modules/private/environment.nix

   1 { config, lib, name, ... }:
   2 with lib;
   3 with types;
   4 with lists;
   5 let
   6   ldapOptions = {
   7     base = mkOption { description = "Base of the LDAP tree"; type = str; };
   8     host = mkOption { description = "Host to access LDAP"; type = str; };
   9     root_dn = mkOption { description = "DN of the root user"; type = str; };
  10     root_pw = mkOption { description = "Hashed password of the root user"; type = str; };
  11     replication_dn = mkOption { description = "DN of the user allowed to replicate the LDAP directory"; type = str; };
  12     replication_pw = mkOption { description = "Password of the user allowed to replicate the LDAP directory"; type = str; };
  13   };
  14   mkLdapOptions = name: more: mkOption {
  15     description = "${name} LDAP configuration";
  16     type = submodule {
  17       options = ldapOptions // {
  18         dn = mkOption { description = "DN of the ${name} user"; type = str; };
  19         password = mkOption { description = "password of the ${name} user"; type = str; };
  20         filter = mkOption { description = "Filter for ${name} users"; type = str; default = ""; };
  21       } // more;
  22     };
  23   };
  24   mysqlOptions = {
  25     host = mkOption { description = "Host to access Mysql"; type = str; };
  26     remoteHost = mkOption { description = "Host to access Mysql from outside"; type = str; };
  27     port = mkOption { description = "Port to access Mysql"; type = str; };
  28     socket = mkOption { description = "Socket to access Mysql"; type = path; };
  29     systemUsers = mkOption {
  30       description = "Attrs of user-passwords allowed to access mysql";
  31       type = attrsOf str;
  32     };
  33     pam = mkOption {
  34       description = "PAM configuration for mysql";
  35       type = submodule {
  36         options = {
  37           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  38           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  39           filter = mkOption { description = "filter to match users"; type = str; };
  40         };
  41       };
  42     };
  43   };
  44   mkMysqlOptions = name: more: mkOption {
  45     description = "${name} mysql configuration";
  46     type = submodule {
  47       options = mysqlOptions // {
  48         database = mkOption { description = "${name} database"; type = str; };
  49         user = mkOption { description = "${name} user"; type = str; };
  50         password = mkOption { description = "mysql password of the ${name} user"; type = str; };
  51       } // more;
  52     };
  53   };
  54   psqlOptions = {
  55     host = mkOption { description = "Host to access Postgresql"; type = str; };
  56     port = mkOption { description = "Port to access Postgresql"; type = str; };
  57     socket = mkOption { description = "Socket to access Postgresql"; type = path; };
  58     pam = mkOption {
  59       description = "PAM configuration for psql";
  60       type = submodule {
  61         options = {
  62           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  63           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  64           filter = mkOption { description = "filter to match users"; type = str; };
  65         };
  66       };
  67     };
  68   };
  69   mkPsqlOptions = name: mkOption {
  70     description = "${name} psql configuration";
  71     type = submodule {
  72       options = psqlOptions // {
  73         database = mkOption { description = "${name} database"; type = str; };
  74         schema = mkOption { description = "${name} schema"; type = nullOr str; default = null; };
  75         user = mkOption { description = "${name} user"; type = str; };
  76         password = mkOption { description = "psql password of the ${name} user"; type = str; };
  77       };
  78     };
  79   };
  80   redisOptions = {
  81     host = mkOption { description = "Host to access Redis"; type = str; };
  82     port = mkOption { description = "Port to access Redis"; type = str; };
  83     socket = mkOption { description = "Socket to access Redis"; type = path; };
  84     dbs = mkOption {
  85       description = "Attrs of db number. Each number should be unique to avoid collision!";
  86       type = attrsOf str;
  87     };
  88     spiped_key = mkOption {
  89       type = str;
  90       description = ''
  91         Key to use with spiped to make a secure channel to replication
  92         '';
  93     };
  94     predixy = mkOption {
  95       description = "Predixy configuration. Unused yet";
  96       type = submodule {
  97         options = {
  98           read = mkOption { type = str; description = "Read password"; };
  99         };
 100       };
 101     };
 102   };
 103   mkRedisOptions = name: mkOption {
 104     description = "${name} redis configuration";
 105     type = submodule {
 106       options = redisOptions // {
 107         db = mkOption { description = "${name} database"; type = str; };
 108       };
 109     };
 110   };
 111   smtpOptions = {
 112     host = mkOption { description = "Host to access SMTP"; type = str; };
 113     port = mkOption { description = "Port to access SMTP"; type = str; };
 114   };
 115   mkSmtpOptions = name: mkOption {
 116     description = "${name} smtp configuration";
 117     type = submodule {
 118       options = smtpOptions // {
 119         email = mkOption { description = "${name} email"; type = str; };
 120         password = mkOption { description = "SMTP password of the ${name} user"; type = str; };
 121       };
 122     };
 123   };
 124   hostEnv = submodule {
 125     options = {
 126       fqdn = mkOption {
 127         description = "Host FQDN";
 128         type = str;
 129       };
 130       users = mkOption {
 131         type = unspecified;
 132         default = pkgs: [];
 133         description = ''
 134           Sublist of users from realUsers. Function that takes pkgs as
 135           argument and gives an array as a result
 136         '';
 137       };
 138       emails = mkOption {
 139         default = [];
 140         description = "List of e-mails that the server can be a sender of";
 141         type = listOf str;
 142       };
 143       ldap = mkOption {
 144         description = ''
 145           LDAP credentials for the host
 146         '';
 147         type = submodule {
 148           options = {
 149             password = mkOption { type = str; description = "Password for the LDAP connection"; };
 150             dn = mkOption { type = str; description = "DN for the LDAP connection"; };
 151           };
 152         };
 153       };
 154       mx = mkOption {
 155         description = "subdomain and priority for MX server";
 156         default = { enable = false; };
 157         type = submodule {
 158           options = {
 159             enable = mkEnableOption "Enable MX";
 160             subdomain = mkOption { type = nullOr str; description = "Subdomain name (mx-*)"; };
 161             priority = mkOption { type = nullOr str; description = "Priority"; };
 162           };
 163         };
 164       };
 165       ips = mkOption {
 166         description = ''
 167           attrs of ip4/ip6 grouped by section
 168         '';
 169         type = attrsOf (submodule {
 170           options = {
 171             ip4 = mkOption {
 172               type = str;
 173               description = ''
 174                 ip4 address of the host
 175               '';
 176             };
 177             ip6 = mkOption {
 178               type = listOf str;
 179               default = [];
 180               description = ''
 181                 ip6 addresses of the host
 182               '';
 183             };
 184           };
 185         });
 186       };
 187     };
 188   };
 189 in
 190 {
 191   options.myEnv = {
 192     servers = mkOption {
 193       description = ''
 194         Attrs of servers information in the cluster (not necessarily handled by nixops)
 195       '';
 196       default = {};
 197       type = attrsOf hostEnv;
 198     };
 199     hetznerCloud = mkOption {
 200       description = ''
 201         Hetzner Cloud credential information
 202       '';
 203       type = submodule {
 204         options = {
 205           authToken = mkOption {
 206             type = str;
 207             description = ''
 208               The API auth token.
 209             '';
 210           };
 211         };
 212       };
 213     };
 214     hetzner = mkOption {
 215       description = ''
 216         Hetzner credential information
 217       '';
 218       type = submodule {
 219         options = {
 220           user = mkOption { type = str; description = "User"; };
 221           pass = mkOption { type = str; description = "Password"; };
 222         };
 223       };
 224     };
 225     sshd = mkOption {
 226       description = ''
 227         sshd service credential information
 228       '';
 229       type = submodule {
 230         options = {
 231           ldap = mkOption {
 232             description = ''
 233               LDAP credentials for cn=ssh,ou=services,dc=immae,dc=eu dn
 234             '';
 235             type = submodule {
 236               options = {
 237                 password = mkOption { description = "Password"; type = str; };
 238               };
 239             };
 240           };
 241         };
 242       };
 243     };
 244     ports = mkOption {
 245       description = ''
 246         non-standard reserved ports. Must be unique!
 247       '';
 248       type = attrsOf port;
 249       default = {};
 250       apply = let
 251         noDupl = x: builtins.length (builtins.attrValues x) == builtins.length (unique (builtins.attrValues x));
 252       in
 253         x: if isAttrs x && noDupl x then x else throw "Non unique values for ports";
 254     };
 255     httpd = mkOption {
 256       description = ''
 257         httpd service credential information
 258       '';
 259       type = submodule {
 260         options = {
 261           ldap = mkOption {
 262             description = ''
 263               LDAP credentials for cn=httpd,ou=services,dc=immae,dc=eu dn
 264             '';
 265             type = submodule {
 266               options = {
 267                 password = mkOption { description = "Password"; type = str; };
 268               };
 269             };
 270           };
 271         };
 272       };
 273     };
 274     smtp = mkOption {
 275       type = submodule { options = smtpOptions; };
 276       description = "SMTP configuration";
 277     };
 278     ldap = mkOption {
 279       description = ''
 280         LDAP server configuration
 281         '';
 282       type = submodule {
 283         options = ldapOptions;
 284       };
 285     };
 286     databases = mkOption {
 287       description = "Databases configuration";
 288       type = submodule {
 289         options = {
 290           mysql = mkOption {
 291             type = submodule { options = mysqlOptions; };
 292             description = "Mysql configuration";
 293           };
 294           redis = mkOption {
 295             type = submodule { options = redisOptions; };
 296             description = "Redis configuration";
 297           };
 298           postgresql = mkOption {
 299             type = submodule { options = psqlOptions; };
 300             description = "Postgresql configuration";
 301           };
 302         };
 303       };
 304     };
 305     jabber = mkOption {
 306       description = "Jabber configuration";
 307       type = submodule {
 308         options = {
 309           postfix_user_filter = mkOption { type = str; description = "Postfix filter to get xmpp users"; };
 310           ldap = mkLdapOptions "Jabber" {};
 311           postgresql = mkPsqlOptions "Jabber";
 312         };
 313       };
 314     };
 315     realUsers = mkOption {
 316       description = ''
 317         Attrset of function taking pkgs as argument.
 318         Real users settings, should provide a subattr of users.users.<name>
 319         with at least: name, (hashed)Password, shell
 320       '';
 321       type = attrsOf unspecified;
 322     };
 323     users = mkOption {
 324       description = "System and regular users uid/gid";
 325       type = attrsOf (submodule {
 326         options = {
 327           uid = mkOption {
 328             description = "user uid";
 329             type = int;
 330           };
 331           gid = mkOption {
 332             description = "user gid";
 333             type = int;
 334           };
 335         };
 336       });
 337     };
 338     dns = mkOption {
 339       description = "DNS configuration";
 340       type = submodule {
 341         options = {
 342           soa = mkOption {
 343             description = "SOA information";
 344             type = submodule {
 345               options = {
 346                 serial = mkOption {
 347                   description = "Serial number. Should be incremented at each change and unique";
 348                   type = str;
 349                 };
 350                 refresh = mkOption {
 351                   description = "Refresh time";
 352                   type = str;
 353                 };
 354                 retry = mkOption {
 355                   description = "Retry time";
 356                   type = str;
 357                 };
 358                 expire = mkOption {
 359                   description = "Expire time";
 360                   type = str;
 361                 };
 362                 ttl = mkOption {
 363                   description = "Default TTL time";
 364                   type = str;
 365                 };
 366                 email = mkOption {
 367                   description = "hostmaster e-mail";
 368                   type = str;
 369                 };
 370                 primary = mkOption {
 371                   description = "Primary NS";
 372                   type = str;
 373                 };
 374               };
 375             };
 376           };
 377           ns = mkOption {
 378             description = "Attrs of NS servers group";
 379             example = {
 380               foo = {
 381                 "ns1.foo.com" = [ "198.51.100.10" "2001:db8:abcd::1" ];
 382                 "ns2.foo.com" = [ "198.51.100.15" "2001:db8:1234::1" ];
 383               };
 384             };
 385             type = attrsOf (attrsOf (listOf str));
 386           };
 387           slaveZones = mkOption {
 388             description = "List of slave zones";
 389             type = listOf (submodule {
 390               options = {
 391                 name = mkOption { type = str; description = "zone name"; };
 392                 masters = mkOption {
 393                   description = "NS master groups of this zone";
 394                   type = listOf str;
 395                 };
 396               };
 397             });
 398           };
 399           masterZones = mkOption {
 400             description = "List of master zones";
 401             type = listOf (submodule {
 402               options = {
 403                 name = mkOption { type = str; description = "zone name"; };
 404                 slaves = mkOption {
 405                   description = "NS slave groups of this zone";
 406                   type = listOf str;
 407                 };
 408                 ns = mkOption {
 409                   description = "groups names that should have their NS entries listed here";
 410                   type = listOf str;
 411                 };
 412                 extra = mkOption {
 413                   description = "Extra zone configuration for bind";
 414                   example = ''
 415                     notify yes;
 416                     '';
 417                   type = lines;
 418                 };
 419                 entries = mkOption { type = lines; description = "Regular entries of the NS zone"; };
 420                 withEmail = mkOption {
 421                   description = "List of domains that should have mail entries (MX, dkim, SPF, ...)";
 422                   default = [];
 423                   type = listOf (submodule {
 424                     options = {
 425                       domain = mkOption { type = str; description = "Which subdomain is concerned"; };
 426                       send = mkOption { type = bool; description = "Whether there can be e-mails originating from the subdomain"; };
 427                       receive = mkOption { type = bool; description = "Whether there can be e-mails arriving to the subdomain"; };
 428                     };
 429                   });
 430                 };
 431               };
 432             });
 433           };
 434         };
 435       };
 436     };
 437     backup = mkOption {
 438       description = ''
 439         Remote backup with duplicity
 440         '';
 441       type = submodule {
 442         options = {
 443           password = mkOption { type = str; description = "Password for encrypting files"; };
 444           remote = mkOption { type = str; description = "Remote url access"; };
 445           accessKeyId = mkOption { type = str; description = "Remote access-key"; };
 446           secretAccessKey = mkOption { type = str; description = "Remote access secret"; };
 447         };
 448       };
 449     };
 450     rsync_backup = mkOption {
 451       description  =''
 452         Rsync backup configuration from controlled host
 453         '';
 454       type = submodule {
 455         options = {
 456           ssh_key = mkOption {
 457             description = "SSH key information";
 458             type = submodule {
 459               options = {
 460                 public = mkOption { type = str; description = "Public part of the key"; };
 461                 private = mkOption { type = lines; description = "Private part of the key"; };
 462               };
 463             };
 464           };
 465           profiles = mkOption {
 466             description = "Attrs of profiles to backup";
 467             type = attrsOf (submodule {
 468               options = {
 469                 keep = mkOption { type = int; description = "Number of backups to keep"; };
 470                 check_command = mkOption { type = str; description = "command to check if backup needs to be done"; default = "backup"; };
 471                 login = mkOption { type = str; description = "Login to connect to host"; };
 472                 port = mkOption { type = str; default = "22"; description = "Port to connect to host"; };
 473                 host = mkOption { type = str; description = "Host to connect to"; };
 474                 host_key = mkOption { type = str; description = "Host key"; };
 475                 host_key_type = mkOption { type = str; description = "Host key type"; };
 476                 parts = mkOption {
 477                   description = "Parts to backup for this host";
 478                   type = attrsOf (submodule {
 479                     options = {
 480                       remote_folder = mkOption { type = path; description = "Remote folder to backup";};
 481                       exclude_from = mkOption {
 482                         type = listOf path;
 483                         default = [];
 484                         description = "List of folders/files to exclude from the backup";
 485                       };
 486                       files_from = mkOption {
 487                         type = listOf path;
 488                         default = [];
 489                         description = "List of folders/files to backup in the base folder";
 490                       };
 491                       args = mkOption {
 492                         type = nullOr str;
 493                         default = null;
 494                         description = "Extra arguments to pass to rsync";
 495                       };
 496                     };
 497                   });
 498                 };
 499               };
 500             });
 501           };
 502         };
 503       };
 504     };
 505     monitoring = mkOption {
 506       description = "Monitoring configuration";
 507       type = submodule {
 508         options = {
 509           status_url = mkOption { type = str; description = "URL to push status to"; };
 510           status_token = mkOption { type = str; description = "Token for the status url"; };
 511           http_user_password = mkOption { type = str; description = "HTTP credentials to check services behind wall"; };
 512           email = mkOption { type = str; description = "Admin E-mail"; };
 513           ssh_public_key = mkOption { type = str; description = "SSH public key"; };
 514           ssh_secret_key = mkOption { type = str; description = "SSH secret key"; };
 515           imap_login = mkOption { type = str; description = "IMAP login"; };
 516           imap_password = mkOption { type = str; description = "IMAP password"; };
 517           eriomem_keys = mkOption { type = listOf (listOf str); description = "Eriomem keys"; default = []; };
 518           ovh_sms = mkOption {
 519             description = "OVH credentials for sms script";
 520             type = submodule {
 521               options = {
 522                 endpoint = mkOption { type = str; default = "ovh-eu"; description = "OVH endpoint"; };
 523                 application_key = mkOption { type = str; description = "Application key"; };
 524                 application_secret = mkOption { type = str; description = "Application secret"; };
 525                 consumer_key = mkOption { type = str; description = "Consumer key"; };
 526                 account = mkOption { type = str; description = "Account"; };
 527               };
 528             };
 529           };
 530           nrdp_tokens = mkOption { type = listOf str; description = "Tokens allowed to push status update"; };
 531           slack_url = mkOption { type = str; description = "Slack webhook url to push status update"; };
 532           slack_channel = mkOption { type = str; description = "Slack channel to push status update"; };
 533           contacts = mkOption { type = attrsOf unspecified; description = "Contact dicts to fill naemon objects"; };
 534           email_check = mkOption {
 535             description = "Emails services to check";
 536             type = attrsOf (submodule {
 537               options = {
 538                 local = mkOption { type = bool; default = false; description = "Use local configuration"; };
 539                 port = mkOption { type = nullOr str; default = null; description = "Port to connect to ssh"; };
 540                 login = mkOption { type = nullOr str; default = null; description = "Login to connect to ssh"; };
 541                 targets = mkOption { type = listOf str; description = "Hosts to send E-mails to"; };
 542                 mail_address = mkOption { type = nullOr str; default = null; description = "E-mail recipient part to send e-mail to"; };
 543                 mail_domain = mkOption { type = nullOr str; default = null; description = "E-mail domain part to send e-mail to"; };
 544               };
 545             });
 546           };
 547         };
 548       };
 549     };
 550     mpd = mkOption {
 551       description = "MPD configuration";
 552       type = submodule {
 553         options = {
 554           folder = mkOption { type = str; description = "Folder to serve from the MPD instance"; };
 555           password = mkOption { type = str; description = "Password to connect to the MPD instance"; };
 556           host = mkOption { type = str; description = "Host to connect to the MPD instance"; };
 557           port = mkOption { type = str; description = "Port to connect to the MPD instance"; };
 558         };
 559       };
 560     };
 561     ftp = mkOption {
 562       description = "FTP configuration";
 563       type = submodule {
 564         options = {
 565           ldap = mkLdapOptions "FTP" {};
 566         };
 567       };
 568     };
 569     vpn = mkOption {
 570       description = "VPN configuration";
 571       type = attrsOf (submodule {
 572         options = {
 573           prefix = mkOption { type = str; description = "ipv6 prefix for the vpn subnet"; };
 574           privateKey = mkOption { type = str; description = "Private key for the host"; };
 575           publicKey = mkOption { type = str; description = "Public key for the host"; };
 576         };
 577       });
 578     };
 579     mail = mkOption {
 580       description = "Mail configuration";
 581       type = submodule {
 582         options = {
 583           dmarc = mkOption {
 584             description = "DMARC configuration";
 585             type = submodule {
 586               options = {
 587                 ignore_hosts = mkOption {
 588                   type = lines;
 589                   description = ''
 590                     Hosts to ignore when checking for dmarc
 591                     '';
 592                 };
 593               };
 594             };
 595           };
 596           dkim = mkOption {
 597             description = "DKIM configuration";
 598             type = attrsOf (submodule {
 599               options = {
 600                 public = mkOption {
 601                   type = str;
 602                   example = ''
 603                     ( "v=DKIM1; k=rsa; "
 604                               "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3w1a2aMxWw9+hdcmbqX4UevcVqr204y0K73Wdc7MPZiOOlUJQYsMNSYR1Y/SC7jmPKeitpcJCpQgn/cveJZbuikjjPLsDReHyFEYmC278ZLRTELHx6f1IXM8WE08JIRT69CfZiMi1rVcOh9qRT4F93PyjCauU8Y5hJjtg9ThsWwIDAQAB" )
 605                     '';
 606                   description = "Public entry to put in DNS TXT field";
 607                 };
 608                 private = mkOption { type = str; description = "Private key"; };
 609               };
 610             });
 611           };
 612           postfix = mkOption {
 613             description = "Postfix configuration";
 614             type = submodule {
 615               options = {
 616                 additional_mailbox_domains = mkOption {
 617                   description = ''
 618                     List of domains that are used as mailbox final destination, in addition to those defined in the DNS records
 619                   '';
 620                   type = listOf str;
 621                 };
 622                 mysql = mkMysqlOptions "Postfix" {
 623                   password_encrypt = mkOption { type = str; description = "Key to encrypt relay password in database"; };
 624                 };
 625                 backup_domains = mkOption {
 626                   description = ''
 627                     Domains that are accepted for relay as backup domain
 628                   '';
 629                   type = attrsOf (submodule {
 630                     options = {
 631                       domains = mkOption { type = listOf str; description = "Domains list"; };
 632                       relay_restrictions = mkOption {
 633                         type = lines;
 634                         description = ''
 635                           Restrictions for relaying the e-mails from the domains
 636                           '';
 637                       };
 638                       recipient_maps = mkOption {
 639                         description = ''
 640                           Recipient map to accept relay for.
 641                           Must be specified for domain, the rules apply to everyone!
 642                         '';
 643                         type = listOf (submodule {
 644                           options = {
 645                             type = mkOption {
 646                               type = enum [ "hash" ];
 647                               description = "Map type";
 648                             };
 649                             content = mkOption {
 650                               type = str;
 651                               description = "Map content";
 652                             };
 653                           };
 654                         });
 655                       };
 656                     };
 657                   });
 658                 };
 659               };
 660             };
 661           };
 662           dovecot = mkOption {
 663             description = "Dovecot configuration";
 664             type = submodule {
 665               options = {
 666                 ldap = mkLdapOptions "Dovecot" {
 667                   pass_attrs = mkOption { type = str; description = "Password attribute in LDAP"; };
 668                   user_attrs = mkOption { type = str; description = "User attribute mapping in LDAP"; };
 669                   iterate_attrs = mkOption { type = str; description = "User attribute mapping for listing in LDAP"; };
 670                   iterate_filter = mkOption { type = str; description = "User attribute filter for listing in LDAP"; };
 671                   postfix_mailbox_filter = mkOption { type = str; description = "Postfix filter to get mailboxes"; };
 672                 };
 673               };
 674             };
 675           };
 676           rspamd = mkOption {
 677             description = "rspamd configuration";
 678             type = submodule {
 679               options = {
 680                 redis = mkRedisOptions "Redis";
 681                 read_password_hashed = mkOption { type = str; description = "Hashed read password for rspamd"; };
 682                 write_password_hashed = mkOption { type = str; description = "Hashed write password for rspamd"; };
 683                 read_password = mkOption {
 684                   type = str;
 685                   description = "Read password for rspamd. Unused";
 686                   apply = x: "";
 687                 };
 688                 write_password = mkOption {
 689                   type = str;
 690                   description = "Write password for rspamd. Unused";
 691                   apply = x: "";
 692                 };
 693               };
 694             };
 695           };
 696           scripts = mkOption {
 697             description = "Mail script recipients";
 698             type = attrsOf (submodule {
 699               options = {
 700                 external = mkEnableOption "Create a script_<name>@mail.immae.eu external address";
 701                 src = mkOption {
 702                   description = ''
 703                     git source to fetch the script from.
 704                     It must have a default.nix file as its root accepting a scriptEnv parameter
 705                   '';
 706                   type = submodule {
 707                     options = {
 708                       url = mkOption { type = str; description = "git url to fetch"; };
 709                       rev = mkOption { type = str; description = "git reference to fetch"; };
 710                     };
 711                   };
 712                 };
 713                 env = mkOption {
 714                   description = "Variables to pass to the script";
 715                   type = unspecified;
 716                 };
 717               };
 718             });
 719           };
 720           sympa = mkOption {
 721             description = "Sympa configuration";
 722             type = submodule {
 723               options = {
 724                 listmasters = mkOption {
 725                   type = listOf str;
 726                   description = "Listmasters";
 727                 };
 728                 postgresql = mkPsqlOptions "Sympa";
 729                 data_sources = mkOption {
 730                   type = attrsOf str;
 731                   default = {};
 732                   description = "Data sources to make available to sympa";
 733                 };
 734                 scenari = mkOption {
 735                   type = attrsOf str;
 736                   default = {};
 737                   description = "Scenari to make available to sympa";
 738                 };
 739               };
 740             };
 741           };
 742         };
 743       };
 744     };
 745     buildbot = mkOption {
 746       description = "Buildbot configuration";
 747       type = submodule {
 748         options = {
 749           user = mkOption {
 750             description = "Buildbot user";
 751             type = submodule {
 752               options = {
 753                 uid = mkOption {
 754                   description = "user uid";
 755                   type = int;
 756                 };
 757                 gid = mkOption {
 758                   description = "user gid";
 759                   type = int;
 760                 };
 761               };
 762             };
 763           };
 764           ldap = mkOption {
 765             description = "Ldap configuration for buildbot";
 766             type = submodule {
 767               options = {
 768                 password = mkOption { type = str; description = "Buildbot password"; };
 769               };
 770             };
 771           };
 772           projects = mkOption {
 773             description = "Projects to make a buildbot for";
 774             type = attrsOf (submodule {
 775               options = {
 776                 name = mkOption { type = str; description = "Project name"; };
 777                 packages = mkOption {
 778                   type = unspecified;
 779                   example = literalExample ''
 780                     pkgs: [ pkgs.bash pkgs.git pkgs.gzip pkgs.openssh ];
 781                     '';
 782                   description = ''
 783                     Function.
 784                     Builds packages list to make available to buildbot project.
 785                     Takes pkgs as argument.
 786                   '';
 787                 };
 788                 pythonPackages = mkOption {
 789                   type = unspecified;
 790                   example = literalExample ''
 791                     p: pkgs: [ pkgs.python3Packages.pip ];
 792                     '';
 793                   description = ''
 794                     Function.
 795                     Builds python packages list to make available to buildbot project.
 796                     Takes buildbot python module as first argument and pkgs as second argument in order to augment the python modules list.
 797                     '';
 798                 };
 799                 pythonPathHome = mkOption { type = bool; description = "Whether to add project’s python home to python path"; };
 800                 secrets = mkOption {
 801                   type = attrsOf str;
 802                   description = "Secrets for the project to dump as files";
 803                 };
 804                 environment = mkOption {
 805                   type = attrsOf str;
 806                   description = ''
 807                     Environment variables for the project.
 808                     BUILDBOT_ is prefixed to the variable names
 809                   '';
 810                 };
 811                 activationScript = mkOption {
 812                   type = lines;
 813                   description = ''
 814                     Activation script to run during deployment
 815                   '';
 816                 };
 817                 builderPaths = mkOption {
 818                   type = attrsOf unspecified;
 819                   default = {};
 820                   description = ''
 821                     Attrs of functions to make accessible specifically per builder.
 822                     Takes pkgs as argument and should return a single path containing binaries.
 823                     This path will be accessible as BUILDBOT_PATH_<attrskey>
 824                     '';
 825                 };
 826                 webhookTokens = mkOption {
 827                   type = nullOr (listOf str);
 828                   default = null;
 829                   description = ''
 830                     List of tokens allowed to push to project’s change_hook/base endpoint
 831                   '';
 832                 };
 833               };
 834             });
 835           };
 836         };
 837       };
 838     };
 839     tools = mkOption {
 840       description = "Tools configurations";
 841       type = submodule {
 842         options = {
 843           contact = mkOption { type = str; description = "Contact e-mail address"; };
 844           davical = mkOption {
 845             description = "Davical configuration";
 846             type = submodule {
 847               options = {
 848                 postgresql = mkPsqlOptions "Davical";
 849                 ldap = mkLdapOptions "Davical" {};
 850               };
 851             };
 852           };
 853           diaspora = mkOption {
 854             description = "Diaspora configuration";
 855             type = submodule {
 856               options = {
 857                 postgresql = mkPsqlOptions "Diaspora";
 858                 redis = mkRedisOptions "Diaspora";
 859                 ldap = mkLdapOptions "Diaspora" {};
 860                 secret_token = mkOption { type = str; description = "Secret token"; };
 861               };
 862             };
 863           };
 864           dmarc_reports = mkOption {
 865             description = "DMARC reports configuration";
 866             type = submodule {
 867               options = {
 868                 mysql = mkMysqlOptions "DMARC" {};
 869                 anonymous_key = mkOption { type = str; description = "Anonymous hashing key"; };
 870               };
 871             };
 872           };
 873           etherpad-lite = mkOption {
 874             description = "Etherpad configuration";
 875             type = submodule {
 876               options = {
 877                 postgresql = mkPsqlOptions "Etherpad";
 878                 ldap = mkLdapOptions "Etherpad" {
 879                   group_filter = mkOption { type = str; description = "Filter for groups"; };
 880                 };
 881                 adminPassword = mkOption { type = str; description = "Admin password for mypads / admin"; };
 882                 session_key = mkOption { type = str; description = "Session key"; };
 883                 api_key = mkOption { type = str; description = "API key"; };
 884                 redirects = mkOption { type = str; description = "Redirects for apache"; };
 885               };
 886             };
 887           };
 888           gitolite = mkOption {
 889             description = "Gitolite configuration";
 890             type = submodule {
 891               options = {
 892                 ldap = mkLdapOptions "Gitolite" {};
 893               };
 894             };
 895           };
 896           kanboard = mkOption {
 897             description = "Kanboard configuration";
 898             type = submodule {
 899               options = {
 900                 postgresql = mkPsqlOptions "Kanboard";
 901                 ldap = mkLdapOptions "Kanboard" {
 902                   admin_dn = mkOption { type = str; description = "Admin DN"; };
 903                 };
 904               };
 905             };
 906           };
 907           mantisbt = mkOption {
 908             description = "Mantisbt configuration";
 909             type = submodule {
 910               options = {
 911                 postgresql = mkPsqlOptions "Mantisbt";
 912                 ldap = mkLdapOptions "Mantisbt" {};
 913                 master_salt = mkOption { type = str; description = "Master salt for password hash"; };
 914               };
 915             };
 916           };
 917           mastodon = mkOption {
 918             description = "Mastodon configuration";
 919             type = submodule {
 920               options = {
 921                 postgresql = mkPsqlOptions "Mastodon";
 922                 redis = mkRedisOptions "Mastodon";
 923                 ldap = mkLdapOptions "Mastodon" {};
 924                 paperclip_secret = mkOption { type = str; description = "Paperclip secret"; };
 925                 otp_secret = mkOption { type = str; description = "OTP secret"; };
 926                 secret_key_base = mkOption { type = str; description = "Secret key base"; };
 927                 vapid = mkOption {
 928                   description = "vapid key";
 929                   type = submodule {
 930                     options = {
 931                       private = mkOption { type = str; description = "Private key"; };
 932                       public = mkOption { type = str; description = "Public key"; };
 933                     };
 934                   };
 935                 };
 936               };
 937             };
 938           };
 939           mediagoblin = mkOption {
 940             description = "Mediagoblin configuration";
 941             type = submodule {
 942               options = {
 943                 postgresql = mkPsqlOptions "Mediagoblin";
 944                 redis = mkRedisOptions "Mediagoblin";
 945                 ldap = mkLdapOptions "Mediagoblin" {};
 946               };
 947             };
 948           };
 949           nextcloud = mkOption {
 950             description = "Nextcloud configuration";
 951             type = submodule {
 952               options = {
 953                 postgresql = mkPsqlOptions "Peertube";
 954                 redis = mkRedisOptions "Peertube";
 955                 password_salt = mkOption { type = str; description = "Password salt"; };
 956                 instance_id = mkOption { type = str; description = "Instance ID"; };
 957                 secret = mkOption { type = str; description = "App secret"; };
 958               };
 959             };
 960           };
 961           peertube = mkOption {
 962             description = "Peertube configuration";
 963             type = submodule {
 964               options = {
 965                 listenPort = mkOption { type = port; description = "Port to listen to"; };
 966                 postgresql = mkPsqlOptions "Peertube";
 967                 redis = mkRedisOptions "Peertube";
 968                 ldap = mkLdapOptions "Peertube" {};
 969               };
 970             };
 971           };
 972           syden_peertube = mkOption {
 973             description = "Peertube Syden configuration";
 974             type = submodule {
 975               options = {
 976                 listenPort = mkOption { type = port; description = "Port to listen to"; };
 977                 postgresql = mkPsqlOptions "Peertube";
 978                 redis = mkRedisOptions "Peertube";
 979               };
 980             };
 981           };
 982           phpldapadmin = mkOption {
 983             description = "phpLdapAdmin configuration";
 984             type = submodule {
 985               options = {
 986                 ldap = mkLdapOptions "phpldapadmin" {};
 987               };
 988             };
 989           };
 990           rompr = mkOption {
 991             description = "Rompr configuration";
 992             type = submodule {
 993               options = {
 994                 mpd = mkOption {
 995                   description = "MPD configuration";
 996                   type = submodule {
 997                     options = {
 998                       host = mkOption { type = str; description = "Host for MPD"; };
 999                       port = mkOption { type = port; description = "Port to access MPD host"; };
1000                     };
1001                   };
1002                 };
1003               };
1004             };
1005           };
1006           roundcubemail = mkOption {
1007             description = "Roundcubemail configuration";
1008             type = submodule {
1009               options = {
1010                 postgresql = mkPsqlOptions "TT-RSS";
1011                 secret = mkOption { type = str; description = "Secret"; };
1012               };
1013             };
1014           };
1015           shaarli = mkOption {
1016             description = "Shaarli configuration";
1017             type = submodule {
1018               options = {
1019                 ldap = mkLdapOptions "Shaarli" {};
1020               };
1021             };
1022           };
1023           status_engine = mkOption {
1024             description = "Status Engine configuration";
1025             type = submodule {
1026               options = {
1027                 mysql = mkMysqlOptions "StatusEngine" {};
1028                 ldap = mkLdapOptions "StatusEngine" {};
1029               };
1030             };
1031           };
1032           task = mkOption {
1033             description = "Taskwarrior configuration";
1034             type = submodule {
1035               options = {
1036                 ldap = mkLdapOptions "Taskwarrior" {};
1037                 taskwarrior-web = mkOption {
1038                   description = "taskwarrior-web profiles";
1039                   type = attrsOf (submodule {
1040                     options = {
1041                       uid = mkOption {
1042                         type = listOf str;
1043                         description = "List of ldap uids having access to this profile";
1044                       };
1045                       org = mkOption { type = str; description = "Taskd organisation"; };
1046                       key = mkOption { type = str; description = "Taskd key"; };
1047                       date = mkOption { type = str; description = "Preferred date format"; };
1048                     };
1049                   });
1050                 };
1051               };
1052             };
1053           };
1054           ttrss = mkOption {
1055             description = "TT-RSS configuration";
1056             type = submodule {
1057               options = {
1058                 postgresql = mkPsqlOptions "TT-RSS";
1059                 ldap = mkLdapOptions "TT-RSS" {};
1060               };
1061             };
1062           };
1063           wallabag = mkOption {
1064             description = "Wallabag configuration";
1065             type = submodule {
1066               options = {
1067                 postgresql = mkPsqlOptions "Wallabag";
1068                 ldap = mkLdapOptions "Wallabag" {
1069                   admin_filter = mkOption { type = str; description = "Admin users filter"; };
1070                 };
1071                 redis = mkRedisOptions "Wallabag";
1072                 secret = mkOption { type = str; description = "App secret"; };
1073               };
1074             };
1075           };
1076           webhooks = mkOption {
1077             type = attrsOf str;
1078             description = "Mapping 'name'.php => script for webhooks";
1079           };
1080           commento = mkOption {
1081             description = "Commento configuration";
1082             type = submodule {
1083               options = {
1084                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1085                 postgresql = mkPsqlOptions "Commento";
1086                 smtp = mkSmtpOptions "Commento";
1087               };
1088             };
1089           };
1090           ympd = mkOption {
1091             description = "Ympd configuration";
1092             type = submodule {
1093               options = {
1094                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1095                 mpd = mkOption {
1096                   description = "MPD configuration";
1097                   type = submodule {
1098                     options = {
1099                       password = mkOption { type = str; description = "Password to access MPD host"; };
1100                       host = mkOption { type = str; description = "Host for MPD"; };
1101                       port = mkOption { type = port; description = "Port to access MPD host"; };
1102                     };
1103                   };
1104                 };
1105               };
1106             };
1107           };
1108           yourls = mkOption {
1109             description = "Yourls configuration";
1110             type = submodule {
1111               options = {
1112                 mysql = mkMysqlOptions "Yourls" {};
1113                 ldap = mkLdapOptions "Yourls" {};
1114                 cookieKey = mkOption { type = str; description = "Cookie key"; };
1115               };
1116             };
1117           };
1118         };
1119       };
1120     };
1121     websites = mkOption {
1122       description = "Websites configurations";
1123       type = submodule {
1124         options = {
1125           immae = mkOption {
1126             description = "Immae configuration by environment";
1127             type = submodule {
1128               options = {
1129                 temp = mkOption {
1130                   description = "Temp configuration";
1131                   type = submodule {
1132                     options = {
1133                       ldap = mkLdapOptions "Immae temp" {
1134                         filter = mkOption { type = str; description = "Filter for user access"; };
1135                       };
1136                     };
1137                   };
1138                 };
1139               };
1140             };
1141           };
1142           isabelle = mkOption {
1143             description = "Isabelle configurations by environment";
1144             type =
1145               let
1146                 atenSubmodule = mkOption {
1147                   description = "environment configuration";
1148                   type = submodule {
1149                     options = {
1150                       environment = mkOption { type = str; description = "Symfony environment"; };
1151                       secret = mkOption { type = str; description = "Symfony App secret"; };
1152                       postgresql = mkPsqlOptions "Aten";
1153                     };
1154                   };
1155                 };
1156               in
1157                 submodule {
1158                   options = {
1159                     aten_production = atenSubmodule;
1160                     aten_integration = atenSubmodule;
1161                     iridologie = mkOption {
1162                       description = "environment configuration";
1163                       type = submodule {
1164                         options = {
1165                           environment = mkOption { type = str; description = "SPIP environment"; };
1166                           mysql = mkMysqlOptions "Iridologie" {};
1167                           ldap = mkLdapOptions "Iridologie" {};
1168                         };
1169                       };
1170                     };
1171                   };
1172                 };
1173           };
1174           chloe = mkOption {
1175             description = "Chloe configurations by environment";
1176             type =
1177               let
1178                 chloeSubmodule = mkOption {
1179                   description = "environment configuration";
1180                   type = submodule {
1181                     options = {
1182                       environment = mkOption { type = str; description = "SPIP environment"; };
1183                       mysql = mkMysqlOptions "Chloe" {};
1184                       ldap = mkLdapOptions "Chloe" {};
1185                     };
1186                   };
1187                 };
1188               in
1189                 submodule {
1190                   options = {
1191                     production = chloeSubmodule;
1192                     integration = chloeSubmodule;
1193                   };
1194                 };
1195           };
1196           connexionswing = mkOption {
1197             description = "Connexionswing configurations by environment";
1198             type =
1199               let
1200                 csSubmodule = mkOption {
1201                   description = "environment configuration";
1202                   type = submodule {
1203                     options = {
1204                       environment = mkOption { type = str; description = "Symfony environment"; };
1205                       mysql = mkMysqlOptions "Connexionswing" {};
1206                       secret = mkOption { type = str; description = "Symfony App secret"; };
1207                       email = mkOption { type = str; description = "Symfony email notification"; };
1208                     };
1209                   };
1210                 };
1211               in
1212                 submodule {
1213                   options = {
1214                     production = csSubmodule;
1215                     integration = csSubmodule;
1216                   };
1217                 };
1218           };
1219           jerome = mkOption {
1220             description = "Naturaloutil configuration";
1221             type = submodule {
1222               options = {
1223                 mysql = mkMysqlOptions "Naturaloutil" {};
1224                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1225               };
1226             };
1227           };
1228           telio_tortay = mkOption {
1229             description = "Telio Tortay configuration";
1230             type = submodule {
1231               options = {
1232                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1233               };
1234             };
1235           };
1236           ludivine = mkOption {
1237             description = "Ludivinecassal configurations by environment";
1238             type =
1239               let
1240                 lcSubmodule = mkOption {
1241                   description = "environment configuration";
1242                   type = submodule {
1243                     options = {
1244                       environment = mkOption { type = str; description = "Symfony environment"; };
1245                       mysql = mkMysqlOptions "LudivineCassal" {};
1246                       ldap = mkLdapOptions "LudivineCassal" {};
1247                       secret = mkOption { type = str; description = "Symfony App secret"; };
1248                     };
1249                   };
1250                 };
1251               in
1252                 submodule {
1253                   options = {
1254                     production = lcSubmodule;
1255                     integration = lcSubmodule;
1256                   };
1257                 };
1258           };
1259           emilia = mkOption {
1260             description = "Emilia configuration";
1261             type = submodule {
1262               options = {
1263                 postgresql = mkPsqlOptions "Emilia";
1264               };
1265             };
1266           };
1267           florian = mkOption {
1268             description = "Florian configuration";
1269             type = submodule {
1270               options = {
1271                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1272               };
1273             };
1274           };
1275           nassime = mkOption {
1276             description = "Nassime configuration";
1277             type = submodule {
1278               options = {
1279                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1280               };
1281             };
1282           };
1283           piedsjaloux = mkOption {
1284             description = "Piedsjaloux configurations by environment";
1285             type =
1286               let
1287                 pjSubmodule = mkOption {
1288                   description = "environment configuration";
1289                   type = submodule {
1290                     options = {
1291                       environment = mkOption { type = str; description = "Symfony environment"; };
1292                       mysql = mkMysqlOptions "Piedsjaloux" {};
1293                       secret = mkOption { type = str; description = "Symfony App secret"; };
1294                     };
1295                   };
1296                 };
1297               in
1298                 submodule {
1299                   options = {
1300                     production = pjSubmodule;
1301                     integration = pjSubmodule;
1302                   };
1303                 };
1304           };
1305           richie = mkOption {
1306             description = "Europe Richie configurations by environment";
1307             type = submodule {
1308               options = {
1309                 mysql = mkMysqlOptions "Richie" {};
1310                 smtp_mailer = mkOption {
1311                   description = "SMTP mailer configuration";
1312                   type = submodule {
1313                     options = {
1314                       user = mkOption { type = str; description = "Username"; };
1315                       password = mkOption { type = str; description = "Password"; };
1316                     };
1317                   };
1318                 };
1319               };
1320             };
1321           };
1322           tellesflorian = mkOption {
1323             description = "Tellesflorian configurations by environment";
1324             type =
1325               let
1326                 tfSubmodule = mkOption {
1327                   description = "environment configuration";
1328                   type = submodule {
1329                     options = {
1330                       environment = mkOption { type = str; description = "Symfony environment"; };
1331                       mysql = mkMysqlOptions "Tellesflorian" {};
1332                       secret = mkOption { type = str; description = "Symfony App secret"; };
1333                       invite_passwords = mkOption { type = str; description = "Password basic auth"; };
1334                     };
1335                   };
1336                 };
1337               in
1338                 submodule {
1339                   options = {
1340                     integration = tfSubmodule;
1341                   };
1342                 };
1343           };
1344         };
1345       };
1346     };
1347
1348     privateFiles = mkOption {
1349       type = path;
1350       description = ''
1351         Path to secret files to make available during build
1352         '';
1353     };
1354   };
1355   options.hostEnv = mkOption {
1356     readOnly = true;
1357     type = hostEnv;
1358     default = config.myEnv.servers."${name}";
1359     description = "Host environment";
1360   };
1361 }