1 { lib, config, ... }: with lib;
3 cfg = config.services.websites;
6 options.services.websites = with types; {
8 description = "Default websites configuration for certificates as accepted by acme";
10 webappDirs = mkOption {
12 Defines a symlink between /run/current-system/webapps and a store
13 app directory to be used in http configuration. Permits to avoid
14 restarting httpd when only the folder name changes.
16 type = types.attrsOf types.path;
19 webappDirsName = mkOption {
23 Name of the webapp dir to create in /run/current-system
28 description = "Each type of website to enable will target a distinct httpd server";
29 type = attrsOf (submodule {
31 enable = mkEnableOption "Enable websites of this type";
32 adminAddr = mkOption {
34 description = "Admin e-mail address of the instance";
36 httpdName = mkOption {
38 description = "Name of the httpd instance to assign this type to";
43 description = "ips to listen to";
48 description = "Additional modules to load in Apache";
50 extraConfig = mkOption {
53 description = "Additional configuration to append to Apache";
55 nosslVhost = mkOption {
56 description = "A default nossl vhost for captive portals";
60 enable = mkEnableOption "Add default no-ssl vhost for this instance";
63 description = "The hostname to use for this vhost";
67 default = ./nosslVhost;
68 description = "The root folder to serve";
70 indexFile = mkOption {
72 default = "index.html";
73 description = "The index file to show.";
78 fallbackVhost = mkOption {
79 description = "The fallback vhost that will be defined as first vhost in Apache";
82 certName = mkOption { type = str; };
83 hosts = mkOption { type = listOf str; };
84 root = mkOption { type = nullOr path; };
89 Automatically create a corresponding non-ssl vhost
90 that will only redirect to the ssl version
93 extraConfig = mkOption { type = listOf lines; default = []; };
97 vhostNoSSLConfs = mkOption {
99 description = "List of no ssl vhosts to define for Apache";
100 type = attrsOf (submodule {
102 hosts = mkOption { type = listOf str; };
103 root = mkOption { type = nullOr path; };
104 extraConfig = mkOption { type = listOf lines; default = []; };
108 vhostConfs = mkOption {
110 description = "List of vhosts to define for Apache";
111 type = attrsOf (submodule {
113 certName = mkOption { type = str; };
114 addToCerts = mkOption {
117 description = "Use these to certificates. Is ignored (considered true) if certMainHost is not null";
119 certMainHost = mkOption {
121 description = "Use that host as 'main host' for acme certs";
124 hosts = mkOption { type = listOf str; };
125 root = mkOption { type = nullOr path; };
126 forceSSL = mkOption {
130 Automatically create a corresponding non-ssl vhost
131 that will only redirect to the ssl version
134 extraConfig = mkOption { type = listOf lines; default = []; };
138 watchPaths = mkOption {
142 Paths to watch that should trigger a reload of httpd
149 webappDirsPaths = mkOption {
153 Full paths of the webapp dir
155 default = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair
156 name "/run/current-system/${cfg.webappDirsName}/${name}"
161 config.services.httpd = let
162 nosslVhost = ips: cfg: {
163 listen = map (ip: { inherit ip; port = 80; }) ips;
165 logFormat = "combinedVhost";
166 documentRoot = cfg.root;
168 <Directory ${cfg.root}>
169 DirectoryIndex ${cfg.indexFile}
174 RewriteRule ^/(.+) / [L]
178 toVhost = ips: vhostConf: {
179 forceSSL = vhostConf.forceSSL or true;
180 useACMEHost = vhostConf.certName;
181 logFormat = "combinedVhost";
182 listen = if vhostConf.forceSSL
183 then lists.flatten (map (ip: [{ inherit ip; port = 443; ssl = true; } { inherit ip; port = 80; }]) ips)
184 else map (ip: { inherit ip; port = 443; ssl = true; }) ips;
185 hostName = builtins.head vhostConf.hosts;
186 serverAliases = builtins.tail vhostConf.hosts or [];
187 documentRoot = vhostConf.root;
188 extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
190 toVhostNoSSL = ips: vhostConf: {
191 logFormat = "combinedVhost";
192 listen = map (ip: { inherit ip; port = 80; }) ips;
193 hostName = builtins.head vhostConf.hosts;
194 serverAliases = builtins.tail vhostConf.hosts or [];
195 documentRoot = vhostConf.root;
196 extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
198 in attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair
199 icfg.httpdName (mkIf icfg.enable {
201 logPerVirtualHost = true;
202 multiProcessingModule = "worker";
203 # https://ssl-config.mozilla.org/#server=apache&version=2.4.41&config=intermediate&openssl=1.0.2t&guideline=5.4
204 sslProtocols = "all -SSLv3 -TLSv1 -TLSv1.1";
205 sslCiphers = builtins.concatStringsSep ":" [
206 "ECDHE-ECDSA-AES128-GCM-SHA256" "ECDHE-RSA-AES128-GCM-SHA256"
207 "ECDHE-ECDSA-AES256-GCM-SHA384" "ECDHE-RSA-AES256-GCM-SHA384"
208 "ECDHE-ECDSA-CHACHA20-POLY1305" "ECDHE-RSA-CHACHA20-POLY1305"
209 "DHE-RSA-AES128-GCM-SHA256" "DHE-RSA-AES256-GCM-SHA384"
211 inherit (icfg) adminAddr;
212 logFormat = "combinedVhost";
213 extraModules = lists.unique icfg.modules;
214 extraConfig = builtins.concatStringsSep "\n" icfg.extraConfig;
216 virtualHosts = with attrsets; {
217 ___fallbackVhost = toVhost icfg.ips icfg.fallbackVhost;
218 } // (optionalAttrs icfg.nosslVhost.enable {
219 nosslVhost = nosslVhost icfg.ips icfg.nosslVhost;
220 }) // (mapAttrs' (n: v: nameValuePair ("nossl_" + n) (toVhostNoSSL icfg.ips v)) icfg.vhostNoSSLConfs)
221 // (mapAttrs' (n: v: nameValuePair ("ssl_" + n) (toVhost icfg.ips v)) icfg.vhostConfs);
225 config.services.filesWatcher = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair
226 "httpd${icfg.httpdName}" {
227 paths = icfg.watchPaths;
232 config.security.acme.certs = let
233 typesToManage = attrsets.filterAttrs (k: v: v.enable) cfg.env;
234 flatVhosts = lists.flatten (attrsets.mapAttrsToList (k: v:
235 attrValues v.vhostConfs
237 groupedCerts = attrsets.filterAttrs
238 (_: group: builtins.any (v: v.addToCerts || !isNull v.certMainHost) group)
239 (lists.groupBy (v: v.certName) flatVhosts);
240 groupToDomain = group:
242 nonNull = builtins.filter (v: !isNull v.certMainHost) group;
243 domains = lists.unique (map (v: v.certMainHost) nonNull);
245 if builtins.length domains == 0
247 else assert (builtins.length domains == 1); (elemAt domains 0);
248 extraDomains = group:
250 mainDomain = groupToDomain group;
252 lists.remove mainDomain (
254 lists.flatten (map (c: optionals (c.addToCerts || !isNull c.certMainHost) c.hosts) group)
257 in attrsets.mapAttrs (k: g:
258 if (!isNull (groupToDomain g))
260 domain = groupToDomain g;
261 extraDomains = builtins.listToAttrs (
262 map (d: attrsets.nameValuePair d null) (extraDomains g));
265 extraDomains = builtins.listToAttrs (
266 map (d: attrsets.nameValuePair d null) (extraDomains g));
270 config.system.extraSystemBuilderCmds = lib.mkIf (builtins.length (builtins.attrValues cfg.webappDirs) > 0) ''
271 mkdir -p $out/${cfg.webappDirsName}
272 ${builtins.concatStringsSep "\n"
273 (attrsets.mapAttrsToList
274 (name: path: "ln -s ${path} $out/${cfg.webappDirsName}/${name}") cfg.webappDirs)