]> git.immae.eu Git - perso/Immae/Config/Nix.git/blob - modules/private/websites/default.nix
Ateliers du changement
[perso/Immae/Config/Nix.git] / modules / private / websites / default.nix
1 { lib, pkgs, config, ... }:
2 let
3 www_root = ./_www;
4 theme_root = (pkgs.webapps.apache-theme {}).theme;
5 apacheConfig = {
6 cache = {
7 # This setting permits to ignore time-based cache for files in the
8 # nix store:
9 # If a client requires an If-Modified-Since from timestamp 1, then
10 # this header is removed, and if the response contains a
11 # too old Last-Modified tag, then it is removed too
12 extraConfig = ''
13 <If "%{HTTP:If-Modified-Since} =~ /01 Jan 1970 00:00:01/" >
14 RequestHeader unset If-Modified-Since
15 </If>
16 Header unset Last-Modified "expr=%{LAST_MODIFIED} < 19991231235959"
17 '';
18 };
19 gzip = {
20 modules = [ "deflate" "filter" ];
21 extraConfig = ''
22 AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
23 '';
24 };
25 macros = {
26 modules = [ "macro" ];
27 };
28 stats = {
29 extraConfig = ''
30 <Macro Stats %{domain}>
31 Alias /webstats ${config.services.webstats.dataDir}/%{domain}
32 <Directory ${config.services.webstats.dataDir}/%{domain}>
33 DirectoryIndex index.html
34 AllowOverride None
35 Require all granted
36 </Directory>
37 <Location /webstats>
38 Use LDAPConnect
39 Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
40 </Location>
41 </Macro>
42 '';
43 };
44 ldap = {
45 modules = [ "ldap" "authnz_ldap" ];
46 extraConfig = ''
47 <IfModule ldap_module>
48 LDAPSharedCacheSize 500000
49 LDAPCacheEntries 1024
50 LDAPCacheTTL 600
51 LDAPOpCacheEntries 1024
52 LDAPOpCacheTTL 600
53 </IfModule>
54
55 Include ${config.secrets.fullPaths."apache-ldap"}
56 '';
57 };
58 global = {
59 extraConfig = ''
60 ErrorDocument 500 /maintenance_immae.html
61 ErrorDocument 501 /maintenance_immae.html
62 ErrorDocument 502 /maintenance_immae.html
63 ErrorDocument 503 /maintenance_immae.html
64 ErrorDocument 504 /maintenance_immae.html
65 Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
66 ProxyPass /maintenance_immae.html !
67
68 AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
69 <Directory ${www_root}>
70 AllowOverride None
71 Require all granted
72 </Directory>
73 '';
74 };
75 apaxy = {
76 extraConfig = (pkgs.webapps.apache-theme { inherit theme_root; }).apacheConfig;
77 };
78 http2 = {
79 modules = [ "http2" ];
80 extraConfig = ''
81 Protocols h2 http/1.1
82 '';
83 };
84 customLog = {
85 extraConfig = ''
86 LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
87 '';
88 };
89 };
90 makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
91 makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
92 moomin = let
93 lines = lib.splitString "\n" (lib.fileContents ./moomin.txt);
94 pad = width: str: let
95 padWidth = width - lib.stringLength str;
96 padding = lib.concatStrings (lib.genList (lib.const "0") padWidth);
97 in lib.optionalString (padWidth > 0) padding + str;
98 in
99 lib.imap0 (i: e: ''Header always set "X-Moomin-${pad 2 (builtins.toString i)}" "${e}"'') lines;
100 in
101 {
102 options.myServices.websites.enable = lib.mkEnableOption "enable websites";
103
104 config = lib.mkIf config.myServices.websites.enable {
105 myServices.chatonsProperties.hostings.web = {
106 file.datetime = "2022-08-22T01:30:00";
107 hosting = {
108 name = "Hébergement Web";
109 description = "Service d'hébergement web avec php/mysql/postgresql";
110 website = "https://www.immae.eu";
111 status.level = "OK";
112 status.description = "OK";
113 registration.load = "OPEN";
114 install.type = "PACKAGE";
115 };
116 software = {
117 name = "Apache Httpd";
118 website = "https://httpd.apache.org/";
119 license.url = "https://www.apache.org/licenses/";
120 license.name = "Apache License Version 2";
121 version = pkgs.apacheHttpd.version;
122 source.url = "https://httpd.apache.org/download.cgi";
123 modules = "openssh,pure-ftpd";
124 };
125 };
126 users.users.wwwrun.extraGroups = [ "keys" ];
127 networking.firewall.allowedTCPPorts = [ 80 443 ];
128
129 secrets.keys."apache-ldap" = {
130 user = "wwwrun";
131 group = "wwwrun";
132 permissions = "0400";
133 text = ''
134 <Macro LDAPConnect>
135 <IfModule authnz_ldap_module>
136 AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
137 AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
138 AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
139 AuthType Basic
140 AuthName "Authentification requise (Acces LDAP)"
141 AuthBasicProvider ldap
142 </IfModule>
143 </Macro>
144 '';
145 };
146
147 system.activationScripts = {
148 httpd = ''
149 install -d -m 0755 /var/lib/acme/acme-challenges
150 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
151 '';
152 };
153
154 services.phpfpm = {
155 phpOptions = ''
156 session.save_path = "/var/lib/php/sessions"
157 post_max_size = 20M
158 ; 15 days (seconds)
159 session.gc_maxlifetime = 1296000
160 ; 30 days (minutes)
161 session.cache_expire = 43200
162 '';
163 settings = {
164 log_level = "notice";
165 };
166 };
167
168 services.filesWatcher.httpdProd.paths = [ config.secrets.fullPaths."apache-ldap" ];
169 services.filesWatcher.httpdInte.paths = [ config.secrets.fullPaths."apache-ldap" ];
170 services.filesWatcher.httpdTools.paths = [ config.secrets.fullPaths."apache-ldap" ];
171
172 services.websites.env.production = {
173 enable = true;
174 adminAddr = "httpd@immae.eu";
175 httpdName = "Prod";
176 ips =
177 let ips = config.myEnv.servers.eldiron.ips.production;
178 in (ips.ip4 or []) ++ (ips.ip6 or []);
179 modules = makeModules;
180 extraConfig = makeExtraConfig;
181 fallbackVhost = {
182 certName = "eldiron";
183 hosts = ["eldiron.immae.eu" ];
184 root = www_root;
185 extraConfig = [ "DirectoryIndex index.htm" ];
186 };
187 };
188
189 services.websites.env.integration = {
190 enable = true;
191 adminAddr = "httpd@immae.eu";
192 httpdName = "Inte";
193 ips =
194 let ips = config.myEnv.servers.eldiron.ips.integration;
195 in (ips.ip4 or []) ++ (ips.ip6 or []);
196 modules = makeModules;
197 extraConfig = makeExtraConfig ++ moomin;
198 fallbackVhost = {
199 certName = "integration";
200 hosts = ["eldiron.immae.eu" ];
201 root = www_root;
202 extraConfig = [ "DirectoryIndex index.htm" ];
203 };
204 };
205
206 services.websites.env.tools = {
207 enable = true;
208 adminAddr = "httpd@immae.eu";
209 httpdName = "Tools";
210 ips =
211 let ips = config.myEnv.servers.eldiron.ips.main;
212 in (ips.ip4 or []) ++ (ips.ip6 or []);
213 modules = makeModules;
214 extraConfig = makeExtraConfig ++
215 [ ''
216 RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
217 RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
218 RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
219 RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
220 RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
221 RedirectMatch ^/CGU$ https://www.immae.eu/CGU
222 ''
223 ];
224 nosslVhost = {
225 enable = true;
226 host = "nossl.immae.eu";
227 };
228 fallbackVhost = {
229 certName = "eldiron";
230 hosts = ["eldiron.immae.eu" ];
231 root = www_root;
232 extraConfig = [ "DirectoryIndex index.htm" ];
233 };
234 };
235
236 myServices.tools.kanboard.farm.instances.tonnelle = {};
237 myServices.tools.kanboard.farm.instances.gebull = {};
238 myServices.websites = {
239 attilax.dolibarr.enable = true;
240
241 bakeer.cloud.enable = true;
242 capitaines.landing_pages.enable = true;
243
244 chloe = {
245 new.enable = true;
246 production.enable = true;
247 };
248
249 christophe_carpentier = {
250 website.enable = true;
251 agorakit.enable = true;
252 agora-project.enable = true;
253 ateliersduchangement.enable = true;
254 };
255
256 cip-ca = {
257 sympa.enable = true;
258 };
259
260 connexionswing = {
261 integration.enable = true;
262 production.enable = true;
263 };
264
265 denise = {
266 evariste.enable = true;
267 denisejerome.enable = true;
268 oms.enable = true;
269 bingo.enable = true;
270 aventuriers.enable = true;
271 production.enable = true;
272 };
273
274 emilia = {
275 moodle.enable = false;
276 atelierfringant.enable = false;
277 };
278
279 florian = {
280 app.enable = true;
281 integration.enable = true;
282 production.enable = true;
283 };
284
285 immae = {
286 production.enable = true;
287 release.enable = true;
288 temp.enable = true;
289 dolibarr.enable = true;
290 };
291
292 isabelle = {
293 aten_integration.enable = true;
294 aten_production.enable = true;
295 iridologie.enable = true;
296 };
297
298 jerome.naturaloutil.enable = true;
299
300 leila.production.enable = true;
301
302 librezo = {
303 cloud.enable = true;
304 dolibarr.enable = true;
305 dolibarrDev.enable = true;
306 website.enable = true;
307 };
308
309 ludivine = {
310 integration.enable = true;
311 production.enable = true;
312 };
313
314 nassime.production.enable = true;
315
316 nicecoop = {
317 gestion-compte.enable = true;
318 gestion-compte-integration.enable = true;
319 odoo.enable = true;
320 dolibarrDev.enable = true;
321 copanier.enable = true;
322 };
323
324 noctambules = {
325 cloud.enable = true;
326 };
327
328 papa = {
329 surveillance.enable = true;
330 maison_bbc.enable = true;
331 };
332
333 patrick_fodella = {
334 ecolyeu.enable = false;
335 altermondia.enable = true;
336 };
337
338 piedsjaloux = {
339 integration.enable = true;
340 production.enable = true;
341 };
342
343 ressourcerie_banon.production.enable = true;
344 ressourcerie_banon.cryptpad.enable = true;
345 ressourcerie_banon.cloud.enable = true;
346
347 richie.production.enable = true;
348
349 syden.peertube.enable = true;
350
351 telio_tortay.production.enable = true;
352
353 tools.assets.enable = true;
354 tools.cloud.enable = true;
355 tools.commento.enable = true;
356 tools.cryptpad.enable = true;
357 tools.dav.enable = true;
358 tools.db.enable = true;
359 tools.diaspora.enable = true;
360 tools.etherpad-lite.enable = true;
361 tools.git.enable = true;
362 tools.mastodon.enable = true;
363 tools.mediagoblin.enable = true;
364 tools.peertube.enable = true;
365 tools.performance.enable = true;
366 tools.tools.enable = true;
367 tools.email.enable = true;
368 tools.stats.enable = false;
369 tools.visio.enable = true;
370
371 games.codenames.enable = true;
372 games.terraforming-mars.enable = true;
373 };
374 };
375 }