flakes/private/environment/flake.nix

   1 {
   2   outputs = { self }: {
   3     nixosModule = self.nixosModules.environment;
   4     nixosModules.environment = { config, lib, name, ... }:
   5       with lib;
   6       with types;
   7       with lists;
   8       let
   9         ldapOptions = {
  10           base = mkOption { description = "Base of the LDAP tree"; type = str; };
  11           host = mkOption { description = "Host to access LDAP"; type = str; };
  12           root_dn = mkOption { description = "DN of the root user"; type = str; };
  13           root_pw = mkOption { description = "Hashed password of the root user"; type = str; };
  14           replication_dn = mkOption { description = "DN of the user allowed to replicate the LDAP directory"; type = str; };
  15           replication_pw = mkOption { description = "Password of the user allowed to replicate the LDAP directory"; type = str; };
  16         };
  17         mkLdapOptions = name: more: mkOption {
  18           description = "${name} LDAP configuration";
  19           type = submodule {
  20             options = ldapOptions // {
  21               dn = mkOption { description = "DN of the ${name} user"; type = str; };
  22               password = mkOption { description = "password of the ${name} user"; type = str; };
  23               filter = mkOption { description = "Filter for ${name} users"; type = str; default = ""; };
  24             } // more;
  25           };
  26         };
  27         mysqlOptions = {
  28           host = mkOption { description = "Host to access Mysql"; type = str; };
  29           remoteHost = mkOption { description = "Host to access Mysql from outside"; type = str; };
  30           port = mkOption { description = "Port to access Mysql"; type = int; };
  31           socket = mkOption { description = "Socket to access Mysql"; type = path; };
  32           systemUsers = mkOption {
  33             description = "Attrs of user-passwords allowed to access mysql";
  34             type = attrsOf str;
  35           };
  36           pam = mkOption {
  37             description = "PAM configuration for mysql";
  38             type = submodule {
  39               options = {
  40                 dn = mkOption { description = "DN to connect as to check users"; type = str; };
  41                 password = mkOption { description = "DN password to connect as to check users"; type = str; };
  42                 filter = mkOption { description = "filter to match users"; type = str; };
  43               };
  44             };
  45           };
  46         };
  47         mkMysqlOptions = name: more: mkOption {
  48           description = "${name} mysql configuration";
  49           type = submodule {
  50             options = mysqlOptions // {
  51               database = mkOption { description = "${name} database"; type = str; };
  52               user = mkOption { description = "${name} user"; type = str; };
  53               password = mkOption { description = "mysql password of the ${name} user"; type = str; };
  54             } // more;
  55           };
  56         };
  57         psqlOptions = {
  58           host = mkOption { description = "Host to access Postgresql"; type = str; };
  59           port = mkOption { description = "Port to access Postgresql"; type = str; };
  60           socket = mkOption { description = "Socket to access Postgresql"; type = path; };
  61           pam = mkOption {
  62             description = "PAM configuration for psql";
  63             type = submodule {
  64               options = {
  65                 dn = mkOption { description = "DN to connect as to check users"; type = str; };
  66                 password = mkOption { description = "DN password to connect as to check users"; type = str; };
  67                 filter = mkOption { description = "filter to match users"; type = str; };
  68               };
  69             };
  70           };
  71         };
  72         mkPsqlOptions = name: mkOption {
  73           description = "${name} psql configuration";
  74           type = submodule {
  75             options = psqlOptions // {
  76               database = mkOption { description = "${name} database"; type = str; };
  77               schema = mkOption { description = "${name} schema"; type = nullOr str; default = null; };
  78               user = mkOption { description = "${name} user"; type = str; };
  79               password = mkOption { description = "psql password of the ${name} user"; type = str; };
  80             };
  81           };
  82         };
  83         redisOptions = {
  84           host = mkOption { description = "Host to access Redis"; type = str; };
  85           port = mkOption { description = "Port to access Redis"; type = str; };
  86           socket = mkOption { description = "Socket to access Redis"; type = path; };
  87           dbs = mkOption {
  88             description = "Attrs of db number. Each number should be unique to avoid collision!";
  89             type = attrsOf str;
  90           };
  91           spiped_key = mkOption {
  92             type = str;
  93             description = ''
  94               Key to use with spiped to make a secure channel to replication
  95               '';
  96           };
  97           predixy = mkOption {
  98             description = "Predixy configuration. Unused yet";
  99             type = submodule {
 100               options = {
 101                 read = mkOption { type = str; description = "Read password"; };
 102               };
 103             };
 104           };
 105         };
 106         mkRedisOptions = name: mkOption {
 107           description = "${name} redis configuration";
 108           type = submodule {
 109             options = redisOptions // {
 110               db = mkOption { description = "${name} database"; type = str; };
 111             };
 112           };
 113         };
 114         smtpOptions = {
 115           host = mkOption { description = "Host to access SMTP"; type = str; };
 116           port = mkOption { description = "Port to access SMTP"; type = str; };
 117         };
 118         mkSmtpOptions = name: mkOption {
 119           description = "${name} smtp configuration";
 120           type = submodule {
 121             options = smtpOptions // {
 122               email = mkOption { description = "${name} email"; type = str; };
 123               password = mkOption { description = "SMTP password of the ${name} user"; type = str; };
 124             };
 125           };
 126         };
 127         hostEnv = submodule {
 128           options = {
 129             fqdn = mkOption {
 130               description = "Host FQDN";
 131               type = str;
 132             };
 133             hostKey = mkOption {
 134               type = nullOr str;
 135               default = null;
 136               description = ''
 137                 ssh host key
 138               '';
 139             };
 140             isVm = mkEnableOption "The host is a vm";
 141             emails = mkOption {
 142               default = [];
 143               description = "List of e-mails that the server can be a sender of";
 144               type = listOf str;
 145             };
 146             ldap = mkOption {
 147               description = ''
 148                 LDAP credentials for the host
 149               '';
 150               type = submodule {
 151                 options = {
 152                   password = mkOption { type = str; description = "Password for the LDAP connection"; };
 153                   dn = mkOption { type = str; description = "DN for the LDAP connection"; };
 154                 };
 155               };
 156             };
 157             mx = mkOption {
 158               description = "subdomain and priority for MX server";
 159               default = { enable = false; };
 160               type = submodule {
 161                 options = {
 162                   enable = mkEnableOption "Enable MX";
 163                   subdomain = mkOption { type = nullOr str; description = "Subdomain name (mx-*)"; };
 164                   priority = mkOption { type = nullOr int; description = "Priority"; };
 165                 };
 166               };
 167             };
 168             ips = mkOption {
 169               description = ''
 170                 attrs of ip4/ip6 grouped by section
 171               '';
 172               type = attrsOf (submodule {
 173                 options = {
 174                   alias = mkOption {
 175                     type = nullOr str;
 176                     default = null;
 177                     description = ''
 178                       alias to use in DNS for that group
 179                     '';
 180                   };
 181                   ip4 = mkOption {
 182                     type = listOf str;
 183                     default = [];
 184                     description = ''
 185                       ip4 addresses of the host
 186                     '';
 187                   };
 188                   ip6 = mkOption {
 189                     type = listOf str;
 190                     default = [];
 191                     description = ''
 192                       ip6 addresses of the host
 193                     '';
 194                   };
 195                 };
 196               });
 197             };
 198           };
 199         };
 200       in
 201       {
 202         # Necessary for situations where flake gets included multiple times
 203         key = builtins.hashString "sha256" (builtins.path { path = self.sourceInfo.outPath; name = "source"; });
 204
 205         options.myEnv = {
 206           servers = mkOption {
 207             description = ''
 208               Attrs of servers information in the cluster (not necessarily handled by nixops)
 209             '';
 210             default = {};
 211             type = attrsOf hostEnv;
 212           };
 213           hetznerCloud = mkOption {
 214             description = ''
 215               Hetzner Cloud credential information
 216             '';
 217             type = submodule {
 218               options = {
 219                 authToken = mkOption {
 220                   type = str;
 221                   description = ''
 222                     The API auth token.
 223                   '';
 224                 };
 225               };
 226             };
 227           };
 228           hetzner = mkOption {
 229             description = ''
 230               Hetzner credential information
 231             '';
 232             type = submodule {
 233               options = {
 234                 user = mkOption { type = str; description = "User"; };
 235                 pass = mkOption { type = str; description = "Password"; };
 236               };
 237             };
 238           };
 239           sshd = mkOption {
 240             description = ''
 241               sshd service credential information
 242             '';
 243             type = submodule {
 244               options = {
 245                 rootKeys = mkOption { type = attrsOf str; description = "Keys of root users"; };
 246                 ldap = mkOption {
 247                   description = ''
 248                     LDAP credentials for cn=ssh,ou=services,dc=immae,dc=eu dn
 249                   '';
 250                   type = submodule {
 251                     options = {
 252                       password = mkOption { description = "Password"; type = str; };
 253                     };
 254                   };
 255                 };
 256                 psql = mkOption {
 257                   description = ''
 258                     PSQL credentials for immae_auth_read
 259                   '';
 260                   type = submodule {
 261                     options = {
 262                       password = mkOption { description = "Password"; type = str; };
 263                     };
 264                   };
 265                 };
 266               };
 267             };
 268           };
 269           ports = mkOption {
 270             description = ''
 271               non-standard reserved ports. Must be unique!
 272             '';
 273             type = attrsOf port;
 274             default = {};
 275             apply = let
 276               noDupl = x: builtins.length (builtins.attrValues x) == builtins.length (unique (builtins.attrValues x));
 277             in
 278               x: if isAttrs x && noDupl x then x else throw "Non unique values for ports";
 279           };
 280           httpd = mkOption {
 281             description = ''
 282               httpd service credential information
 283             '';
 284             type = submodule {
 285               options = {
 286                 ldap = mkOption {
 287                   description = ''
 288                     LDAP credentials for cn=httpd,ou=services,dc=immae,dc=eu dn
 289                   '';
 290                   type = submodule {
 291                     options = {
 292                       password = mkOption { description = "Password"; type = str; };
 293                     };
 294                   };
 295                 };
 296               };
 297             };
 298           };
 299           smtp = mkOption {
 300             type = submodule { options = smtpOptions; };
 301             description = "SMTP configuration";
 302           };
 303           ldap = mkOption {
 304             description = ''
 305               LDAP server configuration
 306               '';
 307             type = submodule {
 308               options = ldapOptions;
 309             };
 310           };
 311           databases = mkOption {
 312             description = "Databases configuration";
 313             type = submodule {
 314               options = {
 315                 mysql = mkOption {
 316                   type = submodule { options = mysqlOptions; };
 317                   description = "Mysql configuration";
 318                 };
 319                 redis = mkOption {
 320                   type = submodule { options = redisOptions; };
 321                   description = "Redis configuration";
 322                 };
 323                 postgresql = mkOption {
 324                   type = submodule { options = psqlOptions; };
 325                   description = "Postgresql configuration";
 326                 };
 327               };
 328             };
 329           };
 330           jabber = mkOption {
 331             description = "Jabber configuration";
 332             type = submodule {
 333               options = {
 334                 postfix_user_filter = mkOption { type = str; description = "Postfix filter to get xmpp users"; };
 335                 ldap = mkLdapOptions "Jabber" {};
 336                 postgresql = mkPsqlOptions "Jabber";
 337               };
 338             };
 339           };
 340           users = mkOption {
 341             description = "System and regular users uid/gid";
 342             type = attrsOf (submodule {
 343               options = {
 344                 uid = mkOption {
 345                   description = "user uid";
 346                   type = int;
 347                 };
 348                 gid = mkOption {
 349                   description = "user gid";
 350                   type = int;
 351                 };
 352               };
 353             });
 354           };
 355           dns = mkOption {
 356             description = "DNS configuration";
 357             type = submodule {
 358               options = {
 359                 ns = mkOption {
 360                   description = "Attrs of NS servers group";
 361                   example = {
 362                     foo = {
 363                       "ns1.foo.com" = [ "198.51.100.10" "2001:db8:abcd::1" ];
 364                       "ns2.foo.com" = [ "198.51.100.15" "2001:db8:1234::1" ];
 365                     };
 366                   };
 367                   type = attrsOf (attrsOf (listOf str));
 368                 };
 369               };
 370             };
 371           };
 372           backup = mkOption {
 373             description = ''
 374               Remote backup with duplicity
 375               '';
 376             type = submodule {
 377               options = {
 378                 password = mkOption { type = str; description = "Password for encrypting files"; };
 379                 remotes = mkOption {
 380                   type = attrsOf (submodule {
 381                     options = {
 382                       remote = mkOption {
 383                         type = functionTo str;
 384                         example = literalExample ''
 385                           bucket: "s3://some_host/${bucket}";
 386                           '';
 387                         description = ''
 388                           Function.
 389                           Takes a bucket name as argument and returns a url
 390                           '';
 391                       };
 392                       accessKeyId = mkOption { type = str; description = "Remote access-key"; };
 393                       secretAccessKey = mkOption { type = str; description = "Remote access secret"; };
 394                     };
 395                   });
 396                 };
 397               };
 398             };
 399           };
 400           zrepl_backup = mkOption {
 401             type = submodule {
 402               options = {
 403                 ssh_key = mkOption {
 404                   description = "SSH key information";
 405                   type = submodule {
 406                     options = {
 407                       public = mkOption { type = str; description = "Public part of the key"; };
 408                       private = mkOption { type = lines; description = "Private part of the key"; };
 409                     };
 410                   };
 411                 };
 412                 mysql = mkMysqlOptions "Zrepl" {};
 413                 certs = mkOption {
 414                   description = "Certificates";
 415                   type = attrsOf (submodule {
 416                     options = {
 417                       key = mkOption { type = str; description = "Key"; };
 418                       certificate = mkOption { type = str; description = "Certificate"; };
 419                     };
 420                   });
 421                 };
 422               };
 423             };
 424           };
 425           rsync_backup = mkOption {
 426             description  =''
 427               Rsync backup configuration from controlled host
 428               '';
 429             type = submodule {
 430               options = {
 431                 ssh_key = mkOption {
 432                   description = "SSH key information";
 433                   type = submodule {
 434                     options = {
 435                       public = mkOption { type = str; description = "Public part of the key"; };
 436                       private = mkOption { type = lines; description = "Private part of the key"; };
 437                     };
 438                   };
 439                 };
 440                 profiles = mkOption {
 441                   description = "Attrs of profiles to backup";
 442                   default = {};
 443                   type = attrsOf (submodule {
 444                     options = {
 445                       keep = mkOption { type = int; description = "Number of backups to keep"; };
 446                       check_command = mkOption { type = str; description = "command to check if backup needs to be done"; default = "backup"; };
 447                       login = mkOption { type = str; description = "Login to connect to host"; };
 448                       port = mkOption { type = str; default = "22"; description = "Port to connect to host"; };
 449                       host = mkOption { type = str; description = "Host to connect to"; };
 450                       host_key = mkOption { type = str; description = "Host key"; };
 451                       host_key_type = mkOption { type = str; description = "Host key type"; };
 452                       parts = mkOption {
 453                         description = "Parts to backup for this host";
 454                         type = attrsOf (submodule {
 455                           options = {
 456                             remote_folder = mkOption { type = path; description = "Remote folder to backup";};
 457                             exclude_from = mkOption {
 458                               type = listOf path;
 459                               default = [];
 460                               description = "List of folders/files to exclude from the backup";
 461                             };
 462                             files_from = mkOption {
 463                               type = listOf path;
 464                               default = [];
 465                               description = "List of folders/files to backup in the base folder";
 466                             };
 467                             args = mkOption {
 468                               type = nullOr str;
 469                               default = null;
 470                               description = "Extra arguments to pass to rsync";
 471                             };
 472                           };
 473                         });
 474                       };
 475                     };
 476                   });
 477                 };
 478               };
 479             };
 480           };
 481           monitoring = mkOption {
 482             description = "Monitoring configuration";
 483             type = submodule {
 484               options = {
 485                 status_url = mkOption { type = str; description = "URL to push status to"; };
 486                 status_token = mkOption { type = str; description = "Token for the status url"; };
 487                 http_user_password = mkOption { type = str; description = "HTTP credentials to check services behind wall"; };
 488                 email = mkOption { type = str; description = "Admin E-mail"; };
 489                 ssh_public_key = mkOption { type = str; description = "SSH public key"; };
 490                 ssh_secret_key = mkOption { type = str; description = "SSH secret key"; };
 491                 imap_login = mkOption { type = str; description = "IMAP login"; };
 492                 imap_password = mkOption { type = str; description = "IMAP password"; };
 493                 eriomem_keys = mkOption { type = listOf (listOf str); description = "Eriomem keys"; default = []; };
 494                 ovh_sms = mkOption {
 495                   description = "OVH credentials for sms script";
 496                   type = submodule {
 497                     options = {
 498                       endpoint = mkOption { type = str; default = "ovh-eu"; description = "OVH endpoint"; };
 499                       application_key = mkOption { type = str; description = "Application key"; };
 500                       application_secret = mkOption { type = str; description = "Application secret"; };
 501                       consumer_key = mkOption { type = str; description = "Consumer key"; };
 502                       account = mkOption { type = str; description = "Account"; };
 503                     };
 504                   };
 505                 };
 506                 nrdp_tokens = mkOption { type = listOf str; description = "Tokens allowed to push status update"; };
 507                 apprise_urls = mkOption { type = str; description = "Apprise space-separated urls to push status update"; };
 508                 netdata_aggregator = mkOption { type = str; description = "Url where netdata information should be sent"; };
 509                 netdata_keys = mkOption { type = attrsOf str; description = "netdata host keys"; };
 510                 immae_contact = mkOption { type = str; description = "Immae Contact e-mail"; };
 511                 email_check = mkOption {
 512                   description = "Emails services to check";
 513                   type = attrsOf (submodule {
 514                     options = {
 515                       local = mkOption { type = bool; default = false; description = "Use local configuration"; };
 516                       port = mkOption { type = nullOr str; default = null; description = "Port to connect to ssh"; };
 517                       login = mkOption { type = nullOr str; default = null; description = "Login to connect to ssh"; };
 518                       targets = mkOption { type = listOf str; description = "Hosts to send E-mails to"; };
 519                       mail_address = mkOption { type = nullOr str; default = null; description = "E-mail recipient part to send e-mail to"; };
 520                       mail_domain = mkOption { type = nullOr str; default = null; description = "E-mail domain part to send e-mail to"; };
 521                     };
 522                   });
 523                 };
 524               };
 525             };
 526           };
 527           mpd = mkOption {
 528             description = "MPD configuration";
 529             type = submodule {
 530               options = {
 531                 folder = mkOption { type = str; description = "Folder to serve from the MPD instance"; };
 532                 password = mkOption { type = str; description = "Password to connect to the MPD instance"; };
 533                 host = mkOption { type = str; description = "Host to connect to the MPD instance"; };
 534                 port = mkOption { type = str; description = "Port to connect to the MPD instance"; };
 535               };
 536             };
 537           };
 538           ftp = mkOption {
 539             description = "FTP configuration";
 540             type = submodule {
 541               options = {
 542                 ldap = mkLdapOptions "FTP" {
 543                   proftpd_filter = mkOption { type = str; description = "Filter for proftpd listing in LDAP"; };
 544                   pure-ftpd_filter = mkOption { type = str; description = "Filter for pure-ftpd listing in LDAP"; };
 545                 };
 546               };
 547             };
 548           };
 549           vpn = mkOption {
 550             description = "VPN configuration";
 551             type = attrsOf (submodule {
 552               options = {
 553                 prefix = mkOption { type = str; description = "ipv6 prefix for the vpn subnet"; };
 554                 privateKey = mkOption { type = str; description = "Private key for the host"; };
 555                 publicKey = mkOption { type = str; description = "Public key for the host"; };
 556               };
 557             });
 558           };
 559           mail = mkOption {
 560             description = "Mail configuration";
 561             type = submodule {
 562               options = {
 563                 dmarc = mkOption {
 564                   description = "DMARC configuration";
 565                   type = submodule {
 566                     options = {
 567                       ignore_hosts = mkOption {
 568                         type = lines;
 569                         description = ''
 570                           Hosts to ignore when checking for dmarc
 571                           '';
 572                       };
 573                     };
 574                   };
 575                 };
 576                 dkim = mkOption {
 577                   description = "DKIM configuration";
 578                   type = attrsOf (submodule {
 579                     options = {
 580                       public = mkOption {
 581                         type = attrsOf str;
 582                         example = literalExample ''
 583                           {
 584                             v = "DKIM1";
 585                             k = "rsa";
 586                             p = "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3w1a2aMxWw9+hdcmbqX4UevcVqr204y0K73Wdc7MPZiOOlUJQYsMNSYR1Y/SC7jmPKeitpcJCpQgn/cveJZbuikjjPLsDReHyFEYmC278ZLRTELHx6f1IXM8WE08JIRT69CfZiMi1rVcOh9qRT4F93PyjCauU8Y5hJjtg9ThsWwIDAQAB";
 587                           }
 588                           '';
 589                         description = "Public entry to put in DNS TXT field";
 590                       };
 591                       private = mkOption { type = nullOr str; default = null; description = "Private key"; };
 592                     };
 593                   });
 594                 };
 595                 postfix = mkOption {
 596                   description = "Postfix configuration";
 597                   type = submodule {
 598                     options = {
 599                       mysql = mkMysqlOptions "Postfix" {
 600                         password_encrypt = mkOption { type = str; description = "Key to encrypt relay password in database"; };
 601                       };
 602                       admins = mkOption {
 603                         description = ''
 604                           List of admins meant to receive common aliases
 605                         '';
 606                         type = listOf str;
 607                       };
 608                       common_aliases = mkOption {
 609                         description = ''
 610                           List of aliases common to all hosts, to forward to admins
 611                         '';
 612                         type = listOf str;
 613                       };
 614                       other_aliases = mkOption {
 615                         description = ''
 616                           Other list of aliases, to forward to admins
 617                         '';
 618                         type = listOf str;
 619                       };
 620                     };
 621                   };
 622                 };
 623                 dovecot = mkOption {
 624                   description = "Dovecot configuration";
 625                   type = submodule {
 626                     options = {
 627                       mysql = mkMysqlOptions "Dovecot" {};
 628                       ldap = mkLdapOptions "Dovecot" {
 629                         pass_attrs = mkOption { type = str; description = "Password attribute in LDAP"; };
 630                         user_attrs = mkOption { type = str; description = "User attribute mapping in LDAP"; };
 631                         iterate_attrs = mkOption { type = str; description = "User attribute mapping for listing in LDAP"; };
 632                         iterate_filter = mkOption { type = str; description = "User attribute filter for listing in LDAP"; };
 633                         postfix_mailbox_filter = mkOption { type = str; description = "Postfix filter to get mailboxes"; };
 634                       };
 635                     };
 636                   };
 637                 };
 638                 rspamd = mkOption {
 639                   description = "rspamd configuration";
 640                   type = submodule {
 641                     options = {
 642                       redis = mkRedisOptions "Redis";
 643                       read_password_hashed = mkOption { type = str; description = "Hashed read password for rspamd"; };
 644                       write_password_hashed = mkOption { type = str; description = "Hashed write password for rspamd"; };
 645                       read_password = mkOption {
 646                         type = str;
 647                         description = "Read password for rspamd. Unused";
 648                         apply = x: "";
 649                       };
 650                       write_password = mkOption {
 651                         type = str;
 652                         description = "Write password for rspamd. Unused";
 653                         apply = x: "";
 654                       };
 655                     };
 656                   };
 657                 };
 658                 sympa = mkOption {
 659                   description = "Sympa configuration";
 660                   type = submodule {
 661                     options = {
 662                       listmasters = mkOption {
 663                         type = listOf str;
 664                         description = "Listmasters";
 665                       };
 666                       postgresql = mkPsqlOptions "Sympa";
 667                       data_sources = mkOption {
 668                         type = attrsOf str;
 669                         default = {};
 670                         description = "Data sources to make available to sympa";
 671                       };
 672                       scenari = mkOption {
 673                         type = attrsOf str;
 674                         default = {};
 675                         description = "Scenari to make available to sympa";
 676                       };
 677                     };
 678                   };
 679                 };
 680               };
 681             };
 682           };
 683           coturn = mkOption {
 684             description = "Coturn configuration";
 685             type = submodule {
 686               options = {
 687                 auth_access_key = mkOption { type = str; description = "key to access coturn"; };
 688               };
 689             };
 690           };
 691           buildbot = mkOption {
 692             description = "Buildbot configuration";
 693             type = submodule {
 694               options = {
 695                 ssh_key = mkOption {
 696                   description = "SSH key information";
 697                   type = submodule {
 698                     options = {
 699                       public = mkOption { type = str; description = "Public part of the key"; };
 700                       private = mkOption { type = lines; description = "Private part of the key"; };
 701                     };
 702                   };
 703                 };
 704                 workerPassword = mkOption { description = "Buildbot worker password"; type = str; };
 705                 user = mkOption {
 706                   description = "Buildbot user";
 707                   type = submodule {
 708                     options = {
 709                       uid = mkOption {
 710                         description = "user uid";
 711                         type = int;
 712                       };
 713                       gid = mkOption {
 714                         description = "user gid";
 715                         type = int;
 716                       };
 717                     };
 718                   };
 719                 };
 720                 ldap = mkOption {
 721                   description = "Ldap configuration for buildbot";
 722                   type = submodule {
 723                     options = {
 724                       password = mkOption { type = str; description = "Buildbot password"; };
 725                     };
 726                   };
 727                 };
 728                 projects = mkOption {
 729                   description = "Projects to make a buildbot for";
 730                   type = attrsOf (submodule {
 731                     options = {
 732                       name = mkOption { type = str; description = "Project name"; };
 733                       src = mkOption { type = path; description = "source of the project configuration"; };
 734                       packages = mkOption {
 735                         type = listOf package;
 736                         example = literalExample ''
 737                           [ pkgs.bash pkgs.git pkgs.gzip pkgs.openssh ];
 738                           '';
 739                         description = ''
 740                           Builds packages list to make available to buildbot project.
 741                         '';
 742                       };
 743                       pythonPathHome = mkOption { type = bool; description = "Whether to add project’s python home to python path"; };
 744                       workerPort = mkOption { type = port; description = "Port for the worker"; };
 745                       secrets = mkOption {
 746                         type = attrsOf lines;
 747                         description = "Secrets for the project to dump as files";
 748                       };
 749                       secretsDeps = mkOption {
 750                         type = listOf package;
 751                         default = [];
 752                         description = "Dependencies of file that will land in secrets";
 753                       };
 754                       environment = mkOption {
 755                         type = attrsOf str;
 756                         description = ''
 757                           Environment variables for the project.
 758                           BUILDBOT_ is prefixed to the variable names
 759                         '';
 760                       };
 761                       activationScript = mkOption {
 762                         type = lines;
 763                         description = ''
 764                           Activation script to run during deployment
 765                         '';
 766                       };
 767                       webhookTokens = mkOption {
 768                         type = nullOr (listOf str);
 769                         default = null;
 770                         description = ''
 771                           List of tokens allowed to push to project’s change_hook/base endpoint
 772                         '';
 773                       };
 774                     };
 775                   });
 776                 };
 777               };
 778             };
 779           };
 780           tools = mkOption {
 781             description = "Tools configurations";
 782             type = submodule {
 783               options = {
 784                 contact = mkOption { type = str; description = "Contact e-mail address"; };
 785                 assets = mkOption {
 786                   default = {};
 787                   type = attrsOf (submodule {
 788                     options = {
 789                       assetType = mkOption { type = enum ["tgz" "url" "googleFont"]; default = "url"; description = "Type of asset"; };
 790                       tgzRemoveComponents = mkOption { type = int; default = 0; description = "Remove components when extracting"; };
 791                       url = mkOption { type = str; description = "URL to fetch"; };
 792                       sha256 = mkOption { type = str; description = "Hash of the url"; };
 793                     };
 794                   });
 795                   description = "Assets to provide on assets.immae.eu";
 796                 };
 797                 davical = mkOption {
 798                   description = "Davical configuration";
 799                   type = submodule {
 800                     options = {
 801                       postgresql = mkPsqlOptions "Davical";
 802                       ldap = mkLdapOptions "Davical" {};
 803                     };
 804                   };
 805                 };
 806                 diaspora = mkOption {
 807                   description = "Diaspora configuration";
 808                   type = submodule {
 809                     options = {
 810                       postgresql = mkPsqlOptions "Diaspora";
 811                       redis = mkRedisOptions "Diaspora";
 812                       ldap = mkLdapOptions "Diaspora" {};
 813                       secret_token = mkOption { type = str; description = "Secret token"; };
 814                     };
 815                   };
 816                 };
 817                 dmarc_reports = mkOption {
 818                   description = "DMARC reports configuration";
 819                   type = submodule {
 820                     options = {
 821                       mysql = mkMysqlOptions "DMARC" {};
 822                       anonymous_key = mkOption { type = str; description = "Anonymous hashing key"; };
 823                     };
 824                   };
 825                 };
 826                 etherpad-lite = mkOption {
 827                   description = "Etherpad configuration";
 828                   type = submodule {
 829                     options = {
 830                       postgresql = mkPsqlOptions "Etherpad";
 831                       ldap = mkLdapOptions "Etherpad" {
 832                         group_filter = mkOption { type = str; description = "Filter for groups"; };
 833                       };
 834                       adminPassword = mkOption { type = str; description = "Admin password for mypads / admin"; };
 835                       session_key = mkOption { type = str; description = "Session key"; };
 836                       api_key = mkOption { type = str; description = "API key"; };
 837                     };
 838                   };
 839                 };
 840                 gitolite = mkOption {
 841                   description = "Gitolite configuration";
 842                   type = submodule {
 843                     options = {
 844                       ldap = mkLdapOptions "Gitolite" {};
 845                       ssh_key = mkOption {
 846                         description = "SSH key information";
 847                         type = submodule {
 848                           options = {
 849                             public = mkOption { type = str; description = "Public part of the key"; };
 850                             private = mkOption { type = lines; description = "Private part of the key"; };
 851                           };
 852                         };
 853                       };
 854                     };
 855                   };
 856                 };
 857                 landing = mkOption {
 858                   description = "Landing configuration";
 859                   type = submodule {
 860                     options = {
 861                       postgresql = mkPsqlOptions "Landing";
 862                     };
 863                   };
 864                 };
 865                 kanboard = mkOption {
 866                   description = "Kanboard configuration";
 867                   type = submodule {
 868                     options = {
 869                       postgresql = mkPsqlOptions "Kanboard";
 870                       ldap = mkLdapOptions "Kanboard" {
 871                         admin_dn = mkOption { type = str; description = "Admin DN"; };
 872                       };
 873                     };
 874                   };
 875                 };
 876                 mantisbt = mkOption {
 877                   description = "Mantisbt configuration";
 878                   type = submodule {
 879                     options = {
 880                       postgresql = mkPsqlOptions "Mantisbt";
 881                       ldap = mkLdapOptions "Mantisbt" {};
 882                       master_salt = mkOption { type = str; description = "Master salt for password hash"; };
 883                     };
 884                   };
 885                 };
 886                 mastodon = mkOption {
 887                   description = "Mastodon configuration";
 888                   type = submodule {
 889                     options = {
 890                       postgresql = mkPsqlOptions "Mastodon";
 891                       redis = mkRedisOptions "Mastodon";
 892                       ldap = mkLdapOptions "Mastodon" {};
 893                       paperclip_secret = mkOption { type = str; description = "Paperclip secret"; };
 894                       otp_secret = mkOption { type = str; description = "OTP secret"; };
 895                       secret_key_base = mkOption { type = str; description = "Secret key base"; };
 896                       vapid = mkOption {
 897                         description = "vapid key";
 898                         type = submodule {
 899                           options = {
 900                             private = mkOption { type = str; description = "Private key"; };
 901                             public = mkOption { type = str; description = "Public key"; };
 902                           };
 903                         };
 904                       };
 905                     };
 906                   };
 907                 };
 908                 mediagoblin = mkOption {
 909                   description = "Mediagoblin configuration";
 910                   type = submodule {
 911                     options = {
 912                       postgresql = mkPsqlOptions "Mediagoblin";
 913                       redis = mkRedisOptions "Mediagoblin";
 914                       ldap = mkLdapOptions "Mediagoblin" {};
 915                     };
 916                   };
 917                 };
 918                 nextcloud = mkOption {
 919                   description = "Nextcloud configuration";
 920                   type = submodule {
 921                     options = {
 922                       postgresql = mkPsqlOptions "Nextcloud";
 923                       redis = mkRedisOptions "Nextcloud";
 924                       password_salt = mkOption { type = str; description = "Password salt"; };
 925                       instance_id = mkOption { type = str; description = "Instance ID"; };
 926                       secret = mkOption { type = str; description = "App secret"; };
 927                     };
 928                   };
 929                 };
 930                 peertube = mkOption {
 931                   description = "Peertube configuration";
 932                   type = submodule {
 933                     options = {
 934                       listenPort = mkOption { type = port; description = "Port to listen to"; };
 935                       postgresql = mkPsqlOptions "Peertube";
 936                       redis = mkRedisOptions "Peertube";
 937                       ldap = mkLdapOptions "Peertube" {};
 938                     };
 939                   };
 940                 };
 941                 phpldapadmin = mkOption {
 942                   description = "phpLdapAdmin configuration";
 943                   type = submodule {
 944                     options = {
 945                       ldap = mkLdapOptions "phpldapadmin" {};
 946                     };
 947                   };
 948                 };
 949                 rompr = mkOption {
 950                   description = "Rompr configuration";
 951                   type = submodule {
 952                     options = {
 953                       mpd = mkOption {
 954                         description = "MPD configuration";
 955                         type = submodule {
 956                           options = {
 957                             host = mkOption { type = str; description = "Host for MPD"; };
 958                             port = mkOption { type = port; description = "Port to access MPD host"; };
 959                           };
 960                         };
 961                       };
 962                     };
 963                   };
 964                 };
 965                 roundcubemail = mkOption {
 966                   description = "Roundcubemail configuration";
 967                   type = submodule {
 968                     options = {
 969                       postgresql = mkPsqlOptions "TT-RSS";
 970                       secret = mkOption { type = str; description = "Secret"; };
 971                     };
 972                   };
 973                 };
 974                 shaarli = mkOption {
 975                   description = "Shaarli configuration";
 976                   type = submodule {
 977                     options = {
 978                       ldap = mkLdapOptions "Shaarli" {};
 979                     };
 980                   };
 981                 };
 982                 status_engine = mkOption {
 983                   description = "Status Engine configuration";
 984                   type = submodule {
 985                     options = {
 986                       mysql = mkMysqlOptions "StatusEngine" {};
 987                       ldap = mkLdapOptions "StatusEngine" {};
 988                     };
 989                   };
 990                 };
 991                 task = mkOption {
 992                   description = "Taskwarrior configuration";
 993                   type = submodule {
 994                     options = {
 995                       ldap = mkLdapOptions "Taskwarrior" {};
 996                       taskwarrior-web = mkOption {
 997                         description = "taskwarrior-web profiles";
 998                         default = {};
 999                         type = attrsOf (submodule {
1000                           options = {
1001                             uid = mkOption {
1002                               type = listOf str;
1003                               description = "List of ldap uids having access to this profile";
1004                             };
1005                             org = mkOption { type = str; description = "Taskd organisation"; };
1006                             key = mkOption { type = str; description = "Taskd key"; };
1007                             date = mkOption { type = str; description = "Preferred date format"; };
1008                           };
1009                         });
1010                       };
1011                     };
1012                   };
1013                 };
1014                 ttrss = mkOption {
1015                   description = "TT-RSS configuration";
1016                   type = submodule {
1017                     options = {
1018                       postgresql = mkPsqlOptions "TT-RSS";
1019                       ldap = mkLdapOptions "TT-RSS" {};
1020                     };
1021                   };
1022                 };
1023                 wallabag = mkOption {
1024                   description = "Wallabag configuration";
1025                   type = submodule {
1026                     options = {
1027                       postgresql = mkPsqlOptions "Wallabag";
1028                       ldap = mkLdapOptions "Wallabag" {
1029                         admin_filter = mkOption { type = str; description = "Admin users filter"; };
1030                       };
1031                       redis = mkRedisOptions "Wallabag";
1032                       secret = mkOption { type = str; description = "App secret"; };
1033                     };
1034                   };
1035                 };
1036                 webhooks = mkOption {
1037                   type = attrsOf str;
1038                   description = "Mapping 'name'.php => script for webhooks";
1039                 };
1040                 csp_reports = mkOption {
1041                   description = "CSP report configuration";
1042                   type = submodule {
1043                     options = {
1044                       report_uri = mkOption { type = str; description = "URI to report CSP violations to"; };
1045                       policies = mkOption { type = attrsOf str; description = "CSP policies to apply"; };
1046                     };
1047                   };
1048                 };
1049                 commento = mkOption {
1050                   description = "Commento configuration";
1051                   type = submodule {
1052                     options = {
1053                       listenPort = mkOption { type = port; description = "Port to listen to"; };
1054                       postgresql = mkPsqlOptions "Commento";
1055                       smtp = mkSmtpOptions "Commento";
1056                     };
1057                   };
1058                 };
1059                 cryptpad = mkOption {
1060                   description = "Cryptpad configuration";
1061                   type = submodule {
1062                     options = {
1063                       email = mkOption { type = str; description = "Admin e-mail"; };
1064                       admins = mkOption { type = listOf str; description = "Instance admin public keys"; };
1065                       port = mkOption { type = port; description = "Port to listen to"; };
1066                     };
1067                   };
1068                 };
1069                 ympd = mkOption {
1070                   description = "Ympd configuration";
1071                   type = submodule {
1072                     options = {
1073                       listenPort = mkOption { type = port; description = "Port to listen to"; };
1074                       mpd = mkOption {
1075                         description = "MPD configuration";
1076                         type = submodule {
1077                           options = {
1078                             password = mkOption { type = str; description = "Password to access MPD host"; };
1079                             host = mkOption { type = str; description = "Host for MPD"; };
1080                             port = mkOption { type = port; description = "Port to access MPD host"; };
1081                           };
1082                         };
1083                       };
1084                     };
1085                   };
1086                 };
1087                 umami = mkOption {
1088                   description = "Umami configuration";
1089                   type = submodule {
1090                     options = {
1091                       listenPort = mkOption { type = port; description = "Port to listen to"; };
1092                       postgresql = mkPsqlOptions "Umami";
1093                       hashSalt = mkOption { type = str; description = "Hash salt"; };
1094                     };
1095                   };
1096                 };
1097                 yourls = mkOption {
1098                   description = "Yourls configuration";
1099                   type = submodule {
1100                     options = {
1101                       mysql = mkMysqlOptions "Yourls" {};
1102                       ldap = mkLdapOptions "Yourls" {};
1103                       cookieKey = mkOption { type = str; description = "Cookie key"; };
1104                     };
1105                   };
1106                 };
1107               };
1108             };
1109           };
1110         };
1111         options.hostEnv = mkOption {
1112           readOnly = true;
1113           type = hostEnv;
1114           default = config.myEnv.servers."${name}";
1115           description = "Host environment";
1116         };
1117       };
1118   };
1119 }