]>
Commit | Line | Data |
---|---|---|
1 | { lib, pkgs, config, nixpkgsRaw, etherpad-lite, ... }: | |
2 | let | |
3 | env = config.myEnv.tools.etherpad-lite; | |
4 | cfg = config.myServices.websites.tools.etherpad-lite; | |
5 | # Make sure we’re not rebuilding whole libreoffice just because of a | |
6 | # dependency | |
7 | libreoffice = nixpkgsRaw.libreoffice-fresh; | |
8 | ecfg = config.services.etherpad-lite; | |
9 | in { | |
10 | options.myServices.websites.tools.etherpad-lite = { | |
11 | enable = lib.mkEnableOption "enable etherpad's website"; | |
12 | }; | |
13 | ||
14 | config = lib.mkIf cfg.enable { | |
15 | myServices.dns.zones."immae.eu".subdomains.ether = | |
16 | with config.myServices.dns.helpers; ips servers.eldiron.ips.main; | |
17 | ||
18 | myServices.chatonsProperties.services.etherpad = { | |
19 | file.datetime = "2021-01-04T00:01:00"; | |
20 | service = { | |
21 | name = "Etherpad"; | |
22 | description = "Éditeur de texte collaboratif en temps réel. on peut y écrire simultanément."; | |
23 | website = "https://ether.immae.eu"; | |
24 | logo = "https://ether.immae.eu/favicon.ico"; | |
25 | status.level = "OK"; | |
26 | status.description = "OK"; | |
27 | registration."" = ["NONE" "MEMBER" "CLIENT"]; | |
28 | registration.load = "OPEN"; | |
29 | install.type = "PACKAGE"; | |
30 | }; | |
31 | software = { | |
32 | name = "Etherpad"; | |
33 | website = "https://etherpad.org/"; | |
34 | license.url = "https://github.com/ether/etherpad-lite/blob/develop/LICENSE"; | |
35 | license.name = "Apache License Version 2.0"; | |
36 | version = ecfg.package.version; | |
37 | source.url = "https://github.com/ether/etherpad-lite"; | |
38 | modules = ecfg.package.moduleNames; | |
39 | }; | |
40 | }; | |
41 | secrets.keys = { | |
42 | "webapps/tools-etherpad-apikey" = { | |
43 | permissions = "0400"; | |
44 | text = env.api_key; | |
45 | }; | |
46 | "webapps/tools-etherpad-sessionkey" = { | |
47 | permissions = "0400"; | |
48 | text = env.session_key; | |
49 | }; | |
50 | "webapps/tools-etherpad" = { | |
51 | permissions = "0400"; | |
52 | keyDependencies = [ libreoffice ]; | |
53 | text = '' | |
54 | { | |
55 | "title": "Etherpad", | |
56 | "favicon": "favicon.ico", | |
57 | "skinName": "colibris", | |
58 | "skinVariants": "dark-toolbar light-background super-light-editor full-width-editor", | |
59 | ||
60 | "ip": "", | |
61 | "port" : "${ecfg.sockets.node}", | |
62 | "showSettingsInAdminPage" : false, | |
63 | "dbType" : "postgres", | |
64 | "dbSettings" : { | |
65 | "user" : "${env.postgresql.user}", | |
66 | "host" : "${env.postgresql.socket}", | |
67 | "password": "${env.postgresql.password}", | |
68 | "database": "${env.postgresql.database}", | |
69 | "charset" : "utf8mb4" | |
70 | }, | |
71 | ||
72 | "defaultPadText" : "Welcome to Etherpad!\n\nThis pad text is synchronized as you type, so that everyone viewing this page sees the same text. This allows you to collaborate seamlessly on documents!\n\nGet involved with Etherpad at http:\/\/etherpad.org\n", | |
73 | "padOptions": { | |
74 | "noColors": false, | |
75 | "showControls": true, | |
76 | "showChat": true, | |
77 | "showLineNumbers": true, | |
78 | "useMonospaceFont": false, | |
79 | "userName": false, | |
80 | "userColor": false, | |
81 | "rtl": false, | |
82 | "alwaysShowChat": false, | |
83 | "chatAndUsers": false, | |
84 | "lang": "fr" | |
85 | }, | |
86 | ||
87 | "suppressErrorsInPadText" : false, | |
88 | "requireSession" : false, | |
89 | "editOnly" : false, | |
90 | "sessionNoPassword" : false, | |
91 | "minify" : false, | |
92 | "maxAge" : 21600, | |
93 | "abiword" : null, | |
94 | "soffice" : "${libreoffice}/bin/soffice", | |
95 | "tidyHtml" : "", | |
96 | "allowUnknownFileEnds" : true, | |
97 | "requireAuthentication" : false, | |
98 | "requireAuthorization" : false, | |
99 | "trustProxy" : true, | |
100 | "disableIPlogging" : false, | |
101 | "automaticReconnectionTimeout" : 0, | |
102 | "scrollWhenFocusLineIsOutOfViewport": { | |
103 | "percentage": { | |
104 | "editionAboveViewport": 0, | |
105 | "editionBelowViewport": 0 | |
106 | }, | |
107 | "duration": 0, | |
108 | "scrollWhenCaretIsInTheLastLineOfViewport": false, | |
109 | "percentageToScrollWhenUserPressesArrowUp": 0 | |
110 | }, | |
111 | "users": { | |
112 | "admin": { | |
113 | "password": "${env.adminPassword}", | |
114 | "is_admin": true | |
115 | }, | |
116 | "ldapauth": { | |
117 | "hash": "invalid", | |
118 | "url": "ldaps://${env.ldap.host}", | |
119 | "accountBase": "${env.ldap.base}", | |
120 | "accountPattern": "${env.ldap.filter}", | |
121 | "displayNameAttribute": "cn", | |
122 | "searchDN": "${env.ldap.dn}", | |
123 | "searchPWD": "${env.ldap.password}", | |
124 | "groupSearchBase": "${env.ldap.base}", | |
125 | "groupAttribute": "member", | |
126 | "groupAttributeIsDN": true, | |
127 | "searchScope": "sub", | |
128 | "groupSearch": "${env.ldap.group_filter}", | |
129 | "anonymousReadonly": false | |
130 | } | |
131 | }, | |
132 | "ep_mypads": { | |
133 | "warning": "This hash is stored in database, changing anything here will not have any consequence", | |
134 | "ldap": { | |
135 | "url": "ldaps://${env.ldap.host}", | |
136 | "bindDN": "${env.ldap.dn}", | |
137 | "bindCredentials": "${env.ldap.password}", | |
138 | "searchBase": "${env.ldap.base}", | |
139 | "searchFilter": "${env.ldap.filter}", | |
140 | "properties": { | |
141 | "login": "uid", | |
142 | "email": "mail", | |
143 | "firstname": "givenName", | |
144 | "lastname": "sn" | |
145 | }, | |
146 | "defaultLang": "fr" | |
147 | } | |
148 | }, | |
149 | "ep_comments_page": { | |
150 | "displayCommentAsIcon": true, | |
151 | "highlightSelectedText": true | |
152 | }, | |
153 | "socketTransportProtocols" : ["xhr-polling", "jsonp-polling", "htmlfile"], | |
154 | "loadTest": false, | |
155 | "indentationOnNewLine": false, | |
156 | "toolbar": { | |
157 | "left": [ | |
158 | ["bold", "italic", "underline", "strikethrough"], | |
159 | ["orderedlist", "unorderedlist", "indent", "outdent"], | |
160 | ["undo", "redo"], | |
161 | ["clearauthorship"] | |
162 | ], | |
163 | "right": [ | |
164 | ["importexport", "timeslider", "savedrevision"], | |
165 | ["settings", "embed"], | |
166 | ["showusers"] | |
167 | ], | |
168 | "timeslider": [ | |
169 | ["timeslider_export", "timeslider_returnToPad"] | |
170 | ] | |
171 | }, | |
172 | "loglevel": "INFO", | |
173 | "logconfig" : { "appenders": [ { "type": "console" } ] } | |
174 | } | |
175 | ''; | |
176 | }; | |
177 | }; | |
178 | services.etherpad-lite = { | |
179 | enable = true; | |
180 | package = etherpad-lite.withModules (p: [ | |
181 | p.ep_align p.ep_bookmark p.ep_colors p.ep_comments_page | |
182 | p.ep_cursortrace p.ep_delete_empty_pads p.ep_embedmedia | |
183 | p.ep_font_size p.ep_headings2 p.ep_immae_buttons p.ep_ldapauth | |
184 | p.ep_line_height p.ep_markdown p.ep_mypads p.ep_page_view | |
185 | p.ep_previewimages p.ep_ruler p.ep_scrollto | |
186 | p.ep_set_title_on_pad p.ep_subscript_and_superscript | |
187 | p.ep_timesliderdiff | |
188 | ]); | |
189 | modules = []; | |
190 | sessionKeyFile = config.secrets.fullPaths."webapps/tools-etherpad-sessionkey"; | |
191 | apiKeyFile = config.secrets.fullPaths."webapps/tools-etherpad-apikey"; | |
192 | configFile = config.secrets.fullPaths."webapps/tools-etherpad"; | |
193 | }; | |
194 | ||
195 | systemd.services.etherpad-lite.serviceConfig.SupplementaryGroups = "keys"; | |
196 | systemd.services.etherpad-lite-cleanup.serviceConfig.SupplementaryGroups = "keys"; | |
197 | # Needed so that they get in the closure | |
198 | systemd.services.etherpad-lite.path = [ libreoffice pkgs.html-tidy ]; | |
199 | ||
200 | services.filesWatcher.etherpad-lite = { | |
201 | restart = true; | |
202 | paths = [ ecfg.sessionKeyFile ecfg.apiKeyFile ecfg.configFile ]; | |
203 | }; | |
204 | ||
205 | services.websites.env.tools.modules = [ | |
206 | "headers" "proxy" "proxy_http" "proxy_wstunnel" | |
207 | ]; | |
208 | security.acme.certs.eldiron.extraDomainNames = [ "ether.immae.eu" ]; | |
209 | services.websites.env.tools.vhostConfs.etherpad-lite = { | |
210 | certName = "eldiron"; | |
211 | hosts = [ "ether.immae.eu" ]; | |
212 | root = null; | |
213 | extraConfig = [ '' | |
214 | Header always set Strict-Transport-Security "max-age=31536000; includeSubdomains;" | |
215 | RequestHeader set X-Forwarded-Proto "https" | |
216 | ||
217 | RewriteEngine On | |
218 | ||
219 | RewriteCond %{REQUEST_URI} ^/socket.io [NC] | |
220 | RewriteCond %{QUERY_STRING} transport=websocket [NC] | |
221 | RewriteRule /(.*) unix://${ecfg.sockets.node}|ws://ether.immae.eu/$1 [P,NE,QSA,L] | |
222 | ||
223 | <IfModule mod_proxy.c> | |
224 | ProxyVia On | |
225 | ProxyRequests Off | |
226 | ProxyPreserveHost On | |
227 | ProxyPass / unix://${ecfg.sockets.node}|http://ether.immae.eu/ | |
228 | ProxyPassReverse / unix://${ecfg.sockets.node}|http://ether.immae.eu/ | |
229 | <Proxy *> | |
230 | Options FollowSymLinks MultiViews | |
231 | AllowOverride None | |
232 | Require all granted | |
233 | </Proxy> | |
234 | </IfModule> | |
235 | '' ]; | |
236 | }; | |
237 | myServices.monitoring.fromMasterActivatedPlugins = [ "http" ]; | |
238 | myServices.monitoring.fromMasterObjects.service = [ | |
239 | { | |
240 | service_description = "etherpad website is running on ether.immae.eu"; | |
241 | host_name = config.hostEnv.fqdn; | |
242 | use = "external-web-service"; | |
243 | check_command = ["check_https" "ether.immae.eu" "/" "<title>Etherpad"]; | |
244 | ||
245 | servicegroups = "webstatus-webapps"; | |
246 | _webstatus_name = "Etherpad"; | |
247 | _webstatus_url = "https://ether.immae.eu/"; | |
248 | } | |
249 | ]; | |
250 | }; | |
251 | } |