modules/private/environment.nix

   1 { config, lib, name, ... }:
   2 with lib;
   3 with types;
   4 with lists;
   5 let
   6   ldapOptions = {
   7     base = mkOption { description = "Base of the LDAP tree"; type = str; };
   8     host = mkOption { description = "Host to access LDAP"; type = str; };
   9     root_dn = mkOption { description = "DN of the root user"; type = str; };
  10     root_pw = mkOption { description = "Hashed password of the root user"; type = str; };
  11     replication_dn = mkOption { description = "DN of the user allowed to replicate the LDAP directory"; type = str; };
  12     replication_pw = mkOption { description = "Password of the user allowed to replicate the LDAP directory"; type = str; };
  13   };
  14   mkLdapOptions = name: more: mkOption {
  15     description = "${name} LDAP configuration";
  16     type = submodule {
  17       options = ldapOptions // {
  18         dn = mkOption { description = "DN of the ${name} user"; type = str; };
  19         password = mkOption { description = "password of the ${name} user"; type = str; };
  20         filter = mkOption { description = "Filter for ${name} users"; type = str; default = ""; };
  21       } // more;
  22     };
  23   };
  24   mysqlOptions = {
  25     host = mkOption { description = "Host to access Mysql"; type = str; };
  26     remoteHost = mkOption { description = "Host to access Mysql from outside"; type = str; };
  27     port = mkOption { description = "Port to access Mysql"; type = str; };
  28     socket = mkOption { description = "Socket to access Mysql"; type = path; };
  29     systemUsers = mkOption {
  30       description = "Attrs of user-passwords allowed to access mysql";
  31       type = attrsOf str;
  32     };
  33     pam = mkOption {
  34       description = "PAM configuration for mysql";
  35       type = submodule {
  36         options = {
  37           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  38           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  39           filter = mkOption { description = "filter to match users"; type = str; };
  40         };
  41       };
  42     };
  43   };
  44   mkMysqlOptions = name: more: mkOption {
  45     description = "${name} mysql configuration";
  46     type = submodule {
  47       options = mysqlOptions // {
  48         database = mkOption { description = "${name} database"; type = str; };
  49         user = mkOption { description = "${name} user"; type = str; };
  50         password = mkOption { description = "mysql password of the ${name} user"; type = str; };
  51       } // more;
  52     };
  53   };
  54   psqlOptions = {
  55     host = mkOption { description = "Host to access Postgresql"; type = str; };
  56     port = mkOption { description = "Port to access Postgresql"; type = str; };
  57     socket = mkOption { description = "Socket to access Postgresql"; type = path; };
  58     pam = mkOption {
  59       description = "PAM configuration for psql";
  60       type = submodule {
  61         options = {
  62           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  63           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  64           filter = mkOption { description = "filter to match users"; type = str; };
  65         };
  66       };
  67     };
  68   };
  69   mkPsqlOptions = name: mkOption {
  70     description = "${name} psql configuration";
  71     type = submodule {
  72       options = psqlOptions // {
  73         database = mkOption { description = "${name} database"; type = str; };
  74         schema = mkOption { description = "${name} schema"; type = nullOr str; default = null; };
  75         user = mkOption { description = "${name} user"; type = str; };
  76         password = mkOption { description = "psql password of the ${name} user"; type = str; };
  77       };
  78     };
  79   };
  80   redisOptions = {
  81     host = mkOption { description = "Host to access Redis"; type = str; };
  82     port = mkOption { description = "Port to access Redis"; type = str; };
  83     socket = mkOption { description = "Socket to access Redis"; type = path; };
  84     dbs = mkOption {
  85       description = "Attrs of db number. Each number should be unique to avoid collision!";
  86       type = attrsOf str;
  87     };
  88     spiped_key = mkOption {
  89       type = str;
  90       description = ''
  91         Key to use with spiped to make a secure channel to replication
  92         '';
  93     };
  94     predixy = mkOption {
  95       description = "Predixy configuration. Unused yet";
  96       type = submodule {
  97         options = {
  98           read = mkOption { type = str; description = "Read password"; };
  99         };
 100       };
 101     };
 102   };
 103   mkRedisOptions = name: mkOption {
 104     description = "${name} redis configuration";
 105     type = submodule {
 106       options = redisOptions // {
 107         db = mkOption { description = "${name} database"; type = str; };
 108       };
 109     };
 110   };
 111   smtpOptions = {
 112     host = mkOption { description = "Host to access SMTP"; type = str; };
 113     port = mkOption { description = "Port to access SMTP"; type = str; };
 114   };
 115   mkSmtpOptions = name: mkOption {
 116     description = "${name} smtp configuration";
 117     type = submodule {
 118       options = smtpOptions // {
 119         email = mkOption { description = "${name} email"; type = str; };
 120         password = mkOption { description = "SMTP password of the ${name} user"; type = str; };
 121       };
 122     };
 123   };
 124   hostEnv = submodule {
 125     options = {
 126       fqdn = mkOption {
 127         description = "Host FQDN";
 128         type = str;
 129       };
 130       users = mkOption {
 131         type = unspecified;
 132         default = pkgs: [];
 133         description = ''
 134           Sublist of users from realUsers. Function that takes pkgs as
 135           argument and gives an array as a result
 136         '';
 137       };
 138       emails = mkOption {
 139         default = [];
 140         description = "List of e-mails that the server can be a sender of";
 141         type = listOf str;
 142       };
 143       ldap = mkOption {
 144         description = ''
 145           LDAP credentials for the host
 146         '';
 147         type = submodule {
 148           options = {
 149             password = mkOption { type = str; description = "Password for the LDAP connection"; };
 150             dn = mkOption { type = str; description = "DN for the LDAP connection"; };
 151           };
 152         };
 153       };
 154       mx = mkOption {
 155         description = "subdomain and priority for MX server";
 156         default = { enable = false; };
 157         type = submodule {
 158           options = {
 159             enable = mkEnableOption "Enable MX";
 160             subdomain = mkOption { type = nullOr str; description = "Subdomain name (mx-*)"; };
 161             priority = mkOption { type = nullOr str; description = "Priority"; };
 162           };
 163         };
 164       };
 165       ips = mkOption {
 166         description = ''
 167           attrs of ip4/ip6 grouped by section
 168         '';
 169         type = attrsOf (submodule {
 170           options = {
 171             ip4 = mkOption {
 172               type = str;
 173               description = ''
 174                 ip4 address of the host
 175               '';
 176             };
 177             ip6 = mkOption {
 178               type = listOf str;
 179               default = [];
 180               description = ''
 181                 ip6 addresses of the host
 182               '';
 183             };
 184           };
 185         });
 186       };
 187     };
 188   };
 189 in
 190 {
 191   options.myEnv = {
 192     servers = mkOption {
 193       description = ''
 194         Attrs of servers information in the cluster (not necessarily handled by nixops)
 195       '';
 196       default = {};
 197       type = attrsOf hostEnv;
 198     };
 199     hetznerCloud = mkOption {
 200       description = ''
 201         Hetzner Cloud credential information
 202       '';
 203       type = submodule {
 204         options = {
 205           authToken = mkOption {
 206             type = str;
 207             description = ''
 208               The API auth token.
 209             '';
 210           };
 211         };
 212       };
 213     };
 214     hetzner = mkOption {
 215       description = ''
 216         Hetzner credential information
 217       '';
 218       type = submodule {
 219         options = {
 220           user = mkOption { type = str; description = "User"; };
 221           pass = mkOption { type = str; description = "Password"; };
 222         };
 223       };
 224     };
 225     sshd = mkOption {
 226       description = ''
 227         sshd service credential information
 228       '';
 229       type = submodule {
 230         options = {
 231           ldap = mkOption {
 232             description = ''
 233               LDAP credentials for cn=ssh,ou=services,dc=immae,dc=eu dn
 234             '';
 235             type = submodule {
 236               options = {
 237                 password = mkOption { description = "Password"; type = str; };
 238               };
 239             };
 240           };
 241         };
 242       };
 243     };
 244     ports = mkOption {
 245       description = ''
 246         non-standard reserved ports. Must be unique!
 247       '';
 248       type = attrsOf port;
 249       default = {};
 250       apply = let
 251         noDupl = x: builtins.length (builtins.attrValues x) == builtins.length (unique (builtins.attrValues x));
 252       in
 253         x: if isAttrs x && noDupl x then x else throw "Non unique values for ports";
 254     };
 255     httpd = mkOption {
 256       description = ''
 257         httpd service credential information
 258       '';
 259       type = submodule {
 260         options = {
 261           ldap = mkOption {
 262             description = ''
 263               LDAP credentials for cn=httpd,ou=services,dc=immae,dc=eu dn
 264             '';
 265             type = submodule {
 266               options = {
 267                 password = mkOption { description = "Password"; type = str; };
 268               };
 269             };
 270           };
 271         };
 272       };
 273     };
 274     smtp = mkOption {
 275       type = submodule { options = smtpOptions; };
 276       description = "SMTP configuration";
 277     };
 278     ldap = mkOption {
 279       description = ''
 280         LDAP server configuration
 281         '';
 282       type = submodule {
 283         options = ldapOptions;
 284       };
 285     };
 286     databases = mkOption {
 287       description = "Databases configuration";
 288       type = submodule {
 289         options = {
 290           mysql = mkOption {
 291             type = submodule { options = mysqlOptions; };
 292             description = "Mysql configuration";
 293           };
 294           redis = mkOption {
 295             type = submodule { options = redisOptions; };
 296             description = "Redis configuration";
 297           };
 298           postgresql = mkOption {
 299             type = submodule { options = psqlOptions; };
 300             description = "Postgresql configuration";
 301           };
 302         };
 303       };
 304     };
 305     jabber = mkOption {
 306       description = "Jabber configuration";
 307       type = submodule {
 308         options = {
 309           postfix_user_filter = mkOption { type = str; description = "Postfix filter to get xmpp users"; };
 310           ldap = mkLdapOptions "Jabber" {};
 311           postgresql = mkPsqlOptions "Jabber";
 312         };
 313       };
 314     };
 315     realUsers = mkOption {
 316       description = ''
 317         Attrset of function taking pkgs as argument.
 318         Real users settings, should provide a subattr of users.users.<name>
 319         with at least: name, (hashed)Password, shell
 320       '';
 321       type = attrsOf unspecified;
 322     };
 323     users = mkOption {
 324       description = "System and regular users uid/gid";
 325       type = attrsOf (submodule {
 326         options = {
 327           uid = mkOption {
 328             description = "user uid";
 329             type = int;
 330           };
 331           gid = mkOption {
 332             description = "user gid";
 333             type = int;
 334           };
 335         };
 336       });
 337     };
 338     dns = mkOption {
 339       description = "DNS configuration";
 340       type = submodule {
 341         options = {
 342           soa = mkOption {
 343             description = "SOA information";
 344             type = submodule {
 345               options = {
 346                 serial = mkOption {
 347                   description = "Serial number. Should be incremented at each change and unique";
 348                   type = str;
 349                 };
 350                 refresh = mkOption {
 351                   description = "Refresh time";
 352                   type = str;
 353                 };
 354                 retry = mkOption {
 355                   description = "Retry time";
 356                   type = str;
 357                 };
 358                 expire = mkOption {
 359                   description = "Expire time";
 360                   type = str;
 361                 };
 362                 ttl = mkOption {
 363                   description = "Default TTL time";
 364                   type = str;
 365                 };
 366                 email = mkOption {
 367                   description = "hostmaster e-mail";
 368                   type = str;
 369                 };
 370                 primary = mkOption {
 371                   description = "Primary NS";
 372                   type = str;
 373                 };
 374               };
 375             };
 376           };
 377           ns = mkOption {
 378             description = "Attrs of NS servers group";
 379             example = {
 380               foo = {
 381                 "ns1.foo.com" = [ "198.51.100.10" "2001:db8:abcd::1" ];
 382                 "ns2.foo.com" = [ "198.51.100.15" "2001:db8:1234::1" ];
 383               };
 384             };
 385             type = attrsOf (attrsOf (listOf str));
 386           };
 387           slaveZones = mkOption {
 388             description = "List of slave zones";
 389             type = listOf (submodule {
 390               options = {
 391                 name = mkOption { type = str; description = "zone name"; };
 392                 masters = mkOption {
 393                   description = "NS master groups of this zone";
 394                   type = listOf str;
 395                 };
 396               };
 397             });
 398           };
 399           masterZones = mkOption {
 400             description = "List of master zones";
 401             type = listOf (submodule {
 402               options = {
 403                 name = mkOption { type = str; description = "zone name"; };
 404                 slaves = mkOption {
 405                   description = "NS slave groups of this zone";
 406                   type = listOf str;
 407                 };
 408                 ns = mkOption {
 409                   description = "groups names that should have their NS entries listed here";
 410                   type = listOf str;
 411                 };
 412                 extra = mkOption {
 413                   description = "Extra zone configuration for bind";
 414                   example = ''
 415                     notify yes;
 416                     '';
 417                   type = lines;
 418                 };
 419                 entries = mkOption { type = lines; description = "Regular entries of the NS zone"; };
 420                 withEmail = mkOption {
 421                   description = "List of domains that should have mail entries (MX, dkim, SPF, ...)";
 422                   default = [];
 423                   type = listOf (submodule {
 424                     options = {
 425                       domain = mkOption { type = str; description = "Which subdomain is concerned"; };
 426                       send = mkOption { type = bool; description = "Whether there can be e-mails originating from the subdomain"; };
 427                       receive = mkOption { type = bool; description = "Whether there can be e-mails arriving to the subdomain"; };
 428                     };
 429                   });
 430                 };
 431               };
 432             });
 433           };
 434         };
 435       };
 436     };
 437     backup = mkOption {
 438       description = ''
 439         Remote backup with duplicity
 440         '';
 441       type = submodule {
 442         options = {
 443           password = mkOption { type = str; description = "Password for encrypting files"; };
 444           remotes = mkOption {
 445             type = attrsOf (submodule {
 446               options = {
 447                 remote = mkOption {
 448                   type = unspecified;
 449                   example = literalExample ''
 450                     bucket: "s3://some_host/${bucket}";
 451                     '';
 452                   description = ''
 453                     Function.
 454                     Takes a bucket name as argument and returns a url
 455                     '';
 456                 };
 457                 accessKeyId = mkOption { type = str; description = "Remote access-key"; };
 458                 secretAccessKey = mkOption { type = str; description = "Remote access secret"; };
 459               };
 460             });
 461           };
 462         };
 463       };
 464     };
 465     rsync_backup = mkOption {
 466       description  =''
 467         Rsync backup configuration from controlled host
 468         '';
 469       type = submodule {
 470         options = {
 471           ssh_key = mkOption {
 472             description = "SSH key information";
 473             type = submodule {
 474               options = {
 475                 public = mkOption { type = str; description = "Public part of the key"; };
 476                 private = mkOption { type = lines; description = "Private part of the key"; };
 477               };
 478             };
 479           };
 480           profiles = mkOption {
 481             description = "Attrs of profiles to backup";
 482             type = attrsOf (submodule {
 483               options = {
 484                 keep = mkOption { type = int; description = "Number of backups to keep"; };
 485                 check_command = mkOption { type = str; description = "command to check if backup needs to be done"; default = "backup"; };
 486                 login = mkOption { type = str; description = "Login to connect to host"; };
 487                 port = mkOption { type = str; default = "22"; description = "Port to connect to host"; };
 488                 host = mkOption { type = str; description = "Host to connect to"; };
 489                 host_key = mkOption { type = str; description = "Host key"; };
 490                 host_key_type = mkOption { type = str; description = "Host key type"; };
 491                 parts = mkOption {
 492                   description = "Parts to backup for this host";
 493                   type = attrsOf (submodule {
 494                     options = {
 495                       remote_folder = mkOption { type = path; description = "Remote folder to backup";};
 496                       exclude_from = mkOption {
 497                         type = listOf path;
 498                         default = [];
 499                         description = "List of folders/files to exclude from the backup";
 500                       };
 501                       files_from = mkOption {
 502                         type = listOf path;
 503                         default = [];
 504                         description = "List of folders/files to backup in the base folder";
 505                       };
 506                       args = mkOption {
 507                         type = nullOr str;
 508                         default = null;
 509                         description = "Extra arguments to pass to rsync";
 510                       };
 511                     };
 512                   });
 513                 };
 514               };
 515             });
 516           };
 517         };
 518       };
 519     };
 520     monitoring = mkOption {
 521       description = "Monitoring configuration";
 522       type = submodule {
 523         options = {
 524           status_url = mkOption { type = str; description = "URL to push status to"; };
 525           status_token = mkOption { type = str; description = "Token for the status url"; };
 526           http_user_password = mkOption { type = str; description = "HTTP credentials to check services behind wall"; };
 527           email = mkOption { type = str; description = "Admin E-mail"; };
 528           ssh_public_key = mkOption { type = str; description = "SSH public key"; };
 529           ssh_secret_key = mkOption { type = str; description = "SSH secret key"; };
 530           imap_login = mkOption { type = str; description = "IMAP login"; };
 531           imap_password = mkOption { type = str; description = "IMAP password"; };
 532           eriomem_keys = mkOption { type = listOf (listOf str); description = "Eriomem keys"; default = []; };
 533           ovh_sms = mkOption {
 534             description = "OVH credentials for sms script";
 535             type = submodule {
 536               options = {
 537                 endpoint = mkOption { type = str; default = "ovh-eu"; description = "OVH endpoint"; };
 538                 application_key = mkOption { type = str; description = "Application key"; };
 539                 application_secret = mkOption { type = str; description = "Application secret"; };
 540                 consumer_key = mkOption { type = str; description = "Consumer key"; };
 541                 account = mkOption { type = str; description = "Account"; };
 542               };
 543             };
 544           };
 545           nrdp_tokens = mkOption { type = listOf str; description = "Tokens allowed to push status update"; };
 546           slack_url = mkOption { type = str; description = "Slack webhook url to push status update"; };
 547           slack_channel = mkOption { type = str; description = "Slack channel to push status update"; };
 548           contacts = mkOption { type = attrsOf unspecified; description = "Contact dicts to fill naemon objects"; };
 549           email_check = mkOption {
 550             description = "Emails services to check";
 551             type = attrsOf (submodule {
 552               options = {
 553                 local = mkOption { type = bool; default = false; description = "Use local configuration"; };
 554                 port = mkOption { type = nullOr str; default = null; description = "Port to connect to ssh"; };
 555                 login = mkOption { type = nullOr str; default = null; description = "Login to connect to ssh"; };
 556                 targets = mkOption { type = listOf str; description = "Hosts to send E-mails to"; };
 557                 mail_address = mkOption { type = nullOr str; default = null; description = "E-mail recipient part to send e-mail to"; };
 558                 mail_domain = mkOption { type = nullOr str; default = null; description = "E-mail domain part to send e-mail to"; };
 559               };
 560             });
 561           };
 562         };
 563       };
 564     };
 565     mpd = mkOption {
 566       description = "MPD configuration";
 567       type = submodule {
 568         options = {
 569           folder = mkOption { type = str; description = "Folder to serve from the MPD instance"; };
 570           password = mkOption { type = str; description = "Password to connect to the MPD instance"; };
 571           host = mkOption { type = str; description = "Host to connect to the MPD instance"; };
 572           port = mkOption { type = str; description = "Port to connect to the MPD instance"; };
 573         };
 574       };
 575     };
 576     ftp = mkOption {
 577       description = "FTP configuration";
 578       type = submodule {
 579         options = {
 580           ldap = mkLdapOptions "FTP" {};
 581         };
 582       };
 583     };
 584     vpn = mkOption {
 585       description = "VPN configuration";
 586       type = attrsOf (submodule {
 587         options = {
 588           prefix = mkOption { type = str; description = "ipv6 prefix for the vpn subnet"; };
 589           privateKey = mkOption { type = str; description = "Private key for the host"; };
 590           publicKey = mkOption { type = str; description = "Public key for the host"; };
 591         };
 592       });
 593     };
 594     mail = mkOption {
 595       description = "Mail configuration";
 596       type = submodule {
 597         options = {
 598           dmarc = mkOption {
 599             description = "DMARC configuration";
 600             type = submodule {
 601               options = {
 602                 ignore_hosts = mkOption {
 603                   type = lines;
 604                   description = ''
 605                     Hosts to ignore when checking for dmarc
 606                     '';
 607                 };
 608               };
 609             };
 610           };
 611           dkim = mkOption {
 612             description = "DKIM configuration";
 613             type = attrsOf (submodule {
 614               options = {
 615                 public = mkOption {
 616                   type = str;
 617                   example = ''
 618                     ( "v=DKIM1; k=rsa; "
 619                               "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3w1a2aMxWw9+hdcmbqX4UevcVqr204y0K73Wdc7MPZiOOlUJQYsMNSYR1Y/SC7jmPKeitpcJCpQgn/cveJZbuikjjPLsDReHyFEYmC278ZLRTELHx6f1IXM8WE08JIRT69CfZiMi1rVcOh9qRT4F93PyjCauU8Y5hJjtg9ThsWwIDAQAB" )
 620                     '';
 621                   description = "Public entry to put in DNS TXT field";
 622                 };
 623                 private = mkOption { type = str; description = "Private key"; };
 624               };
 625             });
 626           };
 627           postfix = mkOption {
 628             description = "Postfix configuration";
 629             type = submodule {
 630               options = {
 631                 additional_mailbox_domains = mkOption {
 632                   description = ''
 633                     List of domains that are used as mailbox final destination, in addition to those defined in the DNS records
 634                   '';
 635                   type = listOf str;
 636                 };
 637                 mysql = mkMysqlOptions "Postfix" {
 638                   password_encrypt = mkOption { type = str; description = "Key to encrypt relay password in database"; };
 639                 };
 640                 backup_domains = mkOption {
 641                   description = ''
 642                     Domains that are accepted for relay as backup domain
 643                   '';
 644                   type = attrsOf (submodule {
 645                     options = {
 646                       domains = mkOption { type = listOf str; description = "Domains list"; };
 647                       relay_restrictions = mkOption {
 648                         type = lines;
 649                         description = ''
 650                           Restrictions for relaying the e-mails from the domains
 651                           '';
 652                       };
 653                       recipient_maps = mkOption {
 654                         description = ''
 655                           Recipient map to accept relay for.
 656                           Must be specified for domain, the rules apply to everyone!
 657                         '';
 658                         type = listOf (submodule {
 659                           options = {
 660                             type = mkOption {
 661                               type = enum [ "hash" ];
 662                               description = "Map type";
 663                             };
 664                             content = mkOption {
 665                               type = str;
 666                               description = "Map content";
 667                             };
 668                           };
 669                         });
 670                       };
 671                     };
 672                   });
 673                 };
 674               };
 675             };
 676           };
 677           dovecot = mkOption {
 678             description = "Dovecot configuration";
 679             type = submodule {
 680               options = {
 681                 ldap = mkLdapOptions "Dovecot" {
 682                   pass_attrs = mkOption { type = str; description = "Password attribute in LDAP"; };
 683                   user_attrs = mkOption { type = str; description = "User attribute mapping in LDAP"; };
 684                   iterate_attrs = mkOption { type = str; description = "User attribute mapping for listing in LDAP"; };
 685                   iterate_filter = mkOption { type = str; description = "User attribute filter for listing in LDAP"; };
 686                   postfix_mailbox_filter = mkOption { type = str; description = "Postfix filter to get mailboxes"; };
 687                 };
 688               };
 689             };
 690           };
 691           rspamd = mkOption {
 692             description = "rspamd configuration";
 693             type = submodule {
 694               options = {
 695                 redis = mkRedisOptions "Redis";
 696                 read_password_hashed = mkOption { type = str; description = "Hashed read password for rspamd"; };
 697                 write_password_hashed = mkOption { type = str; description = "Hashed write password for rspamd"; };
 698                 read_password = mkOption {
 699                   type = str;
 700                   description = "Read password for rspamd. Unused";
 701                   apply = x: "";
 702                 };
 703                 write_password = mkOption {
 704                   type = str;
 705                   description = "Write password for rspamd. Unused";
 706                   apply = x: "";
 707                 };
 708               };
 709             };
 710           };
 711           scripts = mkOption {
 712             description = "Mail script recipients";
 713             type = attrsOf (submodule {
 714               options = {
 715                 external = mkEnableOption "Create a script_<name>@mail.immae.eu external address";
 716                 src = mkOption {
 717                   description = ''
 718                     git source to fetch the script from.
 719                     It must have a default.nix file as its root accepting a scriptEnv parameter
 720                   '';
 721                   type = submodule {
 722                     options = {
 723                       url = mkOption { type = str; description = "git url to fetch"; };
 724                       rev = mkOption { type = str; description = "git reference to fetch"; };
 725                     };
 726                   };
 727                 };
 728                 env = mkOption {
 729                   description = "Variables to pass to the script";
 730                   type = unspecified;
 731                 };
 732               };
 733             });
 734           };
 735           sympa = mkOption {
 736             description = "Sympa configuration";
 737             type = submodule {
 738               options = {
 739                 listmasters = mkOption {
 740                   type = listOf str;
 741                   description = "Listmasters";
 742                 };
 743                 postgresql = mkPsqlOptions "Sympa";
 744                 data_sources = mkOption {
 745                   type = attrsOf str;
 746                   default = {};
 747                   description = "Data sources to make available to sympa";
 748                 };
 749                 scenari = mkOption {
 750                   type = attrsOf str;
 751                   default = {};
 752                   description = "Scenari to make available to sympa";
 753                 };
 754               };
 755             };
 756           };
 757         };
 758       };
 759     };
 760     buildbot = mkOption {
 761       description = "Buildbot configuration";
 762       type = submodule {
 763         options = {
 764           user = mkOption {
 765             description = "Buildbot user";
 766             type = submodule {
 767               options = {
 768                 uid = mkOption {
 769                   description = "user uid";
 770                   type = int;
 771                 };
 772                 gid = mkOption {
 773                   description = "user gid";
 774                   type = int;
 775                 };
 776               };
 777             };
 778           };
 779           ldap = mkOption {
 780             description = "Ldap configuration for buildbot";
 781             type = submodule {
 782               options = {
 783                 password = mkOption { type = str; description = "Buildbot password"; };
 784               };
 785             };
 786           };
 787           projects = mkOption {
 788             description = "Projects to make a buildbot for";
 789             type = attrsOf (submodule {
 790               options = {
 791                 name = mkOption { type = str; description = "Project name"; };
 792                 packages = mkOption {
 793                   type = unspecified;
 794                   example = literalExample ''
 795                     pkgs: [ pkgs.bash pkgs.git pkgs.gzip pkgs.openssh ];
 796                     '';
 797                   description = ''
 798                     Function.
 799                     Builds packages list to make available to buildbot project.
 800                     Takes pkgs as argument.
 801                   '';
 802                 };
 803                 pythonPackages = mkOption {
 804                   type = unspecified;
 805                   example = literalExample ''
 806                     p: pkgs: [ pkgs.python3Packages.pip ];
 807                     '';
 808                   description = ''
 809                     Function.
 810                     Builds python packages list to make available to buildbot project.
 811                     Takes buildbot python module as first argument and pkgs as second argument in order to augment the python modules list.
 812                     '';
 813                 };
 814                 pythonPathHome = mkOption { type = bool; description = "Whether to add project’s python home to python path"; };
 815                 secrets = mkOption {
 816                   type = attrsOf str;
 817                   description = "Secrets for the project to dump as files";
 818                 };
 819                 environment = mkOption {
 820                   type = attrsOf str;
 821                   description = ''
 822                     Environment variables for the project.
 823                     BUILDBOT_ is prefixed to the variable names
 824                   '';
 825                 };
 826                 activationScript = mkOption {
 827                   type = lines;
 828                   description = ''
 829                     Activation script to run during deployment
 830                   '';
 831                 };
 832                 builderPaths = mkOption {
 833                   type = attrsOf unspecified;
 834                   default = {};
 835                   description = ''
 836                     Attrs of functions to make accessible specifically per builder.
 837                     Takes pkgs as argument and should return a single path containing binaries.
 838                     This path will be accessible as BUILDBOT_PATH_<attrskey>
 839                     '';
 840                 };
 841                 webhookTokens = mkOption {
 842                   type = nullOr (listOf str);
 843                   default = null;
 844                   description = ''
 845                     List of tokens allowed to push to project’s change_hook/base endpoint
 846                   '';
 847                 };
 848               };
 849             });
 850           };
 851         };
 852       };
 853     };
 854     tools = mkOption {
 855       description = "Tools configurations";
 856       type = submodule {
 857         options = {
 858           contact = mkOption { type = str; description = "Contact e-mail address"; };
 859           davical = mkOption {
 860             description = "Davical configuration";
 861             type = submodule {
 862               options = {
 863                 postgresql = mkPsqlOptions "Davical";
 864                 ldap = mkLdapOptions "Davical" {};
 865               };
 866             };
 867           };
 868           diaspora = mkOption {
 869             description = "Diaspora configuration";
 870             type = submodule {
 871               options = {
 872                 postgresql = mkPsqlOptions "Diaspora";
 873                 redis = mkRedisOptions "Diaspora";
 874                 ldap = mkLdapOptions "Diaspora" {};
 875                 secret_token = mkOption { type = str; description = "Secret token"; };
 876               };
 877             };
 878           };
 879           dmarc_reports = mkOption {
 880             description = "DMARC reports configuration";
 881             type = submodule {
 882               options = {
 883                 mysql = mkMysqlOptions "DMARC" {};
 884                 anonymous_key = mkOption { type = str; description = "Anonymous hashing key"; };
 885               };
 886             };
 887           };
 888           etherpad-lite = mkOption {
 889             description = "Etherpad configuration";
 890             type = submodule {
 891               options = {
 892                 postgresql = mkPsqlOptions "Etherpad";
 893                 ldap = mkLdapOptions "Etherpad" {
 894                   group_filter = mkOption { type = str; description = "Filter for groups"; };
 895                 };
 896                 adminPassword = mkOption { type = str; description = "Admin password for mypads / admin"; };
 897                 session_key = mkOption { type = str; description = "Session key"; };
 898                 api_key = mkOption { type = str; description = "API key"; };
 899                 redirects = mkOption { type = str; description = "Redirects for apache"; };
 900               };
 901             };
 902           };
 903           gitolite = mkOption {
 904             description = "Gitolite configuration";
 905             type = submodule {
 906               options = {
 907                 ldap = mkLdapOptions "Gitolite" {};
 908               };
 909             };
 910           };
 911           kanboard = mkOption {
 912             description = "Kanboard configuration";
 913             type = submodule {
 914               options = {
 915                 postgresql = mkPsqlOptions "Kanboard";
 916                 ldap = mkLdapOptions "Kanboard" {
 917                   admin_dn = mkOption { type = str; description = "Admin DN"; };
 918                 };
 919               };
 920             };
 921           };
 922           mantisbt = mkOption {
 923             description = "Mantisbt configuration";
 924             type = submodule {
 925               options = {
 926                 postgresql = mkPsqlOptions "Mantisbt";
 927                 ldap = mkLdapOptions "Mantisbt" {};
 928                 master_salt = mkOption { type = str; description = "Master salt for password hash"; };
 929               };
 930             };
 931           };
 932           mastodon = mkOption {
 933             description = "Mastodon configuration";
 934             type = submodule {
 935               options = {
 936                 postgresql = mkPsqlOptions "Mastodon";
 937                 redis = mkRedisOptions "Mastodon";
 938                 ldap = mkLdapOptions "Mastodon" {};
 939                 paperclip_secret = mkOption { type = str; description = "Paperclip secret"; };
 940                 otp_secret = mkOption { type = str; description = "OTP secret"; };
 941                 secret_key_base = mkOption { type = str; description = "Secret key base"; };
 942                 vapid = mkOption {
 943                   description = "vapid key";
 944                   type = submodule {
 945                     options = {
 946                       private = mkOption { type = str; description = "Private key"; };
 947                       public = mkOption { type = str; description = "Public key"; };
 948                     };
 949                   };
 950                 };
 951               };
 952             };
 953           };
 954           mediagoblin = mkOption {
 955             description = "Mediagoblin configuration";
 956             type = submodule {
 957               options = {
 958                 postgresql = mkPsqlOptions "Mediagoblin";
 959                 redis = mkRedisOptions "Mediagoblin";
 960                 ldap = mkLdapOptions "Mediagoblin" {};
 961               };
 962             };
 963           };
 964           nextcloud = mkOption {
 965             description = "Nextcloud configuration";
 966             type = submodule {
 967               options = {
 968                 postgresql = mkPsqlOptions "Peertube";
 969                 redis = mkRedisOptions "Peertube";
 970                 password_salt = mkOption { type = str; description = "Password salt"; };
 971                 instance_id = mkOption { type = str; description = "Instance ID"; };
 972                 secret = mkOption { type = str; description = "App secret"; };
 973               };
 974             };
 975           };
 976           peertube = mkOption {
 977             description = "Peertube configuration";
 978             type = submodule {
 979               options = {
 980                 listenPort = mkOption { type = port; description = "Port to listen to"; };
 981                 postgresql = mkPsqlOptions "Peertube";
 982                 redis = mkRedisOptions "Peertube";
 983                 ldap = mkLdapOptions "Peertube" {};
 984               };
 985             };
 986           };
 987           syden_peertube = mkOption {
 988             description = "Peertube Syden configuration";
 989             type = submodule {
 990               options = {
 991                 listenPort = mkOption { type = port; description = "Port to listen to"; };
 992                 postgresql = mkPsqlOptions "Peertube";
 993                 redis = mkRedisOptions "Peertube";
 994               };
 995             };
 996           };
 997           phpldapadmin = mkOption {
 998             description = "phpLdapAdmin configuration";
 999             type = submodule {
1000               options = {
1001                 ldap = mkLdapOptions "phpldapadmin" {};
1002               };
1003             };
1004           };
1005           rompr = mkOption {
1006             description = "Rompr configuration";
1007             type = submodule {
1008               options = {
1009                 mpd = mkOption {
1010                   description = "MPD configuration";
1011                   type = submodule {
1012                     options = {
1013                       host = mkOption { type = str; description = "Host for MPD"; };
1014                       port = mkOption { type = port; description = "Port to access MPD host"; };
1015                     };
1016                   };
1017                 };
1018               };
1019             };
1020           };
1021           roundcubemail = mkOption {
1022             description = "Roundcubemail configuration";
1023             type = submodule {
1024               options = {
1025                 postgresql = mkPsqlOptions "TT-RSS";
1026                 secret = mkOption { type = str; description = "Secret"; };
1027               };
1028             };
1029           };
1030           shaarli = mkOption {
1031             description = "Shaarli configuration";
1032             type = submodule {
1033               options = {
1034                 ldap = mkLdapOptions "Shaarli" {};
1035               };
1036             };
1037           };
1038           status_engine = mkOption {
1039             description = "Status Engine configuration";
1040             type = submodule {
1041               options = {
1042                 mysql = mkMysqlOptions "StatusEngine" {};
1043                 ldap = mkLdapOptions "StatusEngine" {};
1044               };
1045             };
1046           };
1047           task = mkOption {
1048             description = "Taskwarrior configuration";
1049             type = submodule {
1050               options = {
1051                 ldap = mkLdapOptions "Taskwarrior" {};
1052                 taskwarrior-web = mkOption {
1053                   description = "taskwarrior-web profiles";
1054                   type = attrsOf (submodule {
1055                     options = {
1056                       uid = mkOption {
1057                         type = listOf str;
1058                         description = "List of ldap uids having access to this profile";
1059                       };
1060                       org = mkOption { type = str; description = "Taskd organisation"; };
1061                       key = mkOption { type = str; description = "Taskd key"; };
1062                       date = mkOption { type = str; description = "Preferred date format"; };
1063                     };
1064                   });
1065                 };
1066               };
1067             };
1068           };
1069           ttrss = mkOption {
1070             description = "TT-RSS configuration";
1071             type = submodule {
1072               options = {
1073                 postgresql = mkPsqlOptions "TT-RSS";
1074                 ldap = mkLdapOptions "TT-RSS" {};
1075               };
1076             };
1077           };
1078           wallabag = mkOption {
1079             description = "Wallabag configuration";
1080             type = submodule {
1081               options = {
1082                 postgresql = mkPsqlOptions "Wallabag";
1083                 ldap = mkLdapOptions "Wallabag" {
1084                   admin_filter = mkOption { type = str; description = "Admin users filter"; };
1085                 };
1086                 redis = mkRedisOptions "Wallabag";
1087                 secret = mkOption { type = str; description = "App secret"; };
1088               };
1089             };
1090           };
1091           webhooks = mkOption {
1092             type = attrsOf str;
1093             description = "Mapping 'name'.php => script for webhooks";
1094           };
1095           csp_reports = mkOption {
1096             description = "CSP report configuration";
1097             type = submodule {
1098               options = {
1099                 report_uri = mkOption { type = str; description = "URI to report CSP violations to"; };
1100                 policies = mkOption { type = attrsOf str; description = "CSP policies to apply"; };
1101                 postgresql = mkPsqlOptions "CSP reports";
1102               };
1103             };
1104           };
1105           commento = mkOption {
1106             description = "Commento configuration";
1107             type = submodule {
1108               options = {
1109                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1110                 postgresql = mkPsqlOptions "Commento";
1111                 smtp = mkSmtpOptions "Commento";
1112               };
1113             };
1114           };
1115           ympd = mkOption {
1116             description = "Ympd configuration";
1117             type = submodule {
1118               options = {
1119                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1120                 mpd = mkOption {
1121                   description = "MPD configuration";
1122                   type = submodule {
1123                     options = {
1124                       password = mkOption { type = str; description = "Password to access MPD host"; };
1125                       host = mkOption { type = str; description = "Host for MPD"; };
1126                       port = mkOption { type = port; description = "Port to access MPD host"; };
1127                     };
1128                   };
1129                 };
1130               };
1131             };
1132           };
1133           yourls = mkOption {
1134             description = "Yourls configuration";
1135             type = submodule {
1136               options = {
1137                 mysql = mkMysqlOptions "Yourls" {};
1138                 ldap = mkLdapOptions "Yourls" {};
1139                 cookieKey = mkOption { type = str; description = "Cookie key"; };
1140               };
1141             };
1142           };
1143         };
1144       };
1145     };
1146     websites = mkOption {
1147       description = "Websites configurations";
1148       type = submodule {
1149         options = {
1150           immae = mkOption {
1151             description = "Immae configuration by environment";
1152             type = submodule {
1153               options = {
1154                 temp = mkOption {
1155                   description = "Temp configuration";
1156                   type = submodule {
1157                     options = {
1158                       ldap = mkLdapOptions "Immae temp" {
1159                         filter = mkOption { type = str; description = "Filter for user access"; };
1160                       };
1161                     };
1162                   };
1163                 };
1164               };
1165             };
1166           };
1167           isabelle = mkOption {
1168             description = "Isabelle configurations by environment";
1169             type =
1170               let
1171                 atenSubmodule = mkOption {
1172                   description = "environment configuration";
1173                   type = submodule {
1174                     options = {
1175                       environment = mkOption { type = str; description = "Symfony environment"; };
1176                       secret = mkOption { type = str; description = "Symfony App secret"; };
1177                       postgresql = mkPsqlOptions "Aten";
1178                     };
1179                   };
1180                 };
1181               in
1182                 submodule {
1183                   options = {
1184                     aten_production = atenSubmodule;
1185                     aten_integration = atenSubmodule;
1186                     iridologie = mkOption {
1187                       description = "environment configuration";
1188                       type = submodule {
1189                         options = {
1190                           environment = mkOption { type = str; description = "SPIP environment"; };
1191                           mysql = mkMysqlOptions "Iridologie" {};
1192                           ldap = mkLdapOptions "Iridologie" {};
1193                         };
1194                       };
1195                     };
1196                   };
1197                 };
1198           };
1199           chloe = mkOption {
1200             description = "Chloe configurations by environment";
1201             type =
1202               let
1203                 chloeSubmodule = mkOption {
1204                   description = "environment configuration";
1205                   type = submodule {
1206                     options = {
1207                       environment = mkOption { type = str; description = "SPIP environment"; };
1208                       mysql = mkMysqlOptions "Chloe" {};
1209                       ldap = mkLdapOptions "Chloe" {};
1210                     };
1211                   };
1212                 };
1213               in
1214                 submodule {
1215                   options = {
1216                     production = chloeSubmodule;
1217                     integration = chloeSubmodule;
1218                   };
1219                 };
1220           };
1221           connexionswing = mkOption {
1222             description = "Connexionswing configurations by environment";
1223             type =
1224               let
1225                 csSubmodule = mkOption {
1226                   description = "environment configuration";
1227                   type = submodule {
1228                     options = {
1229                       environment = mkOption { type = str; description = "Symfony environment"; };
1230                       mysql = mkMysqlOptions "Connexionswing" {};
1231                       secret = mkOption { type = str; description = "Symfony App secret"; };
1232                       email = mkOption { type = str; description = "Symfony email notification"; };
1233                     };
1234                   };
1235                 };
1236               in
1237                 submodule {
1238                   options = {
1239                     production = csSubmodule;
1240                     integration = csSubmodule;
1241                   };
1242                 };
1243           };
1244           jerome = mkOption {
1245             description = "Naturaloutil configuration";
1246             type = submodule {
1247               options = {
1248                 mysql = mkMysqlOptions "Naturaloutil" {};
1249                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1250               };
1251             };
1252           };
1253           telio_tortay = mkOption {
1254             description = "Telio Tortay configuration";
1255             type = submodule {
1256               options = {
1257                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1258               };
1259             };
1260           };
1261           ludivine = mkOption {
1262             description = "Ludivinecassal configurations by environment";
1263             type =
1264               let
1265                 lcSubmodule = mkOption {
1266                   description = "environment configuration";
1267                   type = submodule {
1268                     options = {
1269                       environment = mkOption { type = str; description = "Symfony environment"; };
1270                       mysql = mkMysqlOptions "LudivineCassal" {};
1271                       ldap = mkLdapOptions "LudivineCassal" {};
1272                       secret = mkOption { type = str; description = "Symfony App secret"; };
1273                     };
1274                   };
1275                 };
1276               in
1277                 submodule {
1278                   options = {
1279                     production = lcSubmodule;
1280                     integration = lcSubmodule;
1281                   };
1282                 };
1283           };
1284           emilia = mkOption {
1285             description = "Emilia configuration";
1286             type = submodule {
1287               options = {
1288                 postgresql = mkPsqlOptions "Emilia";
1289               };
1290             };
1291           };
1292           florian = mkOption {
1293             description = "Florian configuration";
1294             type = submodule {
1295               options = {
1296                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1297               };
1298             };
1299           };
1300           nassime = mkOption {
1301             description = "Nassime configuration";
1302             type = submodule {
1303               options = {
1304                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1305               };
1306             };
1307           };
1308           piedsjaloux = mkOption {
1309             description = "Piedsjaloux configurations by environment";
1310             type =
1311               let
1312                 pjSubmodule = mkOption {
1313                   description = "environment configuration";
1314                   type = submodule {
1315                     options = {
1316                       environment = mkOption { type = str; description = "Symfony environment"; };
1317                       mysql = mkMysqlOptions "Piedsjaloux" {};
1318                       secret = mkOption { type = str; description = "Symfony App secret"; };
1319                     };
1320                   };
1321                 };
1322               in
1323                 submodule {
1324                   options = {
1325                     production = pjSubmodule;
1326                     integration = pjSubmodule;
1327                   };
1328                 };
1329           };
1330           richie = mkOption {
1331             description = "Europe Richie configurations by environment";
1332             type = submodule {
1333               options = {
1334                 mysql = mkMysqlOptions "Richie" {};
1335                 smtp_mailer = mkOption {
1336                   description = "SMTP mailer configuration";
1337                   type = submodule {
1338                     options = {
1339                       user = mkOption { type = str; description = "Username"; };
1340                       password = mkOption { type = str; description = "Password"; };
1341                     };
1342                   };
1343                 };
1344               };
1345             };
1346           };
1347           tellesflorian = mkOption {
1348             description = "Tellesflorian configurations by environment";
1349             type =
1350               let
1351                 tfSubmodule = mkOption {
1352                   description = "environment configuration";
1353                   type = submodule {
1354                     options = {
1355                       environment = mkOption { type = str; description = "Symfony environment"; };
1356                       mysql = mkMysqlOptions "Tellesflorian" {};
1357                       secret = mkOption { type = str; description = "Symfony App secret"; };
1358                       invite_passwords = mkOption { type = str; description = "Password basic auth"; };
1359                     };
1360                   };
1361                 };
1362               in
1363                 submodule {
1364                   options = {
1365                     integration = tfSubmodule;
1366                   };
1367                 };
1368           };
1369         };
1370       };
1371     };
1372
1373     privateFiles = mkOption {
1374       type = path;
1375       description = ''
1376         Path to secret files to make available during build
1377         '';
1378     };
1379   };
1380   options.hostEnv = mkOption {
1381     readOnly = true;
1382     type = hostEnv;
1383     default = config.myEnv.servers."${name}";
1384     description = "Host environment";
1385   };
1386 }