1 { lib, config, ... }: with lib;
3 cfg = config.services.websites;
6 options.services.websites = with types; {
8 description = "Default websites configuration for certificates as accepted by acme";
10 webappDirs = mkOption {
12 Defines a symlink between /run/current-system/webapps and a store
13 app directory to be used in http configuration. Permits to avoid
14 restarting httpd when only the folder name changes.
16 type = types.attrsOf types.path;
19 webappDirsName = mkOption {
23 Name of the webapp dir to create in /run/current-system
26 webappDirsPath = mkOption {
30 Full path of the webapp dir
32 default = "/run/current-system/${cfg.webappDirsName}";
36 description = "Each type of website to enable will target a distinct httpd server";
37 type = attrsOf (submodule {
39 enable = mkEnableOption "Enable websites of this type";
40 adminAddr = mkOption {
42 description = "Admin e-mail address of the instance";
44 httpdName = mkOption {
46 description = "Name of the httpd instance to assign this type to";
51 description = "ips to listen to";
56 description = "Additional modules to load in Apache";
58 extraConfig = mkOption {
61 description = "Additional configuration to append to Apache";
63 nosslVhost = mkOption {
64 description = "A default nossl vhost for captive portals";
68 enable = mkEnableOption "Add default no-ssl vhost for this instance";
71 description = "The hostname to use for this vhost";
75 default = ./nosslVhost;
76 description = "The root folder to serve";
78 indexFile = mkOption {
80 default = "index.html";
81 description = "The index file to show.";
86 fallbackVhost = mkOption {
87 description = "The fallback vhost that will be defined as first vhost in Apache";
90 certName = mkOption { type = string; };
91 hosts = mkOption { type = listOf string; };
92 root = mkOption { type = nullOr path; };
93 extraConfig = mkOption { type = listOf lines; default = []; };
97 vhostConfs = mkOption {
99 description = "List of vhosts to define for Apache";
100 type = attrsOf (submodule {
102 certName = mkOption { type = string; };
103 addToCerts = mkOption {
106 description = "Use these to certificates. Is ignored (considered true) if certMainHost is not null";
108 certMainHost = mkOption {
109 type = nullOr string;
110 description = "Use that host as 'main host' for acme certs";
113 hosts = mkOption { type = listOf string; };
114 root = mkOption { type = nullOr path; };
115 extraConfig = mkOption { type = listOf lines; default = []; };
119 watchPaths = mkOption {
120 type = listOf string;
123 Paths to watch that should trigger a reload of httpd
131 config.services.httpd = let
132 redirectVhost = ips: { # Should go last, catchall http -> https redirect
133 listen = map (ip: { inherit ip; port = 80; }) ips;
134 hostName = "redirectSSL";
135 serverAliases = [ "*" ];
137 logFormat = "combinedVhost";
138 documentRoot = "${config.security.acme.directory}/acme-challenge";
141 RewriteCond "%{REQUEST_URI}" "!^/\.well-known"
142 RewriteRule ^(.+) https://%{HTTP_HOST}$1 [R=301]
143 # To redirect in specific "VirtualHost *:80", do
144 # RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
145 # rather than rewrite
148 nosslVhost = ips: cfg: {
149 listen = map (ip: { inherit ip; port = 80; }) ips;
152 logFormat = "combinedVhost";
153 documentRoot = cfg.root;
155 <Directory ${cfg.root}>
156 DirectoryIndex ${cfg.indexFile}
161 RewriteRule ^/(.+) / [L]
165 toVhost = ips: vhostConf: {
167 sslServerCert = "${config.security.acme.directory}/${vhostConf.certName}/cert.pem";
168 sslServerKey = "${config.security.acme.directory}/${vhostConf.certName}/key.pem";
169 sslServerChain = "${config.security.acme.directory}/${vhostConf.certName}/chain.pem";
170 logFormat = "combinedVhost";
171 listen = map (ip: { inherit ip; port = 443; }) ips;
172 hostName = builtins.head vhostConf.hosts;
173 serverAliases = builtins.tail vhostConf.hosts or [];
174 documentRoot = vhostConf.root;
175 extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
177 in attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair
178 icfg.httpdName (mkIf icfg.enable {
180 listen = map (ip: { inherit ip; port = 443; }) icfg.ips;
181 stateDir = "/run/httpd_${name}";
182 logPerVirtualHost = true;
183 multiProcessingModule = "worker";
184 inherit (icfg) adminAddr;
185 logFormat = "combinedVhost";
186 extraModules = lists.unique icfg.modules;
187 extraConfig = builtins.concatStringsSep "\n" icfg.extraConfig;
188 virtualHosts = [ (toVhost icfg.ips icfg.fallbackVhost) ]
189 ++ optionals (icfg.nosslVhost.enable) [ (nosslVhost icfg.ips icfg.nosslVhost) ]
190 ++ (attrsets.mapAttrsToList (n: v: toVhost icfg.ips v) icfg.vhostConfs)
191 ++ [ (redirectVhost icfg.ips) ];
195 config.services.filesWatcher = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair
196 "httpd${icfg.httpdName}" {
197 paths = icfg.watchPaths;
202 config.security.acme.certs = let
203 typesToManage = attrsets.filterAttrs (k: v: v.enable) cfg.env;
204 flatVhosts = lists.flatten (attrsets.mapAttrsToList (k: v:
205 attrValues v.vhostConfs
207 groupedCerts = attrsets.filterAttrs
208 (_: group: builtins.any (v: v.addToCerts || !isNull v.certMainHost) group)
209 (lists.groupBy (v: v.certName) flatVhosts);
210 groupToDomain = group:
212 nonNull = builtins.filter (v: !isNull v.certMainHost) group;
213 domains = lists.unique (map (v: v.certMainHost) nonNull);
215 if builtins.length domains == 0
217 else assert (builtins.length domains == 1); (elemAt domains 0);
218 extraDomains = group:
220 mainDomain = groupToDomain group;
222 lists.remove mainDomain (
224 lists.flatten (map (c: optionals (c.addToCerts || !isNull c.certMainHost) c.hosts) group)
227 in attrsets.mapAttrs (k: g:
228 if (!isNull (groupToDomain g))
230 domain = groupToDomain g;
231 extraDomains = builtins.listToAttrs (
232 map (d: attrsets.nameValuePair d null) (extraDomains g));
235 extraDomains = builtins.listToAttrs (
236 map (d: attrsets.nameValuePair d null) (extraDomains g));
240 config.system.extraSystemBuilderCmds = lib.mkIf (builtins.length (builtins.attrValues cfg.webappDirs) > 0) ''
241 mkdir -p $out/${cfg.webappDirsName}
242 ${builtins.concatStringsSep "\n"
243 (attrsets.mapAttrsToList
244 (name: path: "ln -s ${path} $out/${cfg.webappDirsName}/${name}") cfg.webappDirs)