···

       
4
       
 
       
  pkgs,

     

       
5
       
 
       
  ...

     

       
6
       
 
       
}:

     

       
7
       
-
       


     

       
8
       
-
       
with lib;

     

       
9
       
-
       


     

       
10
       
 
       
let

     

       
11
       
 
       


     

       
12
       
 
       
  cfg = config.services.manticore;

     
···

       
14
       
 
       


     

       
15
       
 
       
  toSphinx =

     

       
16
       
 
       
    {

     

       
17
       
-
       
      mkKeyValue ? generators.mkKeyValueDefault { } "=",

     

       
18
       
 
       
      listsAsDuplicateKeys ? true,

     

       
19
       
 
       
    }:

     

       
20
       
 
       
    attrsOfAttrs:

     
···

       
22
       
 
       
      # map function to string for each key val

     

       
23
       
 
       
      mapAttrsToStringsSep =

     

       
24
       
 
       
        sep: mapFn: attrs:

     

       
25
       
-
       
        concatStringsSep sep (mapAttrsToList mapFn attrs);

     

       
26
       
 
       
      mkSection =

     

       
27
       
 
       
        sectName: sectValues:

     

       
28
       
 
       
        ''

     
···

       
46
       
 
       
  options = {

     

       
47
       
 
       
    services.manticore = {

     

       
48
       
 
       


     

       
49
       
-
       
      enable = mkEnableOption "Manticoresearch";

     

       
50
       
 
       


     

       
51
       
-
       
      settings = mkOption {

     

       
52
       
 
       
        default = {

     

       
53
       
 
       
          searchd = {

     

       
54
       
 
       
            listen = [

     
···

       
67
       
 
       
          <https://manual.manticoresearch.com/Server%20settings>

     

       
68
       
 
       
          for more information.

     

       
69
       
 
       
        '';

     

       
70
       
-
       
        type = types.submodule {

     

       
71
       
 
       
          freeformType = format.type;

     

       
72
       
 
       
        };

     

       
73
       
-
       
        example = literalExpression ''

     

       
74
       
 
       
          {

     

       
75
       
 
       
            searchd = {

     

       
76
       
 
       
                listen = [

     
···

       
90
       
 
       
    };

     

       
91
       
 
       
  };

     

       
92
       
 
       


     

       
93
       
-
       
  config = mkIf cfg.enable {

     

       
94
       
 
       


     

       
95
       
 
       
    systemd = {

     

       
96
       
 
       
      packages = [ pkgs.manticoresearch ];

     

···

       
4
       
 
       
  pkgs,

     

       
5
       
 
       
  ...

     

       
6
       
 
       
}:

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
7
       
 
       
let

     

       
8
       
 
       


     

       
9
       
 
       
  cfg = config.services.manticore;

     
···

       
11
       
 
       


     

       
12
       
 
       
  toSphinx =

     

       
13
       
 
       
    {

     

       
14
       
+
       
      mkKeyValue ? lib.generators.mkKeyValueDefault { } "=",

     

       
15
       
 
       
      listsAsDuplicateKeys ? true,

     

       
16
       
 
       
    }:

     

       
17
       
 
       
    attrsOfAttrs:

     
···

       
19
       
 
       
      # map function to string for each key val

     

       
20
       
 
       
      mapAttrsToStringsSep =

     

       
21
       
 
       
        sep: mapFn: attrs:

     

       
22
       
+
       
        lib.concatStringsSep sep (lib.mapAttrsToList mapFn attrs);

     

       
23
       
 
       
      mkSection =

     

       
24
       
 
       
        sectName: sectValues:

     

       
25
       
 
       
        ''

     
···

       
43
       
 
       
  options = {

     

       
44
       
 
       
    services.manticore = {

     

       
45
       
 
       


     

       
46
       
+
       
      enable = lib.mkEnableOption "Manticoresearch";

     

       
47
       
 
       


     

       
48
       
+
       
      settings = lib.mkOption {

     

       
49
       
 
       
        default = {

     

       
50
       
 
       
          searchd = {

     

       
51
       
 
       
            listen = [

     
···

       
64
       
 
       
          <https://manual.manticoresearch.com/Server%20settings>

     

       
65
       
 
       
          for more information.

     

       
66
       
 
       
        '';

     

       
67
       
+
       
        type = lib.types.submodule {

     

       
68
       
 
       
          freeformType = format.type;

     

       
69
       
 
       
        };

     

       
70
       
+
       
        example = lib.literalExpression ''

     

       
71
       
 
       
          {

     

       
72
       
 
       
            searchd = {

     

       
73
       
 
       
                listen = [

     
···

       
87
       
 
       
    };

     

       
88
       
 
       
  };

     

       
89
       
 
       


     

       
90
       
+
       
  config = lib.mkIf cfg.enable {

     

       
91
       
 
       


     

       
92
       
 
       
    systemd = {

     

       
93
       
 
       
      packages = [ pkgs.manticoresearch ];

     

···

       
4
       
 
       
  pkgs,

     

       
5
       
 
       
  ...

     

       
6
       
 
       
}:

     

       
7
       
-
       


     

       
8
       
-
       
with lib;

     

       
9
       
-
       


     

       
10
       
 
       
let

     

       
11
       
 
       
  cfg = config.services.meilisearch;

     

       
12
       
 
       


     

       
13
       
 
       
in

     

       
14
       
 
       
{

     

       
15
       
 
       


     

       
16
       
-
       
  meta.maintainers = with maintainers; [

     

       
17
       
 
       
    Br1ght0ne

     

       
18
       
 
       
    happysalada

     

       
19
       
 
       
  ];

     
···

       
22
       
 
       
  ###### interface

     

       
23
       
 
       


     

       
24
       
 
       
  options.services.meilisearch = {

     

       
25
       
-
       
    enable = mkEnableOption "MeiliSearch - a RESTful search API";

     

       
26
       
 
       


     

       
27
       
-
       
    package = mkPackageOption pkgs "meilisearch" {

     

       
28
       
 
       
      extraDescription = ''

     

       
29
       
 
       
        Use this if you require specific features to be enabled. The default package has no features.

     

       
30
       
 
       
      '';

     

       
31
       
 
       
    };

     

       
32
       
 
       


     

       
33
       
-
       
    listenAddress = mkOption {

     

       
34
       
 
       
      description = "MeiliSearch listen address.";

     

       
35
       
 
       
      default = "127.0.0.1";

     

       
36
       
-
       
      type = types.str;

     

       
37
       
 
       
    };

     

       
38
       
 
       


     

       
39
       
-
       
    listenPort = mkOption {

     

       
40
       
 
       
      description = "MeiliSearch port to listen on.";

     

       
41
       
 
       
      default = 7700;

     

       
42
       
-
       
      type = types.port;

     

       
43
       
 
       
    };

     

       
44
       
 
       


     

       
45
       
-
       
    environment = mkOption {

     

       
46
       
 
       
      description = "Defines the running environment of MeiliSearch.";

     

       
47
       
 
       
      default = "development";

     

       
48
       
-
       
      type = types.enum [

     

       
49
       
 
       
        "development"

     

       
50
       
 
       
        "production"

     

       
51
       
 
       
      ];

     

       
52
       
 
       
    };

     

       
53
       
 
       


     

       
54
       
 
       
    # TODO change this to LoadCredentials once possible

     

       
55
       
-
       
    masterKeyEnvironmentFile = mkOption {

     

       
56
       
 
       
      description = ''

     

       
57
       
 
       
        Path to file which contains the master key.

     

       
58
       
 
       
        By doing so, all routes will be protected and will require a key to be accessed.

     
···

       
61
       
 
       
        MEILI_MASTER_KEY=my_secret_key

     

       
62
       
 
       
      '';

     

       
63
       
 
       
      default = null;

     

       
64
       
-
       
      type = with types; nullOr path;

     

       
65
       
 
       
    };

     

       
66
       
 
       


     

       
67
       
-
       
    noAnalytics = mkOption {

     

       
68
       
 
       
      description = ''

     

       
69
       
 
       
        Deactivates analytics.

     

       
70
       
 
       
        Analytics allow MeiliSearch to know how many users are using MeiliSearch,

     
···

       
72
       
 
       
        This process is entirely anonymous.

     

       
73
       
 
       
      '';

     

       
74
       
 
       
      default = true;

     

       
75
       
-
       
      type = types.bool;

     

       
76
       
 
       
    };

     

       
77
       
 
       


     

       
78
       
-
       
    logLevel = mkOption {

     

       
79
       
 
       
      description = ''

     

       
80
       
 
       
        Defines how much detail should be present in MeiliSearch's logs.

     

       
81
       
 
       
        MeiliSearch currently supports four log levels, listed in order of increasing verbosity:

     
···

       
86
       
 
       
          Useful when diagnosing issues and debugging

     

       
87
       
 
       
      '';

     

       
88
       
 
       
      default = "INFO";

     

       
89
       
-
       
      type = types.str;

     

       
90
       
 
       
    };

     

       
91
       
 
       


     

       
92
       
-
       
    maxIndexSize = mkOption {

     

       
93
       
 
       
      description = ''

     

       
94
       
 
       
        Sets the maximum size of the index.

     

       
95
       
 
       
        Value must be given in bytes or explicitly stating a base unit.

     
···

       
97
       
 
       
        Default is 100 GiB

     

       
98
       
 
       
      '';

     

       
99
       
 
       
      default = "107374182400";

     

       
100
       
-
       
      type = types.str;

     

       
101
       
 
       
    };

     

       
102
       
 
       


     

       
103
       
-
       
    payloadSizeLimit = mkOption {

     

       
104
       
 
       
      description = ''

     

       
105
       
 
       
        Sets the maximum size of accepted JSON payloads.

     

       
106
       
 
       
        Value must be given in bytes or explicitly stating a base unit.

     
···

       
108
       
 
       
        Default is ~ 100 MB

     

       
109
       
 
       
      '';

     

       
110
       
 
       
      default = "104857600";

     

       
111
       
-
       
      type = types.str;

     

       
112
       
 
       
    };

     

       
113
       
 
       


     

       
114
       
 
       
  };

     

       
115
       
 
       


     

       
116
       
 
       
  ###### implementation

     

       
117
       
 
       


     

       
118
       
-
       
  config = mkIf cfg.enable {

     

       
119
       
 
       


     

       
120
       
 
       
    # used to restore dumps

     

       
121
       
 
       
    environment.systemPackages = [ cfg.package ];

     
···

       
127
       
 
       
      environment = {

     

       
128
       
 
       
        MEILI_DB_PATH = "/var/lib/meilisearch";

     

       
129
       
 
       
        MEILI_HTTP_ADDR = "${cfg.listenAddress}:${toString cfg.listenPort}";

     

       
130
       
-
       
        MEILI_NO_ANALYTICS = boolToString cfg.noAnalytics;

     

       
131
       
 
       
        MEILI_ENV = cfg.environment;

     

       
132
       
 
       
        MEILI_DUMP_DIR = "/var/lib/meilisearch/dumps";

     

       
133
       
 
       
        MEILI_LOG_LEVEL = cfg.logLevel;

     
···

       
137
       
 
       
        ExecStart = "${cfg.package}/bin/meilisearch";

     

       
138
       
 
       
        DynamicUser = true;

     

       
139
       
 
       
        StateDirectory = "meilisearch";

     

       
140
       
-
       
        EnvironmentFile = mkIf (cfg.masterKeyEnvironmentFile != null) cfg.masterKeyEnvironmentFile;

     

       
141
       
 
       
      };

     

       
142
       
 
       
    };

     

       
143
       
 
       
  };

     

···

       
4
       
 
       
  pkgs,

     

       
5
       
 
       
  ...

     

       
6
       
 
       
}:

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
7
       
 
       
let

     

       
8
       
 
       
  cfg = config.services.meilisearch;

     

       
9
       
 
       


     

       
10
       
 
       
in

     

       
11
       
 
       
{

     

       
12
       
 
       


     

       
13
       
+
       
  meta.maintainers = with lib.maintainers; [

     

       
14
       
 
       
    Br1ght0ne

     

       
15
       
 
       
    happysalada

     

       
16
       
 
       
  ];

     
···

       
19
       
 
       
  ###### interface

     

       
20
       
 
       


     

       
21
       
 
       
  options.services.meilisearch = {

     

       
22
       
+
       
    enable = lib.mkEnableOption "MeiliSearch - a RESTful search API";

     

       
23
       
 
       


     

       
24
       
+
       
    package = lib.mkPackageOption pkgs "meilisearch" {

     

       
25
       
 
       
      extraDescription = ''

     

       
26
       
 
       
        Use this if you require specific features to be enabled. The default package has no features.

     

       
27
       
 
       
      '';

     

       
28
       
 
       
    };

     

       
29
       
 
       


     

       
30
       
+
       
    listenAddress = lib.mkOption {

     

       
31
       
 
       
      description = "MeiliSearch listen address.";

     

       
32
       
 
       
      default = "127.0.0.1";

     

       
33
       
+
       
      type = lib.types.str;

     

       
34
       
 
       
    };

     

       
35
       
 
       


     

       
36
       
+
       
    listenPort = lib.mkOption {

     

       
37
       
 
       
      description = "MeiliSearch port to listen on.";

     

       
38
       
 
       
      default = 7700;

     

       
39
       
+
       
      type = lib.types.port;

     

       
40
       
 
       
    };

     

       
41
       
 
       


     

       
42
       
+
       
    environment = lib.mkOption {

     

       
43
       
 
       
      description = "Defines the running environment of MeiliSearch.";

     

       
44
       
 
       
      default = "development";

     

       
45
       
+
       
      type = lib.types.enum [

     

       
46
       
 
       
        "development"

     

       
47
       
 
       
        "production"

     

       
48
       
 
       
      ];

     

       
49
       
 
       
    };

     

       
50
       
 
       


     

       
51
       
 
       
    # TODO change this to LoadCredentials once possible

     

       
52
       
+
       
    masterKeyEnvironmentFile = lib.mkOption {

     

       
53
       
 
       
      description = ''

     

       
54
       
 
       
        Path to file which contains the master key.

     

       
55
       
 
       
        By doing so, all routes will be protected and will require a key to be accessed.

     
···

       
58
       
 
       
        MEILI_MASTER_KEY=my_secret_key

     

       
59
       
 
       
      '';

     

       
60
       
 
       
      default = null;

     

       
61
       
+
       
      type = with lib.types; nullOr path;

     

       
62
       
 
       
    };

     

       
63
       
 
       


     

       
64
       
+
       
    noAnalytics = lib.mkOption {

     

       
65
       
 
       
      description = ''

     

       
66
       
 
       
        Deactivates analytics.

     

       
67
       
 
       
        Analytics allow MeiliSearch to know how many users are using MeiliSearch,

     
···

       
69
       
 
       
        This process is entirely anonymous.

     

       
70
       
 
       
      '';

     

       
71
       
 
       
      default = true;

     

       
72
       
+
       
      type = lib.types.bool;

     

       
73
       
 
       
    };

     

       
74
       
 
       


     

       
75
       
+
       
    logLevel = lib.mkOption {

     

       
76
       
 
       
      description = ''

     

       
77
       
 
       
        Defines how much detail should be present in MeiliSearch's logs.

     

       
78
       
 
       
        MeiliSearch currently supports four log levels, listed in order of increasing verbosity:

     
···

       
83
       
 
       
          Useful when diagnosing issues and debugging

     

       
84
       
 
       
      '';

     

       
85
       
 
       
      default = "INFO";

     

       
86
       
+
       
      type = lib.types.str;

     

       
87
       
 
       
    };

     

       
88
       
 
       


     

       
89
       
+
       
    maxIndexSize = lib.mkOption {

     

       
90
       
 
       
      description = ''

     

       
91
       
 
       
        Sets the maximum size of the index.

     

       
92
       
 
       
        Value must be given in bytes or explicitly stating a base unit.

     
···

       
94
       
 
       
        Default is 100 GiB

     

       
95
       
 
       
      '';

     

       
96
       
 
       
      default = "107374182400";

     

       
97
       
+
       
      type = lib.types.str;

     

       
98
       
 
       
    };

     

       
99
       
 
       


     

       
100
       
+
       
    payloadSizeLimit = lib.mkOption {

     

       
101
       
 
       
      description = ''

     

       
102
       
 
       
        Sets the maximum size of accepted JSON payloads.

     

       
103
       
 
       
        Value must be given in bytes or explicitly stating a base unit.

     
···

       
105
       
 
       
        Default is ~ 100 MB

     

       
106
       
 
       
      '';

     

       
107
       
 
       
      default = "104857600";

     

       
108
       
+
       
      type = lib.types.str;

     

       
109
       
 
       
    };

     

       
110
       
 
       


     

       
111
       
 
       
  };

     

       
112
       
 
       


     

       
113
       
 
       
  ###### implementation

     

       
114
       
 
       


     

       
115
       
+
       
  config = lib.mkIf cfg.enable {

     

       
116
       
 
       


     

       
117
       
 
       
    # used to restore dumps

     

       
118
       
 
       
    environment.systemPackages = [ cfg.package ];

     
···

       
124
       
 
       
      environment = {

     

       
125
       
 
       
        MEILI_DB_PATH = "/var/lib/meilisearch";

     

       
126
       
 
       
        MEILI_HTTP_ADDR = "${cfg.listenAddress}:${toString cfg.listenPort}";

     

       
127
       
+
       
        MEILI_NO_ANALYTICS = lib.boolToString cfg.noAnalytics;

     

       
128
       
 
       
        MEILI_ENV = cfg.environment;

     

       
129
       
 
       
        MEILI_DUMP_DIR = "/var/lib/meilisearch/dumps";

     

       
130
       
 
       
        MEILI_LOG_LEVEL = cfg.logLevel;

     
···

       
134
       
 
       
        ExecStart = "${cfg.package}/bin/meilisearch";

     

       
135
       
 
       
        DynamicUser = true;

     

       
136
       
 
       
        StateDirectory = "meilisearch";

     

       
137
       
+
       
        EnvironmentFile = lib.mkIf (cfg.masterKeyEnvironmentFile != null) cfg.masterKeyEnvironmentFile;

     

       
138
       
 
       
      };

     

       
139
       
 
       
    };

     

       
140
       
 
       
  };

     

···

       
4
       
 
       
  pkgs,

     

       
5
       
 
       
  ...

     

       
6
       
 
       
}:

     

       
7
       
-
       


     

       
8
       
-
       
with lib;

     

       
9
       
-
       


     

       
10
       
 
       
let

     

       
11
       
 
       
  cfg = config.services.opensearch;

     

       
12
       
 
       


     
···

       
28
       
 
       
{

     

       
29
       
 
       


     

       
30
       
 
       
  options.services.opensearch = {

     

       
31
       
-
       
    enable = mkEnableOption "OpenSearch";

     

       
32
       
 
       


     

       
33
       
 
       
    package = lib.mkPackageOption pkgs "OpenSearch" {

     

       
34
       
 
       
      default = [ "opensearch" ];

     
···

       
113
       
 
       
        rootLogger.level = info

     

       
114
       
 
       
        rootLogger.appenderRef.console.ref = console

     

       
115
       
 
       
      '';

     

       
116
       
-
       
      type = types.str;

     

       
117
       
 
       
    };

     

       
118
       
 
       


     

       
119
       
 
       
    dataDir = lib.mkOption {

     

       
120
       
 
       
      type = lib.types.path;

     

       
121
       
 
       
      default = "/var/lib/opensearch";

     

       
122
       
-
       
      apply = converge (removeSuffix "/");

     

       
123
       
 
       
      description = ''

     

       
124
       
 
       
        Data directory for OpenSearch. If you change this, you need to

     

       
125
       
 
       
        manually create the directory. You also need to create the

     
···

       
173
       
 
       
    };

     

       
174
       
 
       
  };

     

       
175
       
 
       


     

       
176
       
-
       
  config = mkIf cfg.enable {

     

       
177
       
 
       
    systemd.services.opensearch = {

     

       
178
       
 
       
      description = "OpenSearch Daemon";

     

       
179
       
 
       
      wantedBy = [ "multi-user.target" ];

     
···

       
194
       
 
       
                  set -o errexit -o pipefail -o nounset -o errtrace

     

       
195
       
 
       
                  shopt -s inherit_errexit

     

       
196
       
 
       
                ''

     

       
197
       
-
       
                + (optionalString (!config.boot.isContainer) ''

     

       
198
       
 
       
                  # Only set vm.max_map_count if lower than ES required minimum

     

       
199
       
 
       
                  # This avoids conflict if configured via boot.kernel.sysctl

     

       
200
       
 
       
                  if [ $(${pkgs.procps}/bin/sysctl -n vm.max_map_count) -lt 262144 ]; then

     
···

       
268
       
 
       
          TimeoutStartSec = "infinity";

     

       
269
       
 
       
          DynamicUser = usingDefaultUserAndGroup && usingDefaultDataDir;

     

       
270
       
 
       
        }

     

       
271
       
-
       
        // (optionalAttrs (usingDefaultDataDir) {

     

       
272
       
 
       
          StateDirectory = "opensearch";

     

       
273
       
 
       
          StateDirectoryMode = "0700";

     

       
274
       
 
       
        });

     

···

       
4
       
 
       
  pkgs,

     

       
5
       
 
       
  ...

     

       
6
       
 
       
}:

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
7
       
 
       
let

     

       
8
       
 
       
  cfg = config.services.opensearch;

     

       
9
       
 
       


     
···

       
25
       
 
       
{

     

       
26
       
 
       


     

       
27
       
 
       
  options.services.opensearch = {

     

       
28
       
+
       
    enable = lib.mkEnableOption "OpenSearch";

     

       
29
       
 
       


     

       
30
       
 
       
    package = lib.mkPackageOption pkgs "OpenSearch" {

     

       
31
       
 
       
      default = [ "opensearch" ];

     
···

       
110
       
 
       
        rootLogger.level = info

     

       
111
       
 
       
        rootLogger.appenderRef.console.ref = console

     

       
112
       
 
       
      '';

     

       
113
       
+
       
      type = lib.types.str;

     

       
114
       
 
       
    };

     

       
115
       
 
       


     

       
116
       
 
       
    dataDir = lib.mkOption {

     

       
117
       
 
       
      type = lib.types.path;

     

       
118
       
 
       
      default = "/var/lib/opensearch";

     

       
119
       
+
       
      apply = lib.converge (lib.removeSuffix "/");

     

       
120
       
 
       
      description = ''

     

       
121
       
 
       
        Data directory for OpenSearch. If you change this, you need to

     

       
122
       
 
       
        manually create the directory. You also need to create the

     
···

       
170
       
 
       
    };

     

       
171
       
 
       
  };

     

       
172
       
 
       


     

       
173
       
+
       
  config = lib.mkIf cfg.enable {

     

       
174
       
 
       
    systemd.services.opensearch = {

     

       
175
       
 
       
      description = "OpenSearch Daemon";

     

       
176
       
 
       
      wantedBy = [ "multi-user.target" ];

     
···

       
191
       
 
       
                  set -o errexit -o pipefail -o nounset -o errtrace

     

       
192
       
 
       
                  shopt -s inherit_errexit

     

       
193
       
 
       
                ''

     

       
194
       
+
       
                + (lib.optionalString (!config.boot.isContainer) ''

     

       
195
       
 
       
                  # Only set vm.max_map_count if lower than ES required minimum

     

       
196
       
 
       
                  # This avoids conflict if configured via boot.kernel.sysctl

     

       
197
       
 
       
                  if [ $(${pkgs.procps}/bin/sysctl -n vm.max_map_count) -lt 262144 ]; then

     
···

       
265
       
 
       
          TimeoutStartSec = "infinity";

     

       
266
       
 
       
          DynamicUser = usingDefaultUserAndGroup && usingDefaultDataDir;

     

       
267
       
 
       
        }

     

       
268
       
+
       
        // (lib.optionalAttrs (usingDefaultDataDir) {

     

       
269
       
 
       
          StateDirectory = "opensearch";

     

       
270
       
 
       
          StateDirectoryMode = "0700";

     

       
271
       
 
       
        });

     

···

       
4
       
 
       
  pkgs,

     

       
5
       
 
       
  ...

     

       
6
       
 
       
}:

     

       
7
       
-
       


     

       
8
       
-
       
with lib;

     

       
9
       
 
       
let

     

       
10
       
 
       


     

       
11
       
 
       
  cfg = config.services.qdrant;

     
···

       
17
       
 
       


     

       
18
       
 
       
  options = {

     

       
19
       
 
       
    services.qdrant = {

     

       
20
       
-
       
      enable = mkEnableOption "Vector Search Engine for the next generation of AI applications";

     

       
21
       
 
       


     

       
22
       
-
       
      settings = mkOption {

     

       
23
       
 
       
        description = ''

     

       
24
       
 
       
          Configuration for Qdrant

     

       
25
       
 
       
          Refer to <https://github.com/qdrant/qdrant/blob/master/config/config.yaml> for details on supported values.

     
···

       
43
       
 
       
          telemetry_disabled = true;

     

       
44
       
 
       
        };

     

       
45
       
 
       


     

       
46
       
-
       
        defaultText = literalExpression ''

     

       
47
       
 
       
          {

     

       
48
       
 
       
            storage = {

     

       
49
       
 
       
              storage_path = "/var/lib/qdrant/storage";

     
···

       
64
       
 
       
    };

     

       
65
       
 
       
  };

     

       
66
       
 
       


     

       
67
       
-
       
  config = mkIf cfg.enable {

     

       
68
       
 
       
    services.qdrant.settings = {

     

       
69
       
-
       
      service.static_content_dir = mkDefault pkgs.qdrant-web-ui;

     

       
70
       
-
       
      storage.storage_path = mkDefault "/var/lib/qdrant/storage";

     

       
71
       
-
       
      storage.snapshots_path = mkDefault "/var/lib/qdrant/snapshots";

     

       
72
       
 
       
      # The following default values are the same as in the default config,

     

       
73
       
 
       
      # they are just written here for convenience.

     

       
74
       
-
       
      storage.on_disk_payload = mkDefault true;

     

       
75
       
-
       
      storage.wal.wal_capacity_mb = mkDefault 32;

     

       
76
       
-
       
      storage.wal.wal_segments_ahead = mkDefault 0;

     

       
77
       
-
       
      storage.performance.max_search_threads = mkDefault 0;

     

       
78
       
-
       
      storage.performance.max_optimization_threads = mkDefault 1;

     

       
79
       
-
       
      storage.optimizers.deleted_threshold = mkDefault 0.2;

     

       
80
       
-
       
      storage.optimizers.vacuum_min_vector_number = mkDefault 1000;

     

       
81
       
-
       
      storage.optimizers.default_segment_number = mkDefault 0;

     

       
82
       
-
       
      storage.optimizers.max_segment_size_kb = mkDefault null;

     

       
83
       
-
       
      storage.optimizers.memmap_threshold_kb = mkDefault null;

     

       
84
       
-
       
      storage.optimizers.indexing_threshold_kb = mkDefault 20000;

     

       
85
       
-
       
      storage.optimizers.flush_interval_sec = mkDefault 5;

     

       
86
       
-
       
      storage.optimizers.max_optimization_threads = mkDefault 1;

     

       
87
       
-
       
      storage.hnsw_index.m = mkDefault 16;

     

       
88
       
-
       
      storage.hnsw_index.ef_construct = mkDefault 100;

     

       
89
       
-
       
      storage.hnsw_index.full_scan_threshold_kb = mkDefault 10000;

     

       
90
       
-
       
      storage.hnsw_index.max_indexing_threads = mkDefault 0;

     

       
91
       
-
       
      storage.hnsw_index.on_disk = mkDefault false;

     

       
92
       
-
       
      storage.hnsw_index.payload_m = mkDefault null;

     

       
93
       
-
       
      service.max_request_size_mb = mkDefault 32;

     

       
94
       
-
       
      service.max_workers = mkDefault 0;

     

       
95
       
-
       
      service.http_port = mkDefault 6333;

     

       
96
       
-
       
      service.grpc_port = mkDefault 6334;

     

       
97
       
-
       
      service.enable_cors = mkDefault true;

     

       
98
       
-
       
      cluster.enabled = mkDefault false;

     

       
99
       
 
       
      # the following have been altered for security

     

       
100
       
-
       
      service.host = mkDefault "127.0.0.1";

     

       
101
       
-
       
      telemetry_disabled = mkDefault true;

     

       
102
       
 
       
    };

     

       
103
       
 
       


     

       
104
       
 
       
    systemd.services.qdrant = {

     

···

       
4
       
 
       
  pkgs,

     

       
5
       
 
       
  ...

     

       
6
       
 
       
}:

     

       
0
       
 
       

     

       
0
       
 
       

     

       
7
       
 
       
let

     

       
8
       
 
       


     

       
9
       
 
       
  cfg = config.services.qdrant;

     
···

       
15
       
 
       


     

       
16
       
 
       
  options = {

     

       
17
       
 
       
    services.qdrant = {

     

       
18
       
+
       
      enable = lib.mkEnableOption "Vector Search Engine for the next generation of AI applications";

     

       
19
       
 
       


     

       
20
       
+
       
      settings = lib.mkOption {

     

       
21
       
 
       
        description = ''

     

       
22
       
 
       
          Configuration for Qdrant

     

       
23
       
 
       
          Refer to <https://github.com/qdrant/qdrant/blob/master/config/config.yaml> for details on supported values.

     
···

       
41
       
 
       
          telemetry_disabled = true;

     

       
42
       
 
       
        };

     

       
43
       
 
       


     

       
44
       
+
       
        defaultText = lib.literalExpression ''

     

       
45
       
 
       
          {

     

       
46
       
 
       
            storage = {

     

       
47
       
 
       
              storage_path = "/var/lib/qdrant/storage";

     
···

       
62
       
 
       
    };

     

       
63
       
 
       
  };

     

       
64
       
 
       


     

       
65
       
+
       
  config = lib.mkIf cfg.enable {

     

       
66
       
 
       
    services.qdrant.settings = {

     

       
67
       
+
       
      service.static_content_dir = lib.mkDefault pkgs.qdrant-web-ui;

     

       
68
       
+
       
      storage.storage_path = lib.mkDefault "/var/lib/qdrant/storage";

     

       
69
       
+
       
      storage.snapshots_path = lib.mkDefault "/var/lib/qdrant/snapshots";

     

       
70
       
 
       
      # The following default values are the same as in the default config,

     

       
71
       
 
       
      # they are just written here for convenience.

     

       
72
       
+
       
      storage.on_disk_payload = lib.mkDefault true;

     

       
73
       
+
       
      storage.wal.wal_capacity_mb = lib.mkDefault 32;

     

       
74
       
+
       
      storage.wal.wal_segments_ahead = lib.mkDefault 0;

     

       
75
       
+
       
      storage.performance.max_search_threads = lib.mkDefault 0;

     

       
76
       
+
       
      storage.performance.max_optimization_threads = lib.mkDefault 1;

     

       
77
       
+
       
      storage.optimizers.deleted_threshold = lib.mkDefault 0.2;

     

       
78
       
+
       
      storage.optimizers.vacuum_min_vector_number = lib.mkDefault 1000;

     

       
79
       
+
       
      storage.optimizers.default_segment_number = lib.mkDefault 0;

     

       
80
       
+
       
      storage.optimizers.max_segment_size_kb = lib.mkDefault null;

     

       
81
       
+
       
      storage.optimizers.memmap_threshold_kb = lib.mkDefault null;

     

       
82
       
+
       
      storage.optimizers.indexing_threshold_kb = lib.mkDefault 20000;

     

       
83
       
+
       
      storage.optimizers.flush_interval_sec = lib.mkDefault 5;

     

       
84
       
+
       
      storage.optimizers.max_optimization_threads = lib.mkDefault 1;

     

       
85
       
+
       
      storage.hnsw_index.m = lib.mkDefault 16;

     

       
86
       
+
       
      storage.hnsw_index.ef_construct = lib.mkDefault 100;

     

       
87
       
+
       
      storage.hnsw_index.full_scan_threshold_kb = lib.mkDefault 10000;

     

       
88
       
+
       
      storage.hnsw_index.max_indexing_threads = lib.mkDefault 0;

     

       
89
       
+
       
      storage.hnsw_index.on_disk = lib.mkDefault false;

     

       
90
       
+
       
      storage.hnsw_index.payload_m = lib.mkDefault null;

     

       
91
       
+
       
      service.max_request_size_mb = lib.mkDefault 32;

     

       
92
       
+
       
      service.max_workers = lib.mkDefault 0;

     

       
93
       
+
       
      service.http_port = lib.mkDefault 6333;

     

       
94
       
+
       
      service.grpc_port = lib.mkDefault 6334;

     

       
95
       
+
       
      service.enable_cors = lib.mkDefault true;

     

       
96
       
+
       
      cluster.enabled = lib.mkDefault false;

     

       
97
       
 
       
      # the following have been altered for security

     

       
98
       
+
       
      service.host = lib.mkDefault "127.0.0.1";

     

       
99
       
+
       
      telemetry_disabled = lib.mkDefault true;

     

       
100
       
 
       
    };

     

       
101
       
 
       


     

       
102
       
 
       
    systemd.services.qdrant = {

     

···

       
4
       
 
       
  pkgs,

     

       
5
       
 
       
  ...

     

       
6
       
 
       
}:

     

       
7
       
-
       


     

       
8
       
-
       
with lib;

     

       
9
       
-
       


     

       
10
       
 
       
let

     

       
11
       
 
       
  cfg = config.services.quickwit;

     

       
12
       
 
       


     
···

       
19
       
 
       
{

     

       
20
       
 
       


     

       
21
       
 
       
  options.services.quickwit = {

     

       
22
       
-
       
    enable = mkEnableOption "Quickwit";

     

       
23
       
 
       


     

       
24
       
 
       
    package = lib.mkPackageOption pkgs "Quickwit" {

     

       
25
       
 
       
      default = [ "quickwit" ];

     
···

       
83
       
 
       
    dataDir = lib.mkOption {

     

       
84
       
 
       
      type = lib.types.path;

     

       
85
       
 
       
      default = "/var/lib/quickwit";

     

       
86
       
-
       
      apply = converge (removeSuffix "/");

     

       
87
       
 
       
      description = ''

     

       
88
       
 
       
        Data directory for Quickwit. If you change this, you need to

     

       
89
       
 
       
        manually create the directory. You also need to create the

     
···

       
130
       
 
       
    };

     

       
131
       
 
       
  };

     

       
132
       
 
       


     

       
133
       
-
       
  config = mkIf cfg.enable {

     

       
134
       
 
       
    systemd.services.quickwit = {

     

       
135
       
 
       
      description = "Quickwit";

     

       
136
       
 
       
      wantedBy = [ "multi-user.target" ];

     
···

       
143
       
 
       
        {

     

       
144
       
 
       
          ExecStart = ''

     

       
145
       
 
       
            ${cfg.package}/bin/quickwit run --config ${quickwitYml} \

     

       
146
       
-
       
            ${escapeShellArgs cfg.extraFlags}

     

       
147
       
 
       
          '';

     

       
148
       
 
       
          User = cfg.user;

     

       
149
       
 
       
          Group = cfg.group;

     
···

       
186
       
 
       
            "@chown"

     

       
187
       
 
       
          ];

     

       
188
       
 
       
        }

     

       
189
       
-
       
        // (optionalAttrs (usingDefaultDataDir) {

     

       
190
       
 
       
          StateDirectory = "quickwit";

     

       
191
       
 
       
          StateDirectoryMode = "0700";

     

       
192
       
 
       
        });

     

···

       
4
       
 
       
  pkgs,

     

       
5
       
 
       
  ...

     

       
6
       
 
       
}:

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
7
       
 
       
let

     

       
8
       
 
       
  cfg = config.services.quickwit;

     

       
9
       
 
       


     
···

       
16
       
 
       
{

     

       
17
       
 
       


     

       
18
       
 
       
  options.services.quickwit = {

     

       
19
       
+
       
    enable = lib.mkEnableOption "Quickwit";

     

       
20
       
 
       


     

       
21
       
 
       
    package = lib.mkPackageOption pkgs "Quickwit" {

     

       
22
       
 
       
      default = [ "quickwit" ];

     
···

       
80
       
 
       
    dataDir = lib.mkOption {

     

       
81
       
 
       
      type = lib.types.path;

     

       
82
       
 
       
      default = "/var/lib/quickwit";

     

       
83
       
+
       
      apply = lib.converge (lib.removeSuffix "/");

     

       
84
       
 
       
      description = ''

     

       
85
       
 
       
        Data directory for Quickwit. If you change this, you need to

     

       
86
       
 
       
        manually create the directory. You also need to create the

     
···

       
127
       
 
       
    };

     

       
128
       
 
       
  };

     

       
129
       
 
       


     

       
130
       
+
       
  config = lib.mkIf cfg.enable {

     

       
131
       
 
       
    systemd.services.quickwit = {

     

       
132
       
 
       
      description = "Quickwit";

     

       
133
       
 
       
      wantedBy = [ "multi-user.target" ];

     
···

       
140
       
 
       
        {

     

       
141
       
 
       
          ExecStart = ''

     

       
142
       
 
       
            ${cfg.package}/bin/quickwit run --config ${quickwitYml} \

     

       
143
       
+
       
            ${lib.escapeShellArgs cfg.extraFlags}

     

       
144
       
 
       
          '';

     

       
145
       
 
       
          User = cfg.user;

     

       
146
       
 
       
          Group = cfg.group;

     
···

       
183
       
 
       
            "@chown"

     

       
184
       
 
       
          ];

     

       
185
       
 
       
        }

     

       
186
       
+
       
        // (lib.optionalAttrs (usingDefaultDataDir) {

     

       
187
       
 
       
          StateDirectory = "quickwit";

     

       
188
       
 
       
          StateDirectoryMode = "0700";

     

       
189
       
 
       
        });

     

···

       
4
       
 
       
  pkgs,

     

       
5
       
 
       
  ...

     

       
6
       
 
       
}:

     

       
7
       
-
       


     

       
8
       
-
       
with lib;

     

       
9
       
-
       


     

       
10
       
 
       
let

     

       
11
       
 
       
  cfg = config.services.certmgr;

     

       
12
       
 
       


     

       
13
       
-
       
  specs = mapAttrsToList (n: v: rec {

     

       
14
       
 
       
    name = n + ".json";

     

       
15
       
-
       
    path = if isAttrs v then pkgs.writeText name (builtins.toJSON v) else v;

     

       
16
       
 
       
  }) cfg.specs;

     

       
17
       
 
       


     

       
18
       
 
       
  allSpecs = pkgs.linkFarm "certmgr.d" specs;

     
···

       
29
       
 
       
  );

     

       
30
       
 
       


     

       
31
       
 
       
  specPaths = map dirOf (

     

       
32
       
-
       
    concatMap (

     

       
33
       
 
       
      spec:

     

       
34
       
-
       
      if isAttrs spec then

     

       
35
       
-
       
        collect isString (filterAttrsRecursive (n: v: isAttrs v || n == "path") spec)

     

       
36
       
 
       
      else

     

       
37
       
 
       
        [ spec ]

     

       
38
       
-
       
    ) (attrValues cfg.specs)

     

       
39
       
 
       
  );

     

       
40
       
 
       


     

       
41
       
 
       
  preStart = ''

     

       
42
       
-
       
    ${concatStringsSep " \\\n" ([ "mkdir -p" ] ++ map escapeShellArg specPaths)}

     

       
43
       
 
       
    ${cfg.package}/bin/certmgr -f ${certmgrYaml} check

     

       
44
       
 
       
  '';

     

       
45
       
 
       
in

     

       
46
       
 
       
{

     

       
47
       
 
       
  options.services.certmgr = {

     

       
48
       
-
       
    enable = mkEnableOption "certmgr";

     

       
49
       
 
       


     

       
50
       
-
       
    package = mkPackageOption pkgs "certmgr" { };

     

       
51
       
 
       


     

       
52
       
-
       
    defaultRemote = mkOption {

     

       
53
       
-
       
      type = types.str;

     

       
54
       
 
       
      default = "127.0.0.1:8888";

     

       
55
       
 
       
      description = "The default CA host:port to use.";

     

       
56
       
 
       
    };

     

       
57
       
 
       


     

       
58
       
-
       
    validMin = mkOption {

     

       
59
       
 
       
      default = "72h";

     

       
60
       
-
       
      type = types.str;

     

       
61
       
 
       
      description = "The interval before a certificate expires to start attempting to renew it.";

     

       
62
       
 
       
    };

     

       
63
       
 
       


     

       
64
       
-
       
    renewInterval = mkOption {

     

       
65
       
 
       
      default = "30m";

     

       
66
       
-
       
      type = types.str;

     

       
67
       
 
       
      description = "How often to check certificate expirations and how often to update the cert_next_expires metric.";

     

       
68
       
 
       
    };

     

       
69
       
 
       


     

       
70
       
-
       
    metricsAddress = mkOption {

     

       
71
       
 
       
      default = "127.0.0.1";

     

       
72
       
-
       
      type = types.str;

     

       
73
       
 
       
      description = "The address for the Prometheus HTTP endpoint.";

     

       
74
       
 
       
    };

     

       
75
       
 
       


     

       
76
       
-
       
    metricsPort = mkOption {

     

       
77
       
 
       
      default = 9488;

     

       
78
       
-
       
      type = types.ints.u16;

     

       
79
       
 
       
      description = "The port for the Prometheus HTTP endpoint.";

     

       
80
       
 
       
    };

     

       
81
       
 
       


     

       
82
       
-
       
    specs = mkOption {

     

       
83
       
 
       
      default = { };

     

       
84
       
-
       
      example = literalExpression ''

     

       
85
       
 
       
        {

     

       
86
       
 
       
          exampleCert =

     

       
87
       
 
       
          let

     
···

       
119
       
 
       
        }

     

       
120
       
 
       
      '';

     

       
121
       
 
       
      type =

     

       
122
       
-
       
        with types;

     

       
123
       
 
       
        attrsOf (

     

       
124
       
 
       
          either path (submodule {

     

       
125
       
 
       
            options = {

     

       
126
       
-
       
              service = mkOption {

     

       
127
       
 
       
                type = nullOr str;

     

       
128
       
 
       
                default = null;

     

       
129
       
 
       
                description = "The service on which to perform \<action\> after fetching.";

     

       
130
       
 
       
              };

     

       
131
       
 
       


     

       
132
       
-
       
              action = mkOption {

     

       
133
       
 
       
                type = addCheck str (

     

       
134
       
 
       
                  x:

     

       
135
       
 
       
                  cfg.svcManager == "command"

     
···

       
144
       
 
       
              };

     

       
145
       
 
       


     

       
146
       
 
       
              # These ought all to be specified according to certmgr spec def.

     

       
147
       
-
       
              authority = mkOption {

     

       
148
       
 
       
                type = attrs;

     

       
149
       
 
       
                description = "certmgr spec authority object.";

     

       
150
       
 
       
              };

     

       
151
       
 
       


     

       
152
       
-
       
              certificate = mkOption {

     

       
153
       
 
       
                type = nullOr attrs;

     

       
154
       
 
       
                description = "certmgr spec certificate object.";

     

       
155
       
 
       
              };

     

       
156
       
 
       


     

       
157
       
-
       
              private_key = mkOption {

     

       
158
       
 
       
                type = nullOr attrs;

     

       
159
       
 
       
                description = "certmgr spec private_key object.";

     

       
160
       
 
       
              };

     

       
161
       
 
       


     

       
162
       
-
       
              request = mkOption {

     

       
163
       
 
       
                type = nullOr attrs;

     

       
164
       
 
       
                description = "certmgr spec request object.";

     

       
165
       
 
       
              };

     
···

       
173
       
 
       
      '';

     

       
174
       
 
       
    };

     

       
175
       
 
       


     

       
176
       
-
       
    svcManager = mkOption {

     

       
177
       
 
       
      default = "systemd";

     

       
178
       
-
       
      type = types.enum [

     

       
179
       
 
       
        "circus"

     

       
180
       
 
       
        "command"

     

       
181
       
 
       
        "dummy"

     
···

       
193
       
 
       


     

       
194
       
 
       
  };

     

       
195
       
 
       


     

       
196
       
-
       
  config = mkIf cfg.enable {

     

       
197
       
 
       
    assertions = [

     

       
198
       
 
       
      {

     

       
199
       
 
       
        assertion = cfg.specs != { };

     
···

       
201
       
 
       
      }

     

       
202
       
 
       
      {

     

       
203
       
 
       
        assertion =

     

       
204
       
-
       
          !any (hasAttrByPath [

     

       
205
       
 
       
            "authority"

     

       
206
       
 
       
            "auth_key"

     

       
207
       
-
       
          ]) (attrValues cfg.specs);

     

       
208
       
 
       
        message = ''

     

       
209
       
 
       
          Inline services.certmgr.specs are added to the Nix store rendering them world readable.

     

       
210
       
 
       
          Specify paths as specs, if you want to use include auth_key - or use the auth_key_file option."

     
···

       
214
       
 
       


     

       
215
       
 
       
    systemd.services.certmgr = {

     

       
216
       
 
       
      description = "certmgr";

     

       
217
       
-
       
      path = mkIf (cfg.svcManager == "command") [ pkgs.bash ];

     

       
218
       
 
       
      wants = [ "network-online.target" ];

     

       
219
       
 
       
      after = [ "network-online.target" ];

     

       
220
       
 
       
      wantedBy = [ "multi-user.target" ];

     

···

       
4
       
 
       
  pkgs,

     

       
5
       
 
       
  ...

     

       
6
       
 
       
}:

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
7
       
 
       
let

     

       
8
       
 
       
  cfg = config.services.certmgr;

     

       
9
       
 
       


     

       
10
       
+
       
  specs = lib.mapAttrsToList (n: v: rec {

     

       
11
       
 
       
    name = n + ".json";

     

       
12
       
+
       
    path = if lib.isAttrs v then pkgs.writeText name (builtins.toJSON v) else v;

     

       
13
       
 
       
  }) cfg.specs;

     

       
14
       
 
       


     

       
15
       
 
       
  allSpecs = pkgs.linkFarm "certmgr.d" specs;

     
···

       
26
       
 
       
  );

     

       
27
       
 
       


     

       
28
       
 
       
  specPaths = map dirOf (

     

       
29
       
+
       
    lib.concatMap (

     

       
30
       
 
       
      spec:

     

       
31
       
+
       
      if lib.isAttrs spec then

     

       
32
       
+
       
        lib.collect lib.isString (lib.filterAttrsRecursive (n: v: lib.isAttrs v || n == "path") spec)

     

       
33
       
 
       
      else

     

       
34
       
 
       
        [ spec ]

     

       
35
       
+
       
    ) (lib.attrValues cfg.specs)

     

       
36
       
 
       
  );

     

       
37
       
 
       


     

       
38
       
 
       
  preStart = ''

     

       
39
       
+
       
    ${lib.concatStringsSep " \\\n" ([ "mkdir -p" ] ++ map lib.escapeShellArg specPaths)}

     

       
40
       
 
       
    ${cfg.package}/bin/certmgr -f ${certmgrYaml} check

     

       
41
       
 
       
  '';

     

       
42
       
 
       
in

     

       
43
       
 
       
{

     

       
44
       
 
       
  options.services.certmgr = {

     

       
45
       
+
       
    enable = lib.mkEnableOption "certmgr";

     

       
46
       
 
       


     

       
47
       
+
       
    package = lib.mkPackageOption pkgs "certmgr" { };

     

       
48
       
 
       


     

       
49
       
+
       
    defaultRemote = lib.mkOption {

     

       
50
       
+
       
      type = lib.types.str;

     

       
51
       
 
       
      default = "127.0.0.1:8888";

     

       
52
       
 
       
      description = "The default CA host:port to use.";

     

       
53
       
 
       
    };

     

       
54
       
 
       


     

       
55
       
+
       
    validMin = lib.mkOption {

     

       
56
       
 
       
      default = "72h";

     

       
57
       
+
       
      type = lib.types.str;

     

       
58
       
 
       
      description = "The interval before a certificate expires to start attempting to renew it.";

     

       
59
       
 
       
    };

     

       
60
       
 
       


     

       
61
       
+
       
    renewInterval = lib.mkOption {

     

       
62
       
 
       
      default = "30m";

     

       
63
       
+
       
      type = lib.types.str;

     

       
64
       
 
       
      description = "How often to check certificate expirations and how often to update the cert_next_expires metric.";

     

       
65
       
 
       
    };

     

       
66
       
 
       


     

       
67
       
+
       
    metricsAddress = lib.mkOption {

     

       
68
       
 
       
      default = "127.0.0.1";

     

       
69
       
+
       
      type = lib.types.str;

     

       
70
       
 
       
      description = "The address for the Prometheus HTTP endpoint.";

     

       
71
       
 
       
    };

     

       
72
       
 
       


     

       
73
       
+
       
    metricsPort = lib.mkOption {

     

       
74
       
 
       
      default = 9488;

     

       
75
       
+
       
      type = lib.types.ints.u16;

     

       
76
       
 
       
      description = "The port for the Prometheus HTTP endpoint.";

     

       
77
       
 
       
    };

     

       
78
       
 
       


     

       
79
       
+
       
    specs = lib.mkOption {

     

       
80
       
 
       
      default = { };

     

       
81
       
+
       
      example = lib.literalExpression ''

     

       
82
       
 
       
        {

     

       
83
       
 
       
          exampleCert =

     

       
84
       
 
       
          let

     
···

       
116
       
 
       
        }

     

       
117
       
 
       
      '';

     

       
118
       
 
       
      type =

     

       
119
       
+
       
        with lib.types;

     

       
120
       
 
       
        attrsOf (

     

       
121
       
 
       
          either path (submodule {

     

       
122
       
 
       
            options = {

     

       
123
       
+
       
              service = lib.mkOption {

     

       
124
       
 
       
                type = nullOr str;

     

       
125
       
 
       
                default = null;

     

       
126
       
 
       
                description = "The service on which to perform \<action\> after fetching.";

     

       
127
       
 
       
              };

     

       
128
       
 
       


     

       
129
       
+
       
              action = lib.mkOption {

     

       
130
       
 
       
                type = addCheck str (

     

       
131
       
 
       
                  x:

     

       
132
       
 
       
                  cfg.svcManager == "command"

     
···

       
141
       
 
       
              };

     

       
142
       
 
       


     

       
143
       
 
       
              # These ought all to be specified according to certmgr spec def.

     

       
144
       
+
       
              authority = lib.mkOption {

     

       
145
       
 
       
                type = attrs;

     

       
146
       
 
       
                description = "certmgr spec authority object.";

     

       
147
       
 
       
              };

     

       
148
       
 
       


     

       
149
       
+
       
              certificate = lib.mkOption {

     

       
150
       
 
       
                type = nullOr attrs;

     

       
151
       
 
       
                description = "certmgr spec certificate object.";

     

       
152
       
 
       
              };

     

       
153
       
 
       


     

       
154
       
+
       
              private_key = lib.mkOption {

     

       
155
       
 
       
                type = nullOr attrs;

     

       
156
       
 
       
                description = "certmgr spec private_key object.";

     

       
157
       
 
       
              };

     

       
158
       
 
       


     

       
159
       
+
       
              request = lib.mkOption {

     

       
160
       
 
       
                type = nullOr attrs;

     

       
161
       
 
       
                description = "certmgr spec request object.";

     

       
162
       
 
       
              };

     
···

       
170
       
 
       
      '';

     

       
171
       
 
       
    };

     

       
172
       
 
       


     

       
173
       
+
       
    svcManager = lib.mkOption {

     

       
174
       
 
       
      default = "systemd";

     

       
175
       
+
       
      type = lib.types.enum [

     

       
176
       
 
       
        "circus"

     

       
177
       
 
       
        "command"

     

       
178
       
 
       
        "dummy"

     
···

       
190
       
 
       


     

       
191
       
 
       
  };

     

       
192
       
 
       


     

       
193
       
+
       
  config = lib.mkIf cfg.enable {

     

       
194
       
 
       
    assertions = [

     

       
195
       
 
       
      {

     

       
196
       
 
       
        assertion = cfg.specs != { };

     
···

       
198
       
 
       
      }

     

       
199
       
 
       
      {

     

       
200
       
 
       
        assertion =

     

       
201
       
+
       
          !lib.any (lib.hasAttrByPath [

     

       
202
       
 
       
            "authority"

     

       
203
       
 
       
            "auth_key"

     

       
204
       
+
       
          ]) (lib.attrValues cfg.specs);

     

       
205
       
 
       
        message = ''

     

       
206
       
 
       
          Inline services.certmgr.specs are added to the Nix store rendering them world readable.

     

       
207
       
 
       
          Specify paths as specs, if you want to use include auth_key - or use the auth_key_file option."

     
···

       
211
       
 
       


     

       
212
       
 
       
    systemd.services.certmgr = {

     

       
213
       
 
       
      description = "certmgr";

     

       
214
       
+
       
      path = lib.mkIf (cfg.svcManager == "command") [ pkgs.bash ];

     

       
215
       
 
       
      wants = [ "network-online.target" ];

     

       
216
       
 
       
      after = [ "network-online.target" ];

     

       
217
       
 
       
      wantedBy = [ "multi-user.target" ];

     

···

       
5
       
 
       
  pkgs,

     

       
6
       
 
       
  ...

     

       
7
       
 
       
}:

     

       
8
       
-
       


     

       
9
       
-
       
with lib;

     

       
10
       
-
       


     

       
11
       
 
       
let

     

       
12
       
 
       
  cfg = config.services.cfssl;

     

       
13
       
 
       
in

     

       
14
       
 
       
{

     

       
15
       
 
       
  options.services.cfssl = {

     

       
16
       
-
       
    enable = mkEnableOption "the CFSSL CA api-server";

     

       
17
       
 
       


     

       
18
       
-
       
    dataDir = mkOption {

     

       
19
       
 
       
      default = "/var/lib/cfssl";

     

       
20
       
-
       
      type = types.path;

     

       
21
       
 
       
      description = ''

     

       
22
       
 
       
        The work directory for CFSSL.

     

       
23
       
 
       


     
···

       
30
       
 
       
      '';

     

       
31
       
 
       
    };

     

       
32
       
 
       


     

       
33
       
-
       
    address = mkOption {

     

       
34
       
 
       
      default = "127.0.0.1";

     

       
35
       
-
       
      type = types.str;

     

       
36
       
 
       
      description = "Address to bind.";

     

       
37
       
 
       
    };

     

       
38
       
 
       


     

       
39
       
-
       
    port = mkOption {

     

       
40
       
 
       
      default = 8888;

     

       
41
       
-
       
      type = types.port;

     

       
42
       
 
       
      description = "Port to bind.";

     

       
43
       
 
       
    };

     

       
44
       
 
       


     

       
45
       
-
       
    ca = mkOption {

     

       
46
       
-
       
      defaultText = literalExpression ''"''${cfg.dataDir}/ca.pem"'';

     

       
47
       
-
       
      type = types.str;

     

       
48
       
 
       
      description = "CA used to sign the new certificate -- accepts '[file:]fname' or 'env:varname'.";

     

       
49
       
 
       
    };

     

       
50
       
 
       


     

       
51
       
-
       
    caKey = mkOption {

     

       
52
       
-
       
      defaultText = literalExpression ''"file:''${cfg.dataDir}/ca-key.pem"'';

     

       
53
       
-
       
      type = types.str;

     

       
54
       
 
       
      description = "CA private key -- accepts '[file:]fname' or 'env:varname'.";

     

       
55
       
 
       
    };

     

       
56
       
 
       


     

       
57
       
-
       
    caBundle = mkOption {

     

       
58
       
 
       
      default = null;

     

       
59
       
-
       
      type = types.nullOr types.path;

     

       
60
       
 
       
      description = "Path to root certificate store.";

     

       
61
       
 
       
    };

     

       
62
       
 
       


     

       
63
       
-
       
    intBundle = mkOption {

     

       
64
       
 
       
      default = null;

     

       
65
       
-
       
      type = types.nullOr types.path;

     

       
66
       
 
       
      description = "Path to intermediate certificate store.";

     

       
67
       
 
       
    };

     

       
68
       
 
       


     

       
69
       
-
       
    intDir = mkOption {

     

       
70
       
 
       
      default = null;

     

       
71
       
-
       
      type = types.nullOr types.path;

     

       
72
       
 
       
      description = "Intermediates directory.";

     

       
73
       
 
       
    };

     

       
74
       
 
       


     

       
75
       
-
       
    metadata = mkOption {

     

       
76
       
 
       
      default = null;

     

       
77
       
-
       
      type = types.nullOr types.path;

     

       
78
       
 
       
      description = ''

     

       
79
       
 
       
        Metadata file for root certificate presence.

     

       
80
       
 
       
        The content of the file is a json dictionary (k,v): each key k is

     
···

       
83
       
 
       
      '';

     

       
84
       
 
       
    };

     

       
85
       
 
       


     

       
86
       
-
       
    remote = mkOption {

     

       
87
       
 
       
      default = null;

     

       
88
       
-
       
      type = types.nullOr types.str;

     

       
89
       
 
       
      description = "Remote CFSSL server.";

     

       
90
       
 
       
    };

     

       
91
       
 
       


     

       
92
       
-
       
    configFile = mkOption {

     

       
93
       
 
       
      default = null;

     

       
94
       
-
       
      type = types.nullOr types.str;

     

       
95
       
 
       
      description = "Path to configuration file. Do not put this in nix-store as it might contain secrets.";

     

       
96
       
 
       
    };

     

       
97
       
 
       


     

       
98
       
-
       
    responder = mkOption {

     

       
99
       
 
       
      default = null;

     

       
100
       
-
       
      type = types.nullOr types.path;

     

       
101
       
 
       
      description = "Certificate for OCSP responder.";

     

       
102
       
 
       
    };

     

       
103
       
 
       


     

       
104
       
-
       
    responderKey = mkOption {

     

       
105
       
 
       
      default = null;

     

       
106
       
-
       
      type = types.nullOr types.str;

     

       
107
       
 
       
      description = "Private key for OCSP responder certificate. Do not put this in nix-store.";

     

       
108
       
 
       
    };

     

       
109
       
 
       


     

       
110
       
-
       
    tlsKey = mkOption {

     

       
111
       
 
       
      default = null;

     

       
112
       
-
       
      type = types.nullOr types.str;

     

       
113
       
 
       
      description = "Other endpoint's CA private key. Do not put this in nix-store.";

     

       
114
       
 
       
    };

     

       
115
       
 
       


     

       
116
       
-
       
    tlsCert = mkOption {

     

       
117
       
 
       
      default = null;

     

       
118
       
-
       
      type = types.nullOr types.path;

     

       
119
       
 
       
      description = "Other endpoint's CA to set up TLS protocol.";

     

       
120
       
 
       
    };

     

       
121
       
 
       


     

       
122
       
-
       
    mutualTlsCa = mkOption {

     

       
123
       
 
       
      default = null;

     

       
124
       
-
       
      type = types.nullOr types.path;

     

       
125
       
 
       
      description = "Mutual TLS - require clients be signed by this CA.";

     

       
126
       
 
       
    };

     

       
127
       
 
       


     

       
128
       
-
       
    mutualTlsCn = mkOption {

     

       
129
       
 
       
      default = null;

     

       
130
       
-
       
      type = types.nullOr types.str;

     

       
131
       
 
       
      description = "Mutual TLS - regex for whitelist of allowed client CNs.";

     

       
132
       
 
       
    };

     

       
133
       
 
       


     

       
134
       
-
       
    tlsRemoteCa = mkOption {

     

       
135
       
 
       
      default = null;

     

       
136
       
-
       
      type = types.nullOr types.path;

     

       
137
       
 
       
      description = "CAs to trust for remote TLS requests.";

     

       
138
       
 
       
    };

     

       
139
       
 
       


     

       
140
       
-
       
    mutualTlsClientCert = mkOption {

     

       
141
       
 
       
      default = null;

     

       
142
       
-
       
      type = types.nullOr types.path;

     

       
143
       
 
       
      description = "Mutual TLS - client certificate to call remote instance requiring client certs.";

     

       
144
       
 
       
    };

     

       
145
       
 
       


     

       
146
       
-
       
    mutualTlsClientKey = mkOption {

     

       
147
       
 
       
      default = null;

     

       
148
       
-
       
      type = types.nullOr types.path;

     

       
149
       
 
       
      description = "Mutual TLS - client key to call remote instance requiring client certs. Do not put this in nix-store.";

     

       
150
       
 
       
    };

     

       
151
       
 
       


     

       
152
       
-
       
    dbConfig = mkOption {

     

       
153
       
 
       
      default = null;

     

       
154
       
-
       
      type = types.nullOr types.path;

     

       
155
       
 
       
      description = "Certificate db configuration file. Path must be writeable.";

     

       
156
       
 
       
    };

     

       
157
       
 
       


     

       
158
       
-
       
    logLevel = mkOption {

     

       
159
       
 
       
      default = 1;

     

       
160
       
-
       
      type = types.enum [

     

       
161
       
 
       
        0

     

       
162
       
 
       
        1

     

       
163
       
 
       
        2

     
···

       
169
       
 
       
    };

     

       
170
       
 
       
  };

     

       
171
       
 
       


     

       
172
       
-
       
  config = mkIf cfg.enable {

     

       
173
       
 
       
    users.groups.cfssl = {

     

       
174
       
 
       
      gid = config.ids.gids.cfssl;

     

       
175
       
 
       
    };

     
···

       
223
       
 
       
              (opt "loglevel" (toString logLevel))

     

       
224
       
 
       
            ];

     

       
225
       
 
       
        }

     

       
226
       
-
       
        (mkIf (cfg.dataDir == options.services.cfssl.dataDir.default) {

     

       
227
       
 
       
          StateDirectory = baseNameOf cfg.dataDir;

     

       
228
       
 
       
          StateDirectoryMode = 700;

     

       
229
       
 
       
        })

     
···

       
231
       
 
       
    };

     

       
232
       
 
       


     

       
233
       
 
       
    services.cfssl = {

     

       
234
       
-
       
      ca = mkDefault "${cfg.dataDir}/ca.pem";

     

       
235
       
-
       
      caKey = mkDefault "${cfg.dataDir}/ca-key.pem";

     

       
236
       
 
       
    };

     

       
237
       
 
       
  };

     

       
238
       
 
       
}

     

···

       
5
       
 
       
  pkgs,

     

       
6
       
 
       
  ...

     

       
7
       
 
       
}:

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
8
       
 
       
let

     

       
9
       
 
       
  cfg = config.services.cfssl;

     

       
10
       
 
       
in

     

       
11
       
 
       
{

     

       
12
       
 
       
  options.services.cfssl = {

     

       
13
       
+
       
    enable = lib.mkEnableOption "the CFSSL CA api-server";

     

       
14
       
 
       


     

       
15
       
+
       
    dataDir = lib.mkOption {

     

       
16
       
 
       
      default = "/var/lib/cfssl";

     

       
17
       
+
       
      type = lib.types.path;

     

       
18
       
 
       
      description = ''

     

       
19
       
 
       
        The work directory for CFSSL.

     

       
20
       
 
       


     
···

       
27
       
 
       
      '';

     

       
28
       
 
       
    };

     

       
29
       
 
       


     

       
30
       
+
       
    address = lib.mkOption {

     

       
31
       
 
       
      default = "127.0.0.1";

     

       
32
       
+
       
      type = lib.types.str;

     

       
33
       
 
       
      description = "Address to bind.";

     

       
34
       
 
       
    };

     

       
35
       
 
       


     

       
36
       
+
       
    port = lib.mkOption {

     

       
37
       
 
       
      default = 8888;

     

       
38
       
+
       
      type = lib.types.port;

     

       
39
       
 
       
      description = "Port to bind.";

     

       
40
       
 
       
    };

     

       
41
       
 
       


     

       
42
       
+
       
    ca = lib.mkOption {

     

       
43
       
+
       
      defaultText = lib.literalExpression ''"''${cfg.dataDir}/ca.pem"'';

     

       
44
       
+
       
      type = lib.types.str;

     

       
45
       
 
       
      description = "CA used to sign the new certificate -- accepts '[file:]fname' or 'env:varname'.";

     

       
46
       
 
       
    };

     

       
47
       
 
       


     

       
48
       
+
       
    caKey = lib.mkOption {

     

       
49
       
+
       
      defaultText = lib.literalExpression ''"file:''${cfg.dataDir}/ca-key.pem"'';

     

       
50
       
+
       
      type = lib.types.str;

     

       
51
       
 
       
      description = "CA private key -- accepts '[file:]fname' or 'env:varname'.";

     

       
52
       
 
       
    };

     

       
53
       
 
       


     

       
54
       
+
       
    caBundle = lib.mkOption {

     

       
55
       
 
       
      default = null;

     

       
56
       
+
       
      type = lib.types.nullOr lib.types.path;

     

       
57
       
 
       
      description = "Path to root certificate store.";

     

       
58
       
 
       
    };

     

       
59
       
 
       


     

       
60
       
+
       
    intBundle = lib.mkOption {

     

       
61
       
 
       
      default = null;

     

       
62
       
+
       
      type = lib.types.nullOr lib.types.path;

     

       
63
       
 
       
      description = "Path to intermediate certificate store.";

     

       
64
       
 
       
    };

     

       
65
       
 
       


     

       
66
       
+
       
    intDir = lib.mkOption {

     

       
67
       
 
       
      default = null;

     

       
68
       
+
       
      type = lib.types.nullOr lib.types.path;

     

       
69
       
 
       
      description = "Intermediates directory.";

     

       
70
       
 
       
    };

     

       
71
       
 
       


     

       
72
       
+
       
    metadata = lib.mkOption {

     

       
73
       
 
       
      default = null;

     

       
74
       
+
       
      type = lib.types.nullOr lib.types.path;

     

       
75
       
 
       
      description = ''

     

       
76
       
 
       
        Metadata file for root certificate presence.

     

       
77
       
 
       
        The content of the file is a json dictionary (k,v): each key k is

     
···

       
80
       
 
       
      '';

     

       
81
       
 
       
    };

     

       
82
       
 
       


     

       
83
       
+
       
    remote = lib.mkOption {

     

       
84
       
 
       
      default = null;

     

       
85
       
+
       
      type = lib.types.nullOr lib.types.str;

     

       
86
       
 
       
      description = "Remote CFSSL server.";

     

       
87
       
 
       
    };

     

       
88
       
 
       


     

       
89
       
+
       
    configFile = lib.mkOption {

     

       
90
       
 
       
      default = null;

     

       
91
       
+
       
      type = lib.types.nullOr lib.types.str;

     

       
92
       
 
       
      description = "Path to configuration file. Do not put this in nix-store as it might contain secrets.";

     

       
93
       
 
       
    };

     

       
94
       
 
       


     

       
95
       
+
       
    responder = lib.mkOption {

     

       
96
       
 
       
      default = null;

     

       
97
       
+
       
      type = lib.types.nullOr lib.types.path;

     

       
98
       
 
       
      description = "Certificate for OCSP responder.";

     

       
99
       
 
       
    };

     

       
100
       
 
       


     

       
101
       
+
       
    responderKey = lib.mkOption {

     

       
102
       
 
       
      default = null;

     

       
103
       
+
       
      type = lib.types.nullOr lib.types.str;

     

       
104
       
 
       
      description = "Private key for OCSP responder certificate. Do not put this in nix-store.";

     

       
105
       
 
       
    };

     

       
106
       
 
       


     

       
107
       
+
       
    tlsKey = lib.mkOption {

     

       
108
       
 
       
      default = null;

     

       
109
       
+
       
      type = lib.types.nullOr lib.types.str;

     

       
110
       
 
       
      description = "Other endpoint's CA private key. Do not put this in nix-store.";

     

       
111
       
 
       
    };

     

       
112
       
 
       


     

       
113
       
+
       
    tlsCert = lib.mkOption {

     

       
114
       
 
       
      default = null;

     

       
115
       
+
       
      type = lib.types.nullOr lib.types.path;

     

       
116
       
 
       
      description = "Other endpoint's CA to set up TLS protocol.";

     

       
117
       
 
       
    };

     

       
118
       
 
       


     

       
119
       
+
       
    mutualTlsCa = lib.mkOption {

     

       
120
       
 
       
      default = null;

     

       
121
       
+
       
      type = lib.types.nullOr lib.types.path;

     

       
122
       
 
       
      description = "Mutual TLS - require clients be signed by this CA.";

     

       
123
       
 
       
    };

     

       
124
       
 
       


     

       
125
       
+
       
    mutualTlsCn = lib.mkOption {

     

       
126
       
 
       
      default = null;

     

       
127
       
+
       
      type = lib.types.nullOr lib.types.str;

     

       
128
       
 
       
      description = "Mutual TLS - regex for whitelist of allowed client CNs.";

     

       
129
       
 
       
    };

     

       
130
       
 
       


     

       
131
       
+
       
    tlsRemoteCa = lib.mkOption {

     

       
132
       
 
       
      default = null;

     

       
133
       
+
       
      type = lib.types.nullOr lib.types.path;

     

       
134
       
 
       
      description = "CAs to trust for remote TLS requests.";

     

       
135
       
 
       
    };

     

       
136
       
 
       


     

       
137
       
+
       
    mutualTlsClientCert = lib.mkOption {

     

       
138
       
 
       
      default = null;

     

       
139
       
+
       
      type = lib.types.nullOr lib.types.path;

     

       
140
       
 
       
      description = "Mutual TLS - client certificate to call remote instance requiring client certs.";

     

       
141
       
 
       
    };

     

       
142
       
 
       


     

       
143
       
+
       
    mutualTlsClientKey = lib.mkOption {

     

       
144
       
 
       
      default = null;

     

       
145
       
+
       
      type = lib.types.nullOr lib.types.path;

     

       
146
       
 
       
      description = "Mutual TLS - client key to call remote instance requiring client certs. Do not put this in nix-store.";

     

       
147
       
 
       
    };

     

       
148
       
 
       


     

       
149
       
+
       
    dbConfig = lib.mkOption {

     

       
150
       
 
       
      default = null;

     

       
151
       
+
       
      type = lib.types.nullOr lib.types.path;

     

       
152
       
 
       
      description = "Certificate db configuration file. Path must be writeable.";

     

       
153
       
 
       
    };

     

       
154
       
 
       


     

       
155
       
+
       
    logLevel = lib.mkOption {

     

       
156
       
 
       
      default = 1;

     

       
157
       
+
       
      type = lib.types.enum [

     

       
158
       
 
       
        0

     

       
159
       
 
       
        1

     

       
160
       
 
       
        2

     
···

       
166
       
 
       
    };

     

       
167
       
 
       
  };

     

       
168
       
 
       


     

       
169
       
+
       
  config = lib.mkIf cfg.enable {

     

       
170
       
 
       
    users.groups.cfssl = {

     

       
171
       
 
       
      gid = config.ids.gids.cfssl;

     

       
172
       
 
       
    };

     
···

       
220
       
 
       
              (opt "loglevel" (toString logLevel))

     

       
221
       
 
       
            ];

     

       
222
       
 
       
        }

     

       
223
       
+
       
        (lib.mkIf (cfg.dataDir == options.services.cfssl.dataDir.default) {

     

       
224
       
 
       
          StateDirectory = baseNameOf cfg.dataDir;

     

       
225
       
 
       
          StateDirectoryMode = 700;

     

       
226
       
 
       
        })

     
···

       
228
       
 
       
    };

     

       
229
       
 
       


     

       
230
       
 
       
    services.cfssl = {

     

       
231
       
+
       
      ca = lib.mkDefault "${cfg.dataDir}/ca.pem";

     

       
232
       
+
       
      caKey = lib.mkDefault "${cfg.dataDir}/ca-key.pem";

     

       
233
       
 
       
    };

     

       
234
       
 
       
  };

     

       
235
       
 
       
}

     

···

       
1
       
 
       
{ config, lib, pkgs, ... }:

     

       
2
       
-
       
with lib;

     

       
3
       
 
       
let

     

       
4
       
 
       
  clamavUser = "clamav";

     

       
5
       
 
       
  stateDir = "/var/lib/clamav";

     

       
6
       
 
       
  clamavGroup = clamavUser;

     

       
7
       
 
       
  cfg = config.services.clamav;

     

       
8
       
 
       


     

       
9
       
-
       
  toKeyValue = generators.toKeyValue {

     

       
10
       
-
       
    mkKeyValue = generators.mkKeyValueDefault { } " ";

     

       
11
       
 
       
    listsAsDuplicateKeys = true;

     

       
12
       
 
       
  };

     

       
13
       
 
       


     
···

       
19
       
 
       
in

     

       
20
       
 
       
{

     

       
21
       
 
       
  imports = [

     

       
22
       
-
       
    (mkRemovedOptionModule [ "services" "clamav" "updater" "config" ] "Use services.clamav.updater.settings instead.")

     

       
23
       
-
       
    (mkRemovedOptionModule [ "services" "clamav" "updater" "extraConfig" ] "Use services.clamav.updater.settings instead.")

     

       
24
       
-
       
    (mkRemovedOptionModule [ "services" "clamav" "daemon" "extraConfig" ] "Use services.clamav.daemon.settings instead.")

     

       
25
       
 
       
  ];

     

       
26
       
 
       


     

       
27
       
 
       
  options = {

     

       
28
       
 
       
    services.clamav = {

     

       
29
       
-
       
      package = mkPackageOption pkgs "clamav" { };

     

       
30
       
 
       
      daemon = {

     

       
31
       
-
       
        enable = mkEnableOption "ClamAV clamd daemon";

     

       
32
       
 
       


     

       
33
       
-
       
        settings = mkOption {

     

       
34
       
-
       
          type = with types; attrsOf (oneOf [ bool int str (listOf str) ]);

     

       
35
       
 
       
          default = { };

     

       
36
       
 
       
          description = ''

     

       
37
       
 
       
            ClamAV configuration. Refer to <https://linux.die.net/man/5/clamd.conf>,

     
···

       
40
       
 
       
        };

     

       
41
       
 
       
      };

     

       
42
       
 
       
      updater = {

     

       
43
       
-
       
        enable = mkEnableOption "ClamAV freshclam updater";

     

       
44
       
 
       


     

       
45
       
-
       
        frequency = mkOption {

     

       
46
       
-
       
          type = types.int;

     

       
47
       
 
       
          default = 12;

     

       
48
       
 
       
          description = ''

     

       
49
       
 
       
            Number of database checks per day.

     

       
50
       
 
       
          '';

     

       
51
       
 
       
        };

     

       
52
       
 
       


     

       
53
       
-
       
        interval = mkOption {

     

       
54
       
-
       
          type = types.str;

     

       
55
       
 
       
          default = "hourly";

     

       
56
       
 
       
          description = ''

     

       
57
       
 
       
            How often freshclam is invoked. See systemd.time(7) for more

     
···

       
59
       
 
       
          '';

     

       
60
       
 
       
        };

     

       
61
       
 
       


     

       
62
       
-
       
        settings = mkOption {

     

       
63
       
-
       
          type = with types; attrsOf (oneOf [ bool int str (listOf str) ]);

     

       
64
       
 
       
          default = { };

     

       
65
       
 
       
          description = ''

     

       
66
       
 
       
            freshclam configuration. Refer to <https://linux.die.net/man/5/freshclam.conf>,

     
···

       
69
       
 
       
        };

     

       
70
       
 
       
      };

     

       
71
       
 
       
      fangfrisch = {

     

       
72
       
-
       
        enable = mkEnableOption "ClamAV fangfrisch updater";

     

       
73
       
 
       


     

       
74
       
-
       
        interval = mkOption {

     

       
75
       
-
       
          type = types.str;

     

       
76
       
 
       
          default = "hourly";

     

       
77
       
 
       
          description = ''

     

       
78
       
 
       
            How often freshclam is invoked. See systemd.time(7) for more

     
···

       
80
       
 
       
          '';

     

       
81
       
 
       
        };

     

       
82
       
 
       


     

       
83
       
-
       
        settings = mkOption {

     

       
84
       
 
       
          type = lib.types.submodule {

     

       
85
       
-
       
            freeformType = with types; attrsOf (attrsOf (oneOf [ str int bool ]));

     

       
86
       
 
       
          };

     

       
87
       
 
       
          default = { };

     

       
88
       
 
       
          example = {

     
···

       
100
       
 
       
      };

     

       
101
       
 
       


     

       
102
       
 
       
      scanner = {

     

       
103
       
-
       
        enable = mkEnableOption "ClamAV scanner";

     

       
104
       
 
       


     

       
105
       
-
       
        interval = mkOption {

     

       
106
       
-
       
          type = types.str;

     

       
107
       
 
       
          default = "*-*-* 04:00:00";

     

       
108
       
 
       
          description = ''

     

       
109
       
 
       
            How often clamdscan is invoked. See systemd.time(7) for more

     
···

       
112
       
 
       
          '';

     

       
113
       
 
       
        };

     

       
114
       
 
       


     

       
115
       
-
       
        scanDirectories = mkOption {

     

       
116
       
-
       
          type = with types; listOf str;

     

       
117
       
 
       
          default = [ "/home" "/var/lib" "/tmp" "/etc" "/var/tmp" ];

     

       
118
       
 
       
          description = ''

     

       
119
       
 
       
            List of directories to scan.

     
···

       
124
       
 
       
    };

     

       
125
       
 
       
  };

     

       
126
       
 
       


     

       
127
       
-
       
  config = mkIf (cfg.updater.enable || cfg.daemon.enable) {

     

       
128
       
 
       
    environment.systemPackages = [ cfg.package ];

     

       
129
       
 
       


     

       
130
       
 
       
    users.users.${clamavUser} = {

     
···

       
153
       
 
       
    };

     

       
154
       
 
       


     

       
155
       
 
       
    services.clamav.fangfrisch.settings = {

     

       
156
       
-
       
      DEFAULT.db_url = mkDefault "sqlite:////var/lib/clamav/fangfrisch_db.sqlite";

     

       
157
       
-
       
      DEFAULT.local_directory = mkDefault stateDir;

     

       
158
       
-
       
      DEFAULT.log_level = mkDefault "INFO";

     

       
159
       
-
       
      urlhaus.enabled = mkDefault "yes";

     

       
160
       
-
       
      urlhaus.max_size = mkDefault "2MB";

     

       
161
       
-
       
      sanesecurity.enabled = mkDefault "yes";

     

       
162
       
 
       
    };

     

       
163
       
 
       


     

       
164
       
 
       
    environment.etc."clamav/freshclam.conf".source = freshclamConfigFile;

     
···

       
168
       
 
       
      description = "ClamAV Antivirus Slice";

     

       
169
       
 
       
    };

     

       
170
       
 
       


     

       
171
       
-
       
    systemd.services.clamav-daemon = mkIf cfg.daemon.enable {

     

       
172
       
 
       
      description = "ClamAV daemon (clamd)";

     

       
173
       
-
       
      after = optionals cfg.updater.enable [ "clamav-freshclam.service" ];

     

       
174
       
-
       
      wants = optionals cfg.updater.enable [ "clamav-freshclam.service" ];

     

       
175
       
 
       
      wantedBy = [ "multi-user.target" ];

     

       
176
       
 
       
      restartTriggers = [ clamdConfigFile ];

     

       
177
       
 
       


     
···

       
189
       
 
       
      };

     

       
190
       
 
       
    };

     

       
191
       
 
       


     

       
192
       
-
       
    systemd.timers.clamav-freshclam = mkIf cfg.updater.enable {

     

       
193
       
 
       
      description = "Timer for ClamAV virus database updater (freshclam)";

     

       
194
       
 
       
      wantedBy = [ "timers.target" ];

     

       
195
       
 
       
      timerConfig = {

     
···

       
198
       
 
       
      };

     

       
199
       
 
       
    };

     

       
200
       
 
       


     

       
201
       
-
       
    systemd.services.clamav-freshclam = mkIf cfg.updater.enable {

     

       
202
       
 
       
      description = "ClamAV virus database updater (freshclam)";

     

       
203
       
 
       
      restartTriggers = [ freshclamConfigFile ];

     

       
204
       
 
       
      requires = [ "network-online.target" ];

     
···

       
217
       
 
       
      };

     

       
218
       
 
       
    };

     

       
219
       
 
       


     

       
220
       
-
       
    systemd.services.clamav-fangfrisch-init = mkIf cfg.fangfrisch.enable {

     

       
221
       
 
       
      wantedBy = [ "multi-user.target" ];

     

       
222
       
 
       
      # if the sqlite file can be found assume the database has already been initialised

     

       
223
       
 
       
      script = ''

     
···

       
239
       
 
       
      };

     

       
240
       
 
       
    };

     

       
241
       
 
       


     

       
242
       
-
       
    systemd.timers.clamav-fangfrisch = mkIf cfg.fangfrisch.enable {

     

       
243
       
 
       
      description = "Timer for ClamAV virus database updater (fangfrisch)";

     

       
244
       
 
       
      wantedBy = [ "timers.target" ];

     

       
245
       
 
       
      timerConfig = {

     
···

       
248
       
 
       
      };

     

       
249
       
 
       
    };

     

       
250
       
 
       


     

       
251
       
-
       
    systemd.services.clamav-fangfrisch = mkIf cfg.fangfrisch.enable {

     

       
252
       
 
       
      description = "ClamAV virus database updater (fangfrisch)";

     

       
253
       
 
       
      restartTriggers = [ fangfrischConfigFile ];

     

       
254
       
 
       
      requires = [ "network-online.target" ];

     
···

       
266
       
 
       
      };

     

       
267
       
 
       
    };

     

       
268
       
 
       


     

       
269
       
-
       
    systemd.timers.clamdscan = mkIf cfg.scanner.enable {

     

       
270
       
 
       
      description = "Timer for ClamAV virus scanner";

     

       
271
       
 
       
      wantedBy = [ "timers.target" ];

     

       
272
       
 
       
      timerConfig = {

     
···

       
275
       
 
       
      };

     

       
276
       
 
       
    };

     

       
277
       
 
       


     

       
278
       
-
       
    systemd.services.clamdscan = mkIf cfg.scanner.enable {

     

       
279
       
 
       
      description = "ClamAV virus scanner";

     

       
280
       
-
       
      after = optionals cfg.updater.enable [ "clamav-freshclam.service" ];

     

       
281
       
-
       
      wants = optionals cfg.updater.enable [ "clamav-freshclam.service" ];

     

       
282
       
 
       


     

       
283
       
 
       
      serviceConfig = {

     

       
284
       
 
       
        Type = "oneshot";

     

···

       
1
       
 
       
{ config, lib, pkgs, ... }:

     

       
0
       
 
       

     

       
2
       
 
       
let

     

       
3
       
 
       
  clamavUser = "clamav";

     

       
4
       
 
       
  stateDir = "/var/lib/clamav";

     

       
5
       
 
       
  clamavGroup = clamavUser;

     

       
6
       
 
       
  cfg = config.services.clamav;

     

       
7
       
 
       


     

       
8
       
+
       
  toKeyValue = lib.generators.toKeyValue {

     

       
9
       
+
       
    mkKeyValue = lib.generators.mkKeyValueDefault { } " ";

     

       
10
       
 
       
    listsAsDuplicateKeys = true;

     

       
11
       
 
       
  };

     

       
12
       
 
       


     
···

       
18
       
 
       
in

     

       
19
       
 
       
{

     

       
20
       
 
       
  imports = [

     

       
21
       
+
       
    (lib.mkRemovedOptionModule [ "services" "clamav" "updater" "config" ] "Use services.clamav.updater.settings instead.")

     

       
22
       
+
       
    (lib.mkRemovedOptionModule [ "services" "clamav" "updater" "extraConfig" ] "Use services.clamav.updater.settings instead.")

     

       
23
       
+
       
    (lib.mkRemovedOptionModule [ "services" "clamav" "daemon" "extraConfig" ] "Use services.clamav.daemon.settings instead.")

     

       
24
       
 
       
  ];

     

       
25
       
 
       


     

       
26
       
 
       
  options = {

     

       
27
       
 
       
    services.clamav = {

     

       
28
       
+
       
      package = lib.mkPackageOption pkgs "clamav" { };

     

       
29
       
 
       
      daemon = {

     

       
30
       
+
       
        enable = lib.mkEnableOption "ClamAV clamd daemon";

     

       
31
       
 
       


     

       
32
       
+
       
        settings = lib.mkOption {

     

       
33
       
+
       
          type = with lib.types; attrsOf (oneOf [ bool int str (listOf str) ]);

     

       
34
       
 
       
          default = { };

     

       
35
       
 
       
          description = ''

     

       
36
       
 
       
            ClamAV configuration. Refer to <https://linux.die.net/man/5/clamd.conf>,

     
···

       
39
       
 
       
        };

     

       
40
       
 
       
      };

     

       
41
       
 
       
      updater = {

     

       
42
       
+
       
        enable = lib.mkEnableOption "ClamAV freshclam updater";

     

       
43
       
 
       


     

       
44
       
+
       
        frequency = lib.mkOption {

     

       
45
       
+
       
          type = lib.types.int;

     

       
46
       
 
       
          default = 12;

     

       
47
       
 
       
          description = ''

     

       
48
       
 
       
            Number of database checks per day.

     

       
49
       
 
       
          '';

     

       
50
       
 
       
        };

     

       
51
       
 
       


     

       
52
       
+
       
        interval = lib.mkOption {

     

       
53
       
+
       
          type = lib.types.str;

     

       
54
       
 
       
          default = "hourly";

     

       
55
       
 
       
          description = ''

     

       
56
       
 
       
            How often freshclam is invoked. See systemd.time(7) for more

     
···

       
58
       
 
       
          '';

     

       
59
       
 
       
        };

     

       
60
       
 
       


     

       
61
       
+
       
        settings = lib.mkOption {

     

       
62
       
+
       
          type = with lib.types; attrsOf (oneOf [ bool int str (listOf str) ]);

     

       
63
       
 
       
          default = { };

     

       
64
       
 
       
          description = ''

     

       
65
       
 
       
            freshclam configuration. Refer to <https://linux.die.net/man/5/freshclam.conf>,

     
···

       
68
       
 
       
        };

     

       
69
       
 
       
      };

     

       
70
       
 
       
      fangfrisch = {

     

       
71
       
+
       
        enable = lib.mkEnableOption "ClamAV fangfrisch updater";

     

       
72
       
 
       


     

       
73
       
+
       
        interval = lib.mkOption {

     

       
74
       
+
       
          type = lib.types.str;

     

       
75
       
 
       
          default = "hourly";

     

       
76
       
 
       
          description = ''

     

       
77
       
 
       
            How often freshclam is invoked. See systemd.time(7) for more

     
···

       
79
       
 
       
          '';

     

       
80
       
 
       
        };

     

       
81
       
 
       


     

       
82
       
+
       
        settings = lib.mkOption {

     

       
83
       
 
       
          type = lib.types.submodule {

     

       
84
       
+
       
            freeformType = with lib.types; attrsOf (attrsOf (oneOf [ str int bool ]));

     

       
85
       
 
       
          };

     

       
86
       
 
       
          default = { };

     

       
87
       
 
       
          example = {

     
···

       
99
       
 
       
      };

     

       
100
       
 
       


     

       
101
       
 
       
      scanner = {

     

       
102
       
+
       
        enable = lib.mkEnableOption "ClamAV scanner";

     

       
103
       
 
       


     

       
104
       
+
       
        interval = lib.mkOption {

     

       
105
       
+
       
          type = lib.types.str;

     

       
106
       
 
       
          default = "*-*-* 04:00:00";

     

       
107
       
 
       
          description = ''

     

       
108
       
 
       
            How often clamdscan is invoked. See systemd.time(7) for more

     
···

       
111
       
 
       
          '';

     

       
112
       
 
       
        };

     

       
113
       
 
       


     

       
114
       
+
       
        scanDirectories = lib.mkOption {

     

       
115
       
+
       
          type = with lib.types; listOf str;

     

       
116
       
 
       
          default = [ "/home" "/var/lib" "/tmp" "/etc" "/var/tmp" ];

     

       
117
       
 
       
          description = ''

     

       
118
       
 
       
            List of directories to scan.

     
···

       
123
       
 
       
    };

     

       
124
       
 
       
  };

     

       
125
       
 
       


     

       
126
       
+
       
  config = lib.mkIf (cfg.updater.enable || cfg.daemon.enable) {

     

       
127
       
 
       
    environment.systemPackages = [ cfg.package ];

     

       
128
       
 
       


     

       
129
       
 
       
    users.users.${clamavUser} = {

     
···

       
152
       
 
       
    };

     

       
153
       
 
       


     

       
154
       
 
       
    services.clamav.fangfrisch.settings = {

     

       
155
       
+
       
      DEFAULT.db_url = lib.mkDefault "sqlite:////var/lib/clamav/fangfrisch_db.sqlite";

     

       
156
       
+
       
      DEFAULT.local_directory = lib.mkDefault stateDir;

     

       
157
       
+
       
      DEFAULT.log_level = lib.mkDefault "INFO";

     

       
158
       
+
       
      urlhaus.enabled = lib.mkDefault "yes";

     

       
159
       
+
       
      urlhaus.max_size = lib.mkDefault "2MB";

     

       
160
       
+
       
      sanesecurity.enabled = lib.mkDefault "yes";

     

       
161
       
 
       
    };

     

       
162
       
 
       


     

       
163
       
 
       
    environment.etc."clamav/freshclam.conf".source = freshclamConfigFile;

     
···

       
167
       
 
       
      description = "ClamAV Antivirus Slice";

     

       
168
       
 
       
    };

     

       
169
       
 
       


     

       
170
       
+
       
    systemd.services.clamav-daemon = lib.mkIf cfg.daemon.enable {

     

       
171
       
 
       
      description = "ClamAV daemon (clamd)";

     

       
172
       
+
       
      after = lib.optionals cfg.updater.enable [ "clamav-freshclam.service" ];

     

       
173
       
+
       
      wants = lib.optionals cfg.updater.enable [ "clamav-freshclam.service" ];

     

       
174
       
 
       
      wantedBy = [ "multi-user.target" ];

     

       
175
       
 
       
      restartTriggers = [ clamdConfigFile ];

     

       
176
       
 
       


     
···

       
188
       
 
       
      };

     

       
189
       
 
       
    };

     

       
190
       
 
       


     

       
191
       
+
       
    systemd.timers.clamav-freshclam = lib.mkIf cfg.updater.enable {

     

       
192
       
 
       
      description = "Timer for ClamAV virus database updater (freshclam)";

     

       
193
       
 
       
      wantedBy = [ "timers.target" ];

     

       
194
       
 
       
      timerConfig = {

     
···

       
197
       
 
       
      };

     

       
198
       
 
       
    };

     

       
199
       
 
       


     

       
200
       
+
       
    systemd.services.clamav-freshclam = lib.mkIf cfg.updater.enable {

     

       
201
       
 
       
      description = "ClamAV virus database updater (freshclam)";

     

       
202
       
 
       
      restartTriggers = [ freshclamConfigFile ];

     

       
203
       
 
       
      requires = [ "network-online.target" ];

     
···

       
216
       
 
       
      };

     

       
217
       
 
       
    };

     

       
218
       
 
       


     

       
219
       
+
       
    systemd.services.clamav-fangfrisch-init = lib.mkIf cfg.fangfrisch.enable {

     

       
220
       
 
       
      wantedBy = [ "multi-user.target" ];

     

       
221
       
 
       
      # if the sqlite file can be found assume the database has already been initialised

     

       
222
       
 
       
      script = ''

     
···

       
238
       
 
       
      };

     

       
239
       
 
       
    };

     

       
240
       
 
       


     

       
241
       
+
       
    systemd.timers.clamav-fangfrisch = lib.mkIf cfg.fangfrisch.enable {

     

       
242
       
 
       
      description = "Timer for ClamAV virus database updater (fangfrisch)";

     

       
243
       
 
       
      wantedBy = [ "timers.target" ];

     

       
244
       
 
       
      timerConfig = {

     
···

       
247
       
 
       
      };

     

       
248
       
 
       
    };

     

       
249
       
 
       


     

       
250
       
+
       
    systemd.services.clamav-fangfrisch = lib.mkIf cfg.fangfrisch.enable {

     

       
251
       
 
       
      description = "ClamAV virus database updater (fangfrisch)";

     

       
252
       
 
       
      restartTriggers = [ fangfrischConfigFile ];

     

       
253
       
 
       
      requires = [ "network-online.target" ];

     
···

       
265
       
 
       
      };

     

       
266
       
 
       
    };

     

       
267
       
 
       


     

       
268
       
+
       
    systemd.timers.clamdscan = lib.mkIf cfg.scanner.enable {

     

       
269
       
 
       
      description = "Timer for ClamAV virus scanner";

     

       
270
       
 
       
      wantedBy = [ "timers.target" ];

     

       
271
       
 
       
      timerConfig = {

     
···

       
274
       
 
       
      };

     

       
275
       
 
       
    };

     

       
276
       
 
       


     

       
277
       
+
       
    systemd.services.clamdscan = lib.mkIf cfg.scanner.enable {

     

       
278
       
 
       
      description = "ClamAV virus scanner";

     

       
279
       
+
       
      after = lib.optionals cfg.updater.enable [ "clamav-freshclam.service" ];

     

       
280
       
+
       
      wants = lib.optionals cfg.updater.enable [ "clamav-freshclam.service" ];

     

       
281
       
 
       


     

       
282
       
 
       
      serviceConfig = {

     

       
283
       
 
       
        Type = "oneshot";