modules/private/environment.nix

   1 { config, lib, name, ... }:
   2 with lib;
   3 with types;
   4 with lists;
   5 let
   6   ldapOptions = {
   7     base = mkOption { description = "Base of the LDAP tree"; type = str; };
   8     host = mkOption { description = "Host to access LDAP"; type = str; };
   9     root_dn = mkOption { description = "DN of the root user"; type = str; };
  10     root_pw = mkOption { description = "Hashed password of the root user"; type = str; };
  11     replication_dn = mkOption { description = "DN of the user allowed to replicate the LDAP directory"; type = str; };
  12     replication_pw = mkOption { description = "Password of the user allowed to replicate the LDAP directory"; type = str; };
  13   };
  14   mkLdapOptions = name: more: mkOption {
  15     description = "${name} LDAP configuration";
  16     type = submodule {
  17       options = ldapOptions // {
  18         dn = mkOption { description = "DN of the ${name} user"; type = str; };
  19         password = mkOption { description = "password of the ${name} user"; type = str; };
  20         filter = mkOption { description = "Filter for ${name} users"; type = str; default = ""; };
  21       } // more;
  22     };
  23   };
  24   mysqlOptions = {
  25     host = mkOption { description = "Host to access Mysql"; type = str; };
  26     remoteHost = mkOption { description = "Host to access Mysql from outside"; type = str; };
  27     port = mkOption { description = "Port to access Mysql"; type = str; };
  28     socket = mkOption { description = "Socket to access Mysql"; type = path; };
  29     systemUsers = mkOption {
  30       description = "Attrs of user-passwords allowed to access mysql";
  31       type = attrsOf str;
  32     };
  33     pam = mkOption {
  34       description = "PAM configuration for mysql";
  35       type = submodule {
  36         options = {
  37           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  38           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  39           filter = mkOption { description = "filter to match users"; type = str; };
  40         };
  41       };
  42     };
  43   };
  44   mkMysqlOptions = name: more: mkOption {
  45     description = "${name} mysql configuration";
  46     type = submodule {
  47       options = mysqlOptions // {
  48         database = mkOption { description = "${name} database"; type = str; };
  49         user = mkOption { description = "${name} user"; type = str; };
  50         password = mkOption { description = "mysql password of the ${name} user"; type = str; };
  51       } // more;
  52     };
  53   };
  54   psqlOptions = {
  55     host = mkOption { description = "Host to access Postgresql"; type = str; };
  56     port = mkOption { description = "Port to access Postgresql"; type = str; };
  57     socket = mkOption { description = "Socket to access Postgresql"; type = path; };
  58     pam = mkOption {
  59       description = "PAM configuration for psql";
  60       type = submodule {
  61         options = {
  62           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  63           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  64           filter = mkOption { description = "filter to match users"; type = str; };
  65         };
  66       };
  67     };
  68   };
  69   mkPsqlOptions = name: mkOption {
  70     description = "${name} psql configuration";
  71     type = submodule {
  72       options = psqlOptions // {
  73         database = mkOption { description = "${name} database"; type = str; };
  74         schema = mkOption { description = "${name} schema"; type = nullOr str; default = null; };
  75         user = mkOption { description = "${name} user"; type = str; };
  76         password = mkOption { description = "psql password of the ${name} user"; type = str; };
  77       };
  78     };
  79   };
  80   redisOptions = {
  81     host = mkOption { description = "Host to access Redis"; type = str; };
  82     port = mkOption { description = "Port to access Redis"; type = str; };
  83     socket = mkOption { description = "Socket to access Redis"; type = path; };
  84     dbs = mkOption {
  85       description = "Attrs of db number. Each number should be unique to avoid collision!";
  86       type = attrsOf str;
  87     };
  88     spiped_key = mkOption {
  89       type = str;
  90       description = ''
  91         Key to use with spiped to make a secure channel to replication
  92         '';
  93     };
  94     predixy = mkOption {
  95       description = "Predixy configuration. Unused yet";
  96       type = submodule {
  97         options = {
  98           read = mkOption { type = str; description = "Read password"; };
  99         };
 100       };
 101     };
 102   };
 103   mkRedisOptions = name: mkOption {
 104     description = "${name} redis configuration";
 105     type = submodule {
 106       options = redisOptions // {
 107         db = mkOption { description = "${name} database"; type = str; };
 108       };
 109     };
 110   };
 111   smtpOptions = {
 112     host = mkOption { description = "Host to access SMTP"; type = str; };
 113     port = mkOption { description = "Port to access SMTP"; type = str; };
 114   };
 115   mkSmtpOptions = name: mkOption {
 116     description = "${name} smtp configuration";
 117     type = submodule {
 118       options = smtpOptions // {
 119         email = mkOption { description = "${name} email"; type = str; };
 120         password = mkOption { description = "SMTP password of the ${name} user"; type = str; };
 121       };
 122     };
 123   };
 124   hostEnv = submodule {
 125     options = {
 126       fqdn = mkOption {
 127         description = "Host FQDN";
 128         type = str;
 129       };
 130       users = mkOption {
 131         type = unspecified;
 132         default = pkgs: [];
 133         description = ''
 134           Sublist of users from realUsers. Function that takes pkgs as
 135           argument and gives an array as a result
 136         '';
 137       };
 138       emails = mkOption {
 139         default = [];
 140         description = "List of e-mails that the server can be a sender of";
 141         type = listOf str;
 142       };
 143       ldap = mkOption {
 144         description = ''
 145           LDAP credentials for the host
 146         '';
 147         type = submodule {
 148           options = {
 149             password = mkOption { type = str; description = "Password for the LDAP connection"; };
 150             dn = mkOption { type = str; description = "DN for the LDAP connection"; };
 151           };
 152         };
 153       };
 154       mx = mkOption {
 155         description = "subdomain and priority for MX server";
 156         default = { enable = false; };
 157         type = submodule {
 158           options = {
 159             enable = mkEnableOption "Enable MX";
 160             subdomain = mkOption { type = nullOr str; description = "Subdomain name (mx-*)"; };
 161             priority = mkOption { type = nullOr str; description = "Priority"; };
 162           };
 163         };
 164       };
 165       ips = mkOption {
 166         description = ''
 167           attrs of ip4/ip6 grouped by section
 168         '';
 169         type = attrsOf (submodule {
 170           options = {
 171             ip4 = mkOption {
 172               type = str;
 173               description = ''
 174                 ip4 address of the host
 175               '';
 176             };
 177             ip6 = mkOption {
 178               type = listOf str;
 179               default = [];
 180               description = ''
 181                 ip6 addresses of the host
 182               '';
 183             };
 184           };
 185         });
 186       };
 187     };
 188   };
 189 in
 190 {
 191   options.myEnv = {
 192     servers = mkOption {
 193       description = ''
 194         Attrs of servers information in the cluster (not necessarily handled by nixops)
 195       '';
 196       default = {};
 197       type = attrsOf hostEnv;
 198     };
 199     hetznerCloud = mkOption {
 200       description = ''
 201         Hetzner Cloud credential information
 202       '';
 203       type = submodule {
 204         options = {
 205           authToken = mkOption {
 206             type = str;
 207             description = ''
 208               The API auth token.
 209             '';
 210           };
 211         };
 212       };
 213     };
 214     hetzner = mkOption {
 215       description = ''
 216         Hetzner credential information
 217       '';
 218       type = submodule {
 219         options = {
 220           user = mkOption { type = str; description = "User"; };
 221           pass = mkOption { type = str; description = "Password"; };
 222         };
 223       };
 224     };
 225     sshd = mkOption {
 226       description = ''
 227         sshd service credential information
 228       '';
 229       type = submodule {
 230         options = {
 231           ldap = mkOption {
 232             description = ''
 233               LDAP credentials for cn=ssh,ou=services,dc=immae,dc=eu dn
 234             '';
 235             type = submodule {
 236               options = {
 237                 password = mkOption { description = "Password"; type = str; };
 238               };
 239             };
 240           };
 241         };
 242       };
 243     };
 244     ports = mkOption {
 245       description = ''
 246         non-standard reserved ports. Must be unique!
 247       '';
 248       type = attrsOf port;
 249       default = {};
 250       apply = let
 251         noDupl = x: builtins.length (builtins.attrValues x) == builtins.length (unique (builtins.attrValues x));
 252       in
 253         x: if isAttrs x && noDupl x then x else throw "Non unique values for ports";
 254     };
 255     httpd = mkOption {
 256       description = ''
 257         httpd service credential information
 258       '';
 259       type = submodule {
 260         options = {
 261           ldap = mkOption {
 262             description = ''
 263               LDAP credentials for cn=httpd,ou=services,dc=immae,dc=eu dn
 264             '';
 265             type = submodule {
 266               options = {
 267                 password = mkOption { description = "Password"; type = str; };
 268               };
 269             };
 270           };
 271         };
 272       };
 273     };
 274     smtp = mkOption {
 275       type = submodule { options = smtpOptions; };
 276       description = "SMTP configuration";
 277     };
 278     ldap = mkOption {
 279       description = ''
 280         LDAP server configuration
 281         '';
 282       type = submodule {
 283         options = ldapOptions;
 284       };
 285     };
 286     databases = mkOption {
 287       description = "Databases configuration";
 288       type = submodule {
 289         options = {
 290           mysql = mkOption {
 291             type = submodule { options = mysqlOptions; };
 292             description = "Mysql configuration";
 293           };
 294           redis = mkOption {
 295             type = submodule { options = redisOptions; };
 296             description = "Redis configuration";
 297           };
 298           postgresql = mkOption {
 299             type = submodule { options = psqlOptions; };
 300             description = "Postgresql configuration";
 301           };
 302         };
 303       };
 304     };
 305     jabber = mkOption {
 306       description = "Jabber configuration";
 307       type = submodule {
 308         options = {
 309           postfix_user_filter = mkOption { type = str; description = "Postfix filter to get xmpp users"; };
 310           ldap = mkLdapOptions "Jabber" {};
 311           postgresql = mkPsqlOptions "Jabber";
 312         };
 313       };
 314     };
 315     realUsers = mkOption {
 316       description = ''
 317         Attrset of function taking pkgs as argument.
 318         Real users settings, should provide a subattr of users.users.<name>
 319         with at least: name, (hashed)Password, shell
 320       '';
 321       type = attrsOf unspecified;
 322     };
 323     users = mkOption {
 324       description = "System and regular users uid/gid";
 325       type = attrsOf (submodule {
 326         options = {
 327           uid = mkOption {
 328             description = "user uid";
 329             type = int;
 330           };
 331           gid = mkOption {
 332             description = "user gid";
 333             type = int;
 334           };
 335         };
 336       });
 337     };
 338     dns = mkOption {
 339       description = "DNS configuration";
 340       type = submodule {
 341         options = {
 342           soa = mkOption {
 343             description = "SOA information";
 344             type = submodule {
 345               options = {
 346                 serial = mkOption {
 347                   description = "Serial number. Should be incremented at each change and unique";
 348                   type = str;
 349                 };
 350                 refresh = mkOption {
 351                   description = "Refresh time";
 352                   type = str;
 353                 };
 354                 retry = mkOption {
 355                   description = "Retry time";
 356                   type = str;
 357                 };
 358                 expire = mkOption {
 359                   description = "Expire time";
 360                   type = str;
 361                 };
 362                 ttl = mkOption {
 363                   description = "Default TTL time";
 364                   type = str;
 365                 };
 366                 email = mkOption {
 367                   description = "hostmaster e-mail";
 368                   type = str;
 369                 };
 370                 primary = mkOption {
 371                   description = "Primary NS";
 372                   type = str;
 373                 };
 374               };
 375             };
 376           };
 377           ns = mkOption {
 378             description = "Attrs of NS servers group";
 379             example = {
 380               foo = {
 381                 "ns1.foo.com" = [ "198.51.100.10" "2001:db8:abcd::1" ];
 382                 "ns2.foo.com" = [ "198.51.100.15" "2001:db8:1234::1" ];
 383               };
 384             };
 385             type = attrsOf (attrsOf (listOf str));
 386           };
 387           slaveZones = mkOption {
 388             description = "List of slave zones";
 389             type = listOf (submodule {
 390               options = {
 391                 name = mkOption { type = str; description = "zone name"; };
 392                 masters = mkOption {
 393                   description = "NS master groups of this zone";
 394                   type = listOf str;
 395                 };
 396               };
 397             });
 398           };
 399           masterZones = mkOption {
 400             description = "List of master zones";
 401             type = listOf (submodule {
 402               options = {
 403                 name = mkOption { type = str; description = "zone name"; };
 404                 slaves = mkOption {
 405                   description = "NS slave groups of this zone";
 406                   type = listOf str;
 407                 };
 408                 ns = mkOption {
 409                   description = "groups names that should have their NS entries listed here";
 410                   type = listOf str;
 411                 };
 412                 extra = mkOption {
 413                   description = "Extra zone configuration for bind";
 414                   example = ''
 415                     notify yes;
 416                     '';
 417                   type = lines;
 418                 };
 419                 entries = mkOption { type = lines; description = "Regular entries of the NS zone"; };
 420                 withEmail = mkOption {
 421                   description = "List of domains that should have mail entries (MX, dkim, SPF, ...)";
 422                   default = [];
 423                   type = listOf (submodule {
 424                     options = {
 425                       domain = mkOption { type = str; description = "Which subdomain is concerned"; };
 426                       send = mkOption { type = bool; description = "Whether there can be e-mails originating from the subdomain"; };
 427                       receive = mkOption { type = bool; description = "Whether there can be e-mails arriving to the subdomain"; };
 428                     };
 429                   });
 430                 };
 431               };
 432             });
 433           };
 434         };
 435       };
 436     };
 437     backup = mkOption {
 438       description = ''
 439         Remote backup with duplicity
 440         '';
 441       type = submodule {
 442         options = {
 443           password = mkOption { type = str; description = "Password for encrypting files"; };
 444           remotes = mkOption {
 445             type = attrsOf (submodule {
 446               options = {
 447                 remote = mkOption {
 448                   type = unspecified;
 449                   example = literalExample ''
 450                     bucket: "s3://some_host/${bucket}";
 451                     '';
 452                   description = ''
 453                     Function.
 454                     Takes a bucket name as argument and returns a url
 455                     '';
 456                 };
 457                 accessKeyId = mkOption { type = str; description = "Remote access-key"; };
 458                 secretAccessKey = mkOption { type = str; description = "Remote access secret"; };
 459               };
 460             });
 461           };
 462         };
 463       };
 464     };
 465     rsync_backup = mkOption {
 466       description  =''
 467         Rsync backup configuration from controlled host
 468         '';
 469       type = submodule {
 470         options = {
 471           ssh_key = mkOption {
 472             description = "SSH key information";
 473             type = submodule {
 474               options = {
 475                 public = mkOption { type = str; description = "Public part of the key"; };
 476                 private = mkOption { type = lines; description = "Private part of the key"; };
 477               };
 478             };
 479           };
 480           profiles = mkOption {
 481             description = "Attrs of profiles to backup";
 482             type = attrsOf (submodule {
 483               options = {
 484                 keep = mkOption { type = int; description = "Number of backups to keep"; };
 485                 check_command = mkOption { type = str; description = "command to check if backup needs to be done"; default = "backup"; };
 486                 login = mkOption { type = str; description = "Login to connect to host"; };
 487                 port = mkOption { type = str; default = "22"; description = "Port to connect to host"; };
 488                 host = mkOption { type = str; description = "Host to connect to"; };
 489                 host_key = mkOption { type = str; description = "Host key"; };
 490                 host_key_type = mkOption { type = str; description = "Host key type"; };
 491                 parts = mkOption {
 492                   description = "Parts to backup for this host";
 493                   type = attrsOf (submodule {
 494                     options = {
 495                       remote_folder = mkOption { type = path; description = "Remote folder to backup";};
 496                       exclude_from = mkOption {
 497                         type = listOf path;
 498                         default = [];
 499                         description = "List of folders/files to exclude from the backup";
 500                       };
 501                       files_from = mkOption {
 502                         type = listOf path;
 503                         default = [];
 504                         description = "List of folders/files to backup in the base folder";
 505                       };
 506                       args = mkOption {
 507                         type = nullOr str;
 508                         default = null;
 509                         description = "Extra arguments to pass to rsync";
 510                       };
 511                     };
 512                   });
 513                 };
 514               };
 515             });
 516           };
 517         };
 518       };
 519     };
 520     monitoring = mkOption {
 521       description = "Monitoring configuration";
 522       type = submodule {
 523         options = {
 524           status_url = mkOption { type = str; description = "URL to push status to"; };
 525           status_token = mkOption { type = str; description = "Token for the status url"; };
 526           http_user_password = mkOption { type = str; description = "HTTP credentials to check services behind wall"; };
 527           email = mkOption { type = str; description = "Admin E-mail"; };
 528           ssh_public_key = mkOption { type = str; description = "SSH public key"; };
 529           ssh_secret_key = mkOption { type = str; description = "SSH secret key"; };
 530           imap_login = mkOption { type = str; description = "IMAP login"; };
 531           imap_password = mkOption { type = str; description = "IMAP password"; };
 532           eriomem_keys = mkOption { type = listOf (listOf str); description = "Eriomem keys"; default = []; };
 533           ovh_sms = mkOption {
 534             description = "OVH credentials for sms script";
 535             type = submodule {
 536               options = {
 537                 endpoint = mkOption { type = str; default = "ovh-eu"; description = "OVH endpoint"; };
 538                 application_key = mkOption { type = str; description = "Application key"; };
 539                 application_secret = mkOption { type = str; description = "Application secret"; };
 540                 consumer_key = mkOption { type = str; description = "Consumer key"; };
 541                 account = mkOption { type = str; description = "Account"; };
 542               };
 543             };
 544           };
 545           nrdp_tokens = mkOption { type = listOf str; description = "Tokens allowed to push status update"; };
 546           slack_url = mkOption { type = str; description = "Slack webhook url to push status update"; };
 547           slack_channel = mkOption { type = str; description = "Slack channel to push status update"; };
 548           contacts = mkOption { type = attrsOf unspecified; description = "Contact dicts to fill naemon objects"; };
 549           email_check = mkOption {
 550             description = "Emails services to check";
 551             type = attrsOf (submodule {
 552               options = {
 553                 local = mkOption { type = bool; default = false; description = "Use local configuration"; };
 554                 port = mkOption { type = nullOr str; default = null; description = "Port to connect to ssh"; };
 555                 login = mkOption { type = nullOr str; default = null; description = "Login to connect to ssh"; };
 556                 targets = mkOption { type = listOf str; description = "Hosts to send E-mails to"; };
 557                 mail_address = mkOption { type = nullOr str; default = null; description = "E-mail recipient part to send e-mail to"; };
 558                 mail_domain = mkOption { type = nullOr str; default = null; description = "E-mail domain part to send e-mail to"; };
 559               };
 560             });
 561           };
 562         };
 563       };
 564     };
 565     mpd = mkOption {
 566       description = "MPD configuration";
 567       type = submodule {
 568         options = {
 569           folder = mkOption { type = str; description = "Folder to serve from the MPD instance"; };
 570           password = mkOption { type = str; description = "Password to connect to the MPD instance"; };
 571           host = mkOption { type = str; description = "Host to connect to the MPD instance"; };
 572           port = mkOption { type = str; description = "Port to connect to the MPD instance"; };
 573         };
 574       };
 575     };
 576     ftp = mkOption {
 577       description = "FTP configuration";
 578       type = submodule {
 579         options = {
 580           ldap = mkLdapOptions "FTP" {};
 581         };
 582       };
 583     };
 584     vpn = mkOption {
 585       description = "VPN configuration";
 586       type = attrsOf (submodule {
 587         options = {
 588           prefix = mkOption { type = str; description = "ipv6 prefix for the vpn subnet"; };
 589           privateKey = mkOption { type = str; description = "Private key for the host"; };
 590           publicKey = mkOption { type = str; description = "Public key for the host"; };
 591         };
 592       });
 593     };
 594     mail = mkOption {
 595       description = "Mail configuration";
 596       type = submodule {
 597         options = {
 598           dmarc = mkOption {
 599             description = "DMARC configuration";
 600             type = submodule {
 601               options = {
 602                 ignore_hosts = mkOption {
 603                   type = lines;
 604                   description = ''
 605                     Hosts to ignore when checking for dmarc
 606                     '';
 607                 };
 608               };
 609             };
 610           };
 611           dkim = mkOption {
 612             description = "DKIM configuration";
 613             type = attrsOf (submodule {
 614               options = {
 615                 public = mkOption {
 616                   type = str;
 617                   example = ''
 618                     ( "v=DKIM1; k=rsa; "
 619                               "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3w1a2aMxWw9+hdcmbqX4UevcVqr204y0K73Wdc7MPZiOOlUJQYsMNSYR1Y/SC7jmPKeitpcJCpQgn/cveJZbuikjjPLsDReHyFEYmC278ZLRTELHx6f1IXM8WE08JIRT69CfZiMi1rVcOh9qRT4F93PyjCauU8Y5hJjtg9ThsWwIDAQAB" )
 620                     '';
 621                   description = "Public entry to put in DNS TXT field";
 622                 };
 623                 private = mkOption { type = str; description = "Private key"; };
 624               };
 625             });
 626           };
 627           postfix = mkOption {
 628             description = "Postfix configuration";
 629             type = submodule {
 630               options = {
 631                 additional_mailbox_domains = mkOption {
 632                   description = ''
 633                     List of domains that are used as mailbox final destination, in addition to those defined in the DNS records
 634                   '';
 635                   type = listOf str;
 636                 };
 637                 mysql = mkMysqlOptions "Postfix" {
 638                   password_encrypt = mkOption { type = str; description = "Key to encrypt relay password in database"; };
 639                 };
 640                 backup_domains = mkOption {
 641                   description = ''
 642                     Domains that are accepted for relay as backup domain
 643                   '';
 644                   type = attrsOf (submodule {
 645                     options = {
 646                       domains = mkOption { type = listOf str; description = "Domains list"; };
 647                       relay_restrictions = mkOption {
 648                         type = lines;
 649                         description = ''
 650                           Restrictions for relaying the e-mails from the domains
 651                           '';
 652                       };
 653                       recipient_maps = mkOption {
 654                         description = ''
 655                           Recipient map to accept relay for.
 656                           Must be specified for domain, the rules apply to everyone!
 657                         '';
 658                         type = listOf (submodule {
 659                           options = {
 660                             type = mkOption {
 661                               type = enum [ "hash" ];
 662                               description = "Map type";
 663                             };
 664                             content = mkOption {
 665                               type = str;
 666                               description = "Map content";
 667                             };
 668                           };
 669                         });
 670                       };
 671                     };
 672                   });
 673                 };
 674               };
 675             };
 676           };
 677           dovecot = mkOption {
 678             description = "Dovecot configuration";
 679             type = submodule {
 680               options = {
 681                 ldap = mkLdapOptions "Dovecot" {
 682                   pass_attrs = mkOption { type = str; description = "Password attribute in LDAP"; };
 683                   user_attrs = mkOption { type = str; description = "User attribute mapping in LDAP"; };
 684                   iterate_attrs = mkOption { type = str; description = "User attribute mapping for listing in LDAP"; };
 685                   iterate_filter = mkOption { type = str; description = "User attribute filter for listing in LDAP"; };
 686                   postfix_mailbox_filter = mkOption { type = str; description = "Postfix filter to get mailboxes"; };
 687                 };
 688               };
 689             };
 690           };
 691           rspamd = mkOption {
 692             description = "rspamd configuration";
 693             type = submodule {
 694               options = {
 695                 redis = mkRedisOptions "Redis";
 696                 read_password_hashed = mkOption { type = str; description = "Hashed read password for rspamd"; };
 697                 write_password_hashed = mkOption { type = str; description = "Hashed write password for rspamd"; };
 698                 read_password = mkOption {
 699                   type = str;
 700                   description = "Read password for rspamd. Unused";
 701                   apply = x: "";
 702                 };
 703                 write_password = mkOption {
 704                   type = str;
 705                   description = "Write password for rspamd. Unused";
 706                   apply = x: "";
 707                 };
 708               };
 709             };
 710           };
 711           scripts = mkOption {
 712             description = "Mail script recipients";
 713             type = attrsOf (submodule {
 714               options = {
 715                 external = mkEnableOption "Create a script_<name>@mail.immae.eu external address";
 716                 src = mkOption {
 717                   description = ''
 718                     git source to fetch the script from.
 719                     It must have a default.nix file as its root accepting a scriptEnv parameter
 720                   '';
 721                   type = submodule {
 722                     options = {
 723                       url = mkOption { type = str; description = "git url to fetch"; };
 724                       rev = mkOption { type = str; description = "git reference to fetch"; };
 725                     };
 726                   };
 727                 };
 728                 env = mkOption {
 729                   description = "Variables to pass to the script";
 730                   type = unspecified;
 731                 };
 732               };
 733             });
 734           };
 735           sympa = mkOption {
 736             description = "Sympa configuration";
 737             type = submodule {
 738               options = {
 739                 listmasters = mkOption {
 740                   type = listOf str;
 741                   description = "Listmasters";
 742                 };
 743                 postgresql = mkPsqlOptions "Sympa";
 744                 data_sources = mkOption {
 745                   type = attrsOf str;
 746                   default = {};
 747                   description = "Data sources to make available to sympa";
 748                 };
 749                 scenari = mkOption {
 750                   type = attrsOf str;
 751                   default = {};
 752                   description = "Scenari to make available to sympa";
 753                 };
 754               };
 755             };
 756           };
 757         };
 758       };
 759     };
 760     buildbot = mkOption {
 761       description = "Buildbot configuration";
 762       type = submodule {
 763         options = {
 764           user = mkOption {
 765             description = "Buildbot user";
 766             type = submodule {
 767               options = {
 768                 uid = mkOption {
 769                   description = "user uid";
 770                   type = int;
 771                 };
 772                 gid = mkOption {
 773                   description = "user gid";
 774                   type = int;
 775                 };
 776               };
 777             };
 778           };
 779           ldap = mkOption {
 780             description = "Ldap configuration for buildbot";
 781             type = submodule {
 782               options = {
 783                 password = mkOption { type = str; description = "Buildbot password"; };
 784               };
 785             };
 786           };
 787           projects = mkOption {
 788             description = "Projects to make a buildbot for";
 789             type = attrsOf (submodule {
 790               options = {
 791                 name = mkOption { type = str; description = "Project name"; };
 792                 packages = mkOption {
 793                   type = unspecified;
 794                   example = literalExample ''
 795                     pkgs: [ pkgs.bash pkgs.git pkgs.gzip pkgs.openssh ];
 796                     '';
 797                   description = ''
 798                     Function.
 799                     Builds packages list to make available to buildbot project.
 800                     Takes pkgs as argument.
 801                   '';
 802                 };
 803                 pythonPackages = mkOption {
 804                   type = unspecified;
 805                   example = literalExample ''
 806                     p: pkgs: [ pkgs.python3Packages.pip ];
 807                     '';
 808                   description = ''
 809                     Function.
 810                     Builds python packages list to make available to buildbot project.
 811                     Takes buildbot python module as first argument and pkgs as second argument in order to augment the python modules list.
 812                     '';
 813                 };
 814                 pythonPathHome = mkOption { type = bool; description = "Whether to add project’s python home to python path"; };
 815                 secrets = mkOption {
 816                   type = attrsOf str;
 817                   description = "Secrets for the project to dump as files";
 818                 };
 819                 environment = mkOption {
 820                   type = attrsOf str;
 821                   description = ''
 822                     Environment variables for the project.
 823                     BUILDBOT_ is prefixed to the variable names
 824                   '';
 825                 };
 826                 activationScript = mkOption {
 827                   type = lines;
 828                   description = ''
 829                     Activation script to run during deployment
 830                   '';
 831                 };
 832                 builderPaths = mkOption {
 833                   type = attrsOf unspecified;
 834                   default = {};
 835                   description = ''
 836                     Attrs of functions to make accessible specifically per builder.
 837                     Takes pkgs as argument and should return a single path containing binaries.
 838                     This path will be accessible as BUILDBOT_PATH_<attrskey>
 839                     '';
 840                 };
 841                 webhookTokens = mkOption {
 842                   type = nullOr (listOf str);
 843                   default = null;
 844                   description = ''
 845                     List of tokens allowed to push to project’s change_hook/base endpoint
 846                   '';
 847                 };
 848               };
 849             });
 850           };
 851         };
 852       };
 853     };
 854     tools = mkOption {
 855       description = "Tools configurations";
 856       type = submodule {
 857         options = {
 858           contact = mkOption { type = str; description = "Contact e-mail address"; };
 859           assets = mkOption {
 860             default = {};
 861             type = attrsOf (submodule {
 862               options = {
 863                 url = mkOption { type = str; description = "URL to fetch"; };
 864                 sha256 = mkOption { type = str; description = "Hash of the url"; };
 865               };
 866             });
 867             description = "Assets to provide on assets.immae.eu";
 868           };
 869           davical = mkOption {
 870             description = "Davical configuration";
 871             type = submodule {
 872               options = {
 873                 postgresql = mkPsqlOptions "Davical";
 874                 ldap = mkLdapOptions "Davical" {};
 875               };
 876             };
 877           };
 878           diaspora = mkOption {
 879             description = "Diaspora configuration";
 880             type = submodule {
 881               options = {
 882                 postgresql = mkPsqlOptions "Diaspora";
 883                 redis = mkRedisOptions "Diaspora";
 884                 ldap = mkLdapOptions "Diaspora" {};
 885                 secret_token = mkOption { type = str; description = "Secret token"; };
 886               };
 887             };
 888           };
 889           dmarc_reports = mkOption {
 890             description = "DMARC reports configuration";
 891             type = submodule {
 892               options = {
 893                 mysql = mkMysqlOptions "DMARC" {};
 894                 anonymous_key = mkOption { type = str; description = "Anonymous hashing key"; };
 895               };
 896             };
 897           };
 898           etherpad-lite = mkOption {
 899             description = "Etherpad configuration";
 900             type = submodule {
 901               options = {
 902                 postgresql = mkPsqlOptions "Etherpad";
 903                 ldap = mkLdapOptions "Etherpad" {
 904                   group_filter = mkOption { type = str; description = "Filter for groups"; };
 905                 };
 906                 adminPassword = mkOption { type = str; description = "Admin password for mypads / admin"; };
 907                 session_key = mkOption { type = str; description = "Session key"; };
 908                 api_key = mkOption { type = str; description = "API key"; };
 909                 redirects = mkOption { type = str; description = "Redirects for apache"; };
 910               };
 911             };
 912           };
 913           gitolite = mkOption {
 914             description = "Gitolite configuration";
 915             type = submodule {
 916               options = {
 917                 ldap = mkLdapOptions "Gitolite" {};
 918               };
 919             };
 920           };
 921           kanboard = mkOption {
 922             description = "Kanboard configuration";
 923             type = submodule {
 924               options = {
 925                 postgresql = mkPsqlOptions "Kanboard";
 926                 ldap = mkLdapOptions "Kanboard" {
 927                   admin_dn = mkOption { type = str; description = "Admin DN"; };
 928                 };
 929               };
 930             };
 931           };
 932           mantisbt = mkOption {
 933             description = "Mantisbt configuration";
 934             type = submodule {
 935               options = {
 936                 postgresql = mkPsqlOptions "Mantisbt";
 937                 ldap = mkLdapOptions "Mantisbt" {};
 938                 master_salt = mkOption { type = str; description = "Master salt for password hash"; };
 939               };
 940             };
 941           };
 942           mastodon = mkOption {
 943             description = "Mastodon configuration";
 944             type = submodule {
 945               options = {
 946                 postgresql = mkPsqlOptions "Mastodon";
 947                 redis = mkRedisOptions "Mastodon";
 948                 ldap = mkLdapOptions "Mastodon" {};
 949                 paperclip_secret = mkOption { type = str; description = "Paperclip secret"; };
 950                 otp_secret = mkOption { type = str; description = "OTP secret"; };
 951                 secret_key_base = mkOption { type = str; description = "Secret key base"; };
 952                 vapid = mkOption {
 953                   description = "vapid key";
 954                   type = submodule {
 955                     options = {
 956                       private = mkOption { type = str; description = "Private key"; };
 957                       public = mkOption { type = str; description = "Public key"; };
 958                     };
 959                   };
 960                 };
 961               };
 962             };
 963           };
 964           mediagoblin = mkOption {
 965             description = "Mediagoblin configuration";
 966             type = submodule {
 967               options = {
 968                 postgresql = mkPsqlOptions "Mediagoblin";
 969                 redis = mkRedisOptions "Mediagoblin";
 970                 ldap = mkLdapOptions "Mediagoblin" {};
 971               };
 972             };
 973           };
 974           nextcloud = mkOption {
 975             description = "Nextcloud configuration";
 976             type = submodule {
 977               options = {
 978                 postgresql = mkPsqlOptions "Peertube";
 979                 redis = mkRedisOptions "Peertube";
 980                 password_salt = mkOption { type = str; description = "Password salt"; };
 981                 instance_id = mkOption { type = str; description = "Instance ID"; };
 982                 secret = mkOption { type = str; description = "App secret"; };
 983               };
 984             };
 985           };
 986           peertube = mkOption {
 987             description = "Peertube configuration";
 988             type = submodule {
 989               options = {
 990                 listenPort = mkOption { type = port; description = "Port to listen to"; };
 991                 postgresql = mkPsqlOptions "Peertube";
 992                 redis = mkRedisOptions "Peertube";
 993                 ldap = mkLdapOptions "Peertube" {};
 994               };
 995             };
 996           };
 997           syden_peertube = mkOption {
 998             description = "Peertube Syden configuration";
 999             type = submodule {
1000               options = {
1001                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1002                 postgresql = mkPsqlOptions "Peertube";
1003                 redis = mkRedisOptions "Peertube";
1004               };
1005             };
1006           };
1007           phpldapadmin = mkOption {
1008             description = "phpLdapAdmin configuration";
1009             type = submodule {
1010               options = {
1011                 ldap = mkLdapOptions "phpldapadmin" {};
1012               };
1013             };
1014           };
1015           rompr = mkOption {
1016             description = "Rompr configuration";
1017             type = submodule {
1018               options = {
1019                 mpd = mkOption {
1020                   description = "MPD configuration";
1021                   type = submodule {
1022                     options = {
1023                       host = mkOption { type = str; description = "Host for MPD"; };
1024                       port = mkOption { type = port; description = "Port to access MPD host"; };
1025                     };
1026                   };
1027                 };
1028               };
1029             };
1030           };
1031           roundcubemail = mkOption {
1032             description = "Roundcubemail configuration";
1033             type = submodule {
1034               options = {
1035                 postgresql = mkPsqlOptions "TT-RSS";
1036                 secret = mkOption { type = str; description = "Secret"; };
1037               };
1038             };
1039           };
1040           shaarli = mkOption {
1041             description = "Shaarli configuration";
1042             type = submodule {
1043               options = {
1044                 ldap = mkLdapOptions "Shaarli" {};
1045               };
1046             };
1047           };
1048           status_engine = mkOption {
1049             description = "Status Engine configuration";
1050             type = submodule {
1051               options = {
1052                 mysql = mkMysqlOptions "StatusEngine" {};
1053                 ldap = mkLdapOptions "StatusEngine" {};
1054               };
1055             };
1056           };
1057           task = mkOption {
1058             description = "Taskwarrior configuration";
1059             type = submodule {
1060               options = {
1061                 ldap = mkLdapOptions "Taskwarrior" {};
1062                 taskwarrior-web = mkOption {
1063                   description = "taskwarrior-web profiles";
1064                   type = attrsOf (submodule {
1065                     options = {
1066                       uid = mkOption {
1067                         type = listOf str;
1068                         description = "List of ldap uids having access to this profile";
1069                       };
1070                       org = mkOption { type = str; description = "Taskd organisation"; };
1071                       key = mkOption { type = str; description = "Taskd key"; };
1072                       date = mkOption { type = str; description = "Preferred date format"; };
1073                     };
1074                   });
1075                 };
1076               };
1077             };
1078           };
1079           ttrss = mkOption {
1080             description = "TT-RSS configuration";
1081             type = submodule {
1082               options = {
1083                 postgresql = mkPsqlOptions "TT-RSS";
1084                 ldap = mkLdapOptions "TT-RSS" {};
1085               };
1086             };
1087           };
1088           wallabag = mkOption {
1089             description = "Wallabag configuration";
1090             type = submodule {
1091               options = {
1092                 postgresql = mkPsqlOptions "Wallabag";
1093                 ldap = mkLdapOptions "Wallabag" {
1094                   admin_filter = mkOption { type = str; description = "Admin users filter"; };
1095                 };
1096                 redis = mkRedisOptions "Wallabag";
1097                 secret = mkOption { type = str; description = "App secret"; };
1098               };
1099             };
1100           };
1101           webhooks = mkOption {
1102             type = attrsOf str;
1103             description = "Mapping 'name'.php => script for webhooks";
1104           };
1105           csp_reports = mkOption {
1106             description = "CSP report configuration";
1107             type = submodule {
1108               options = {
1109                 report_uri = mkOption { type = str; description = "URI to report CSP violations to"; };
1110                 policies = mkOption { type = attrsOf str; description = "CSP policies to apply"; };
1111                 postgresql = mkPsqlOptions "CSP reports";
1112               };
1113             };
1114           };
1115           commento = mkOption {
1116             description = "Commento configuration";
1117             type = submodule {
1118               options = {
1119                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1120                 postgresql = mkPsqlOptions "Commento";
1121                 smtp = mkSmtpOptions "Commento";
1122               };
1123             };
1124           };
1125           ympd = mkOption {
1126             description = "Ympd configuration";
1127             type = submodule {
1128               options = {
1129                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1130                 mpd = mkOption {
1131                   description = "MPD configuration";
1132                   type = submodule {
1133                     options = {
1134                       password = mkOption { type = str; description = "Password to access MPD host"; };
1135                       host = mkOption { type = str; description = "Host for MPD"; };
1136                       port = mkOption { type = port; description = "Port to access MPD host"; };
1137                     };
1138                   };
1139                 };
1140               };
1141             };
1142           };
1143           yourls = mkOption {
1144             description = "Yourls configuration";
1145             type = submodule {
1146               options = {
1147                 mysql = mkMysqlOptions "Yourls" {};
1148                 ldap = mkLdapOptions "Yourls" {};
1149                 cookieKey = mkOption { type = str; description = "Cookie key"; };
1150               };
1151             };
1152           };
1153         };
1154       };
1155     };
1156     websites = mkOption {
1157       description = "Websites configurations";
1158       type = submodule {
1159         options = {
1160           immae = mkOption {
1161             description = "Immae configuration by environment";
1162             type = submodule {
1163               options = {
1164                 temp = mkOption {
1165                   description = "Temp configuration";
1166                   type = submodule {
1167                     options = {
1168                       ldap = mkLdapOptions "Immae temp" {
1169                         filter = mkOption { type = str; description = "Filter for user access"; };
1170                       };
1171                     };
1172                   };
1173                 };
1174               };
1175             };
1176           };
1177           isabelle = mkOption {
1178             description = "Isabelle configurations by environment";
1179             type =
1180               let
1181                 atenSubmodule = mkOption {
1182                   description = "environment configuration";
1183                   type = submodule {
1184                     options = {
1185                       environment = mkOption { type = str; description = "Symfony environment"; };
1186                       secret = mkOption { type = str; description = "Symfony App secret"; };
1187                       postgresql = mkPsqlOptions "Aten";
1188                     };
1189                   };
1190                 };
1191               in
1192                 submodule {
1193                   options = {
1194                     aten_production = atenSubmodule;
1195                     aten_integration = atenSubmodule;
1196                     iridologie = mkOption {
1197                       description = "environment configuration";
1198                       type = submodule {
1199                         options = {
1200                           environment = mkOption { type = str; description = "SPIP environment"; };
1201                           mysql = mkMysqlOptions "Iridologie" {};
1202                           ldap = mkLdapOptions "Iridologie" {};
1203                         };
1204                       };
1205                     };
1206                   };
1207                 };
1208           };
1209           chloe = mkOption {
1210             description = "Chloe configurations by environment";
1211             type =
1212               let
1213                 chloeSubmodule = mkOption {
1214                   description = "environment configuration";
1215                   type = submodule {
1216                     options = {
1217                       environment = mkOption { type = str; description = "SPIP environment"; };
1218                       mysql = mkMysqlOptions "Chloe" {};
1219                       ldap = mkLdapOptions "Chloe" {};
1220                     };
1221                   };
1222                 };
1223               in
1224                 submodule {
1225                   options = {
1226                     production = chloeSubmodule;
1227                     integration = chloeSubmodule;
1228                   };
1229                 };
1230           };
1231           connexionswing = mkOption {
1232             description = "Connexionswing configurations by environment";
1233             type =
1234               let
1235                 csSubmodule = mkOption {
1236                   description = "environment configuration";
1237                   type = submodule {
1238                     options = {
1239                       environment = mkOption { type = str; description = "Symfony environment"; };
1240                       mysql = mkMysqlOptions "Connexionswing" {};
1241                       secret = mkOption { type = str; description = "Symfony App secret"; };
1242                       email = mkOption { type = str; description = "Symfony email notification"; };
1243                     };
1244                   };
1245                 };
1246               in
1247                 submodule {
1248                   options = {
1249                     production = csSubmodule;
1250                     integration = csSubmodule;
1251                   };
1252                 };
1253           };
1254           jerome = mkOption {
1255             description = "Naturaloutil configuration";
1256             type = submodule {
1257               options = {
1258                 mysql = mkMysqlOptions "Naturaloutil" {};
1259                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1260               };
1261             };
1262           };
1263           telio_tortay = mkOption {
1264             description = "Telio Tortay configuration";
1265             type = submodule {
1266               options = {
1267                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1268               };
1269             };
1270           };
1271           ludivine = mkOption {
1272             description = "Ludivinecassal configurations by environment";
1273             type =
1274               let
1275                 lcSubmodule = mkOption {
1276                   description = "environment configuration";
1277                   type = submodule {
1278                     options = {
1279                       environment = mkOption { type = str; description = "Symfony environment"; };
1280                       mysql = mkMysqlOptions "LudivineCassal" {};
1281                       ldap = mkLdapOptions "LudivineCassal" {};
1282                       secret = mkOption { type = str; description = "Symfony App secret"; };
1283                     };
1284                   };
1285                 };
1286               in
1287                 submodule {
1288                   options = {
1289                     production = lcSubmodule;
1290                     integration = lcSubmodule;
1291                   };
1292                 };
1293           };
1294           emilia = mkOption {
1295             description = "Emilia configuration";
1296             type = submodule {
1297               options = {
1298                 postgresql = mkPsqlOptions "Emilia";
1299               };
1300             };
1301           };
1302           florian = mkOption {
1303             description = "Florian configuration";
1304             type = submodule {
1305               options = {
1306                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1307               };
1308             };
1309           };
1310           nassime = mkOption {
1311             description = "Nassime configuration";
1312             type = submodule {
1313               options = {
1314                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1315               };
1316             };
1317           };
1318           piedsjaloux = mkOption {
1319             description = "Piedsjaloux configurations by environment";
1320             type =
1321               let
1322                 pjSubmodule = mkOption {
1323                   description = "environment configuration";
1324                   type = submodule {
1325                     options = {
1326                       environment = mkOption { type = str; description = "Symfony environment"; };
1327                       mysql = mkMysqlOptions "Piedsjaloux" {};
1328                       secret = mkOption { type = str; description = "Symfony App secret"; };
1329                     };
1330                   };
1331                 };
1332               in
1333                 submodule {
1334                   options = {
1335                     production = pjSubmodule;
1336                     integration = pjSubmodule;
1337                   };
1338                 };
1339           };
1340           richie = mkOption {
1341             description = "Europe Richie configurations by environment";
1342             type = submodule {
1343               options = {
1344                 mysql = mkMysqlOptions "Richie" {};
1345                 smtp_mailer = mkOption {
1346                   description = "SMTP mailer configuration";
1347                   type = submodule {
1348                     options = {
1349                       user = mkOption { type = str; description = "Username"; };
1350                       password = mkOption { type = str; description = "Password"; };
1351                     };
1352                   };
1353                 };
1354               };
1355             };
1356           };
1357           tellesflorian = mkOption {
1358             description = "Tellesflorian configurations by environment";
1359             type =
1360               let
1361                 tfSubmodule = mkOption {
1362                   description = "environment configuration";
1363                   type = submodule {
1364                     options = {
1365                       environment = mkOption { type = str; description = "Symfony environment"; };
1366                       mysql = mkMysqlOptions "Tellesflorian" {};
1367                       secret = mkOption { type = str; description = "Symfony App secret"; };
1368                       invite_passwords = mkOption { type = str; description = "Password basic auth"; };
1369                     };
1370                   };
1371                 };
1372               in
1373                 submodule {
1374                   options = {
1375                     integration = tfSubmodule;
1376                   };
1377                 };
1378           };
1379         };
1380       };
1381     };
1382
1383     privateFiles = mkOption {
1384       type = path;
1385       description = ''
1386         Path to secret files to make available during build
1387         '';
1388     };
1389   };
1390   options.hostEnv = mkOption {
1391     readOnly = true;
1392     type = hostEnv;
1393     default = config.myEnv.servers."${name}";
1394     description = "Host environment";
1395   };
1396 }