modules/private/environment.nix

   1 { config, lib, name, ... }:
   2 with lib;
   3 with types;
   4 with lists;
   5 let
   6   ldapOptions = {
   7     base = mkOption { description = "Base of the LDAP tree"; type = str; };
   8     host = mkOption { description = "Host to access LDAP"; type = str; };
   9     root_dn = mkOption { description = "DN of the root user"; type = str; };
  10     root_pw = mkOption { description = "Hashed password of the root user"; type = str; };
  11     replication_dn = mkOption { description = "DN of the user allowed to replicate the LDAP directory"; type = str; };
  12     replication_pw = mkOption { description = "Password of the user allowed to replicate the LDAP directory"; type = str; };
  13   };
  14   mkLdapOptions = name: more: mkOption {
  15     description = "${name} LDAP configuration";
  16     type = submodule {
  17       options = ldapOptions // {
  18         dn = mkOption { description = "DN of the ${name} user"; type = str; };
  19         password = mkOption { description = "password of the ${name} user"; type = str; };
  20         filter = mkOption { description = "Filter for ${name} users"; type = str; default = ""; };
  21       } // more;
  22     };
  23   };
  24   mysqlOptions = {
  25     host = mkOption { description = "Host to access Mysql"; type = str; };
  26     remoteHost = mkOption { description = "Host to access Mysql from outside"; type = str; };
  27     port = mkOption { description = "Port to access Mysql"; type = str; };
  28     socket = mkOption { description = "Socket to access Mysql"; type = path; };
  29     systemUsers = mkOption {
  30       description = "Attrs of user-passwords allowed to access mysql";
  31       type = attrsOf str;
  32     };
  33     pam = mkOption {
  34       description = "PAM configuration for mysql";
  35       type = submodule {
  36         options = {
  37           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  38           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  39           filter = mkOption { description = "filter to match users"; type = str; };
  40         };
  41       };
  42     };
  43   };
  44   mkMysqlOptions = name: more: mkOption {
  45     description = "${name} mysql configuration";
  46     type = submodule {
  47       options = mysqlOptions // {
  48         database = mkOption { description = "${name} database"; type = str; };
  49         user = mkOption { description = "${name} user"; type = str; };
  50         password = mkOption { description = "mysql password of the ${name} user"; type = str; };
  51       } // more;
  52     };
  53   };
  54   psqlOptions = {
  55     host = mkOption { description = "Host to access Postgresql"; type = str; };
  56     port = mkOption { description = "Port to access Postgresql"; type = str; };
  57     socket = mkOption { description = "Socket to access Postgresql"; type = path; };
  58     pam = mkOption {
  59       description = "PAM configuration for psql";
  60       type = submodule {
  61         options = {
  62           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  63           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  64           filter = mkOption { description = "filter to match users"; type = str; };
  65         };
  66       };
  67     };
  68   };
  69   mkPsqlOptions = name: mkOption {
  70     description = "${name} psql configuration";
  71     type = submodule {
  72       options = psqlOptions // {
  73         database = mkOption { description = "${name} database"; type = str; };
  74         schema = mkOption { description = "${name} schema"; type = nullOr str; default = null; };
  75         user = mkOption { description = "${name} user"; type = str; };
  76         password = mkOption { description = "psql password of the ${name} user"; type = str; };
  77       };
  78     };
  79   };
  80   redisOptions = {
  81     host = mkOption { description = "Host to access Redis"; type = str; };
  82     port = mkOption { description = "Port to access Redis"; type = str; };
  83     socket = mkOption { description = "Socket to access Redis"; type = path; };
  84     dbs = mkOption {
  85       description = "Attrs of db number. Each number should be unique to avoid collision!";
  86       type = attrsOf str;
  87     };
  88     spiped_key = mkOption {
  89       type = str;
  90       description = ''
  91         Key to use with spiped to make a secure channel to replication
  92         '';
  93     };
  94     predixy = mkOption {
  95       description = "Predixy configuration. Unused yet";
  96       type = submodule {
  97         options = {
  98           read = mkOption { type = str; description = "Read password"; };
  99         };
 100       };
 101     };
 102   };
 103   mkRedisOptions = name: mkOption {
 104     description = "${name} redis configuration";
 105     type = submodule {
 106       options = redisOptions // {
 107         db = mkOption { description = "${name} database"; type = str; };
 108       };
 109     };
 110   };
 111   smtpOptions = {
 112     host = mkOption { description = "Host to access SMTP"; type = str; };
 113     port = mkOption { description = "Port to access SMTP"; type = str; };
 114   };
 115   mkSmtpOptions = name: mkOption {
 116     description = "${name} smtp configuration";
 117     type = submodule {
 118       options = smtpOptions // {
 119         email = mkOption { description = "${name} email"; type = str; };
 120         password = mkOption { description = "SMTP password of the ${name} user"; type = str; };
 121       };
 122     };
 123   };
 124   hostEnv = submodule {
 125     options = {
 126       fqdn = mkOption {
 127         description = "Host FQDN";
 128         type = str;
 129       };
 130       users = mkOption {
 131         type = unspecified;
 132         default = pkgs: [];
 133         description = ''
 134           Sublist of users from realUsers. Function that takes pkgs as
 135           argument and gives an array as a result
 136         '';
 137       };
 138       emails = mkOption {
 139         default = [];
 140         description = "List of e-mails that the server can be a sender of";
 141         type = listOf str;
 142       };
 143       ldap = mkOption {
 144         description = ''
 145           LDAP credentials for the host
 146         '';
 147         type = submodule {
 148           options = {
 149             password = mkOption { type = str; description = "Password for the LDAP connection"; };
 150             dn = mkOption { type = str; description = "DN for the LDAP connection"; };
 151           };
 152         };
 153       };
 154       mx = mkOption {
 155         description = "subdomain and priority for MX server";
 156         default = { enable = false; };
 157         type = submodule {
 158           options = {
 159             enable = mkEnableOption "Enable MX";
 160             subdomain = mkOption { type = nullOr str; description = "Subdomain name (mx-*)"; };
 161             priority = mkOption { type = nullOr str; description = "Priority"; };
 162           };
 163         };
 164       };
 165       ips = mkOption {
 166         description = ''
 167           attrs of ip4/ip6 grouped by section
 168         '';
 169         type = attrsOf (submodule {
 170           options = {
 171             ip4 = mkOption {
 172               type = str;
 173               description = ''
 174                 ip4 address of the host
 175               '';
 176             };
 177             ip6 = mkOption {
 178               type = listOf str;
 179               default = [];
 180               description = ''
 181                 ip6 addresses of the host
 182               '';
 183             };
 184           };
 185         });
 186       };
 187     };
 188   };
 189 in
 190 {
 191   options.myEnv = {
 192     servers = mkOption {
 193       description = ''
 194         Attrs of servers information in the cluster (not necessarily handled by nixops)
 195       '';
 196       default = {};
 197       type = attrsOf hostEnv;
 198     };
 199     hetznerCloud = mkOption {
 200       description = ''
 201         Hetzner Cloud credential information
 202       '';
 203       type = submodule {
 204         options = {
 205           authToken = mkOption {
 206             type = str;
 207             description = ''
 208               The API auth token.
 209             '';
 210           };
 211         };
 212       };
 213     };
 214     hetzner = mkOption {
 215       description = ''
 216         Hetzner credential information
 217       '';
 218       type = submodule {
 219         options = {
 220           user = mkOption { type = str; description = "User"; };
 221           pass = mkOption { type = str; description = "Password"; };
 222         };
 223       };
 224     };
 225     sshd = mkOption {
 226       description = ''
 227         sshd service credential information
 228       '';
 229       type = submodule {
 230         options = {
 231           ldap = mkOption {
 232             description = ''
 233               LDAP credentials for cn=ssh,ou=services,dc=immae,dc=eu dn
 234             '';
 235             type = submodule {
 236               options = {
 237                 password = mkOption { description = "Password"; type = str; };
 238               };
 239             };
 240           };
 241         };
 242       };
 243     };
 244     ports = mkOption {
 245       description = ''
 246         non-standard reserved ports. Must be unique!
 247       '';
 248       type = attrsOf port;
 249       default = {};
 250       apply = let
 251         noDupl = x: builtins.length (builtins.attrValues x) == builtins.length (unique (builtins.attrValues x));
 252       in
 253         x: if isAttrs x && noDupl x then x else throw "Non unique values for ports";
 254     };
 255     httpd = mkOption {
 256       description = ''
 257         httpd service credential information
 258       '';
 259       type = submodule {
 260         options = {
 261           ldap = mkOption {
 262             description = ''
 263               LDAP credentials for cn=httpd,ou=services,dc=immae,dc=eu dn
 264             '';
 265             type = submodule {
 266               options = {
 267                 password = mkOption { description = "Password"; type = str; };
 268               };
 269             };
 270           };
 271         };
 272       };
 273     };
 274     smtp = mkOption {
 275       type = submodule { options = smtpOptions; };
 276       description = "SMTP configuration";
 277     };
 278     ldap = mkOption {
 279       description = ''
 280         LDAP server configuration
 281         '';
 282       type = submodule {
 283         options = ldapOptions;
 284       };
 285     };
 286     databases = mkOption {
 287       description = "Databases configuration";
 288       type = submodule {
 289         options = {
 290           mysql = mkOption {
 291             type = submodule { options = mysqlOptions; };
 292             description = "Mysql configuration";
 293           };
 294           redis = mkOption {
 295             type = submodule { options = redisOptions; };
 296             description = "Redis configuration";
 297           };
 298           postgresql = mkOption {
 299             type = submodule { options = psqlOptions; };
 300             description = "Postgresql configuration";
 301           };
 302         };
 303       };
 304     };
 305     jabber = mkOption {
 306       description = "Jabber configuration";
 307       type = submodule {
 308         options = {
 309           postfix_user_filter = mkOption { type = str; description = "Postfix filter to get xmpp users"; };
 310           ldap = mkLdapOptions "Jabber" {};
 311           postgresql = mkPsqlOptions "Jabber";
 312         };
 313       };
 314     };
 315     realUsers = mkOption {
 316       description = ''
 317         Attrset of function taking pkgs as argument.
 318         Real users settings, should provide a subattr of users.users.<name>
 319         with at least: name, (hashed)Password, shell
 320       '';
 321       type = attrsOf unspecified;
 322     };
 323     users = mkOption {
 324       description = "System and regular users uid/gid";
 325       type = attrsOf (submodule {
 326         options = {
 327           uid = mkOption {
 328             description = "user uid";
 329             type = int;
 330           };
 331           gid = mkOption {
 332             description = "user gid";
 333             type = int;
 334           };
 335         };
 336       });
 337     };
 338     dns = mkOption {
 339       description = "DNS configuration";
 340       type = submodule {
 341         options = {
 342           soa = mkOption {
 343             description = "SOA information";
 344             type = submodule {
 345               options = {
 346                 serial = mkOption {
 347                   description = "Serial number. Should be incremented at each change and unique";
 348                   type = str;
 349                 };
 350                 refresh = mkOption {
 351                   description = "Refresh time";
 352                   type = str;
 353                 };
 354                 retry = mkOption {
 355                   description = "Retry time";
 356                   type = str;
 357                 };
 358                 expire = mkOption {
 359                   description = "Expire time";
 360                   type = str;
 361                 };
 362                 ttl = mkOption {
 363                   description = "Default TTL time";
 364                   type = str;
 365                 };
 366                 email = mkOption {
 367                   description = "hostmaster e-mail";
 368                   type = str;
 369                 };
 370                 primary = mkOption {
 371                   description = "Primary NS";
 372                   type = str;
 373                 };
 374               };
 375             };
 376           };
 377           ns = mkOption {
 378             description = "Attrs of NS servers group";
 379             example = {
 380               foo = {
 381                 "ns1.foo.com" = [ "198.51.100.10" "2001:db8:abcd::1" ];
 382                 "ns2.foo.com" = [ "198.51.100.15" "2001:db8:1234::1" ];
 383               };
 384             };
 385             type = attrsOf (attrsOf (listOf str));
 386           };
 387           keys = mkOption {
 388             default = {};
 389             description = "DNS keys";
 390             type = attrsOf (submodule {
 391               options = {
 392                 algorithm = mkOption { type = str; description = "Algorithm"; };
 393                 secret    = mkOption { type = str; description = "Secret"; };
 394               };
 395             });
 396           };
 397           slaveZones = mkOption {
 398             description = "List of slave zones";
 399             type = listOf (submodule {
 400               options = {
 401                 name = mkOption { type = str; description = "zone name"; };
 402                 masters = mkOption {
 403                   description = "NS master groups of this zone";
 404                   type = listOf str;
 405                 };
 406                 keys = mkOption {
 407                   default = [];
 408                   description = "Keys associated to the server";
 409                   type = listOf str;
 410                 };
 411               };
 412             });
 413           };
 414           masterZones = mkOption {
 415             description = "List of master zones";
 416             type = listOf (submodule {
 417               options = {
 418                 name = mkOption { type = str; description = "zone name"; };
 419                 withCAA = mkOption { type = nullOr str; description = "CAA entry"; default = null; };
 420                 slaves = mkOption {
 421                   description = "NS slave groups of this zone";
 422                   type = listOf str;
 423                 };
 424                 ns = mkOption {
 425                   description = "groups names that should have their NS entries listed here";
 426                   type = listOf str;
 427                 };
 428                 extra = mkOption {
 429                   description = "Extra zone configuration for bind";
 430                   example = ''
 431                     notify yes;
 432                     '';
 433                   type = lines;
 434                 };
 435                 entries = mkOption { type = lines; description = "Regular entries of the NS zone"; };
 436                 withEmail = mkOption {
 437                   description = "List of domains that should have mail entries (MX, dkim, SPF, ...)";
 438                   default = [];
 439                   type = listOf (submodule {
 440                     options = {
 441                       domain = mkOption { type = str; description = "Which subdomain is concerned"; };
 442                       send = mkOption { type = bool; description = "Whether there can be e-mails originating from the subdomain"; };
 443                       receive = mkOption { type = bool; description = "Whether there can be e-mails arriving to the subdomain"; };
 444                     };
 445                   });
 446                 };
 447               };
 448             });
 449           };
 450         };
 451       };
 452     };
 453     backup = mkOption {
 454       description = ''
 455         Remote backup with duplicity
 456         '';
 457       type = submodule {
 458         options = {
 459           password = mkOption { type = str; description = "Password for encrypting files"; };
 460           remotes = mkOption {
 461             type = attrsOf (submodule {
 462               options = {
 463                 remote = mkOption {
 464                   type = unspecified;
 465                   example = literalExample ''
 466                     bucket: "s3://some_host/${bucket}";
 467                     '';
 468                   description = ''
 469                     Function.
 470                     Takes a bucket name as argument and returns a url
 471                     '';
 472                 };
 473                 accessKeyId = mkOption { type = str; description = "Remote access-key"; };
 474                 secretAccessKey = mkOption { type = str; description = "Remote access secret"; };
 475               };
 476             });
 477           };
 478         };
 479       };
 480     };
 481     zrepl_backup = mkOption {
 482       type = submodule {
 483         options = {
 484           ssh_key = mkOption {
 485             description = "SSH key information";
 486             type = submodule {
 487               options = {
 488                 public = mkOption { type = str; description = "Public part of the key"; };
 489                 private = mkOption { type = lines; description = "Private part of the key"; };
 490               };
 491             };
 492           };
 493           mysql = mkMysqlOptions "Zrepl" {};
 494         };
 495       };
 496     };
 497     rsync_backup = mkOption {
 498       description  =''
 499         Rsync backup configuration from controlled host
 500         '';
 501       type = submodule {
 502         options = {
 503           ssh_key = mkOption {
 504             description = "SSH key information";
 505             type = submodule {
 506               options = {
 507                 public = mkOption { type = str; description = "Public part of the key"; };
 508                 private = mkOption { type = lines; description = "Private part of the key"; };
 509               };
 510             };
 511           };
 512           profiles = mkOption {
 513             description = "Attrs of profiles to backup";
 514             type = attrsOf (submodule {
 515               options = {
 516                 keep = mkOption { type = int; description = "Number of backups to keep"; };
 517                 check_command = mkOption { type = str; description = "command to check if backup needs to be done"; default = "backup"; };
 518                 login = mkOption { type = str; description = "Login to connect to host"; };
 519                 port = mkOption { type = str; default = "22"; description = "Port to connect to host"; };
 520                 host = mkOption { type = str; description = "Host to connect to"; };
 521                 host_key = mkOption { type = str; description = "Host key"; };
 522                 host_key_type = mkOption { type = str; description = "Host key type"; };
 523                 parts = mkOption {
 524                   description = "Parts to backup for this host";
 525                   type = attrsOf (submodule {
 526                     options = {
 527                       remote_folder = mkOption { type = path; description = "Remote folder to backup";};
 528                       exclude_from = mkOption {
 529                         type = listOf path;
 530                         default = [];
 531                         description = "List of folders/files to exclude from the backup";
 532                       };
 533                       files_from = mkOption {
 534                         type = listOf path;
 535                         default = [];
 536                         description = "List of folders/files to backup in the base folder";
 537                       };
 538                       args = mkOption {
 539                         type = nullOr str;
 540                         default = null;
 541                         description = "Extra arguments to pass to rsync";
 542                       };
 543                     };
 544                   });
 545                 };
 546               };
 547             });
 548           };
 549         };
 550       };
 551     };
 552     monitoring = mkOption {
 553       description = "Monitoring configuration";
 554       type = submodule {
 555         options = {
 556           status_url = mkOption { type = str; description = "URL to push status to"; };
 557           status_token = mkOption { type = str; description = "Token for the status url"; };
 558           http_user_password = mkOption { type = str; description = "HTTP credentials to check services behind wall"; };
 559           email = mkOption { type = str; description = "Admin E-mail"; };
 560           ssh_public_key = mkOption { type = str; description = "SSH public key"; };
 561           ssh_secret_key = mkOption { type = str; description = "SSH secret key"; };
 562           imap_login = mkOption { type = str; description = "IMAP login"; };
 563           imap_password = mkOption { type = str; description = "IMAP password"; };
 564           eriomem_keys = mkOption { type = listOf (listOf str); description = "Eriomem keys"; default = []; };
 565           ovh_sms = mkOption {
 566             description = "OVH credentials for sms script";
 567             type = submodule {
 568               options = {
 569                 endpoint = mkOption { type = str; default = "ovh-eu"; description = "OVH endpoint"; };
 570                 application_key = mkOption { type = str; description = "Application key"; };
 571                 application_secret = mkOption { type = str; description = "Application secret"; };
 572                 consumer_key = mkOption { type = str; description = "Consumer key"; };
 573                 account = mkOption { type = str; description = "Account"; };
 574               };
 575             };
 576           };
 577           eban = mkOption {
 578             description = "Eban credentials for webhook";
 579             type = submodule {
 580               options = {
 581                 user = mkOption { type = str; description = "User"; };
 582                 password = mkOption { type = str; description = "Password"; };
 583               };
 584             };
 585           };
 586           nrdp_tokens = mkOption { type = listOf str; description = "Tokens allowed to push status update"; };
 587           slack_url = mkOption { type = str; description = "Slack webhook url to push status update"; };
 588           slack_channel = mkOption { type = str; description = "Slack channel to push status update"; };
 589           netdata_aggregator = mkOption { type = str; description = "Url where netdata information should be sent"; };
 590           netdata_keys = mkOption { type = attrsOf str; description = "netdata host keys"; };
 591           contacts = mkOption { type = attrsOf unspecified; description = "Contact dicts to fill naemon objects"; };
 592           email_check = mkOption {
 593             description = "Emails services to check";
 594             type = attrsOf (submodule {
 595               options = {
 596                 local = mkOption { type = bool; default = false; description = "Use local configuration"; };
 597                 port = mkOption { type = nullOr str; default = null; description = "Port to connect to ssh"; };
 598                 login = mkOption { type = nullOr str; default = null; description = "Login to connect to ssh"; };
 599                 targets = mkOption { type = listOf str; description = "Hosts to send E-mails to"; };
 600                 mail_address = mkOption { type = nullOr str; default = null; description = "E-mail recipient part to send e-mail to"; };
 601                 mail_domain = mkOption { type = nullOr str; default = null; description = "E-mail domain part to send e-mail to"; };
 602               };
 603             });
 604           };
 605         };
 606       };
 607     };
 608     mpd = mkOption {
 609       description = "MPD configuration";
 610       type = submodule {
 611         options = {
 612           folder = mkOption { type = str; description = "Folder to serve from the MPD instance"; };
 613           password = mkOption { type = str; description = "Password to connect to the MPD instance"; };
 614           host = mkOption { type = str; description = "Host to connect to the MPD instance"; };
 615           port = mkOption { type = str; description = "Port to connect to the MPD instance"; };
 616         };
 617       };
 618     };
 619     ftp = mkOption {
 620       description = "FTP configuration";
 621       type = submodule {
 622         options = {
 623           ldap = mkLdapOptions "FTP" {};
 624         };
 625       };
 626     };
 627     vpn = mkOption {
 628       description = "VPN configuration";
 629       type = attrsOf (submodule {
 630         options = {
 631           prefix = mkOption { type = str; description = "ipv6 prefix for the vpn subnet"; };
 632           privateKey = mkOption { type = str; description = "Private key for the host"; };
 633           publicKey = mkOption { type = str; description = "Public key for the host"; };
 634         };
 635       });
 636     };
 637     mail = mkOption {
 638       description = "Mail configuration";
 639       type = submodule {
 640         options = {
 641           dmarc = mkOption {
 642             description = "DMARC configuration";
 643             type = submodule {
 644               options = {
 645                 ignore_hosts = mkOption {
 646                   type = lines;
 647                   description = ''
 648                     Hosts to ignore when checking for dmarc
 649                     '';
 650                 };
 651               };
 652             };
 653           };
 654           dkim = mkOption {
 655             description = "DKIM configuration";
 656             type = attrsOf (submodule {
 657               options = {
 658                 public = mkOption {
 659                   type = str;
 660                   example = ''
 661                     ( "v=DKIM1; k=rsa; "
 662                               "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3w1a2aMxWw9+hdcmbqX4UevcVqr204y0K73Wdc7MPZiOOlUJQYsMNSYR1Y/SC7jmPKeitpcJCpQgn/cveJZbuikjjPLsDReHyFEYmC278ZLRTELHx6f1IXM8WE08JIRT69CfZiMi1rVcOh9qRT4F93PyjCauU8Y5hJjtg9ThsWwIDAQAB" )
 663                     '';
 664                   description = "Public entry to put in DNS TXT field";
 665                 };
 666                 private = mkOption { type = str; description = "Private key"; };
 667               };
 668             });
 669           };
 670           postfix = mkOption {
 671             description = "Postfix configuration";
 672             type = submodule {
 673               options = {
 674                 additional_mailbox_domains = mkOption {
 675                   description = ''
 676                     List of domains that are used as mailbox final destination, in addition to those defined in the DNS records
 677                   '';
 678                   type = listOf str;
 679                 };
 680                 mysql = mkMysqlOptions "Postfix" {
 681                   password_encrypt = mkOption { type = str; description = "Key to encrypt relay password in database"; };
 682                 };
 683                 backup_domains = mkOption {
 684                   description = ''
 685                     Domains that are accepted for relay as backup domain
 686                   '';
 687                   type = attrsOf (submodule {
 688                     options = {
 689                       domains = mkOption { type = listOf str; description = "Domains list"; };
 690                       relay_restrictions = mkOption {
 691                         type = lines;
 692                         description = ''
 693                           Restrictions for relaying the e-mails from the domains
 694                           '';
 695                       };
 696                       recipient_maps = mkOption {
 697                         description = ''
 698                           Recipient map to accept relay for.
 699                           Must be specified for domain, the rules apply to everyone!
 700                         '';
 701                         type = listOf (submodule {
 702                           options = {
 703                             type = mkOption {
 704                               type = enum [ "hash" ];
 705                               description = "Map type";
 706                             };
 707                             content = mkOption {
 708                               type = str;
 709                               description = "Map content";
 710                             };
 711                           };
 712                         });
 713                       };
 714                     };
 715                   });
 716                 };
 717               };
 718             };
 719           };
 720           dovecot = mkOption {
 721             description = "Dovecot configuration";
 722             type = submodule {
 723               options = {
 724                 ldap = mkLdapOptions "Dovecot" {
 725                   pass_attrs = mkOption { type = str; description = "Password attribute in LDAP"; };
 726                   user_attrs = mkOption { type = str; description = "User attribute mapping in LDAP"; };
 727                   iterate_attrs = mkOption { type = str; description = "User attribute mapping for listing in LDAP"; };
 728                   iterate_filter = mkOption { type = str; description = "User attribute filter for listing in LDAP"; };
 729                   postfix_mailbox_filter = mkOption { type = str; description = "Postfix filter to get mailboxes"; };
 730                 };
 731               };
 732             };
 733           };
 734           rspamd = mkOption {
 735             description = "rspamd configuration";
 736             type = submodule {
 737               options = {
 738                 redis = mkRedisOptions "Redis";
 739                 read_password_hashed = mkOption { type = str; description = "Hashed read password for rspamd"; };
 740                 write_password_hashed = mkOption { type = str; description = "Hashed write password for rspamd"; };
 741                 read_password = mkOption {
 742                   type = str;
 743                   description = "Read password for rspamd. Unused";
 744                   apply = x: "";
 745                 };
 746                 write_password = mkOption {
 747                   type = str;
 748                   description = "Write password for rspamd. Unused";
 749                   apply = x: "";
 750                 };
 751               };
 752             };
 753           };
 754           scripts = mkOption {
 755             description = "Mail script recipients";
 756             type = attrsOf (submodule {
 757               options = {
 758                 external = mkEnableOption "Create a script_<name>@mail.immae.eu external address";
 759                 src = mkOption {
 760                   description = ''
 761                     git source to fetch the script from.
 762                     It must have a default.nix file as its root accepting a scriptEnv parameter
 763                   '';
 764                   type = submodule {
 765                     options = {
 766                       url = mkOption { type = str; description = "git url to fetch"; };
 767                       rev = mkOption { type = str; description = "git reference to fetch"; };
 768                     };
 769                   };
 770                 };
 771                 env = mkOption {
 772                   description = "Variables to pass to the script";
 773                   type = unspecified;
 774                 };
 775               };
 776             });
 777           };
 778           sympa = mkOption {
 779             description = "Sympa configuration";
 780             type = submodule {
 781               options = {
 782                 listmasters = mkOption {
 783                   type = listOf str;
 784                   description = "Listmasters";
 785                 };
 786                 postgresql = mkPsqlOptions "Sympa";
 787                 data_sources = mkOption {
 788                   type = attrsOf str;
 789                   default = {};
 790                   description = "Data sources to make available to sympa";
 791                 };
 792                 scenari = mkOption {
 793                   type = attrsOf str;
 794                   default = {};
 795                   description = "Scenari to make available to sympa";
 796                 };
 797               };
 798             };
 799           };
 800         };
 801       };
 802     };
 803     buildbot = mkOption {
 804       description = "Buildbot configuration";
 805       type = submodule {
 806         options = {
 807           user = mkOption {
 808             description = "Buildbot user";
 809             type = submodule {
 810               options = {
 811                 uid = mkOption {
 812                   description = "user uid";
 813                   type = int;
 814                 };
 815                 gid = mkOption {
 816                   description = "user gid";
 817                   type = int;
 818                 };
 819               };
 820             };
 821           };
 822           ldap = mkOption {
 823             description = "Ldap configuration for buildbot";
 824             type = submodule {
 825               options = {
 826                 password = mkOption { type = str; description = "Buildbot password"; };
 827               };
 828             };
 829           };
 830           projects = mkOption {
 831             description = "Projects to make a buildbot for";
 832             type = attrsOf (submodule {
 833               options = {
 834                 name = mkOption { type = str; description = "Project name"; };
 835                 packages = mkOption {
 836                   type = unspecified;
 837                   example = literalExample ''
 838                     pkgs: [ pkgs.bash pkgs.git pkgs.gzip pkgs.openssh ];
 839                     '';
 840                   description = ''
 841                     Function.
 842                     Builds packages list to make available to buildbot project.
 843                     Takes pkgs as argument.
 844                   '';
 845                 };
 846                 pythonPackages = mkOption {
 847                   type = unspecified;
 848                   example = literalExample ''
 849                     p: pkgs: [ pkgs.python3Packages.pip ];
 850                     '';
 851                   description = ''
 852                     Function.
 853                     Builds python packages list to make available to buildbot project.
 854                     Takes buildbot python module as first argument and pkgs as second argument in order to augment the python modules list.
 855                     '';
 856                 };
 857                 pythonPathHome = mkOption { type = bool; description = "Whether to add project’s python home to python path"; };
 858                 secrets = mkOption {
 859                   type = attrsOf str;
 860                   description = "Secrets for the project to dump as files";
 861                 };
 862                 environment = mkOption {
 863                   type = attrsOf str;
 864                   description = ''
 865                     Environment variables for the project.
 866                     BUILDBOT_ is prefixed to the variable names
 867                   '';
 868                 };
 869                 activationScript = mkOption {
 870                   type = lines;
 871                   description = ''
 872                     Activation script to run during deployment
 873                   '';
 874                 };
 875                 builderPaths = mkOption {
 876                   type = attrsOf unspecified;
 877                   default = {};
 878                   description = ''
 879                     Attrs of functions to make accessible specifically per builder.
 880                     Takes pkgs as argument and should return a single path containing binaries.
 881                     This path will be accessible as BUILDBOT_PATH_<attrskey>
 882                     '';
 883                 };
 884                 webhookTokens = mkOption {
 885                   type = nullOr (listOf str);
 886                   default = null;
 887                   description = ''
 888                     List of tokens allowed to push to project’s change_hook/base endpoint
 889                   '';
 890                 };
 891               };
 892             });
 893           };
 894         };
 895       };
 896     };
 897     tools = mkOption {
 898       description = "Tools configurations";
 899       type = submodule {
 900         options = {
 901           contact = mkOption { type = str; description = "Contact e-mail address"; };
 902           assets = mkOption {
 903             default = {};
 904             type = attrsOf (submodule {
 905               options = {
 906                 url = mkOption { type = str; description = "URL to fetch"; };
 907                 sha256 = mkOption { type = str; description = "Hash of the url"; };
 908               };
 909             });
 910             description = "Assets to provide on assets.immae.eu";
 911           };
 912           davical = mkOption {
 913             description = "Davical configuration";
 914             type = submodule {
 915               options = {
 916                 postgresql = mkPsqlOptions "Davical";
 917                 ldap = mkLdapOptions "Davical" {};
 918               };
 919             };
 920           };
 921           diaspora = mkOption {
 922             description = "Diaspora configuration";
 923             type = submodule {
 924               options = {
 925                 postgresql = mkPsqlOptions "Diaspora";
 926                 redis = mkRedisOptions "Diaspora";
 927                 ldap = mkLdapOptions "Diaspora" {};
 928                 secret_token = mkOption { type = str; description = "Secret token"; };
 929               };
 930             };
 931           };
 932           dmarc_reports = mkOption {
 933             description = "DMARC reports configuration";
 934             type = submodule {
 935               options = {
 936                 mysql = mkMysqlOptions "DMARC" {};
 937                 anonymous_key = mkOption { type = str; description = "Anonymous hashing key"; };
 938               };
 939             };
 940           };
 941           etherpad-lite = mkOption {
 942             description = "Etherpad configuration";
 943             type = submodule {
 944               options = {
 945                 postgresql = mkPsqlOptions "Etherpad";
 946                 ldap = mkLdapOptions "Etherpad" {
 947                   group_filter = mkOption { type = str; description = "Filter for groups"; };
 948                 };
 949                 adminPassword = mkOption { type = str; description = "Admin password for mypads / admin"; };
 950                 session_key = mkOption { type = str; description = "Session key"; };
 951                 api_key = mkOption { type = str; description = "API key"; };
 952                 redirects = mkOption { type = str; description = "Redirects for apache"; };
 953               };
 954             };
 955           };
 956           gitolite = mkOption {
 957             description = "Gitolite configuration";
 958             type = submodule {
 959               options = {
 960                 ldap = mkLdapOptions "Gitolite" {};
 961               };
 962             };
 963           };
 964           kanboard = mkOption {
 965             description = "Kanboard configuration";
 966             type = submodule {
 967               options = {
 968                 postgresql = mkPsqlOptions "Kanboard";
 969                 ldap = mkLdapOptions "Kanboard" {
 970                   admin_dn = mkOption { type = str; description = "Admin DN"; };
 971                 };
 972               };
 973             };
 974           };
 975           mantisbt = mkOption {
 976             description = "Mantisbt configuration";
 977             type = submodule {
 978               options = {
 979                 postgresql = mkPsqlOptions "Mantisbt";
 980                 ldap = mkLdapOptions "Mantisbt" {};
 981                 master_salt = mkOption { type = str; description = "Master salt for password hash"; };
 982               };
 983             };
 984           };
 985           mastodon = mkOption {
 986             description = "Mastodon configuration";
 987             type = submodule {
 988               options = {
 989                 postgresql = mkPsqlOptions "Mastodon";
 990                 redis = mkRedisOptions "Mastodon";
 991                 ldap = mkLdapOptions "Mastodon" {};
 992                 paperclip_secret = mkOption { type = str; description = "Paperclip secret"; };
 993                 otp_secret = mkOption { type = str; description = "OTP secret"; };
 994                 secret_key_base = mkOption { type = str; description = "Secret key base"; };
 995                 vapid = mkOption {
 996                   description = "vapid key";
 997                   type = submodule {
 998                     options = {
 999                       private = mkOption { type = str; description = "Private key"; };
1000                       public = mkOption { type = str; description = "Public key"; };
1001                     };
1002                   };
1003                 };
1004               };
1005             };
1006           };
1007           mediagoblin = mkOption {
1008             description = "Mediagoblin configuration";
1009             type = submodule {
1010               options = {
1011                 postgresql = mkPsqlOptions "Mediagoblin";
1012                 redis = mkRedisOptions "Mediagoblin";
1013                 ldap = mkLdapOptions "Mediagoblin" {};
1014               };
1015             };
1016           };
1017           nextcloud = mkOption {
1018             description = "Nextcloud configuration";
1019             type = submodule {
1020               options = {
1021                 postgresql = mkPsqlOptions "Peertube";
1022                 redis = mkRedisOptions "Peertube";
1023                 password_salt = mkOption { type = str; description = "Password salt"; };
1024                 instance_id = mkOption { type = str; description = "Instance ID"; };
1025                 secret = mkOption { type = str; description = "App secret"; };
1026               };
1027             };
1028           };
1029           peertube = mkOption {
1030             description = "Peertube configuration";
1031             type = submodule {
1032               options = {
1033                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1034                 postgresql = mkPsqlOptions "Peertube";
1035                 redis = mkRedisOptions "Peertube";
1036                 ldap = mkLdapOptions "Peertube" {};
1037               };
1038             };
1039           };
1040           syden_peertube = mkOption {
1041             description = "Peertube Syden configuration";
1042             type = submodule {
1043               options = {
1044                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1045                 postgresql = mkPsqlOptions "Peertube";
1046                 redis = mkRedisOptions "Peertube";
1047               };
1048             };
1049           };
1050           phpldapadmin = mkOption {
1051             description = "phpLdapAdmin configuration";
1052             type = submodule {
1053               options = {
1054                 ldap = mkLdapOptions "phpldapadmin" {};
1055               };
1056             };
1057           };
1058           rompr = mkOption {
1059             description = "Rompr configuration";
1060             type = submodule {
1061               options = {
1062                 mpd = mkOption {
1063                   description = "MPD configuration";
1064                   type = submodule {
1065                     options = {
1066                       host = mkOption { type = str; description = "Host for MPD"; };
1067                       port = mkOption { type = port; description = "Port to access MPD host"; };
1068                     };
1069                   };
1070                 };
1071               };
1072             };
1073           };
1074           roundcubemail = mkOption {
1075             description = "Roundcubemail configuration";
1076             type = submodule {
1077               options = {
1078                 postgresql = mkPsqlOptions "TT-RSS";
1079                 secret = mkOption { type = str; description = "Secret"; };
1080               };
1081             };
1082           };
1083           shaarli = mkOption {
1084             description = "Shaarli configuration";
1085             type = submodule {
1086               options = {
1087                 ldap = mkLdapOptions "Shaarli" {};
1088               };
1089             };
1090           };
1091           status_engine = mkOption {
1092             description = "Status Engine configuration";
1093             type = submodule {
1094               options = {
1095                 mysql = mkMysqlOptions "StatusEngine" {};
1096                 ldap = mkLdapOptions "StatusEngine" {};
1097               };
1098             };
1099           };
1100           task = mkOption {
1101             description = "Taskwarrior configuration";
1102             type = submodule {
1103               options = {
1104                 ldap = mkLdapOptions "Taskwarrior" {};
1105                 taskwarrior-web = mkOption {
1106                   description = "taskwarrior-web profiles";
1107                   type = attrsOf (submodule {
1108                     options = {
1109                       uid = mkOption {
1110                         type = listOf str;
1111                         description = "List of ldap uids having access to this profile";
1112                       };
1113                       org = mkOption { type = str; description = "Taskd organisation"; };
1114                       key = mkOption { type = str; description = "Taskd key"; };
1115                       date = mkOption { type = str; description = "Preferred date format"; };
1116                     };
1117                   });
1118                 };
1119               };
1120             };
1121           };
1122           ttrss = mkOption {
1123             description = "TT-RSS configuration";
1124             type = submodule {
1125               options = {
1126                 postgresql = mkPsqlOptions "TT-RSS";
1127                 ldap = mkLdapOptions "TT-RSS" {};
1128               };
1129             };
1130           };
1131           wallabag = mkOption {
1132             description = "Wallabag configuration";
1133             type = submodule {
1134               options = {
1135                 postgresql = mkPsqlOptions "Wallabag";
1136                 ldap = mkLdapOptions "Wallabag" {
1137                   admin_filter = mkOption { type = str; description = "Admin users filter"; };
1138                 };
1139                 redis = mkRedisOptions "Wallabag";
1140                 secret = mkOption { type = str; description = "App secret"; };
1141               };
1142             };
1143           };
1144           webhooks = mkOption {
1145             type = attrsOf str;
1146             description = "Mapping 'name'.php => script for webhooks";
1147           };
1148           csp_reports = mkOption {
1149             description = "CSP report configuration";
1150             type = submodule {
1151               options = {
1152                 report_uri = mkOption { type = str; description = "URI to report CSP violations to"; };
1153                 policies = mkOption { type = attrsOf str; description = "CSP policies to apply"; };
1154                 postgresql = mkPsqlOptions "CSP reports";
1155               };
1156             };
1157           };
1158           commento = mkOption {
1159             description = "Commento configuration";
1160             type = submodule {
1161               options = {
1162                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1163                 postgresql = mkPsqlOptions "Commento";
1164                 smtp = mkSmtpOptions "Commento";
1165               };
1166             };
1167           };
1168           ympd = mkOption {
1169             description = "Ympd configuration";
1170             type = submodule {
1171               options = {
1172                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1173                 mpd = mkOption {
1174                   description = "MPD configuration";
1175                   type = submodule {
1176                     options = {
1177                       password = mkOption { type = str; description = "Password to access MPD host"; };
1178                       host = mkOption { type = str; description = "Host for MPD"; };
1179                       port = mkOption { type = port; description = "Port to access MPD host"; };
1180                     };
1181                   };
1182                 };
1183               };
1184             };
1185           };
1186           yourls = mkOption {
1187             description = "Yourls configuration";
1188             type = submodule {
1189               options = {
1190                 mysql = mkMysqlOptions "Yourls" {};
1191                 ldap = mkLdapOptions "Yourls" {};
1192                 cookieKey = mkOption { type = str; description = "Cookie key"; };
1193               };
1194             };
1195           };
1196         };
1197       };
1198     };
1199     serverSpecific = mkOption { type = attrsOf unspecified; description = "Server specific configuration"; };
1200     websites = mkOption {
1201       description = "Websites configurations";
1202       type = submodule {
1203         options = {
1204           immae = mkOption {
1205             description = "Immae configuration by environment";
1206             type = submodule {
1207               options = {
1208                 temp = mkOption {
1209                   description = "Temp configuration";
1210                   type = submodule {
1211                     options = {
1212                       ldap = mkLdapOptions "Immae temp" {
1213                         filter = mkOption { type = str; description = "Filter for user access"; };
1214                       };
1215                     };
1216                   };
1217                 };
1218               };
1219             };
1220           };
1221           isabelle = mkOption {
1222             description = "Isabelle configurations by environment";
1223             type =
1224               let
1225                 atenSubmodule = mkOption {
1226                   description = "environment configuration";
1227                   type = submodule {
1228                     options = {
1229                       environment = mkOption { type = str; description = "Symfony environment"; };
1230                       secret = mkOption { type = str; description = "Symfony App secret"; };
1231                       postgresql = mkPsqlOptions "Aten";
1232                     };
1233                   };
1234                 };
1235               in
1236                 submodule {
1237                   options = {
1238                     aten_production = atenSubmodule;
1239                     aten_integration = atenSubmodule;
1240                     iridologie = mkOption {
1241                       description = "environment configuration";
1242                       type = submodule {
1243                         options = {
1244                           environment = mkOption { type = str; description = "SPIP environment"; };
1245                           mysql = mkMysqlOptions "Iridologie" {};
1246                           ldap = mkLdapOptions "Iridologie" {};
1247                         };
1248                       };
1249                     };
1250                   };
1251                 };
1252           };
1253           chloe = mkOption {
1254             description = "Chloe configurations by environment";
1255             type =
1256               let
1257                 chloeSubmodule = mkOption {
1258                   description = "environment configuration";
1259                   type = submodule {
1260                     options = {
1261                       environment = mkOption { type = str; description = "SPIP environment"; };
1262                       mysql = mkMysqlOptions "Chloe" {};
1263                       ldap = mkLdapOptions "Chloe" {};
1264                     };
1265                   };
1266                 };
1267               in
1268                 submodule {
1269                   options = {
1270                     production = chloeSubmodule;
1271                     integration = chloeSubmodule;
1272                   };
1273                 };
1274           };
1275           connexionswing = mkOption {
1276             description = "Connexionswing configurations by environment";
1277             type =
1278               let
1279                 csSubmodule = mkOption {
1280                   description = "environment configuration";
1281                   type = submodule {
1282                     options = {
1283                       environment = mkOption { type = str; description = "Symfony environment"; };
1284                       mysql = mkMysqlOptions "Connexionswing" {};
1285                       secret = mkOption { type = str; description = "Symfony App secret"; };
1286                       email = mkOption { type = str; description = "Symfony email notification"; };
1287                     };
1288                   };
1289                 };
1290               in
1291                 submodule {
1292                   options = {
1293                     production = csSubmodule;
1294                     integration = csSubmodule;
1295                   };
1296                 };
1297           };
1298           jerome = mkOption {
1299             description = "Naturaloutil configuration";
1300             type = submodule {
1301               options = {
1302                 mysql = mkMysqlOptions "Naturaloutil" {};
1303                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1304               };
1305             };
1306           };
1307           telio_tortay = mkOption {
1308             description = "Telio Tortay configuration";
1309             type = submodule {
1310               options = {
1311                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1312               };
1313             };
1314           };
1315           ludivine = mkOption {
1316             description = "Ludivinecassal configurations by environment";
1317             type =
1318               let
1319                 lcSubmodule = mkOption {
1320                   description = "environment configuration";
1321                   type = submodule {
1322                     options = {
1323                       environment = mkOption { type = str; description = "Symfony environment"; };
1324                       mysql = mkMysqlOptions "LudivineCassal" {};
1325                       ldap = mkLdapOptions "LudivineCassal" {};
1326                       secret = mkOption { type = str; description = "Symfony App secret"; };
1327                     };
1328                   };
1329                 };
1330               in
1331                 submodule {
1332                   options = {
1333                     production = lcSubmodule;
1334                     integration = lcSubmodule;
1335                   };
1336                 };
1337           };
1338           emilia = mkOption {
1339             description = "Emilia configuration";
1340             type = submodule {
1341               options = {
1342                 postgresql = mkPsqlOptions "Emilia";
1343               };
1344             };
1345           };
1346           florian = mkOption {
1347             description = "Florian configuration";
1348             type = submodule {
1349               options = {
1350                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1351               };
1352             };
1353           };
1354           nassime = mkOption {
1355             description = "Nassime configuration";
1356             type = submodule {
1357               options = {
1358                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1359               };
1360             };
1361           };
1362           piedsjaloux = mkOption {
1363             description = "Piedsjaloux configurations by environment";
1364             type =
1365               let
1366                 pjSubmodule = mkOption {
1367                   description = "environment configuration";
1368                   type = submodule {
1369                     options = {
1370                       environment = mkOption { type = str; description = "Symfony environment"; };
1371                       mysql = mkMysqlOptions "Piedsjaloux" {};
1372                       secret = mkOption { type = str; description = "Symfony App secret"; };
1373                     };
1374                   };
1375                 };
1376               in
1377                 submodule {
1378                   options = {
1379                     production = pjSubmodule;
1380                     integration = pjSubmodule;
1381                   };
1382                 };
1383           };
1384           richie = mkOption {
1385             description = "Europe Richie configurations by environment";
1386             type = submodule {
1387               options = {
1388                 mysql = mkMysqlOptions "Richie" {};
1389                 smtp_mailer = mkOption {
1390                   description = "SMTP mailer configuration";
1391                   type = submodule {
1392                     options = {
1393                       user = mkOption { type = str; description = "Username"; };
1394                       password = mkOption { type = str; description = "Password"; };
1395                     };
1396                   };
1397                 };
1398               };
1399             };
1400           };
1401           caldance = mkOption {
1402             description = "Caldance configurations by environment";
1403             type = submodule {
1404               options = {
1405                 integration = mkOption {
1406                   description = "environment configuration";
1407                   type = submodule {
1408                     options = {
1409                       password = mkOption { type = str; description = "Password file content for basic auth"; };
1410                     };
1411                   };
1412                 };
1413               };
1414             };
1415           };
1416           tellesflorian = mkOption {
1417             description = "Tellesflorian configurations by environment";
1418             type =
1419               let
1420                 tfSubmodule = mkOption {
1421                   description = "environment configuration";
1422                   type = submodule {
1423                     options = {
1424                       environment = mkOption { type = str; description = "Symfony environment"; };
1425                       mysql = mkMysqlOptions "Tellesflorian" {};
1426                       secret = mkOption { type = str; description = "Symfony App secret"; };
1427                       invite_passwords = mkOption { type = str; description = "Password basic auth"; };
1428                     };
1429                   };
1430                 };
1431               in
1432                 submodule {
1433                   options = {
1434                     integration = tfSubmodule;
1435                   };
1436                 };
1437           };
1438         };
1439       };
1440     };
1441
1442     privateFiles = mkOption {
1443       type = path;
1444       description = ''
1445         Path to secret files to make available during build
1446         '';
1447     };
1448   };
1449   options.hostEnv = mkOption {
1450     readOnly = true;
1451     type = hostEnv;
1452     default = config.myEnv.servers."${name}";
1453     description = "Host environment";
1454   };
1455 }