modules/private/websites/default.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   www_root = ./_www;
   4   theme_root = (pkgs.webapps.apache-theme {}).theme;
   5   apacheConfig = {
   6     cache = {
   7       # This setting permits to ignore time-based cache for files in the
   8       # nix store:
   9       # If a client requires an If-Modified-Since from timestamp 1, then
  10       # this header is removed, and if the response contains a
  11       # too old Last-Modified tag, then it is removed too
  12       extraConfig = ''
  13         <If "%{HTTP:If-Modified-Since} =~ /01 Jan 1970 00:00:01/" >
  14           RequestHeader unset If-Modified-Since
  15         </If>
  16         Header unset Last-Modified "expr=%{LAST_MODIFIED} < 19991231235959"
  17       '';
  18     };
  19     gzip = {
  20       modules = [ "deflate" "filter" ];
  21       extraConfig = ''
  22         AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
  23       '';
  24     };
  25     macros = {
  26       modules = [ "macro" ];
  27     };
  28     stats = {
  29       extraConfig = ''
  30         <Macro Stats %{domain}>
  31           Alias /webstats ${config.services.webstats.dataDir}/%{domain}
  32           <Directory ${config.services.webstats.dataDir}/%{domain}>
  33             DirectoryIndex index.html
  34             AllowOverride None
  35             Require all granted
  36           </Directory>
  37           <Location /webstats>
  38             Use LDAPConnect
  39             Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
  40           </Location>
  41         </Macro>
  42       '';
  43     };
  44     ldap = {
  45       modules = [ "ldap" "authnz_ldap" ];
  46       extraConfig = ''
  47         <IfModule ldap_module>
  48           LDAPSharedCacheSize 500000
  49           LDAPCacheEntries 1024
  50           LDAPCacheTTL 600
  51           LDAPOpCacheEntries 1024
  52           LDAPOpCacheTTL 600
  53         </IfModule>
  54
  55         Include ${config.secrets.fullPaths."apache-ldap"}
  56       '';
  57     };
  58     global = {
  59       extraConfig = ''
  60         ErrorDocument 500 /maintenance_immae.html
  61         ErrorDocument 501 /maintenance_immae.html
  62         ErrorDocument 502 /maintenance_immae.html
  63         ErrorDocument 503 /maintenance_immae.html
  64         ErrorDocument 504 /maintenance_immae.html
  65         Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
  66         ProxyPass /maintenance_immae.html !
  67
  68         AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
  69         <Directory ${www_root}>
  70           AllowOverride None
  71           Require all granted
  72         </Directory>
  73       '';
  74     };
  75     apaxy = {
  76       extraConfig = (pkgs.webapps.apache-theme { inherit theme_root; }).apacheConfig;
  77     };
  78     http2 = {
  79       modules = [ "http2" ];
  80       extraConfig = ''
  81         Protocols h2 http/1.1
  82       '';
  83     };
  84     customLog = {
  85       extraConfig = ''
  86         LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
  87       '';
  88     };
  89   };
  90   makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
  91   makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
  92   moomin = let
  93     lines = lib.splitString "\n" (lib.fileContents ./moomin.txt);
  94     pad = width: str: let
  95         padWidth = width - lib.stringLength str;
  96         padding = lib.concatStrings (lib.genList (lib.const "0") padWidth);
  97       in lib.optionalString (padWidth > 0) padding + str;
  98   in
  99     lib.imap0 (i: e: ''Header always set "X-Moomin-${pad 2 (builtins.toString i)}" "${e}"'') lines;
 100 in
 101 {
 102   options.myServices.websites.enable = lib.mkEnableOption "enable websites";
 103
 104   config = lib.mkIf config.myServices.websites.enable {
 105     myServices.chatonsProperties.hostings.web = {
 106       file.datetime = "2022-08-22T01:30:00";
 107       hosting = {
 108         name = "Hébergement Web";
 109         description = "Service d'hébergement web avec php/mysql/postgresql";
 110         website = "https://www.immae.eu";
 111         status.level = "OK";
 112         status.description = "OK";
 113         registration.load = "OPEN";
 114         install.type = "PACKAGE";
 115       };
 116       software = {
 117         name = "Apache Httpd";
 118         website = "https://httpd.apache.org/";
 119         license.url = "https://www.apache.org/licenses/";
 120         license.name = "Apache License Version 2";
 121         version = pkgs.apacheHttpd.version;
 122         source.url = "https://httpd.apache.org/download.cgi";
 123         modules = "openssh,pure-ftpd";
 124       };
 125     };
 126     users.users.wwwrun.extraGroups = [ "keys" ];
 127     networking.firewall.allowedTCPPorts = [ 80 443 ];
 128
 129     secrets.keys."apache-ldap" = {
 130       user = "wwwrun";
 131       group = "wwwrun";
 132       permissions = "0400";
 133       text = ''
 134         <Macro LDAPConnect>
 135           <IfModule authnz_ldap_module>
 136             AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 137             AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 138             AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
 139             AuthType             Basic
 140             AuthName             "Authentification requise (Acces LDAP)"
 141             AuthBasicProvider    ldap
 142           </IfModule>
 143         </Macro>
 144         '';
 145     };
 146
 147     system.activationScripts = {
 148       httpd = ''
 149         install -d -m 0755 /var/lib/acme/acme-challenges
 150         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 151         '';
 152     };
 153
 154     services.phpfpm = {
 155       phpOptions = ''
 156         session.save_path = "/var/lib/php/sessions"
 157         post_max_size = 20M
 158         ; 15 days (seconds)
 159         session.gc_maxlifetime = 1296000
 160         ; 30 days (minutes)
 161         session.cache_expire = 43200
 162         '';
 163       settings = {
 164         log_level = "notice";
 165       };
 166     };
 167
 168     services.filesWatcher.httpdProd.paths = [ config.secrets.fullPaths."apache-ldap" ];
 169     services.filesWatcher.httpdInte.paths = [ config.secrets.fullPaths."apache-ldap" ];
 170     services.filesWatcher.httpdTools.paths = [ config.secrets.fullPaths."apache-ldap" ];
 171
 172     services.websites.env.production = {
 173       enable = true;
 174       adminAddr = "httpd@immae.eu";
 175       httpdName = "Prod";
 176       ips =
 177         let ips = config.myEnv.servers.eldiron.ips.production;
 178         in (ips.ip4 or []) ++ (ips.ip6 or []);
 179       modules = makeModules;
 180       extraConfig = makeExtraConfig;
 181       fallbackVhost = {
 182         certName    = "eldiron";
 183         hosts       = ["eldiron.immae.eu" ];
 184         root        = www_root;
 185         extraConfig = [ "DirectoryIndex index.htm" ];
 186       };
 187     };
 188
 189     services.websites.env.integration = {
 190       enable = true;
 191       adminAddr = "httpd@immae.eu";
 192       httpdName = "Inte";
 193       ips =
 194         let ips = config.myEnv.servers.eldiron.ips.integration;
 195         in (ips.ip4 or []) ++ (ips.ip6 or []);
 196       modules = makeModules;
 197       extraConfig = makeExtraConfig ++ moomin;
 198       fallbackVhost = {
 199         certName    = "integration";
 200         hosts       = ["eldiron.immae.eu" ];
 201         root        = www_root;
 202         extraConfig = [ "DirectoryIndex index.htm" ];
 203       };
 204     };
 205
 206     services.websites.env.tools = {
 207       enable = true;
 208       adminAddr = "httpd@immae.eu";
 209       httpdName = "Tools";
 210       ips =
 211         let ips = config.myEnv.servers.eldiron.ips.main;
 212         in (ips.ip4 or []) ++ (ips.ip6 or []);
 213       modules = makeModules;
 214       extraConfig = makeExtraConfig ++
 215         [ ''
 216             RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 217             RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 218             RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 219             RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 220             RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 221             RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 222           ''
 223           ];
 224       nosslVhost = {
 225         enable = true;
 226         host = "nossl.immae.eu";
 227       };
 228       fallbackVhost = {
 229         certName    = "eldiron";
 230         hosts       = ["eldiron.immae.eu" ];
 231         root        = www_root;
 232         extraConfig = [ "DirectoryIndex index.htm" ];
 233       };
 234     };
 235
 236     myServices.tools.kanboard.farm.instances.tonnelle = {};
 237     myServices.tools.kanboard.farm.instances.gebull = {};
 238     myServices.websites = {
 239       attilax.dolibarr.enable = true;
 240
 241       bakeer.cloud.enable = true;
 242       capitaines.landing_pages.enable = true;
 243
 244       chloe = {
 245         new.enable = true;
 246         production.enable = true;
 247       };
 248
 249       christophe_carpentier = {
 250         website.enable = true;
 251         agorakit.enable = true;
 252         agora-project.enable = true;
 253         ateliersduchangement.enable = true;
 254       };
 255
 256       cip-ca = {
 257         sympa.enable = true;
 258       };
 259
 260       connexionswing = {
 261         integration.enable = true;
 262         production.enable = true;
 263       };
 264
 265       denise = {
 266         evariste.enable = true;
 267         denisejerome.enable = true;
 268         oms.enable = true;
 269         bingo.enable = true;
 270         aventuriers.enable = true;
 271         production.enable = true;
 272       };
 273
 274       emilia = {
 275         moodle.enable = false;
 276         atelierfringant.enable = false;
 277       };
 278
 279       florian = {
 280         app.enable = true;
 281         integration.enable = true;
 282         production.enable = true;
 283       };
 284
 285       immae = {
 286         production.enable = true;
 287         release.enable = true;
 288         temp.enable = true;
 289         dolibarr.enable = true;
 290       };
 291
 292       isabelle = {
 293         aten_integration.enable = true;
 294         aten_production.enable = true;
 295         iridologie.enable = true;
 296       };
 297
 298       jerome.naturaloutil.enable = true;
 299
 300       leila.production.enable = true;
 301
 302       librezo = {
 303         cloud.enable = true;
 304         dolibarr.enable = true;
 305         dolibarrDev.enable = true;
 306         website.enable = true;
 307       };
 308
 309       ludivine = {
 310         integration.enable = true;
 311         production.enable = true;
 312       };
 313
 314       nassime.production.enable = true;
 315
 316       nicecoop = {
 317         gestion-compte.enable = true;
 318         gestion-compte-integration.enable = true;
 319         odoo.enable = true;
 320         dolibarrDev.enable = true;
 321         copanier.enable = true;
 322       };
 323
 324       noctambules = {
 325         cloud.enable = true;
 326       };
 327
 328       papa = {
 329         surveillance.enable = true;
 330         maison_bbc.enable = true;
 331       };
 332
 333       patrick_fodella = {
 334         ecolyeu.enable = false;
 335         altermondia.enable = true;
 336       };
 337
 338       piedsjaloux = {
 339         integration.enable = true;
 340         production.enable = true;
 341       };
 342
 343       ressourcerie_banon.production.enable = true;
 344       ressourcerie_banon.cryptpad.enable = true;
 345       ressourcerie_banon.cloud.enable = true;
 346
 347       richie.production.enable = true;
 348
 349       syden.peertube.enable = true;
 350
 351       telio_tortay.production.enable = true;
 352
 353       tools.assets.enable = true;
 354       tools.cloud.enable = true;
 355       tools.commento.enable = true;
 356       tools.cryptpad.enable = true;
 357       tools.dav.enable = true;
 358       tools.db.enable = true;
 359       tools.diaspora.enable = true;
 360       tools.etherpad-lite.enable = true;
 361       tools.git.enable = true;
 362       tools.mastodon.enable = true;
 363       tools.mediagoblin.enable = true;
 364       tools.peertube.enable = true;
 365       tools.performance.enable = true;
 366       tools.tools.enable = true;
 367       tools.email.enable = true;
 368       tools.stats.enable = false;
 369       tools.visio.enable = true;
 370
 371       games.codenames.enable = true;
 372       games.terraforming-mars.enable = true;
 373     };
 374   };
 375 }