modules/private/environment.nix

   1 { config, lib, name, ... }:
   2 with lib;
   3 with types;
   4 with lists;
   5 let
   6   ldapOptions = {
   7     base = mkOption { description = "Base of the LDAP tree"; type = str; };
   8     host = mkOption { description = "Host to access LDAP"; type = str; };
   9     root_dn = mkOption { description = "DN of the root user"; type = str; };
  10     root_pw = mkOption { description = "Hashed password of the root user"; type = str; };
  11     replication_dn = mkOption { description = "DN of the user allowed to replicate the LDAP directory"; type = str; };
  12     replication_pw = mkOption { description = "Password of the user allowed to replicate the LDAP directory"; type = str; };
  13   };
  14   mkLdapOptions = name: more: mkOption {
  15     description = "${name} LDAP configuration";
  16     type = submodule {
  17       options = ldapOptions // {
  18         dn = mkOption { description = "DN of the ${name} user"; type = str; };
  19         password = mkOption { description = "password of the ${name} user"; type = str; };
  20         filter = mkOption { description = "Filter for ${name} users"; type = str; default = ""; };
  21       } // more;
  22     };
  23   };
  24   mysqlOptions = {
  25     host = mkOption { description = "Host to access Mysql"; type = str; };
  26     remoteHost = mkOption { description = "Host to access Mysql from outside"; type = str; };
  27     port = mkOption { description = "Port to access Mysql"; type = str; };
  28     socket = mkOption { description = "Socket to access Mysql"; type = path; };
  29     systemUsers = mkOption {
  30       description = "Attrs of user-passwords allowed to access mysql";
  31       type = attrsOf str;
  32     };
  33     pam = mkOption {
  34       description = "PAM configuration for mysql";
  35       type = submodule {
  36         options = {
  37           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  38           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  39           filter = mkOption { description = "filter to match users"; type = str; };
  40         };
  41       };
  42     };
  43   };
  44   mkMysqlOptions = name: more: mkOption {
  45     description = "${name} mysql configuration";
  46     type = submodule {
  47       options = mysqlOptions // {
  48         database = mkOption { description = "${name} database"; type = str; };
  49         user = mkOption { description = "${name} user"; type = str; };
  50         password = mkOption { description = "mysql password of the ${name} user"; type = str; };
  51       } // more;
  52     };
  53   };
  54   psqlOptions = {
  55     host = mkOption { description = "Host to access Postgresql"; type = str; };
  56     port = mkOption { description = "Port to access Postgresql"; type = str; };
  57     socket = mkOption { description = "Socket to access Postgresql"; type = path; };
  58     pam = mkOption {
  59       description = "PAM configuration for psql";
  60       type = submodule {
  61         options = {
  62           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  63           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  64           filter = mkOption { description = "filter to match users"; type = str; };
  65         };
  66       };
  67     };
  68   };
  69   mkPsqlOptions = name: mkOption {
  70     description = "${name} psql configuration";
  71     type = submodule {
  72       options = psqlOptions // {
  73         database = mkOption { description = "${name} database"; type = str; };
  74         schema = mkOption { description = "${name} schema"; type = nullOr str; default = null; };
  75         user = mkOption { description = "${name} user"; type = str; };
  76         password = mkOption { description = "psql password of the ${name} user"; type = str; };
  77       };
  78     };
  79   };
  80   redisOptions = {
  81     host = mkOption { description = "Host to access Redis"; type = str; };
  82     port = mkOption { description = "Port to access Redis"; type = str; };
  83     socket = mkOption { description = "Socket to access Redis"; type = path; };
  84     dbs = mkOption {
  85       description = "Attrs of db number. Each number should be unique to avoid collision!";
  86       type = attrsOf str;
  87     };
  88     spiped_key = mkOption {
  89       type = str;
  90       description = ''
  91         Key to use with spiped to make a secure channel to replication
  92         '';
  93     };
  94     predixy = mkOption {
  95       description = "Predixy configuration. Unused yet";
  96       type = submodule {
  97         options = {
  98           read = mkOption { type = str; description = "Read password"; };
  99         };
 100       };
 101     };
 102   };
 103   mkRedisOptions = name: mkOption {
 104     description = "${name} redis configuration";
 105     type = submodule {
 106       options = redisOptions // {
 107         db = mkOption { description = "${name} database"; type = str; };
 108       };
 109     };
 110   };
 111   hostEnv = submodule {
 112     options = {
 113       fqdn = mkOption {
 114         description = "Host FQDN";
 115         type = str;
 116       };
 117       users = mkOption {
 118         type = unspecified;
 119         default = pkgs: [];
 120         description = ''
 121           Sublist of users from realUsers. Function that takes pkgs as
 122           argument and gives an array as a result
 123         '';
 124       };
 125       emails = mkOption {
 126         default = [];
 127         description = "List of e-mails that the server can be a sender of";
 128         type = listOf str;
 129       };
 130       ldap = mkOption {
 131         description = ''
 132           LDAP credentials for the host
 133         '';
 134         type = submodule {
 135           options = {
 136             password = mkOption { type = str; description = "Password for the LDAP connection"; };
 137             dn = mkOption { type = str; description = "DN for the LDAP connection"; };
 138           };
 139         };
 140       };
 141       mx = mkOption {
 142         description = "subdomain and priority for MX server";
 143         default = { enable = false; };
 144         type = submodule {
 145           options = {
 146             enable = mkEnableOption "Enable MX";
 147             subdomain = mkOption { type = nullOr str; description = "Subdomain name (mx-*)"; };
 148             priority = mkOption { type = nullOr str; description = "Priority"; };
 149           };
 150         };
 151       };
 152       ips = mkOption {
 153         description = ''
 154           attrs of ip4/ip6 grouped by section
 155         '';
 156         type = attrsOf (submodule {
 157           options = {
 158             ip4 = mkOption {
 159               type = str;
 160               description = ''
 161                 ip4 address of the host
 162               '';
 163             };
 164             ip6 = mkOption {
 165               type = listOf str;
 166               default = [];
 167               description = ''
 168                 ip6 addresses of the host
 169               '';
 170             };
 171           };
 172         });
 173       };
 174     };
 175   };
 176 in
 177 {
 178   options.myEnv = {
 179     servers = mkOption {
 180       description = ''
 181         Attrs of servers information in the cluster (not necessarily handled by nixops)
 182       '';
 183       default = {};
 184       type = attrsOf hostEnv;
 185     };
 186     hetznerCloud = mkOption {
 187       description = ''
 188         Hetzner Cloud credential information
 189       '';
 190       type = submodule {
 191         options = {
 192           authToken = mkOption {
 193             type = str;
 194             description = ''
 195               The API auth token.
 196             '';
 197           };
 198         };
 199       };
 200     };
 201     hetzner = mkOption {
 202       description = ''
 203         Hetzner credential information
 204       '';
 205       type = submodule {
 206         options = {
 207           user = mkOption { type = str; description = "User"; };
 208           pass = mkOption { type = str; description = "Password"; };
 209         };
 210       };
 211     };
 212     sshd = mkOption {
 213       description = ''
 214         sshd service credential information
 215       '';
 216       type = submodule {
 217         options = {
 218           ldap = mkOption {
 219             description = ''
 220               LDAP credentials for cn=ssh,ou=services,dc=immae,dc=eu dn
 221             '';
 222             type = submodule {
 223               options = {
 224                 password = mkOption { description = "Password"; type = str; };
 225               };
 226             };
 227           };
 228         };
 229       };
 230     };
 231     ports = mkOption {
 232       description = ''
 233         non-standard reserved ports. Must be unique!
 234       '';
 235       type = attrsOf port;
 236       default = {};
 237       apply = let
 238         noDupl = x: builtins.length (builtins.attrValues x) == builtins.length (unique (builtins.attrValues x));
 239       in
 240         x: if isAttrs x && noDupl x then x else throw "Non unique values for ports";
 241     };
 242     httpd = mkOption {
 243       description = ''
 244         httpd service credential information
 245       '';
 246       type = submodule {
 247         options = {
 248           ldap = mkOption {
 249             description = ''
 250               LDAP credentials for cn=httpd,ou=services,dc=immae,dc=eu dn
 251             '';
 252             type = submodule {
 253               options = {
 254                 password = mkOption { description = "Password"; type = str; };
 255               };
 256             };
 257           };
 258         };
 259       };
 260     };
 261     ldap = mkOption {
 262       description = ''
 263         LDAP server configuration
 264         '';
 265       type = submodule {
 266         options = ldapOptions;
 267       };
 268     };
 269     databases = mkOption {
 270       description = "Databases configuration";
 271       type = submodule {
 272         options = {
 273           mysql = mkOption {
 274             type = submodule { options = mysqlOptions; };
 275             description = "Mysql configuration";
 276           };
 277           redis = mkOption {
 278             type = submodule { options = redisOptions; };
 279             description = "Redis configuration";
 280           };
 281           postgresql = mkOption {
 282             type = submodule { options = psqlOptions; };
 283             description = "Postgresql configuration";
 284           };
 285         };
 286       };
 287     };
 288     jabber = mkOption {
 289       description = "Jabber configuration";
 290       type = submodule {
 291         options = {
 292           postfix_user_filter = mkOption { type = str; description = "Postfix filter to get xmpp users"; };
 293           ldap = mkLdapOptions "Jabber" {};
 294           postgresql = mkPsqlOptions "Jabber";
 295         };
 296       };
 297     };
 298     realUsers = mkOption {
 299       description = ''
 300         Attrset of function taking pkgs as argument.
 301         Real users settings, should provide a subattr of users.users.<name>
 302         with at least: name, (hashed)Password, shell
 303       '';
 304       type = attrsOf unspecified;
 305     };
 306     users = mkOption {
 307       description = "System and regular users uid/gid";
 308       type = attrsOf (submodule {
 309         options = {
 310           uid = mkOption {
 311             description = "user uid";
 312             type = int;
 313           };
 314           gid = mkOption {
 315             description = "user gid";
 316             type = int;
 317           };
 318         };
 319       });
 320     };
 321     dns = mkOption {
 322       description = "DNS configuration";
 323       type = submodule {
 324         options = {
 325           soa = mkOption {
 326             description = "SOA information";
 327             type = submodule {
 328               options = {
 329                 serial = mkOption {
 330                   description = "Serial number. Should be incremented at each change and unique";
 331                   type = str;
 332                 };
 333                 refresh = mkOption {
 334                   description = "Refresh time";
 335                   type = str;
 336                 };
 337                 retry = mkOption {
 338                   description = "Retry time";
 339                   type = str;
 340                 };
 341                 expire = mkOption {
 342                   description = "Expire time";
 343                   type = str;
 344                 };
 345                 ttl = mkOption {
 346                   description = "Default TTL time";
 347                   type = str;
 348                 };
 349                 email = mkOption {
 350                   description = "hostmaster e-mail";
 351                   type = str;
 352                 };
 353                 primary = mkOption {
 354                   description = "Primary NS";
 355                   type = str;
 356                 };
 357               };
 358             };
 359           };
 360           ns = mkOption {
 361             description = "Attrs of NS servers group";
 362             example = {
 363               foo = {
 364                 "ns1.foo.com" = [ "198.51.100.10" "2001:db8:abcd::1" ];
 365                 "ns2.foo.com" = [ "198.51.100.15" "2001:db8:1234::1" ];
 366               };
 367             };
 368             type = attrsOf (attrsOf (listOf str));
 369           };
 370           slaveZones = mkOption {
 371             description = "List of slave zones";
 372             type = listOf (submodule {
 373               options = {
 374                 name = mkOption { type = str; description = "zone name"; };
 375                 masters = mkOption {
 376                   description = "NS master groups of this zone";
 377                   type = listOf str;
 378                 };
 379               };
 380             });
 381           };
 382           masterZones = mkOption {
 383             description = "List of master zones";
 384             type = listOf (submodule {
 385               options = {
 386                 name = mkOption { type = str; description = "zone name"; };
 387                 slaves = mkOption {
 388                   description = "NS slave groups of this zone";
 389                   type = listOf str;
 390                 };
 391                 ns = mkOption {
 392                   description = "groups names that should have their NS entries listed here";
 393                   type = listOf str;
 394                 };
 395                 extra = mkOption {
 396                   description = "Extra zone configuration for bind";
 397                   example = ''
 398                     notify yes;
 399                     '';
 400                   type = lines;
 401                 };
 402                 entries = mkOption { type = lines; description = "Regular entries of the NS zone"; };
 403                 withEmail = mkOption {
 404                   description = "List of domains that should have mail entries (MX, dkim, SPF, ...)";
 405                   default = [];
 406                   type = listOf (submodule {
 407                     options = {
 408                       domain = mkOption { type = str; description = "Which subdomain is concerned"; };
 409                       send = mkOption { type = bool; description = "Whether there can be e-mails originating from the subdomain"; };
 410                       receive = mkOption { type = bool; description = "Whether there can be e-mails arriving to the subdomain"; };
 411                     };
 412                   });
 413                 };
 414               };
 415             });
 416           };
 417         };
 418       };
 419     };
 420     backup = mkOption {
 421       description = ''
 422         Remote backup with duplicity
 423         '';
 424       type = submodule {
 425         options = {
 426           password = mkOption { type = str; description = "Password for encrypting files"; };
 427           remote = mkOption { type = str; description = "Remote url access"; };
 428           accessKeyId = mkOption { type = str; description = "Remote access-key"; };
 429           secretAccessKey = mkOption { type = str; description = "Remote access secret"; };
 430         };
 431       };
 432     };
 433     rsync_backup = mkOption {
 434       description  =''
 435         Rsync backup configuration from controlled host
 436         '';
 437       type = submodule {
 438         options = {
 439           ssh_key = mkOption {
 440             description = "SSH key information";
 441             type = submodule {
 442               options = {
 443                 public = mkOption { type = str; description = "Public part of the key"; };
 444                 private = mkOption { type = lines; description = "Private part of the key"; };
 445               };
 446             };
 447           };
 448           profiles = mkOption {
 449             description = "Attrs of profiles to backup";
 450             type = attrsOf (submodule {
 451               options = {
 452                 keep = mkOption { type = int; description = "Number of backups to keep"; };
 453                 login = mkOption { type = str; description = "Login to connect to host"; };
 454                 port = mkOption { type = str; default = "22"; description = "Port to connect to host"; };
 455                 host = mkOption { type = str; description = "Host to connect to"; };
 456                 host_key = mkOption { type = str; description = "Host key"; };
 457                 host_key_type = mkOption { type = str; description = "Host key type"; };
 458                 parts = mkOption {
 459                   description = "Parts to backup for this host";
 460                   type = attrsOf (submodule {
 461                     options = {
 462                       remote_folder = mkOption { type = path; description = "Remote folder to backup";};
 463                       exclude_from = mkOption {
 464                         type = listOf path;
 465                         default = [];
 466                         description = "List of folders/files to exclude from the backup";
 467                       };
 468                       files_from = mkOption {
 469                         type = listOf path;
 470                         default = [];
 471                         description = "List of folders/files to backup in the base folder";
 472                       };
 473                       args = mkOption {
 474                         type = nullOr str;
 475                         default = null;
 476                         description = "Extra arguments to pass to rsync";
 477                       };
 478                     };
 479                   });
 480                 };
 481               };
 482             });
 483           };
 484         };
 485       };
 486     };
 487     monitoring = mkOption {
 488       description = "Monitoring configuration";
 489       type = submodule {
 490         options = {
 491           status_url = mkOption { type = str; description = "URL to push status to"; };
 492           status_token = mkOption { type = str; description = "Token for the status url"; };
 493           http_user_password = mkOption { type = str; description = "HTTP credentials to check services behind wall"; };
 494           email = mkOption { type = str; description = "Admin E-mail"; };
 495           ssh_public_key = mkOption { type = str; description = "SSH public key"; };
 496           ssh_secret_key = mkOption { type = str; description = "SSH secret key"; };
 497           imap_login = mkOption { type = str; description = "IMAP login"; };
 498           imap_password = mkOption { type = str; description = "IMAP password"; };
 499           eriomem_keys = mkOption { type = listOf (listOf str); description = "Eriomem keys"; default = []; };
 500           ovh_sms = mkOption {
 501             description = "OVH credentials for sms script";
 502             type = submodule {
 503               options = {
 504                 endpoint = mkOption { type = str; default = "ovh-eu"; description = "OVH endpoint"; };
 505                 application_key = mkOption { type = str; description = "Application key"; };
 506                 application_secret = mkOption { type = str; description = "Application secret"; };
 507                 consumer_key = mkOption { type = str; description = "Consumer key"; };
 508                 account = mkOption { type = str; description = "Account"; };
 509               };
 510             };
 511           };
 512           nrdp_tokens = mkOption { type = listOf str; description = "Tokens allowed to push status update"; };
 513           slack_url = mkOption { type = str; description = "Slack webhook url to push status update"; };
 514           slack_channel = mkOption { type = str; description = "Slack channel to push status update"; };
 515           contacts = mkOption { type = attrsOf unspecified; description = "Contact dicts to fill naemon objects"; };
 516           email_check = mkOption {
 517             description = "Emails services to check";
 518             type = attrsOf (submodule {
 519               options = {
 520                 local = mkOption { type = bool; default = false; description = "Use local configuration"; };
 521                 port = mkOption { type = nullOr str; default = null; description = "Port to connect to ssh"; };
 522                 login = mkOption { type = nullOr str; default = null; description = "Login to connect to ssh"; };
 523                 targets = mkOption { type = listOf str; description = "Hosts to send E-mails to"; };
 524                 mail_address = mkOption { type = nullOr str; default = null; description = "E-mail recipient part to send e-mail to"; };
 525                 mail_domain = mkOption { type = nullOr str; default = null; description = "E-mail domain part to send e-mail to"; };
 526               };
 527             });
 528           };
 529         };
 530       };
 531     };
 532     mpd = mkOption {
 533       description = "MPD configuration";
 534       type = submodule {
 535         options = {
 536           folder = mkOption { type = str; description = "Folder to serve from the MPD instance"; };
 537           password = mkOption { type = str; description = "Password to connect to the MPD instance"; };
 538           host = mkOption { type = str; description = "Host to connect to the MPD instance"; };
 539           port = mkOption { type = str; description = "Port to connect to the MPD instance"; };
 540         };
 541       };
 542     };
 543     ftp = mkOption {
 544       description = "FTP configuration";
 545       type = submodule {
 546         options = {
 547           ldap = mkLdapOptions "FTP" {};
 548         };
 549       };
 550     };
 551     vpn = mkOption {
 552       description = "VPN configuration";
 553       type = attrsOf (submodule {
 554         options = {
 555           prefix = mkOption { type = str; description = "ipv6 prefix for the vpn subnet"; };
 556           privateKey = mkOption { type = str; description = "Private key for the host"; };
 557           publicKey = mkOption { type = str; description = "Public key for the host"; };
 558         };
 559       });
 560     };
 561     mail = mkOption {
 562       description = "Mail configuration";
 563       type = submodule {
 564         options = {
 565           dmarc = mkOption {
 566             description = "DMARC configuration";
 567             type = submodule {
 568               options = {
 569                 ignore_hosts = mkOption {
 570                   type = lines;
 571                   description = ''
 572                     Hosts to ignore when checking for dmarc
 573                     '';
 574                 };
 575               };
 576             };
 577           };
 578           dkim = mkOption {
 579             description = "DKIM configuration";
 580             type = attrsOf (submodule {
 581               options = {
 582                 public = mkOption {
 583                   type = str;
 584                   example = ''
 585                     ( "v=DKIM1; k=rsa; "
 586                               "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3w1a2aMxWw9+hdcmbqX4UevcVqr204y0K73Wdc7MPZiOOlUJQYsMNSYR1Y/SC7jmPKeitpcJCpQgn/cveJZbuikjjPLsDReHyFEYmC278ZLRTELHx6f1IXM8WE08JIRT69CfZiMi1rVcOh9qRT4F93PyjCauU8Y5hJjtg9ThsWwIDAQAB" )
 587                     '';
 588                   description = "Public entry to put in DNS TXT field";
 589                 };
 590                 private = mkOption { type = str; description = "Private key"; };
 591               };
 592             });
 593           };
 594           postfix = mkOption {
 595             description = "Postfix configuration";
 596             type = submodule {
 597               options = {
 598                 additional_mailbox_domains = mkOption {
 599                   description = ''
 600                     List of domains that are used as mailbox final destination, in addition to those defined in the DNS records
 601                   '';
 602                   type = listOf str;
 603                 };
 604                 mysql = mkMysqlOptions "Postfix" {
 605                   password_encrypt = mkOption { type = str; description = "Key to encrypt relay password in database"; };
 606                 };
 607                 backup_domains = mkOption {
 608                   description = ''
 609                     Domains that are accepted for relay as backup domain
 610                   '';
 611                   type = attrsOf (submodule {
 612                     options = {
 613                       domains = mkOption { type = listOf str; description = "Domains list"; };
 614                       relay_restrictions = mkOption {
 615                         type = lines;
 616                         description = ''
 617                           Restrictions for relaying the e-mails from the domains
 618                           '';
 619                       };
 620                       recipient_maps = mkOption {
 621                         description = ''
 622                           Recipient map to accept relay for.
 623                           Must be specified for domain, the rules apply to everyone!
 624                         '';
 625                         type = listOf (submodule {
 626                           options = {
 627                             type = mkOption {
 628                               type = enum [ "hash" ];
 629                               description = "Map type";
 630                             };
 631                             content = mkOption {
 632                               type = str;
 633                               description = "Map content";
 634                             };
 635                           };
 636                         });
 637                       };
 638                     };
 639                   });
 640                 };
 641               };
 642             };
 643           };
 644           dovecot = mkOption {
 645             description = "Dovecot configuration";
 646             type = submodule {
 647               options = {
 648                 ldap = mkLdapOptions "Dovecot" {
 649                   pass_attrs = mkOption { type = str; description = "Password attribute in LDAP"; };
 650                   user_attrs = mkOption { type = str; description = "User attribute mapping in LDAP"; };
 651                   iterate_attrs = mkOption { type = str; description = "User attribute mapping for listing in LDAP"; };
 652                   iterate_filter = mkOption { type = str; description = "User attribute filter for listing in LDAP"; };
 653                 };
 654               };
 655             };
 656           };
 657           rspamd = mkOption {
 658             description = "rspamd configuration";
 659             type = submodule {
 660               options = {
 661                 redis = mkRedisOptions "Redis";
 662                 read_password_hashed = mkOption { type = str; description = "Hashed read password for rspamd"; };
 663                 write_password_hashed = mkOption { type = str; description = "Hashed write password for rspamd"; };
 664                 read_password = mkOption {
 665                   type = str;
 666                   description = "Read password for rspamd. Unused";
 667                   apply = x: "";
 668                 };
 669                 write_password = mkOption {
 670                   type = str;
 671                   description = "Write password for rspamd. Unused";
 672                   apply = x: "";
 673                 };
 674               };
 675             };
 676           };
 677           scripts = mkOption {
 678             description = "Mail script recipients";
 679             type = attrsOf (submodule {
 680               options = {
 681                 external = mkEnableOption "Create a script_<name>@mail.immae.eu external address";
 682                 src = mkOption {
 683                   description = ''
 684                     git source to fetch the script from.
 685                     It must have a default.nix file as its root accepting a scriptEnv parameter
 686                   '';
 687                   type = submodule {
 688                     options = {
 689                       url = mkOption { type = str; description = "git url to fetch"; };
 690                       rev = mkOption { type = str; description = "git reference to fetch"; };
 691                     };
 692                   };
 693                 };
 694                 env = mkOption {
 695                   description = "Variables to pass to the script";
 696                   type = unspecified;
 697                 };
 698               };
 699             });
 700           };
 701         };
 702       };
 703     };
 704     buildbot = mkOption {
 705       description = "Buildbot configuration";
 706       type = submodule {
 707         options = {
 708           user = mkOption {
 709             description = "Buildbot user";
 710             type = submodule {
 711               options = {
 712                 uid = mkOption {
 713                   description = "user uid";
 714                   type = int;
 715                 };
 716                 gid = mkOption {
 717                   description = "user gid";
 718                   type = int;
 719                 };
 720               };
 721             };
 722           };
 723           ldap = mkOption {
 724             description = "Ldap configuration for buildbot";
 725             type = submodule {
 726               options = {
 727                 password = mkOption { type = str; description = "Buildbot password"; };
 728               };
 729             };
 730           };
 731           projects = mkOption {
 732             description = "Projects to make a buildbot for";
 733             type = attrsOf (submodule {
 734               options = {
 735                 name = mkOption { type = str; description = "Project name"; };
 736                 packages = mkOption {
 737                   type = unspecified;
 738                   example = literalExample ''
 739                     pkgs: [ pkgs.bash pkgs.git pkgs.gzip pkgs.openssh ];
 740                     '';
 741                   description = ''
 742                     Function.
 743                     Builds packages list to make available to buildbot project.
 744                     Takes pkgs as argument.
 745                   '';
 746                 };
 747                 pythonPackages = mkOption {
 748                   type = unspecified;
 749                   example = literalExample ''
 750                     p: pkgs: [ pkgs.python3Packages.pip ];
 751                     '';
 752                   description = ''
 753                     Function.
 754                     Builds python packages list to make available to buildbot project.
 755                     Takes buildbot python module as first argument and pkgs as second argument in order to augment the python modules list.
 756                     '';
 757                 };
 758                 pythonPathHome = mkOption { type = bool; description = "Whether to add project’s python home to python path"; };
 759                 secrets = mkOption {
 760                   type = attrsOf str;
 761                   description = "Secrets for the project to dump as files";
 762                 };
 763                 environment = mkOption {
 764                   type = attrsOf str;
 765                   description = ''
 766                     Environment variables for the project.
 767                     BUILDBOT_ is prefixed to the variable names
 768                   '';
 769                 };
 770                 activationScript = mkOption {
 771                   type = lines;
 772                   description = ''
 773                     Activation script to run during deployment
 774                   '';
 775                 };
 776                 builderPaths = mkOption {
 777                   type = attrsOf unspecified;
 778                   default = {};
 779                   description = ''
 780                     Attrs of functions to make accessible specifically per builder.
 781                     Takes pkgs as argument and should return a single path containing binaries.
 782                     This path will be accessible as BUILDBOT_PATH_<attrskey>
 783                     '';
 784                 };
 785                 webhookTokens = mkOption {
 786                   type = nullOr (listOf str);
 787                   default = null;
 788                   description = ''
 789                     List of tokens allowed to push to project’s change_hook/base endpoint
 790                   '';
 791                 };
 792               };
 793             });
 794           };
 795         };
 796       };
 797     };
 798     tools = mkOption {
 799       description = "Tools configurations";
 800       type = submodule {
 801         options = {
 802           contact = mkOption { type = str; description = "Contact e-mail address"; };
 803           davical = mkOption {
 804             description = "Davical configuration";
 805             type = submodule {
 806               options = {
 807                 postgresql = mkPsqlOptions "Davical";
 808                 ldap = mkLdapOptions "Davical" {};
 809               };
 810             };
 811           };
 812           diaspora = mkOption {
 813             description = "Diaspora configuration";
 814             type = submodule {
 815               options = {
 816                 postgresql = mkPsqlOptions "Diaspora";
 817                 redis = mkRedisOptions "Diaspora";
 818                 ldap = mkLdapOptions "Diaspora" {};
 819                 secret_token = mkOption { type = str; description = "Secret token"; };
 820               };
 821             };
 822           };
 823           dmarc_reports = mkOption {
 824             description = "DMARC reports configuration";
 825             type = submodule {
 826               options = {
 827                 mysql = mkMysqlOptions "DMARC" {};
 828                 anonymous_key = mkOption { type = str; description = "Anonymous hashing key"; };
 829               };
 830             };
 831           };
 832           etherpad-lite = mkOption {
 833             description = "Etherpad configuration";
 834             type = submodule {
 835               options = {
 836                 postgresql = mkPsqlOptions "Etherpad";
 837                 ldap = mkLdapOptions "Etherpad" {
 838                   group_filter = mkOption { type = str; description = "Filter for groups"; };
 839                 };
 840                 session_key = mkOption { type = str; description = "Session key"; };
 841                 api_key = mkOption { type = str; description = "API key"; };
 842                 redirects = mkOption { type = str; description = "Redirects for apache"; };
 843               };
 844             };
 845           };
 846           gitolite = mkOption {
 847             description = "Gitolite configuration";
 848             type = submodule {
 849               options = {
 850                 ldap = mkLdapOptions "Gitolite" {};
 851               };
 852             };
 853           };
 854           kanboard = mkOption {
 855             description = "Kanboard configuration";
 856             type = submodule {
 857               options = {
 858                 postgresql = mkPsqlOptions "Kanboard";
 859                 ldap = mkLdapOptions "Kanboard" {
 860                   admin_dn = mkOption { type = str; description = "Admin DN"; };
 861                 };
 862               };
 863             };
 864           };
 865           mantisbt = mkOption {
 866             description = "Mantisbt configuration";
 867             type = submodule {
 868               options = {
 869                 postgresql = mkPsqlOptions "Mantisbt";
 870                 ldap = mkLdapOptions "Mantisbt" {};
 871                 master_salt = mkOption { type = str; description = "Master salt for password hash"; };
 872               };
 873             };
 874           };
 875           mastodon = mkOption {
 876             description = "Mastodon configuration";
 877             type = submodule {
 878               options = {
 879                 postgresql = mkPsqlOptions "Mastodon";
 880                 redis = mkRedisOptions "Mastodon";
 881                 ldap = mkLdapOptions "Mastodon" {};
 882                 paperclip_secret = mkOption { type = str; description = "Paperclip secret"; };
 883                 otp_secret = mkOption { type = str; description = "OTP secret"; };
 884                 secret_key_base = mkOption { type = str; description = "Secret key base"; };
 885                 vapid = mkOption {
 886                   description = "vapid key";
 887                   type = submodule {
 888                     options = {
 889                       private = mkOption { type = str; description = "Private key"; };
 890                       public = mkOption { type = str; description = "Public key"; };
 891                     };
 892                   };
 893                 };
 894               };
 895             };
 896           };
 897           mediagoblin = mkOption {
 898             description = "Mediagoblin configuration";
 899             type = submodule {
 900               options = {
 901                 postgresql = mkPsqlOptions "Mediagoblin";
 902                 redis = mkRedisOptions "Mediagoblin";
 903                 ldap = mkLdapOptions "Mediagoblin" {};
 904               };
 905             };
 906           };
 907           nextcloud = mkOption {
 908             description = "Nextcloud configuration";
 909             type = submodule {
 910               options = {
 911                 postgresql = mkPsqlOptions "Peertube";
 912                 redis = mkRedisOptions "Peertube";
 913                 password_salt = mkOption { type = str; description = "Password salt"; };
 914                 instance_id = mkOption { type = str; description = "Instance ID"; };
 915                 secret = mkOption { type = str; description = "App secret"; };
 916               };
 917             };
 918           };
 919           peertube = mkOption {
 920             description = "Peertube configuration";
 921             type = submodule {
 922               options = {
 923                 listenPort = mkOption { type = port; description = "Port to listen to"; };
 924                 postgresql = mkPsqlOptions "Peertube";
 925                 redis = mkRedisOptions "Peertube";
 926                 ldap = mkLdapOptions "Peertube" {};
 927               };
 928             };
 929           };
 930           syden_peertube = mkOption {
 931             description = "Peertube Syden configuration";
 932             type = submodule {
 933               options = {
 934                 listenPort = mkOption { type = port; description = "Port to listen to"; };
 935                 postgresql = mkPsqlOptions "Peertube";
 936                 redis = mkRedisOptions "Peertube";
 937               };
 938             };
 939           };
 940           phpldapadmin = mkOption {
 941             description = "phpLdapAdmin configuration";
 942             type = submodule {
 943               options = {
 944                 ldap = mkLdapOptions "phpldapadmin" {};
 945               };
 946             };
 947           };
 948           rompr = mkOption {
 949             description = "Rompr configuration";
 950             type = submodule {
 951               options = {
 952                 mpd = mkOption {
 953                   description = "MPD configuration";
 954                   type = submodule {
 955                     options = {
 956                       host = mkOption { type = str; description = "Host for MPD"; };
 957                       port = mkOption { type = port; description = "Port to access MPD host"; };
 958                     };
 959                   };
 960                 };
 961               };
 962             };
 963           };
 964           roundcubemail = mkOption {
 965             description = "Roundcubemail configuration";
 966             type = submodule {
 967               options = {
 968                 postgresql = mkPsqlOptions "TT-RSS";
 969                 secret = mkOption { type = str; description = "Secret"; };
 970               };
 971             };
 972           };
 973           shaarli = mkOption {
 974             description = "Shaarli configuration";
 975             type = submodule {
 976               options = {
 977                 ldap = mkLdapOptions "Shaarli" {};
 978               };
 979             };
 980           };
 981           task = mkOption {
 982             description = "Taskwarrior configuration";
 983             type = submodule {
 984               options = {
 985                 ldap = mkLdapOptions "Taskwarrior" {};
 986                 taskwarrior-web = mkOption {
 987                   description = "taskwarrior-web profiles";
 988                   type = attrsOf (submodule {
 989                     options = {
 990                       uid = mkOption {
 991                         type = listOf str;
 992                         description = "List of ldap uids having access to this profile";
 993                       };
 994                       org = mkOption { type = str; description = "Taskd organisation"; };
 995                       key = mkOption { type = str; description = "Taskd key"; };
 996                       date = mkOption { type = str; description = "Preferred date format"; };
 997                     };
 998                   });
 999                 };
1000               };
1001             };
1002           };
1003           ttrss = mkOption {
1004             description = "TT-RSS configuration";
1005             type = submodule {
1006               options = {
1007                 postgresql = mkPsqlOptions "TT-RSS";
1008                 ldap = mkLdapOptions "TT-RSS" {};
1009               };
1010             };
1011           };
1012           wallabag = mkOption {
1013             description = "Wallabag configuration";
1014             type = submodule {
1015               options = {
1016                 postgresql = mkPsqlOptions "Wallabag";
1017                 ldap = mkLdapOptions "Wallabag" {
1018                   admin_filter = mkOption { type = str; description = "Admin users filter"; };
1019                 };
1020                 redis = mkRedisOptions "Wallabag";
1021                 secret = mkOption { type = str; description = "App secret"; };
1022               };
1023             };
1024           };
1025           webhooks = mkOption {
1026             type = attrsOf str;
1027             description = "Mapping 'name'.php => script for webhooks";
1028           };
1029           ympd = mkOption {
1030             description = "Ympd configuration";
1031             type = submodule {
1032               options = {
1033                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1034                 mpd = mkOption {
1035                   description = "MPD configuration";
1036                   type = submodule {
1037                     options = {
1038                       password = mkOption { type = str; description = "Password to access MPD host"; };
1039                       host = mkOption { type = str; description = "Host for MPD"; };
1040                       port = mkOption { type = port; description = "Port to access MPD host"; };
1041                     };
1042                   };
1043                 };
1044               };
1045             };
1046           };
1047           yourls = mkOption {
1048             description = "Yourls configuration";
1049             type = submodule {
1050               options = {
1051                 mysql = mkMysqlOptions "Yourls" {};
1052                 ldap = mkLdapOptions "Yourls" {};
1053                 cookieKey = mkOption { type = str; description = "Cookie key"; };
1054               };
1055             };
1056           };
1057         };
1058       };
1059     };
1060     websites = mkOption {
1061       description = "Websites configurations";
1062       type = submodule {
1063         options = {
1064           isabelle = mkOption {
1065             description = "Isabelle configurations by environment";
1066             type =
1067               let
1068                 atenSubmodule = mkOption {
1069                   description = "environment configuration";
1070                   type = submodule {
1071                     options = {
1072                       environment = mkOption { type = str; description = "Symfony environment"; };
1073                       secret = mkOption { type = str; description = "Symfony App secret"; };
1074                       postgresql = mkPsqlOptions "Aten";
1075                     };
1076                   };
1077                 };
1078               in
1079                 submodule {
1080                   options = {
1081                     aten_production = atenSubmodule;
1082                     aten_integration = atenSubmodule;
1083                     iridologie = mkOption {
1084                       description = "environment configuration";
1085                       type = submodule {
1086                         options = {
1087                           environment = mkOption { type = str; description = "SPIP environment"; };
1088                           mysql = mkMysqlOptions "Iridologie" {};
1089                           ldap = mkLdapOptions "Iridologie" {};
1090                         };
1091                       };
1092                     };
1093                   };
1094                 };
1095           };
1096           chloe = mkOption {
1097             description = "Chloe configurations by environment";
1098             type =
1099               let
1100                 chloeSubmodule = mkOption {
1101                   description = "environment configuration";
1102                   type = submodule {
1103                     options = {
1104                       environment = mkOption { type = str; description = "SPIP environment"; };
1105                       mysql = mkMysqlOptions "Chloe" {};
1106                       ldap = mkLdapOptions "Chloe" {};
1107                     };
1108                   };
1109                 };
1110               in
1111                 submodule {
1112                   options = {
1113                     production = chloeSubmodule;
1114                     integration = chloeSubmodule;
1115                   };
1116                 };
1117           };
1118           connexionswing = mkOption {
1119             description = "Connexionswing configurations by environment";
1120             type =
1121               let
1122                 csSubmodule = mkOption {
1123                   description = "environment configuration";
1124                   type = submodule {
1125                     options = {
1126                       environment = mkOption { type = str; description = "Symfony environment"; };
1127                       mysql = mkMysqlOptions "Connexionswing" {};
1128                       secret = mkOption { type = str; description = "Symfony App secret"; };
1129                       email = mkOption { type = str; description = "Symfony email notification"; };
1130                     };
1131                   };
1132                 };
1133               in
1134                 submodule {
1135                   options = {
1136                     production = csSubmodule;
1137                     integration = csSubmodule;
1138                   };
1139                 };
1140           };
1141           jerome = mkOption {
1142             description = "Naturaloutil configuration";
1143             type = submodule {
1144               options = {
1145                 mysql = mkMysqlOptions "Naturaloutil" {};
1146                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1147               };
1148             };
1149           };
1150           telio_tortay = mkOption {
1151             description = "Telio Tortay configuration";
1152             type = submodule {
1153               options = {
1154                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1155               };
1156             };
1157           };
1158           ludivine = mkOption {
1159             description = "Ludivinecassal configurations by environment";
1160             type =
1161               let
1162                 lcSubmodule = mkOption {
1163                   description = "environment configuration";
1164                   type = submodule {
1165                     options = {
1166                       environment = mkOption { type = str; description = "Symfony environment"; };
1167                       mysql = mkMysqlOptions "LudivineCassal" {};
1168                       ldap = mkLdapOptions "LudivineCassal" {};
1169                       secret = mkOption { type = str; description = "Symfony App secret"; };
1170                     };
1171                   };
1172                 };
1173               in
1174                 submodule {
1175                   options = {
1176                     production = lcSubmodule;
1177                     integration = lcSubmodule;
1178                   };
1179                 };
1180           };
1181           emilia = mkOption {
1182             description = "Emilia configuration";
1183             type = submodule {
1184               options = {
1185                 postgresql = mkPsqlOptions "Emilia";
1186               };
1187             };
1188           };
1189           florian = mkOption {
1190             description = "Florian configuration";
1191             type = submodule {
1192               options = {
1193                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1194               };
1195             };
1196           };
1197           nassime = mkOption {
1198             description = "Nassime configuration";
1199             type = submodule {
1200               options = {
1201                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1202               };
1203             };
1204           };
1205           piedsjaloux = mkOption {
1206             description = "Piedsjaloux configurations by environment";
1207             type =
1208               let
1209                 pjSubmodule = mkOption {
1210                   description = "environment configuration";
1211                   type = submodule {
1212                     options = {
1213                       environment = mkOption { type = str; description = "Symfony environment"; };
1214                       mysql = mkMysqlOptions "Piedsjaloux" {};
1215                       secret = mkOption { type = str; description = "Symfony App secret"; };
1216                     };
1217                   };
1218                 };
1219               in
1220                 submodule {
1221                   options = {
1222                     production = pjSubmodule;
1223                     integration = pjSubmodule;
1224                   };
1225                 };
1226           };
1227           richie = mkOption {
1228             description = "Europe Richie configurations by environment";
1229             type = submodule {
1230               options = {
1231                 mysql = mkMysqlOptions "Richie" {};
1232                 smtp_mailer = mkOption {
1233                   description = "SMTP mailer configuration";
1234                   type = submodule {
1235                     options = {
1236                       user = mkOption { type = str; description = "Username"; };
1237                       password = mkOption { type = str; description = "Password"; };
1238                     };
1239                   };
1240                 };
1241               };
1242             };
1243           };
1244           tellesflorian = mkOption {
1245             description = "Tellesflorian configurations by environment";
1246             type =
1247               let
1248                 tfSubmodule = mkOption {
1249                   description = "environment configuration";
1250                   type = submodule {
1251                     options = {
1252                       environment = mkOption { type = str; description = "Symfony environment"; };
1253                       mysql = mkMysqlOptions "Tellesflorian" {};
1254                       secret = mkOption { type = str; description = "Symfony App secret"; };
1255                       invite_passwords = mkOption { type = str; description = "Password basic auth"; };
1256                     };
1257                   };
1258                 };
1259               in
1260                 submodule {
1261                   options = {
1262                     integration = tfSubmodule;
1263                   };
1264                 };
1265           };
1266         };
1267       };
1268     };
1269
1270     privateFiles = mkOption {
1271       type = path;
1272       description = ''
1273         Path to secret files to make available during build
1274         '';
1275     };
1276   };
1277   options.hostEnv = mkOption {
1278     readOnly = true;
1279     type = hostEnv;
1280     default = config.myEnv.servers."${name}";
1281     description = "Host environment";
1282   };
1283 }