modules/private/environment.nix

   1 { config, lib, name, ... }:
   2 with lib;
   3 with types;
   4 with lists;
   5 let
   6   ldapOptions = {
   7     base = mkOption { description = "Base of the LDAP tree"; type = str; };
   8     host = mkOption { description = "Host to access LDAP"; type = str; };
   9     root_dn = mkOption { description = "DN of the root user"; type = str; };
  10     root_pw = mkOption { description = "Hashed password of the root user"; type = str; };
  11     replication_dn = mkOption { description = "DN of the user allowed to replicate the LDAP directory"; type = str; };
  12     replication_pw = mkOption { description = "Password of the user allowed to replicate the LDAP directory"; type = str; };
  13   };
  14   mkLdapOptions = name: more: mkOption {
  15     description = "${name} LDAP configuration";
  16     type = submodule {
  17       options = ldapOptions // {
  18         dn = mkOption { description = "DN of the ${name} user"; type = str; };
  19         password = mkOption { description = "password of the ${name} user"; type = str; };
  20         filter = mkOption { description = "Filter for ${name} users"; type = str; default = ""; };
  21       } // more;
  22     };
  23   };
  24   mysqlOptions = {
  25     host = mkOption { description = "Host to access Mysql"; type = str; };
  26     remoteHost = mkOption { description = "Host to access Mysql from outside"; type = str; };
  27     port = mkOption { description = "Port to access Mysql"; type = str; };
  28     socket = mkOption { description = "Socket to access Mysql"; type = path; };
  29     systemUsers = mkOption {
  30       description = "Attrs of user-passwords allowed to access mysql";
  31       type = attrsOf str;
  32     };
  33     pam = mkOption {
  34       description = "PAM configuration for mysql";
  35       type = submodule {
  36         options = {
  37           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  38           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  39           filter = mkOption { description = "filter to match users"; type = str; };
  40         };
  41       };
  42     };
  43   };
  44   mkMysqlOptions = name: more: mkOption {
  45     description = "${name} mysql configuration";
  46     type = submodule {
  47       options = mysqlOptions // {
  48         database = mkOption { description = "${name} database"; type = str; };
  49         user = mkOption { description = "${name} user"; type = str; };
  50         password = mkOption { description = "mysql password of the ${name} user"; type = str; };
  51       } // more;
  52     };
  53   };
  54   psqlOptions = {
  55     host = mkOption { description = "Host to access Postgresql"; type = str; };
  56     port = mkOption { description = "Port to access Postgresql"; type = str; };
  57     socket = mkOption { description = "Socket to access Postgresql"; type = path; };
  58     pam = mkOption {
  59       description = "PAM configuration for psql";
  60       type = submodule {
  61         options = {
  62           dn = mkOption { description = "DN to connect as to check users"; type = str; };
  63           password = mkOption { description = "DN password to connect as to check users"; type = str; };
  64           filter = mkOption { description = "filter to match users"; type = str; };
  65         };
  66       };
  67     };
  68   };
  69   mkPsqlOptions = name: mkOption {
  70     description = "${name} psql configuration";
  71     type = submodule {
  72       options = psqlOptions // {
  73         database = mkOption { description = "${name} database"; type = str; };
  74         schema = mkOption { description = "${name} schema"; type = nullOr str; default = null; };
  75         user = mkOption { description = "${name} user"; type = str; };
  76         password = mkOption { description = "psql password of the ${name} user"; type = str; };
  77       };
  78     };
  79   };
  80   redisOptions = {
  81     host = mkOption { description = "Host to access Redis"; type = str; };
  82     port = mkOption { description = "Port to access Redis"; type = str; };
  83     socket = mkOption { description = "Socket to access Redis"; type = path; };
  84     dbs = mkOption {
  85       description = "Attrs of db number. Each number should be unique to avoid collision!";
  86       type = attrsOf str;
  87     };
  88     spiped_key = mkOption {
  89       type = str;
  90       description = ''
  91         Key to use with spiped to make a secure channel to replication
  92         '';
  93     };
  94     predixy = mkOption {
  95       description = "Predixy configuration. Unused yet";
  96       type = submodule {
  97         options = {
  98           read = mkOption { type = str; description = "Read password"; };
  99         };
 100       };
 101     };
 102   };
 103   mkRedisOptions = name: mkOption {
 104     description = "${name} redis configuration";
 105     type = submodule {
 106       options = redisOptions // {
 107         db = mkOption { description = "${name} database"; type = str; };
 108       };
 109     };
 110   };
 111   smtpOptions = {
 112     host = mkOption { description = "Host to access SMTP"; type = str; };
 113     port = mkOption { description = "Port to access SMTP"; type = str; };
 114   };
 115   mkSmtpOptions = name: mkOption {
 116     description = "${name} smtp configuration";
 117     type = submodule {
 118       options = smtpOptions // {
 119         email = mkOption { description = "${name} email"; type = str; };
 120         password = mkOption { description = "SMTP password of the ${name} user"; type = str; };
 121       };
 122     };
 123   };
 124   hostEnv = submodule {
 125     options = {
 126       fqdn = mkOption {
 127         description = "Host FQDN";
 128         type = str;
 129       };
 130       users = mkOption {
 131         type = unspecified;
 132         default = pkgs: [];
 133         description = ''
 134           Sublist of users from realUsers. Function that takes pkgs as
 135           argument and gives an array as a result
 136         '';
 137       };
 138       emails = mkOption {
 139         default = [];
 140         description = "List of e-mails that the server can be a sender of";
 141         type = listOf str;
 142       };
 143       ldap = mkOption {
 144         description = ''
 145           LDAP credentials for the host
 146         '';
 147         type = submodule {
 148           options = {
 149             password = mkOption { type = str; description = "Password for the LDAP connection"; };
 150             dn = mkOption { type = str; description = "DN for the LDAP connection"; };
 151           };
 152         };
 153       };
 154       mx = mkOption {
 155         description = "subdomain and priority for MX server";
 156         default = { enable = false; };
 157         type = submodule {
 158           options = {
 159             enable = mkEnableOption "Enable MX";
 160             subdomain = mkOption { type = nullOr str; description = "Subdomain name (mx-*)"; };
 161             priority = mkOption { type = nullOr str; description = "Priority"; };
 162           };
 163         };
 164       };
 165       ips = mkOption {
 166         description = ''
 167           attrs of ip4/ip6 grouped by section
 168         '';
 169         type = attrsOf (submodule {
 170           options = {
 171             ip4 = mkOption {
 172               type = str;
 173               description = ''
 174                 ip4 address of the host
 175               '';
 176             };
 177             ip6 = mkOption {
 178               type = listOf str;
 179               default = [];
 180               description = ''
 181                 ip6 addresses of the host
 182               '';
 183             };
 184           };
 185         });
 186       };
 187     };
 188   };
 189 in
 190 {
 191   options.myEnv = {
 192     servers = mkOption {
 193       description = ''
 194         Attrs of servers information in the cluster (not necessarily handled by nixops)
 195       '';
 196       default = {};
 197       type = attrsOf hostEnv;
 198     };
 199     hetznerCloud = mkOption {
 200       description = ''
 201         Hetzner Cloud credential information
 202       '';
 203       type = submodule {
 204         options = {
 205           authToken = mkOption {
 206             type = str;
 207             description = ''
 208               The API auth token.
 209             '';
 210           };
 211         };
 212       };
 213     };
 214     hetzner = mkOption {
 215       description = ''
 216         Hetzner credential information
 217       '';
 218       type = submodule {
 219         options = {
 220           user = mkOption { type = str; description = "User"; };
 221           pass = mkOption { type = str; description = "Password"; };
 222         };
 223       };
 224     };
 225     sshd = mkOption {
 226       description = ''
 227         sshd service credential information
 228       '';
 229       type = submodule {
 230         options = {
 231           rootKeys = mkOption { type = attrsOf str; description = "Keys of root users"; };
 232           ldap = mkOption {
 233             description = ''
 234               LDAP credentials for cn=ssh,ou=services,dc=immae,dc=eu dn
 235             '';
 236             type = submodule {
 237               options = {
 238                 password = mkOption { description = "Password"; type = str; };
 239               };
 240             };
 241           };
 242         };
 243       };
 244     };
 245     ports = mkOption {
 246       description = ''
 247         non-standard reserved ports. Must be unique!
 248       '';
 249       type = attrsOf port;
 250       default = {};
 251       apply = let
 252         noDupl = x: builtins.length (builtins.attrValues x) == builtins.length (unique (builtins.attrValues x));
 253       in
 254         x: if isAttrs x && noDupl x then x else throw "Non unique values for ports";
 255     };
 256     httpd = mkOption {
 257       description = ''
 258         httpd service credential information
 259       '';
 260       type = submodule {
 261         options = {
 262           ldap = mkOption {
 263             description = ''
 264               LDAP credentials for cn=httpd,ou=services,dc=immae,dc=eu dn
 265             '';
 266             type = submodule {
 267               options = {
 268                 password = mkOption { description = "Password"; type = str; };
 269               };
 270             };
 271           };
 272         };
 273       };
 274     };
 275     smtp = mkOption {
 276       type = submodule { options = smtpOptions; };
 277       description = "SMTP configuration";
 278     };
 279     ldap = mkOption {
 280       description = ''
 281         LDAP server configuration
 282         '';
 283       type = submodule {
 284         options = ldapOptions;
 285       };
 286     };
 287     databases = mkOption {
 288       description = "Databases configuration";
 289       type = submodule {
 290         options = {
 291           mysql = mkOption {
 292             type = submodule { options = mysqlOptions; };
 293             description = "Mysql configuration";
 294           };
 295           redis = mkOption {
 296             type = submodule { options = redisOptions; };
 297             description = "Redis configuration";
 298           };
 299           postgresql = mkOption {
 300             type = submodule { options = psqlOptions; };
 301             description = "Postgresql configuration";
 302           };
 303         };
 304       };
 305     };
 306     jabber = mkOption {
 307       description = "Jabber configuration";
 308       type = submodule {
 309         options = {
 310           postfix_user_filter = mkOption { type = str; description = "Postfix filter to get xmpp users"; };
 311           ldap = mkLdapOptions "Jabber" {};
 312           postgresql = mkPsqlOptions "Jabber";
 313         };
 314       };
 315     };
 316     realUsers = mkOption {
 317       description = ''
 318         Attrset of function taking pkgs as argument.
 319         Real users settings, should provide a subattr of users.users.<name>
 320         with at least: name, (hashed)Password, shell
 321       '';
 322       type = attrsOf unspecified;
 323     };
 324     users = mkOption {
 325       description = "System and regular users uid/gid";
 326       type = attrsOf (submodule {
 327         options = {
 328           uid = mkOption {
 329             description = "user uid";
 330             type = int;
 331           };
 332           gid = mkOption {
 333             description = "user gid";
 334             type = int;
 335           };
 336         };
 337       });
 338     };
 339     dns = mkOption {
 340       description = "DNS configuration";
 341       type = submodule {
 342         options = {
 343           soa = mkOption {
 344             description = "SOA information";
 345             type = submodule {
 346               options = {
 347                 serial = mkOption {
 348                   description = "Serial number. Should be incremented at each change and unique";
 349                   type = str;
 350                 };
 351                 refresh = mkOption {
 352                   description = "Refresh time";
 353                   type = str;
 354                 };
 355                 retry = mkOption {
 356                   description = "Retry time";
 357                   type = str;
 358                 };
 359                 expire = mkOption {
 360                   description = "Expire time";
 361                   type = str;
 362                 };
 363                 ttl = mkOption {
 364                   description = "Default TTL time";
 365                   type = str;
 366                 };
 367                 email = mkOption {
 368                   description = "hostmaster e-mail";
 369                   type = str;
 370                 };
 371                 primary = mkOption {
 372                   description = "Primary NS";
 373                   type = str;
 374                 };
 375               };
 376             };
 377           };
 378           ns = mkOption {
 379             description = "Attrs of NS servers group";
 380             example = {
 381               foo = {
 382                 "ns1.foo.com" = [ "198.51.100.10" "2001:db8:abcd::1" ];
 383                 "ns2.foo.com" = [ "198.51.100.15" "2001:db8:1234::1" ];
 384               };
 385             };
 386             type = attrsOf (attrsOf (listOf str));
 387           };
 388           keys = mkOption {
 389             default = {};
 390             description = "DNS keys";
 391             type = attrsOf (submodule {
 392               options = {
 393                 algorithm = mkOption { type = str; description = "Algorithm"; };
 394                 secret    = mkOption { type = str; description = "Secret"; };
 395               };
 396             });
 397           };
 398           slaveZones = mkOption {
 399             description = "List of slave zones";
 400             type = listOf (submodule {
 401               options = {
 402                 name = mkOption { type = str; description = "zone name"; };
 403                 masters = mkOption {
 404                   description = "NS master groups of this zone";
 405                   type = listOf str;
 406                 };
 407                 keys = mkOption {
 408                   default = [];
 409                   description = "Keys associated to the server";
 410                   type = listOf str;
 411                 };
 412               };
 413             });
 414           };
 415           masterZones = mkOption {
 416             description = "List of master zones";
 417             type = listOf (submodule {
 418               options = {
 419                 name = mkOption { type = str; description = "zone name"; };
 420                 withCAA = mkOption { type = nullOr str; description = "CAA entry"; default = null; };
 421                 slaves = mkOption {
 422                   description = "NS slave groups of this zone";
 423                   type = listOf str;
 424                 };
 425                 ns = mkOption {
 426                   description = "groups names that should have their NS entries listed here";
 427                   type = listOf str;
 428                 };
 429                 extra = mkOption {
 430                   description = "Extra zone configuration for bind";
 431                   example = ''
 432                     notify yes;
 433                     '';
 434                   type = lines;
 435                 };
 436                 entries = mkOption { type = lines; description = "Regular entries of the NS zone"; };
 437                 withEmail = mkOption {
 438                   description = "List of domains that should have mail entries (MX, dkim, SPF, ...)";
 439                   default = [];
 440                   type = listOf (submodule {
 441                     options = {
 442                       domain = mkOption { type = str; description = "Which subdomain is concerned"; };
 443                       send = mkOption { type = bool; description = "Whether there can be e-mails originating from the subdomain"; };
 444                       receive = mkOption { type = bool; description = "Whether there can be e-mails arriving to the subdomain"; };
 445                     };
 446                   });
 447                 };
 448               };
 449             });
 450           };
 451         };
 452       };
 453     };
 454     backup = mkOption {
 455       description = ''
 456         Remote backup with duplicity
 457         '';
 458       type = submodule {
 459         options = {
 460           password = mkOption { type = str; description = "Password for encrypting files"; };
 461           remotes = mkOption {
 462             type = attrsOf (submodule {
 463               options = {
 464                 remote = mkOption {
 465                   type = unspecified;
 466                   example = literalExample ''
 467                     bucket: "s3://some_host/${bucket}";
 468                     '';
 469                   description = ''
 470                     Function.
 471                     Takes a bucket name as argument and returns a url
 472                     '';
 473                 };
 474                 accessKeyId = mkOption { type = str; description = "Remote access-key"; };
 475                 secretAccessKey = mkOption { type = str; description = "Remote access secret"; };
 476               };
 477             });
 478           };
 479         };
 480       };
 481     };
 482     zrepl_backup = mkOption {
 483       type = submodule {
 484         options = {
 485           ssh_key = mkOption {
 486             description = "SSH key information";
 487             type = submodule {
 488               options = {
 489                 public = mkOption { type = str; description = "Public part of the key"; };
 490                 private = mkOption { type = lines; description = "Private part of the key"; };
 491               };
 492             };
 493           };
 494           mysql = mkMysqlOptions "Zrepl" {};
 495         };
 496       };
 497     };
 498     rsync_backup = mkOption {
 499       description  =''
 500         Rsync backup configuration from controlled host
 501         '';
 502       type = submodule {
 503         options = {
 504           ssh_key = mkOption {
 505             description = "SSH key information";
 506             type = submodule {
 507               options = {
 508                 public = mkOption { type = str; description = "Public part of the key"; };
 509                 private = mkOption { type = lines; description = "Private part of the key"; };
 510               };
 511             };
 512           };
 513           profiles = mkOption {
 514             description = "Attrs of profiles to backup";
 515             type = attrsOf (submodule {
 516               options = {
 517                 keep = mkOption { type = int; description = "Number of backups to keep"; };
 518                 check_command = mkOption { type = str; description = "command to check if backup needs to be done"; default = "backup"; };
 519                 login = mkOption { type = str; description = "Login to connect to host"; };
 520                 port = mkOption { type = str; default = "22"; description = "Port to connect to host"; };
 521                 host = mkOption { type = str; description = "Host to connect to"; };
 522                 host_key = mkOption { type = str; description = "Host key"; };
 523                 host_key_type = mkOption { type = str; description = "Host key type"; };
 524                 parts = mkOption {
 525                   description = "Parts to backup for this host";
 526                   type = attrsOf (submodule {
 527                     options = {
 528                       remote_folder = mkOption { type = path; description = "Remote folder to backup";};
 529                       exclude_from = mkOption {
 530                         type = listOf path;
 531                         default = [];
 532                         description = "List of folders/files to exclude from the backup";
 533                       };
 534                       files_from = mkOption {
 535                         type = listOf path;
 536                         default = [];
 537                         description = "List of folders/files to backup in the base folder";
 538                       };
 539                       args = mkOption {
 540                         type = nullOr str;
 541                         default = null;
 542                         description = "Extra arguments to pass to rsync";
 543                       };
 544                     };
 545                   });
 546                 };
 547               };
 548             });
 549           };
 550         };
 551       };
 552     };
 553     monitoring = mkOption {
 554       description = "Monitoring configuration";
 555       type = submodule {
 556         options = {
 557           status_url = mkOption { type = str; description = "URL to push status to"; };
 558           status_token = mkOption { type = str; description = "Token for the status url"; };
 559           http_user_password = mkOption { type = str; description = "HTTP credentials to check services behind wall"; };
 560           email = mkOption { type = str; description = "Admin E-mail"; };
 561           ssh_public_key = mkOption { type = str; description = "SSH public key"; };
 562           ssh_secret_key = mkOption { type = str; description = "SSH secret key"; };
 563           imap_login = mkOption { type = str; description = "IMAP login"; };
 564           imap_password = mkOption { type = str; description = "IMAP password"; };
 565           eriomem_keys = mkOption { type = listOf (listOf str); description = "Eriomem keys"; default = []; };
 566           ovh_sms = mkOption {
 567             description = "OVH credentials for sms script";
 568             type = submodule {
 569               options = {
 570                 endpoint = mkOption { type = str; default = "ovh-eu"; description = "OVH endpoint"; };
 571                 application_key = mkOption { type = str; description = "Application key"; };
 572                 application_secret = mkOption { type = str; description = "Application secret"; };
 573                 consumer_key = mkOption { type = str; description = "Consumer key"; };
 574                 account = mkOption { type = str; description = "Account"; };
 575               };
 576             };
 577           };
 578           eban = mkOption {
 579             description = "Eban credentials for webhook";
 580             type = submodule {
 581               options = {
 582                 user = mkOption { type = str; description = "User"; };
 583                 password = mkOption { type = str; description = "Password"; };
 584               };
 585             };
 586           };
 587           nrdp_tokens = mkOption { type = listOf str; description = "Tokens allowed to push status update"; };
 588           slack_url = mkOption { type = str; description = "Slack webhook url to push status update"; };
 589           slack_channel = mkOption { type = str; description = "Slack channel to push status update"; };
 590           netdata_aggregator = mkOption { type = str; description = "Url where netdata information should be sent"; };
 591           netdata_keys = mkOption { type = attrsOf str; description = "netdata host keys"; };
 592           contacts = mkOption { type = attrsOf unspecified; description = "Contact dicts to fill naemon objects"; };
 593           email_check = mkOption {
 594             description = "Emails services to check";
 595             type = attrsOf (submodule {
 596               options = {
 597                 local = mkOption { type = bool; default = false; description = "Use local configuration"; };
 598                 port = mkOption { type = nullOr str; default = null; description = "Port to connect to ssh"; };
 599                 login = mkOption { type = nullOr str; default = null; description = "Login to connect to ssh"; };
 600                 targets = mkOption { type = listOf str; description = "Hosts to send E-mails to"; };
 601                 mail_address = mkOption { type = nullOr str; default = null; description = "E-mail recipient part to send e-mail to"; };
 602                 mail_domain = mkOption { type = nullOr str; default = null; description = "E-mail domain part to send e-mail to"; };
 603               };
 604             });
 605           };
 606         };
 607       };
 608     };
 609     mpd = mkOption {
 610       description = "MPD configuration";
 611       type = submodule {
 612         options = {
 613           folder = mkOption { type = str; description = "Folder to serve from the MPD instance"; };
 614           password = mkOption { type = str; description = "Password to connect to the MPD instance"; };
 615           host = mkOption { type = str; description = "Host to connect to the MPD instance"; };
 616           port = mkOption { type = str; description = "Port to connect to the MPD instance"; };
 617         };
 618       };
 619     };
 620     ftp = mkOption {
 621       description = "FTP configuration";
 622       type = submodule {
 623         options = {
 624           ldap = mkLdapOptions "FTP" {};
 625         };
 626       };
 627     };
 628     vpn = mkOption {
 629       description = "VPN configuration";
 630       type = attrsOf (submodule {
 631         options = {
 632           prefix = mkOption { type = str; description = "ipv6 prefix for the vpn subnet"; };
 633           privateKey = mkOption { type = str; description = "Private key for the host"; };
 634           publicKey = mkOption { type = str; description = "Public key for the host"; };
 635         };
 636       });
 637     };
 638     mail = mkOption {
 639       description = "Mail configuration";
 640       type = submodule {
 641         options = {
 642           dmarc = mkOption {
 643             description = "DMARC configuration";
 644             type = submodule {
 645               options = {
 646                 ignore_hosts = mkOption {
 647                   type = lines;
 648                   description = ''
 649                     Hosts to ignore when checking for dmarc
 650                     '';
 651                 };
 652               };
 653             };
 654           };
 655           dkim = mkOption {
 656             description = "DKIM configuration";
 657             type = attrsOf (submodule {
 658               options = {
 659                 public = mkOption {
 660                   type = str;
 661                   example = ''
 662                     ( "v=DKIM1; k=rsa; "
 663                               "p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC3w1a2aMxWw9+hdcmbqX4UevcVqr204y0K73Wdc7MPZiOOlUJQYsMNSYR1Y/SC7jmPKeitpcJCpQgn/cveJZbuikjjPLsDReHyFEYmC278ZLRTELHx6f1IXM8WE08JIRT69CfZiMi1rVcOh9qRT4F93PyjCauU8Y5hJjtg9ThsWwIDAQAB" )
 664                     '';
 665                   description = "Public entry to put in DNS TXT field";
 666                 };
 667                 private = mkOption { type = str; description = "Private key"; };
 668               };
 669             });
 670           };
 671           postfix = mkOption {
 672             description = "Postfix configuration";
 673             type = submodule {
 674               options = {
 675                 additional_mailbox_domains = mkOption {
 676                   description = ''
 677                     List of domains that are used as mailbox final destination, in addition to those defined in the DNS records
 678                   '';
 679                   type = listOf str;
 680                 };
 681                 mysql = mkMysqlOptions "Postfix" {
 682                   password_encrypt = mkOption { type = str; description = "Key to encrypt relay password in database"; };
 683                 };
 684                 backup_domains = mkOption {
 685                   description = ''
 686                     Domains that are accepted for relay as backup domain
 687                   '';
 688                   type = attrsOf (submodule {
 689                     options = {
 690                       domains = mkOption { type = listOf str; description = "Domains list"; };
 691                       relay_restrictions = mkOption {
 692                         type = lines;
 693                         description = ''
 694                           Restrictions for relaying the e-mails from the domains
 695                           '';
 696                       };
 697                       recipient_maps = mkOption {
 698                         description = ''
 699                           Recipient map to accept relay for.
 700                           Must be specified for domain, the rules apply to everyone!
 701                         '';
 702                         type = listOf (submodule {
 703                           options = {
 704                             type = mkOption {
 705                               type = enum [ "hash" ];
 706                               description = "Map type";
 707                             };
 708                             content = mkOption {
 709                               type = str;
 710                               description = "Map content";
 711                             };
 712                           };
 713                         });
 714                       };
 715                     };
 716                   });
 717                 };
 718               };
 719             };
 720           };
 721           dovecot = mkOption {
 722             description = "Dovecot configuration";
 723             type = submodule {
 724               options = {
 725                 ldap = mkLdapOptions "Dovecot" {
 726                   pass_attrs = mkOption { type = str; description = "Password attribute in LDAP"; };
 727                   user_attrs = mkOption { type = str; description = "User attribute mapping in LDAP"; };
 728                   iterate_attrs = mkOption { type = str; description = "User attribute mapping for listing in LDAP"; };
 729                   iterate_filter = mkOption { type = str; description = "User attribute filter for listing in LDAP"; };
 730                   postfix_mailbox_filter = mkOption { type = str; description = "Postfix filter to get mailboxes"; };
 731                 };
 732               };
 733             };
 734           };
 735           rspamd = mkOption {
 736             description = "rspamd configuration";
 737             type = submodule {
 738               options = {
 739                 redis = mkRedisOptions "Redis";
 740                 read_password_hashed = mkOption { type = str; description = "Hashed read password for rspamd"; };
 741                 write_password_hashed = mkOption { type = str; description = "Hashed write password for rspamd"; };
 742                 read_password = mkOption {
 743                   type = str;
 744                   description = "Read password for rspamd. Unused";
 745                   apply = x: "";
 746                 };
 747                 write_password = mkOption {
 748                   type = str;
 749                   description = "Write password for rspamd. Unused";
 750                   apply = x: "";
 751                 };
 752               };
 753             };
 754           };
 755           scripts = mkOption {
 756             description = "Mail script recipients";
 757             type = attrsOf (submodule {
 758               options = {
 759                 external = mkEnableOption "Create a script_<name>@mail.immae.eu external address";
 760                 src = mkOption {
 761                   description = ''
 762                     git source to fetch the script from.
 763                     It must have a default.nix file as its root accepting a scriptEnv parameter
 764                   '';
 765                   type = submodule {
 766                     options = {
 767                       url = mkOption { type = str; description = "git url to fetch"; };
 768                       rev = mkOption { type = str; description = "git reference to fetch"; };
 769                     };
 770                   };
 771                 };
 772                 env = mkOption {
 773                   description = "Variables to pass to the script";
 774                   type = unspecified;
 775                 };
 776               };
 777             });
 778           };
 779           sympa = mkOption {
 780             description = "Sympa configuration";
 781             type = submodule {
 782               options = {
 783                 listmasters = mkOption {
 784                   type = listOf str;
 785                   description = "Listmasters";
 786                 };
 787                 postgresql = mkPsqlOptions "Sympa";
 788                 data_sources = mkOption {
 789                   type = attrsOf str;
 790                   default = {};
 791                   description = "Data sources to make available to sympa";
 792                 };
 793                 scenari = mkOption {
 794                   type = attrsOf str;
 795                   default = {};
 796                   description = "Scenari to make available to sympa";
 797                 };
 798               };
 799             };
 800           };
 801         };
 802       };
 803     };
 804     buildbot = mkOption {
 805       description = "Buildbot configuration";
 806       type = submodule {
 807         options = {
 808           workerPassword = mkOption { description = "Buildbot worker password"; type = str; };
 809           user = mkOption {
 810             description = "Buildbot user";
 811             type = submodule {
 812               options = {
 813                 uid = mkOption {
 814                   description = "user uid";
 815                   type = int;
 816                 };
 817                 gid = mkOption {
 818                   description = "user gid";
 819                   type = int;
 820                 };
 821               };
 822             };
 823           };
 824           ldap = mkOption {
 825             description = "Ldap configuration for buildbot";
 826             type = submodule {
 827               options = {
 828                 password = mkOption { type = str; description = "Buildbot password"; };
 829               };
 830             };
 831           };
 832           projects = mkOption {
 833             description = "Projects to make a buildbot for";
 834             type = attrsOf (submodule {
 835               options = {
 836                 name = mkOption { type = str; description = "Project name"; };
 837                 packages = mkOption {
 838                   type = unspecified;
 839                   example = literalExample ''
 840                     pkgs: [ pkgs.bash pkgs.git pkgs.gzip pkgs.openssh ];
 841                     '';
 842                   description = ''
 843                     Function.
 844                     Builds packages list to make available to buildbot project.
 845                     Takes pkgs as argument.
 846                   '';
 847                 };
 848                 pythonPackages = mkOption {
 849                   type = unspecified;
 850                   example = literalExample ''
 851                     p: pkgs: [ pkgs.python3Packages.pip ];
 852                     '';
 853                   description = ''
 854                     Function.
 855                     Builds python packages list to make available to buildbot project.
 856                     Takes buildbot python module as first argument and pkgs as second argument in order to augment the python modules list.
 857                     '';
 858                 };
 859                 pythonPathHome = mkOption { type = bool; description = "Whether to add project’s python home to python path"; };
 860                 workerPort = mkOption { type = port; description = "Port for the worker"; };
 861                 secrets = mkOption {
 862                   type = attrsOf str;
 863                   description = "Secrets for the project to dump as files";
 864                 };
 865                 environment = mkOption {
 866                   type = attrsOf str;
 867                   description = ''
 868                     Environment variables for the project.
 869                     BUILDBOT_ is prefixed to the variable names
 870                   '';
 871                 };
 872                 activationScript = mkOption {
 873                   type = lines;
 874                   description = ''
 875                     Activation script to run during deployment
 876                   '';
 877                 };
 878                 builderPaths = mkOption {
 879                   type = attrsOf unspecified;
 880                   default = {};
 881                   description = ''
 882                     Attrs of functions to make accessible specifically per builder.
 883                     Takes pkgs as argument and should return a single path containing binaries.
 884                     This path will be accessible as BUILDBOT_PATH_<attrskey>
 885                     '';
 886                 };
 887                 webhookTokens = mkOption {
 888                   type = nullOr (listOf str);
 889                   default = null;
 890                   description = ''
 891                     List of tokens allowed to push to project’s change_hook/base endpoint
 892                   '';
 893                 };
 894               };
 895             });
 896           };
 897         };
 898       };
 899     };
 900     tools = mkOption {
 901       description = "Tools configurations";
 902       type = submodule {
 903         options = {
 904           contact = mkOption { type = str; description = "Contact e-mail address"; };
 905           assets = mkOption {
 906             default = {};
 907             type = attrsOf (submodule {
 908               options = {
 909                 url = mkOption { type = str; description = "URL to fetch"; };
 910                 sha256 = mkOption { type = str; description = "Hash of the url"; };
 911               };
 912             });
 913             description = "Assets to provide on assets.immae.eu";
 914           };
 915           davical = mkOption {
 916             description = "Davical configuration";
 917             type = submodule {
 918               options = {
 919                 postgresql = mkPsqlOptions "Davical";
 920                 ldap = mkLdapOptions "Davical" {};
 921               };
 922             };
 923           };
 924           diaspora = mkOption {
 925             description = "Diaspora configuration";
 926             type = submodule {
 927               options = {
 928                 postgresql = mkPsqlOptions "Diaspora";
 929                 redis = mkRedisOptions "Diaspora";
 930                 ldap = mkLdapOptions "Diaspora" {};
 931                 secret_token = mkOption { type = str; description = "Secret token"; };
 932               };
 933             };
 934           };
 935           dmarc_reports = mkOption {
 936             description = "DMARC reports configuration";
 937             type = submodule {
 938               options = {
 939                 mysql = mkMysqlOptions "DMARC" {};
 940                 anonymous_key = mkOption { type = str; description = "Anonymous hashing key"; };
 941               };
 942             };
 943           };
 944           etherpad-lite = mkOption {
 945             description = "Etherpad configuration";
 946             type = submodule {
 947               options = {
 948                 postgresql = mkPsqlOptions "Etherpad";
 949                 ldap = mkLdapOptions "Etherpad" {
 950                   group_filter = mkOption { type = str; description = "Filter for groups"; };
 951                 };
 952                 adminPassword = mkOption { type = str; description = "Admin password for mypads / admin"; };
 953                 session_key = mkOption { type = str; description = "Session key"; };
 954                 api_key = mkOption { type = str; description = "API key"; };
 955                 redirects = mkOption { type = str; description = "Redirects for apache"; };
 956               };
 957             };
 958           };
 959           gitolite = mkOption {
 960             description = "Gitolite configuration";
 961             type = submodule {
 962               options = {
 963                 ldap = mkLdapOptions "Gitolite" {};
 964               };
 965             };
 966           };
 967           kanboard = mkOption {
 968             description = "Kanboard configuration";
 969             type = submodule {
 970               options = {
 971                 postgresql = mkPsqlOptions "Kanboard";
 972                 ldap = mkLdapOptions "Kanboard" {
 973                   admin_dn = mkOption { type = str; description = "Admin DN"; };
 974                 };
 975               };
 976             };
 977           };
 978           mantisbt = mkOption {
 979             description = "Mantisbt configuration";
 980             type = submodule {
 981               options = {
 982                 postgresql = mkPsqlOptions "Mantisbt";
 983                 ldap = mkLdapOptions "Mantisbt" {};
 984                 master_salt = mkOption { type = str; description = "Master salt for password hash"; };
 985               };
 986             };
 987           };
 988           mastodon = mkOption {
 989             description = "Mastodon configuration";
 990             type = submodule {
 991               options = {
 992                 postgresql = mkPsqlOptions "Mastodon";
 993                 redis = mkRedisOptions "Mastodon";
 994                 ldap = mkLdapOptions "Mastodon" {};
 995                 paperclip_secret = mkOption { type = str; description = "Paperclip secret"; };
 996                 otp_secret = mkOption { type = str; description = "OTP secret"; };
 997                 secret_key_base = mkOption { type = str; description = "Secret key base"; };
 998                 vapid = mkOption {
 999                   description = "vapid key";
1000                   type = submodule {
1001                     options = {
1002                       private = mkOption { type = str; description = "Private key"; };
1003                       public = mkOption { type = str; description = "Public key"; };
1004                     };
1005                   };
1006                 };
1007               };
1008             };
1009           };
1010           mediagoblin = mkOption {
1011             description = "Mediagoblin configuration";
1012             type = submodule {
1013               options = {
1014                 postgresql = mkPsqlOptions "Mediagoblin";
1015                 redis = mkRedisOptions "Mediagoblin";
1016                 ldap = mkLdapOptions "Mediagoblin" {};
1017               };
1018             };
1019           };
1020           nextcloud = mkOption {
1021             description = "Nextcloud configuration";
1022             type = submodule {
1023               options = {
1024                 postgresql = mkPsqlOptions "Peertube";
1025                 redis = mkRedisOptions "Peertube";
1026                 password_salt = mkOption { type = str; description = "Password salt"; };
1027                 instance_id = mkOption { type = str; description = "Instance ID"; };
1028                 secret = mkOption { type = str; description = "App secret"; };
1029               };
1030             };
1031           };
1032           peertube = mkOption {
1033             description = "Peertube configuration";
1034             type = submodule {
1035               options = {
1036                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1037                 postgresql = mkPsqlOptions "Peertube";
1038                 redis = mkRedisOptions "Peertube";
1039                 ldap = mkLdapOptions "Peertube" {};
1040               };
1041             };
1042           };
1043           syden_peertube = mkOption {
1044             description = "Peertube Syden configuration";
1045             type = submodule {
1046               options = {
1047                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1048                 postgresql = mkPsqlOptions "Peertube";
1049                 redis = mkRedisOptions "Peertube";
1050               };
1051             };
1052           };
1053           phpldapadmin = mkOption {
1054             description = "phpLdapAdmin configuration";
1055             type = submodule {
1056               options = {
1057                 ldap = mkLdapOptions "phpldapadmin" {};
1058               };
1059             };
1060           };
1061           rompr = mkOption {
1062             description = "Rompr configuration";
1063             type = submodule {
1064               options = {
1065                 mpd = mkOption {
1066                   description = "MPD configuration";
1067                   type = submodule {
1068                     options = {
1069                       host = mkOption { type = str; description = "Host for MPD"; };
1070                       port = mkOption { type = port; description = "Port to access MPD host"; };
1071                     };
1072                   };
1073                 };
1074               };
1075             };
1076           };
1077           roundcubemail = mkOption {
1078             description = "Roundcubemail configuration";
1079             type = submodule {
1080               options = {
1081                 postgresql = mkPsqlOptions "TT-RSS";
1082                 secret = mkOption { type = str; description = "Secret"; };
1083               };
1084             };
1085           };
1086           shaarli = mkOption {
1087             description = "Shaarli configuration";
1088             type = submodule {
1089               options = {
1090                 ldap = mkLdapOptions "Shaarli" {};
1091               };
1092             };
1093           };
1094           status_engine = mkOption {
1095             description = "Status Engine configuration";
1096             type = submodule {
1097               options = {
1098                 mysql = mkMysqlOptions "StatusEngine" {};
1099                 ldap = mkLdapOptions "StatusEngine" {};
1100               };
1101             };
1102           };
1103           task = mkOption {
1104             description = "Taskwarrior configuration";
1105             type = submodule {
1106               options = {
1107                 ldap = mkLdapOptions "Taskwarrior" {};
1108                 taskwarrior-web = mkOption {
1109                   description = "taskwarrior-web profiles";
1110                   type = attrsOf (submodule {
1111                     options = {
1112                       uid = mkOption {
1113                         type = listOf str;
1114                         description = "List of ldap uids having access to this profile";
1115                       };
1116                       org = mkOption { type = str; description = "Taskd organisation"; };
1117                       key = mkOption { type = str; description = "Taskd key"; };
1118                       date = mkOption { type = str; description = "Preferred date format"; };
1119                     };
1120                   });
1121                 };
1122               };
1123             };
1124           };
1125           ttrss = mkOption {
1126             description = "TT-RSS configuration";
1127             type = submodule {
1128               options = {
1129                 postgresql = mkPsqlOptions "TT-RSS";
1130                 ldap = mkLdapOptions "TT-RSS" {};
1131               };
1132             };
1133           };
1134           wallabag = mkOption {
1135             description = "Wallabag configuration";
1136             type = submodule {
1137               options = {
1138                 postgresql = mkPsqlOptions "Wallabag";
1139                 ldap = mkLdapOptions "Wallabag" {
1140                   admin_filter = mkOption { type = str; description = "Admin users filter"; };
1141                 };
1142                 redis = mkRedisOptions "Wallabag";
1143                 secret = mkOption { type = str; description = "App secret"; };
1144               };
1145             };
1146           };
1147           webhooks = mkOption {
1148             type = attrsOf str;
1149             description = "Mapping 'name'.php => script for webhooks";
1150           };
1151           csp_reports = mkOption {
1152             description = "CSP report configuration";
1153             type = submodule {
1154               options = {
1155                 report_uri = mkOption { type = str; description = "URI to report CSP violations to"; };
1156                 policies = mkOption { type = attrsOf str; description = "CSP policies to apply"; };
1157                 postgresql = mkPsqlOptions "CSP reports";
1158               };
1159             };
1160           };
1161           commento = mkOption {
1162             description = "Commento configuration";
1163             type = submodule {
1164               options = {
1165                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1166                 postgresql = mkPsqlOptions "Commento";
1167                 smtp = mkSmtpOptions "Commento";
1168               };
1169             };
1170           };
1171           cryptpad = mkOption {
1172             description = "Cryptpad configuration";
1173             type = attrsOf (submodule {
1174               options = {
1175                 email = mkOption { type = str; description = "Admin e-mail"; };
1176                 admins = mkOption { type = listOf str; description = "Instance admin public keys"; };
1177                 port = mkOption { type = port; description = "Port to listen to"; };
1178               };
1179             });
1180           };
1181           ympd = mkOption {
1182             description = "Ympd configuration";
1183             type = submodule {
1184               options = {
1185                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1186                 mpd = mkOption {
1187                   description = "MPD configuration";
1188                   type = submodule {
1189                     options = {
1190                       password = mkOption { type = str; description = "Password to access MPD host"; };
1191                       host = mkOption { type = str; description = "Host for MPD"; };
1192                       port = mkOption { type = port; description = "Port to access MPD host"; };
1193                     };
1194                   };
1195                 };
1196               };
1197             };
1198           };
1199           umami = mkOption {
1200             description = "Umami configuration";
1201             type = submodule {
1202               options = {
1203                 listenPort = mkOption { type = port; description = "Port to listen to"; };
1204                 postgresql = mkPsqlOptions "Umami";
1205                 hashSalt = mkOption { type = str; description = "Hash salt"; };
1206               };
1207             };
1208           };
1209           yourls = mkOption {
1210             description = "Yourls configuration";
1211             type = submodule {
1212               options = {
1213                 mysql = mkMysqlOptions "Yourls" {};
1214                 ldap = mkLdapOptions "Yourls" {};
1215                 cookieKey = mkOption { type = str; description = "Cookie key"; };
1216               };
1217             };
1218           };
1219         };
1220       };
1221     };
1222     serverSpecific = mkOption { type = attrsOf unspecified; description = "Server specific configuration"; };
1223     websites = mkOption {
1224       description = "Websites configurations";
1225       type = submodule {
1226         options = {
1227           immae = mkOption {
1228             description = "Immae configuration by environment";
1229             type = submodule {
1230               options = {
1231                 temp = mkOption {
1232                   description = "Temp configuration";
1233                   type = submodule {
1234                     options = {
1235                       ldap = mkLdapOptions "Immae temp" {
1236                         filter = mkOption { type = str; description = "Filter for user access"; };
1237                       };
1238                     };
1239                   };
1240                 };
1241               };
1242             };
1243           };
1244           isabelle = mkOption {
1245             description = "Isabelle configurations by environment";
1246             type =
1247               let
1248                 atenSubmodule = mkOption {
1249                   description = "environment configuration";
1250                   type = submodule {
1251                     options = {
1252                       environment = mkOption { type = str; description = "Symfony environment"; };
1253                       secret = mkOption { type = str; description = "Symfony App secret"; };
1254                       postgresql = mkPsqlOptions "Aten";
1255                     };
1256                   };
1257                 };
1258               in
1259                 submodule {
1260                   options = {
1261                     aten_production = atenSubmodule;
1262                     aten_integration = atenSubmodule;
1263                     iridologie = mkOption {
1264                       description = "environment configuration";
1265                       type = submodule {
1266                         options = {
1267                           environment = mkOption { type = str; description = "SPIP environment"; };
1268                           mysql = mkMysqlOptions "Iridologie" {};
1269                           ldap = mkLdapOptions "Iridologie" {};
1270                         };
1271                       };
1272                     };
1273                   };
1274                 };
1275           };
1276           chloe = mkOption {
1277             description = "Chloe configurations by environment";
1278             type =
1279               let
1280                 chloeSubmodule = mkOption {
1281                   description = "environment configuration";
1282                   type = submodule {
1283                     options = {
1284                       environment = mkOption { type = str; description = "SPIP environment"; };
1285                       mysql = mkMysqlOptions "Chloe" {};
1286                       ldap = mkLdapOptions "Chloe" {};
1287                     };
1288                   };
1289                 };
1290               in
1291                 submodule {
1292                   options = {
1293                     production = chloeSubmodule;
1294                     integration = chloeSubmodule;
1295                   };
1296                 };
1297           };
1298           connexionswing = mkOption {
1299             description = "Connexionswing configurations by environment";
1300             type =
1301               let
1302                 csSubmodule = mkOption {
1303                   description = "environment configuration";
1304                   type = submodule {
1305                     options = {
1306                       environment = mkOption { type = str; description = "Symfony environment"; };
1307                       mysql = mkMysqlOptions "Connexionswing" {};
1308                       secret = mkOption { type = str; description = "Symfony App secret"; };
1309                       email = mkOption { type = str; description = "Symfony email notification"; };
1310                     };
1311                   };
1312                 };
1313               in
1314                 submodule {
1315                   options = {
1316                     production = csSubmodule;
1317                     integration = csSubmodule;
1318                   };
1319                 };
1320           };
1321           jerome = mkOption {
1322             description = "Naturaloutil configuration";
1323             type = submodule {
1324               options = {
1325                 mysql = mkMysqlOptions "Naturaloutil" {};
1326                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1327               };
1328             };
1329           };
1330           telio_tortay = mkOption {
1331             description = "Telio Tortay configuration";
1332             type = submodule {
1333               options = {
1334                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1335               };
1336             };
1337           };
1338           ludivine = mkOption {
1339             description = "Ludivinecassal configurations by environment";
1340             type =
1341               let
1342                 lcSubmodule = mkOption {
1343                   description = "environment configuration";
1344                   type = submodule {
1345                     options = {
1346                       environment = mkOption { type = str; description = "Symfony environment"; };
1347                       mysql = mkMysqlOptions "LudivineCassal" {};
1348                       ldap = mkLdapOptions "LudivineCassal" {};
1349                       secret = mkOption { type = str; description = "Symfony App secret"; };
1350                     };
1351                   };
1352                 };
1353               in
1354                 submodule {
1355                   options = {
1356                     production = lcSubmodule;
1357                     integration = lcSubmodule;
1358                   };
1359                 };
1360           };
1361           emilia = mkOption {
1362             description = "Emilia configuration";
1363             type = submodule {
1364               options = {
1365                 postgresql = mkPsqlOptions "Emilia";
1366               };
1367             };
1368           };
1369           florian = mkOption {
1370             description = "Florian configuration";
1371             type = submodule {
1372               options = {
1373                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1374               };
1375             };
1376           };
1377           nassime = mkOption {
1378             description = "Nassime configuration";
1379             type = submodule {
1380               options = {
1381                 server_admin = mkOption { type = str; description = "Server admin e-mail"; };
1382               };
1383             };
1384           };
1385           piedsjaloux = mkOption {
1386             description = "Piedsjaloux configurations by environment";
1387             type =
1388               let
1389                 pjSubmodule = mkOption {
1390                   description = "environment configuration";
1391                   type = submodule {
1392                     options = {
1393                       environment = mkOption { type = str; description = "Symfony environment"; };
1394                       mysql = mkMysqlOptions "Piedsjaloux" {};
1395                       secret = mkOption { type = str; description = "Symfony App secret"; };
1396                     };
1397                   };
1398                 };
1399               in
1400                 submodule {
1401                   options = {
1402                     production = pjSubmodule;
1403                     integration = pjSubmodule;
1404                   };
1405                 };
1406           };
1407           richie = mkOption {
1408             description = "Europe Richie configurations by environment";
1409             type = submodule {
1410               options = {
1411                 mysql = mkMysqlOptions "Richie" {};
1412                 smtp_mailer = mkOption {
1413                   description = "SMTP mailer configuration";
1414                   type = submodule {
1415                     options = {
1416                       user = mkOption { type = str; description = "Username"; };
1417                       password = mkOption { type = str; description = "Password"; };
1418                     };
1419                   };
1420                 };
1421               };
1422             };
1423           };
1424           caldance = mkOption {
1425             description = "Caldance configurations by environment";
1426             type = submodule {
1427               options = {
1428                 integration = mkOption {
1429                   description = "environment configuration";
1430                   type = submodule {
1431                     options = {
1432                       password = mkOption { type = str; description = "Password file content for basic auth"; };
1433                     };
1434                   };
1435                 };
1436               };
1437             };
1438           };
1439           tellesflorian = mkOption {
1440             description = "Tellesflorian configurations by environment";
1441             type =
1442               let
1443                 tfSubmodule = mkOption {
1444                   description = "environment configuration";
1445                   type = submodule {
1446                     options = {
1447                       environment = mkOption { type = str; description = "Symfony environment"; };
1448                       mysql = mkMysqlOptions "Tellesflorian" {};
1449                       secret = mkOption { type = str; description = "Symfony App secret"; };
1450                       invite_passwords = mkOption { type = str; description = "Password basic auth"; };
1451                     };
1452                   };
1453                 };
1454               in
1455                 submodule {
1456                   options = {
1457                     integration = tfSubmodule;
1458                   };
1459                 };
1460           };
1461         };
1462       };
1463     };
1464
1465     privateFiles = mkOption {
1466       type = path;
1467       description = ''
1468         Path to secret files to make available during build
1469         '';
1470     };
1471   };
1472   options.hostEnv = mkOption {
1473     readOnly = true;
1474     type = hostEnv;
1475     default = config.myEnv.servers."${name}";
1476     description = "Host environment";
1477   };
1478 }