
907 };
908 phpldapadmin = mkOption {
909 description = "phpLdapAdmin configuration";
910 type = submodule {
911 options = {
912 ldap = mkLdapOptions "phpldapadmin" {};
913 };
914 };
915 };
916 rompr = mkOption {
917 description = "Rompr configuration";
918 type = submodule {
919 options = {
920 mpd = mkOption {
921 description = "MPD configuration";
922 type = submodule {
923 options = {
924 host = mkOption { type = str; description = "Host for MPD"; };
925 port = mkOption { type = port; description = "Port to access MPD host"; };
926 };
927 };
928 };
929 };
930 };
931 };
932 roundcubemail = mkOption {
933 description = "Roundcubemail configuration";
934 type = submodule {
935 options = {
936 postgresql = mkPsqlOptions "TT-RSS";
937 secret = mkOption { type = str; description = "Secret"; };
938 };
939 };
940 };
941 shaarli = mkOption {
942 description = "Shaarli configuration";
943 type = submodule {
944 options = {
945 ldap = mkLdapOptions "Shaarli" {};
946 };
947 };
948 };
949 task = mkOption {
950 description = "Taskwarrior configuration";
951 type = submodule {
952 options = {
953 ldap = mkLdapOptions "Taskwarrior" {};
954 taskwarrior-web = mkOption {
955 description = "taskwarrior-web profiles";
956 type = attrsOf (submodule {
957 options = {
958 uid = mkOption {
959 type = listOf str;
960 description = "List of ldap uids having access to this profile";
961 };
962 org = mkOption { type = str; description = "Taskd organisation"; };
963 key = mkOption { type = str; description = "Taskd key"; };
964 date = mkOption { type = str; description = "Preferred date format"; };
965 };
966 });
967 };
968 };
969 };
970 };
971 ttrss = mkOption {
972 description = "TT-RSS configuration";
973 type = submodule {
974 options = {
975 postgresql = mkPsqlOptions "TT-RSS";
976 ldap = mkLdapOptions "TT-RSS" {};
977 };
978 };
979 };
980 wallabag = mkOption {
981 description = "Wallabag configuration";
982 type = submodule {
983 options = {
984 postgresql = mkPsqlOptions "Wallabag";
985 ldap = mkLdapOptions "Wallabag" {
986 admin_filter = mkOption { type = str; description = "Admin users filter"; };
987 };
988 redis = mkRedisOptions "Wallabag";
989 secret = mkOption { type = str; description = "App secret"; };
990 };
991 };
992 };
993 ympd = mkOption {
994 description = "Ympd configuration";
995 type = submodule {
996 options = {
997 listenPort = mkOption { type = port; description = "Port to listen to"; };
998 mpd = mkOption {
999 description = "MPD configuration";
1000 type = submodule {
1001 options = {
1002 password = mkOption { type = str; description = "Password to access MPD host"; };
1003 host = mkOption { type = str; description = "Host for MPD"; };
1004 port = mkOption { type = port; description = "Port to access MPD host"; };
1005 };
1006 };
1007 };
1008 };
1009 };
1010 };
1011 yourls = mkOption {
1012 description = "Yourls configuration";
1013 type = submodule {
1014 options = {
87a8bffd 1015 mysql = mkMysqlOptions "Yourls" {};
ab8f306d
IB		 1016 ldap = mkLdapOptions "Yourls" {};
1017 cookieKey = mkOption { type = str; description = "Cookie key"; };
1018 };
1019 };
1020 };
1021 };
1022 };
1023 };
1024 websites = mkOption {
1025 description = "Websites configurations";
1026 type = submodule {
1027 options = {
829ef7f1
IB		 1028 isabelle = mkOption {
1029 description = "Isabelle configurations by environment";
ab8f306d
IB		 1030 type =
1031 let
1032 atenSubmodule = mkOption {
1033 description = "environment configuration";
1034 type = submodule {
1035 options = {
1036 environment = mkOption { type = str; description = "Symfony environment"; };
1037 secret = mkOption { type = str; description = "Symfony App secret"; };
1038 postgresql = mkPsqlOptions "Aten";
1039 };
1040 };
1041 };
1042 in
1043 submodule {
1044 options = {
829ef7f1
IB		 1045 aten_production = atenSubmodule;
1046 aten_integration = atenSubmodule;
423c3f1c
IB		 1047 iridologie = mkOption {
1048 description = "environment configuration";
1049 type = submodule {
1050 options = {
1051 environment = mkOption { type = str; description = "SPIP environment"; };
1052 mysql = mkMysqlOptions "Iridologie" {};
1053 ldap = mkLdapOptions "Iridologie" {};
1054 };
1055 };
1056 };
ab8f306d
IB		 1057 };
1058 };
1059 };
1060 chloe = mkOption {
1061 description = "Chloe configurations by environment";
1062 type =
1063 let
1064 chloeSubmodule = mkOption {
1065 description = "environment configuration";
1066 type = submodule {
1067 options = {
423c3f1c 1068 environment = mkOption { type = str; description = "SPIP environment"; };
87a8bffd 1069 mysql = mkMysqlOptions "Chloe" {};
ab8f306d
IB		 1070 ldap = mkLdapOptions "Chloe" {};
1071 };
1072 };
1073 };
1074 in
1075 submodule {
1076 options = {
1077 production = chloeSubmodule;
1078 integration = chloeSubmodule;
1079 };
1080 };
1081 };
1082 connexionswing = mkOption {
1083 description = "Connexionswing configurations by environment";
1084 type =
1085 let
1086 csSubmodule = mkOption {
1087 description = "environment configuration";
1088 type = submodule {
1089 options = {
1090 environment = mkOption { type = str; description = "Symfony environment"; };
87a8bffd 1091 mysql = mkMysqlOptions "Connexionswing" {};
ab8f306d
IB		 1092 secret = mkOption { type = str; description = "Symfony App secret"; };
1093 email = mkOption { type = str; description = "Symfony email notification"; };
1094 };
1095 };
1096 };
1097 in
1098 submodule {
1099 options = {
1100 production = csSubmodule;
1101 integration = csSubmodule;
1102 };
1103 };
1104 };
1105 jerome = mkOption {
1106 description = "Naturaloutil configuration";
1107 type = submodule {
1108 options = {
87a8bffd 1109 mysql = mkMysqlOptions "Naturaloutil" {};
ab8f306d
IB		 1110 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1111 };
1112 };
1113 };
1114 telioTortay = mkOption {
1115 description = "Telio Tortay configuration";
1116 type = submodule {
1117 options = {
1118 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1119 };
1120 };
1121 };
1122 ludivinecassal = mkOption {
1123 description = "Ludivinecassal configurations by environment";
1124 type =
1125 let
1126 lcSubmodule = mkOption {
1127 description = "environment configuration";
1128 type = submodule {
1129 options = {
1130 environment = mkOption { type = str; description = "Symfony environment"; };
87a8bffd 1131 mysql = mkMysqlOptions "LudivineCassal" {};
ab8f306d
IB		 1132 ldap = mkLdapOptions "LudivineCassal" {};
1133 secret = mkOption { type = str; description = "Symfony App secret"; };
1134 };
1135 };
1136 };
1137 in
1138 submodule {
1139 options = {
1140 production = lcSubmodule;
1141 integration = lcSubmodule;
1142 };
1143 };
1144 };
1145 emilia = mkOption {
1146 description = "Emilia configuration";
1147 type = submodule {
1148 options = {
1149 postgresql = mkPsqlOptions "Emilia";
1150 };
1151 };
1152 };
1153 florian = mkOption {
1154 description = "Florian configuration";
1155 type = submodule {
1156 options = {
1157 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1158 };
1159 };
1160 };
1161 nassime = mkOption {
1162 description = "Nassime configuration";
1163 type = submodule {
1164 options = {
1165 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1166 };
1167 };
1168 };
1169 piedsjaloux = mkOption {
1170 description = "Piedsjaloux configurations by environment";
1171 type =
1172 let
1173 pjSubmodule = mkOption {
1174 description = "environment configuration";
1175 type = submodule {
1176 options = {
1177 environment = mkOption { type = str; description = "Symfony environment"; };
87a8bffd 1178 mysql = mkMysqlOptions "Piedsjaloux" {};
ab8f306d
IB		 1179 secret = mkOption { type = str; description = "Symfony App secret"; };
1180 };
1181 };
1182 };
1183 in
1184 submodule {
1185 options = {
1186 production = pjSubmodule;
1187 integration = pjSubmodule;
1188 };
1189 };
1190 };
91b75ffe
IB		 1191 richie = mkOption {
1192 description = "Europe Richie configurations by environment";
1193 type = submodule {
1194 options = {
87a8bffd 1195 mysql = mkMysqlOptions "Richie" {};
91b75ffe
IB		 1196 smtp_mailer = mkOption {
1197 description = "SMTP mailer configuration";
1198 type = submodule {
1199 options = {
1200 user = mkOption { type = str; description = "Username"; };
1201 password = mkOption { type = str; description = "Password"; };
1202 };
1203 };
1204 };
1205 };
1206 };
1207 };
ab8f306d
IB		 1208 tellesflorian = mkOption {
1209 description = "Tellesflorian configurations by environment";
1210 type =
1211 let
1212 tfSubmodule = mkOption {
1213 description = "environment configuration";
1214 type = submodule {
1215 options = {
1216 environment = mkOption { type = str; description = "Symfony environment"; };
87a8bffd 1217 mysql = mkMysqlOptions "Tellesflorian" {};
ab8f306d
IB		 1218 secret = mkOption { type = str; description = "Symfony App secret"; };
1219 invite_passwords = mkOption { type = str; description = "Password basic auth"; };
1220 };
1221 };
1222 };
1223 in
1224 submodule {
1225 options = {
1226 integration = tfSubmodule;
1227 };
1228 };
1229 };
1230 };
1231 };
1232 };
1233
1234 privateFiles = mkOption {
1235 type = path;
1236 description = ''
1237 Path to secret files to make available during build
1238 '';
1239 };
1240 };
619e4f46
IB		 1241 options.hostEnv = mkOption {
1242 readOnly = true;
1243 type = hostEnv;
1244 default = config.myEnv.servers."${name}";
1245 description = "Host environment";
ab8f306d
IB		 1246 };
1247}
My infrastructure configuration