1 { lib, pkgs, config, ... }:
4 theme_root = pkgs.webapps.apache-theme.theme;
7 # This setting permits to ignore time-based cache for files in the
9 # If a client requires an If-Modified-Since from timestamp 1, then
10 # this header is removed, and if the response contains a
11 # too old Last-Modified tag, then it is removed too
13 <If "%{HTTP:If-Modified-Since} =~ /01 Jan 1970 00:00:01/" >
14 RequestHeader unset If-Modified-Since
16 Header unset Last-Modified "expr=%{LAST_MODIFIED} < 19991231235959"
20 modules = [ "deflate" "filter" ];
22 AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
26 modules = [ "macro" ];
30 <Macro Stats %{domain}>
31 Alias /webstats ${config.services.webstats.dataDir}/%{domain}
32 <Directory ${config.services.webstats.dataDir}/%{domain}>
33 DirectoryIndex index.html
39 Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
45 modules = [ "ldap" "authnz_ldap" ];
47 <IfModule ldap_module>
48 LDAPSharedCacheSize 500000
51 LDAPOpCacheEntries 1024
55 Include ${config.secrets.fullPaths."apache-ldap"}
60 ErrorDocument 500 /maintenance_immae.html
61 ErrorDocument 501 /maintenance_immae.html
62 ErrorDocument 502 /maintenance_immae.html
63 ErrorDocument 503 /maintenance_immae.html
64 ErrorDocument 504 /maintenance_immae.html
65 Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
66 ProxyPass /maintenance_immae.html !
68 AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
69 <Directory ${www_root}>
76 extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
79 modules = [ "http2" ];
86 LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
90 makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
91 makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
93 lines = lib.splitString "\n" (lib.fileContents ./moomin.txt);
95 padWidth = width - lib.stringLength str;
96 padding = lib.concatStrings (lib.genList (lib.const "0") padWidth);
97 in lib.optionalString (padWidth > 0) padding + str;
99 lib.imap0 (i: e: ''Header always set "X-Moomin-${pad 2 (builtins.toString i)}" "${e}"'') lines;
102 options.myServices.websites.enable = lib.mkEnableOption "enable websites";
104 config = lib.mkIf config.myServices.websites.enable {
105 users.users.wwwrun.extraGroups = [ "keys" ];
106 networking.firewall.allowedTCPPorts = [ 80 443 ];
108 secrets.keys."apache-ldap" = {
111 permissions = "0400";
114 <IfModule authnz_ldap_module>
115 AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
116 AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
117 AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
119 AuthName "Authentification requise (Acces LDAP)"
120 AuthBasicProvider ldap
126 system.activationScripts = {
128 install -d -m 0755 /var/lib/acme/acme-challenges
129 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
135 session.save_path = "/var/lib/php/sessions"
138 session.gc_maxlifetime = 1296000
140 session.cache_expire = 43200
143 log_level = "notice";
147 services.filesWatcher.httpdProd.paths = [ config.secrets.fullPaths."apache-ldap" ];
148 services.filesWatcher.httpdInte.paths = [ config.secrets.fullPaths."apache-ldap" ];
149 services.filesWatcher.httpdTools.paths = [ config.secrets.fullPaths."apache-ldap" ];
151 services.websites.env.production = {
153 adminAddr = "httpd@immae.eu";
156 let ips = config.myEnv.servers.eldiron.ips.production;
157 in (ips.ip4 or []) ++ (ips.ip6 or []);
158 modules = makeModules;
159 extraConfig = makeExtraConfig;
161 certName = "eldiron";
162 hosts = ["eldiron.immae.eu" ];
164 extraConfig = [ "DirectoryIndex index.htm" ];
168 services.websites.env.integration = {
170 adminAddr = "httpd@immae.eu";
173 let ips = config.myEnv.servers.eldiron.ips.integration;
174 in (ips.ip4 or []) ++ (ips.ip6 or []);
175 modules = makeModules;
176 extraConfig = makeExtraConfig ++ moomin;
178 certName = "integration";
179 hosts = ["eldiron.immae.eu" ];
181 extraConfig = [ "DirectoryIndex index.htm" ];
185 services.websites.env.tools = {
187 adminAddr = "httpd@immae.eu";
190 let ips = config.myEnv.servers.eldiron.ips.main;
191 in (ips.ip4 or []) ++ (ips.ip6 or []);
192 modules = makeModules;
193 extraConfig = makeExtraConfig ++
195 RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
196 RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
197 RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
198 RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
199 RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
200 RedirectMatch ^/CGU$ https://www.immae.eu/CGU
205 host = "nossl.immae.eu";
208 certName = "eldiron";
209 hosts = ["eldiron.immae.eu" ];
211 extraConfig = [ "DirectoryIndex index.htm" ];
215 myServices.tools.kanboard.farm.instances.tonnelle = null;
216 myServices.websites = {
217 bakeer.cloud.enable = true;
218 capitaines.landing_pages.enable = true;
222 production.enable = true;
225 christophe_carpentier = {
226 website.enable = true;
227 agorakit.enable = true;
228 agora-project.enable = true;
236 integration.enable = true;
237 production.enable = true;
241 evariste.enable = true;
242 denisejerome.enable = true;
245 aventuriers.enable = true;
246 production.enable = true;
250 moodle.enable = false;
251 atelierfringant.enable = true;
256 integration.enable = true;
257 production.enable = true;
261 production.enable = true;
262 release.enable = true;
267 aten_integration.enable = true;
268 aten_production.enable = true;
269 iridologie.enable = true;
272 jerome.naturaloutil.enable = true;
274 leila.production.enable = true;
278 dolibarr.enable = true;
279 dolibarrDev.enable = true;
280 website.enable = true;
284 integration.enable = true;
285 production.enable = true;
288 nassime.production.enable = true;
290 nath.villon.enable = true;
293 gestion-compte.enable = true;
294 gestion-compte-integration.enable = true;
296 copanier.enable = true;
299 surveillance.enable = true;
300 maison_bbc.enable = true;
304 ecolyeu.enable = true;
305 altermondia.enable = true;
309 integration.enable = true;
310 production.enable = true;
313 ressourcerie_banon.production.enable = true;
314 ressourcerie_banon.cryptpad.enable = true;
315 ressourcerie_banon.cloud.enable = true;
317 richie.production.enable = true;
319 syden.peertube.enable = true;
321 telio_tortay.production.enable = true;
323 tools.assets.enable = true;
324 tools.cloud.enable = true;
325 tools.commento.enable = true;
326 tools.cryptpad.enable = true;
327 tools.dav.enable = true;
328 tools.db.enable = true;
329 tools.diaspora.enable = true;
330 tools.etherpad-lite.enable = true;
331 tools.git.enable = true;
332 tools.mastodon.enable = true;
333 tools.mediagoblin.enable = true;
334 tools.peertube.enable = true;
335 tools.performance.enable = true;
336 tools.tools.enable = true;
337 tools.email.enable = true;
338 tools.stats.enable = false;
339 tools.visio.enable = true;
341 games.codenames.enable = true;
342 games.terraforming-mars.enable = true;