1 { lib, pkgs, config, ... }:
3 www_root = "/run/current-system/webapps/_www";
4 theme_root = "/run/current-system/webapps/_theme";
7 modules = [ "deflate" "filter" ];
9 AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
13 modules = [ "macro" ];
17 <Macro Stats %{domain}>
18 Alias /webstats ${config.services.webstats.dataDir}/%{domain}
19 <Directory ${config.services.webstats.dataDir}/%{domain}>
20 DirectoryIndex index.html
26 Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
32 modules = [ "ldap" "authnz_ldap" ];
34 <IfModule ldap_module>
35 LDAPSharedCacheSize 500000
38 LDAPOpCacheEntries 1024
42 Include /var/secrets/apache-ldap
47 ErrorDocument 500 /maintenance_immae.html
48 ErrorDocument 501 /maintenance_immae.html
49 ErrorDocument 502 /maintenance_immae.html
50 ErrorDocument 503 /maintenance_immae.html
51 ErrorDocument 504 /maintenance_immae.html
52 Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
53 ProxyPass /maintenance_immae.html !
55 AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
56 <Directory ${www_root}>
63 extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
66 modules = [ "http2" ];
73 LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
77 makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
78 makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
81 options.myServices.websites.enable = lib.mkEnableOption "enable websites";
83 config = lib.mkIf config.myServices.websites.enable {
84 services.duplyBackup.profiles.php = {
85 rootDir = "/var/lib/php";
87 users.users.wwwrun.extraGroups = [ "keys" ];
88 networking.firewall.allowedTCPPorts = [ 80 443 ];
90 nixpkgs.overlays = [ (self: super: rec {
91 #openssl = self.openssl_1_1;
93 php72 = (super.php72.override {
94 config.php.mysqlnd = true;
95 config.php.mysqli = false;
96 config.php.mhash = true; # Is it needed?
97 }).overrideAttrs(old: rec {
98 # Didn't manage to build with mysqli + mysql_config connector
99 configureFlags = old.configureFlags ++ [
100 "--with-mysqli=shared,mysqlnd"
102 # preConfigure = (old.preConfigure or "") + ''
103 # export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
104 # sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
105 # ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
108 phpPackages = super.php72Packages.override { inherit php; };
112 dest = "apache-ldap";
115 permissions = "0400";
118 <IfModule authnz_ldap_module>
119 AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
120 AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
121 AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
123 AuthName "Authentification requise (Acces LDAP)"
124 AuthBasicProvider ldap
130 system.activationScripts = {
132 install -d -m 0755 /var/lib/acme/acme-challenges
133 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
138 phpPackage = pkgs.php;
140 session.save_path = "/var/lib/php/sessions"
143 session.gc_maxlifetime = 1296000
145 session.cache_expire = 43200
148 log_level = "notice";
152 services.filesWatcher.httpdProd.paths = [ "/var/secrets/apache-ldap" ];
153 services.filesWatcher.httpdInte.paths = [ "/var/secrets/apache-ldap" ];
154 services.filesWatcher.httpdTools.paths = [ "/var/secrets/apache-ldap" ];
156 services.websites.env.production = {
158 adminAddr = "httpd@immae.eu";
161 let ips = config.myEnv.servers.eldiron.ips.production;
162 in [ips.ip4] ++ (ips.ip6 or []);
163 modules = makeModules;
164 extraConfig = makeExtraConfig;
166 certName = "eldiron";
167 hosts = ["eldiron.immae.eu" ];
169 extraConfig = [ "DirectoryIndex index.htm" ];
173 services.websites.env.integration = {
175 adminAddr = "httpd@immae.eu";
178 let ips = config.myEnv.servers.eldiron.ips.integration;
179 in [ips.ip4] ++ (ips.ip6 or []);
180 modules = makeModules;
181 extraConfig = makeExtraConfig;
183 certName = "eldiron";
184 hosts = ["eldiron.immae.eu" ];
186 extraConfig = [ "DirectoryIndex index.htm" ];
190 services.websites.env.tools = {
192 adminAddr = "httpd@immae.eu";
195 let ips = config.myEnv.servers.eldiron.ips.main;
196 in [ips.ip4] ++ (ips.ip6 or []);
197 modules = makeModules;
198 extraConfig = makeExtraConfig ++
200 RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
201 RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
202 RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
203 RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
204 RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
205 RedirectMatch ^/CGU$ https://www.immae.eu/CGU
210 host = "nossl.immae.eu";
213 certName = "eldiron";
214 hosts = ["eldiron.immae.eu" ];
216 extraConfig = [ "DirectoryIndex index.htm" ];
220 services.websites.webappDirs = {
222 _theme = pkgs.webapps.apache-theme.theme;
224 myServices.websites = {
225 capitaines.landing_pages.enable = true;
228 integration.enable = true;
229 production.enable = true;
233 integration.enable = true;
234 production.enable = true;
238 evariste.enable = true;
239 denisejerome.enable = true;
242 emilia.moodle.enable = true;
246 integration.enable = true;
247 production.enable = true;
251 production.enable = true;
252 release.enable = true;
257 aten_integration.enable = true;
258 aten_production.enable = true;
259 iridologie.enable = true;
262 jerome.naturaloutil.enable = true;
264 leila.production.enable = true;
267 integration.enable = true;
268 production.enable = true;
271 nassime.production.enable = true;
273 nathanael.villon.enable = true;
276 surveillance.enable = true;
277 maison_bbc.enable = true;
281 integration.enable = true;
282 production.enable = true;
285 richie.production.enable = true;
287 syden.peertube.enable = true;
289 telio_tortay.production.enable = true;
291 tools.cloud.enable = true;
292 tools.dav.enable = true;
293 tools.db.enable = true;
294 tools.diaspora.enable = true;
295 tools.etherpad-lite.enable = true;
296 tools.git.enable = true;
297 tools.mastodon.enable = true;
298 tools.mediagoblin.enable = true;
299 tools.peertube.enable = true;
300 tools.tools.enable = true;
301 tools.email.enable = true;
303 games.codenames.enable = true;