1 { lib, pkgs, config, ... }:
3 www_root = "/run/current-system/webapps/_www";
4 theme_root = "/run/current-system/webapps/_theme";
7 modules = [ "deflate" "filter" ];
9 AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
13 modules = [ "macro" ];
17 <Macro Stats %{domain}>
18 Alias /webstats ${config.services.webstats.dataDir}/%{domain}
19 <Directory ${config.services.webstats.dataDir}/%{domain}>
20 DirectoryIndex index.html
26 Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
32 modules = [ "ldap" "authnz_ldap" ];
34 <IfModule ldap_module>
35 LDAPSharedCacheSize 500000
38 LDAPOpCacheEntries 1024
42 Include /var/secrets/apache-ldap
46 extraConfig = (pkgs.webapps.apache-default.override { inherit www_root;}).apacheConfig;
49 extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
52 modules = [ "http2" ];
59 LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
63 makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
64 makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
67 options.myServices.websites = {
68 enable = lib.mkEnableOption "enable websites";
70 webappDirs = lib.mkOption {
71 type = lib.types.attrsOf lib.types.path;
73 Webapp paths to create in /run/current-system/webapps
79 config = lib.mkIf config.myServices.websites.enable {
80 services.duplyBackup.profiles.php = {
81 rootDir = "/var/lib/php";
83 users.users.wwwrun.extraGroups = [ "keys" ];
84 networking.firewall.allowedTCPPorts = [ 80 443 ];
86 nixpkgs.overlays = [ (self: super: rec {
87 #openssl = self.openssl_1_1;
89 php72 = (super.php72.override {
90 mysql.connector-c = self.mariadb;
91 config.php.mysqlnd = false;
92 config.php.mysqli = false;
93 }).overrideAttrs(old: rec {
94 # Didn't manage to build with mysqli + mysql_config connector
95 configureFlags = old.configureFlags ++ [
96 "--with-mysqli=shared,mysqlnd"
98 # preConfigure = (old.preConfigure or "") + ''
99 # export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
100 # sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
101 # ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
104 phpPackages = super.php72Packages.override { inherit php; };
108 dest = "apache-ldap";
111 permissions = "0400";
114 <IfModule authnz_ldap_module>
115 AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
116 AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
117 AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
119 AuthName "Authentification requise (Acces LDAP)"
120 AuthBasicProvider ldap
126 system.activationScripts = {
128 install -d -m 0755 ${config.security.acme.directory}/acme-challenge
129 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
134 phpPackage = pkgs.php;
136 session.save_path = "/var/lib/php/sessions"
139 session.gc_maxlifetime = 1296000
141 session.cache_expire = 43200
148 services.filesWatcher.httpdProd.paths = [ "/var/secrets/apache-ldap" ];
149 services.filesWatcher.httpdInte.paths = [ "/var/secrets/apache-ldap" ];
150 services.filesWatcher.httpdTools.paths = [ "/var/secrets/apache-ldap" ];
152 services.websites.env.production = {
154 adminAddr = "httpd@immae.eu";
157 let ips = config.myEnv.servers.eldiron.ips.production;
158 in [ips.ip4] ++ (ips.ip6 or []);
159 modules = makeModules;
160 extraConfig = makeExtraConfig;
162 certName = "eldiron";
163 hosts = ["eldiron.immae.eu" ];
165 extraConfig = [ "DirectoryIndex index.htm" ];
169 services.websites.env.integration = {
171 adminAddr = "httpd@immae.eu";
174 let ips = config.myEnv.servers.eldiron.ips.integration;
175 in [ips.ip4] ++ (ips.ip6 or []);
176 modules = makeModules;
177 extraConfig = makeExtraConfig;
179 certName = "eldiron";
180 hosts = ["eldiron.immae.eu" ];
182 extraConfig = [ "DirectoryIndex index.htm" ];
186 services.websites.env.tools = {
188 adminAddr = "httpd@immae.eu";
191 let ips = config.myEnv.servers.eldiron.ips.main;
192 in [ips.ip4] ++ (ips.ip6 or []);
193 modules = makeModules;
194 extraConfig = makeExtraConfig ++
196 RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
197 RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
198 RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
199 RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
200 RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
201 RedirectMatch ^/CGU$ https://www.immae.eu/CGU
206 host = "nossl.immae.eu";
209 certName = "eldiron";
210 hosts = ["eldiron.immae.eu" ];
212 extraConfig = [ "DirectoryIndex index.htm" ];
216 system.extraSystemBuilderCmds = lib.mkIf (builtins.length (builtins.attrValues config.myServices.websites.webappDirs) > 0) ''
217 mkdir -p $out/webapps
218 ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList (name: path: "ln -s ${path} $out/webapps/${name}") config.myServices.websites.webappDirs)}
221 myServices.websites = {
223 _www = pkgs.webapps.apache-default.www;
224 _theme = pkgs.webapps.apache-theme.theme;
227 isabelle.aten_integration.enable = true;
228 isabelle.aten_production.enable = true;
229 isabelle.iridologie.enable = true;
231 capitaines.production.enable = true;
233 chloe.integration.enable = true;
234 chloe.production.enable = true;
236 connexionswing.integration.enable = true;
237 connexionswing.production.enable = true;
239 denisejerome.production.enable = true;
241 emilia.production.enable = true;
242 emilia.richie_production.enable = true;
244 florian.app.enable = true;
245 florian.integration.enable = true;
246 florian.production.enable = true;
248 immae.production.enable = true;
249 immae.release.enable = true;
250 immae.temp.enable = true;
252 leila.production.enable = true;
254 ludivinecassal.integration.enable = true;
255 ludivinecassal.production.enable = true;
257 nassime.production.enable = true;
259 naturaloutil.production.enable = true;
260 telioTortay.production.enable = true;
262 papa.surveillance.enable = true;
263 papa.maison_bbc.enable = true;
265 piedsjaloux.integration.enable = true;
266 piedsjaloux.production.enable = true;
268 tools.cloud.enable = true;
269 tools.dav.enable = true;
270 tools.db.enable = true;
271 tools.diaspora.enable = true;
272 tools.etherpad-lite.enable = true;
273 tools.git.enable = true;
274 tools.mastodon.enable = true;
275 tools.mediagoblin.enable = true;
276 tools.peertube.enable = true;
277 tools.tools.enable = true;
278 tools.email.enable = true;