1 { lib, config, ... }: with lib;
3 cfg = config.services.websites;
6 options.services.websites = with types; {
8 description = "Default websites configuration for certificates as accepted by acme";
10 webappDirs = mkOption {
12 Defines a symlink between /run/current-system/webapps and a store
13 app directory to be used in http configuration. Permits to avoid
14 restarting httpd when only the folder name changes.
16 type = types.attrsOf types.path;
19 webappDirsName = mkOption {
23 Name of the webapp dir to create in /run/current-system
28 description = "Each type of website to enable will target a distinct httpd server";
29 type = attrsOf (submodule {
31 enable = mkEnableOption "Enable websites of this type";
32 adminAddr = mkOption {
34 description = "Admin e-mail address of the instance";
36 httpdName = mkOption {
38 description = "Name of the httpd instance to assign this type to";
43 description = "ips to listen to";
48 description = "Additional modules to load in Apache";
50 extraConfig = mkOption {
53 description = "Additional configuration to append to Apache";
55 nosslVhost = mkOption {
56 description = "A default nossl vhost for captive portals";
60 enable = mkEnableOption "Add default no-ssl vhost for this instance";
63 description = "The hostname to use for this vhost";
67 default = ./nosslVhost;
68 description = "The root folder to serve";
70 indexFile = mkOption {
72 default = "index.html";
73 description = "The index file to show.";
78 fallbackVhost = mkOption {
79 description = "The fallback vhost that will be defined as first vhost in Apache";
82 certName = mkOption { type = string; };
83 hosts = mkOption { type = listOf string; };
84 root = mkOption { type = nullOr path; };
85 extraConfig = mkOption { type = listOf lines; default = []; };
89 vhostNoSSLConfs = mkOption {
91 description = "List of no ssl vhosts to define for Apache";
92 type = attrsOf (submodule {
94 hosts = mkOption { type = listOf string; };
95 root = mkOption { type = nullOr path; };
96 extraConfig = mkOption { type = listOf lines; default = []; };
100 vhostConfs = mkOption {
102 description = "List of vhosts to define for Apache";
103 type = attrsOf (submodule {
105 certName = mkOption { type = string; };
106 addToCerts = mkOption {
109 description = "Use these to certificates. Is ignored (considered true) if certMainHost is not null";
111 certMainHost = mkOption {
112 type = nullOr string;
113 description = "Use that host as 'main host' for acme certs";
116 hosts = mkOption { type = listOf string; };
117 root = mkOption { type = nullOr path; };
118 extraConfig = mkOption { type = listOf lines; default = []; };
122 watchPaths = mkOption {
123 type = listOf string;
126 Paths to watch that should trigger a reload of httpd
133 webappDirsPaths = mkOption {
137 Full paths of the webapp dir
139 default = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair
140 name "/run/current-system/${cfg.webappDirsName}/${name}"
145 config.services.httpd = let
146 redirectVhost = ips: { # Should go last, catchall http -> https redirect
147 listen = map (ip: { inherit ip; port = 80; }) ips;
148 hostName = "redirectSSL";
149 serverAliases = [ "*" ];
151 logFormat = "combinedVhost";
152 documentRoot = "${config.security.acme.directory}/acme-challenge";
155 RewriteCond "%{REQUEST_URI}" "!^/\.well-known"
156 RewriteRule ^(.+) https://%{HTTP_HOST}$1 [R=301]
157 # To redirect in specific "VirtualHost *:80", do
158 # RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
159 # rather than rewrite
162 nosslVhost = ips: cfg: {
163 listen = map (ip: { inherit ip; port = 80; }) ips;
166 logFormat = "combinedVhost";
167 documentRoot = cfg.root;
169 <Directory ${cfg.root}>
170 DirectoryIndex ${cfg.indexFile}
175 RewriteRule ^/(.+) / [L]
179 toVhost = ips: vhostConf: {
181 sslServerCert = "${config.security.acme.directory}/${vhostConf.certName}/cert.pem";
182 sslServerKey = "${config.security.acme.directory}/${vhostConf.certName}/key.pem";
183 sslServerChain = "${config.security.acme.directory}/${vhostConf.certName}/chain.pem";
184 logFormat = "combinedVhost";
185 listen = map (ip: { inherit ip; port = 443; }) ips;
186 hostName = builtins.head vhostConf.hosts;
187 serverAliases = builtins.tail vhostConf.hosts or [];
188 documentRoot = vhostConf.root;
189 extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
191 toVhostNoSSL = ips: vhostConf: {
193 logFormat = "combinedVhost";
194 listen = map (ip: { inherit ip; port = 80; }) ips;
195 hostName = builtins.head vhostConf.hosts;
196 serverAliases = builtins.tail vhostConf.hosts or [];
197 documentRoot = vhostConf.root;
198 extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
200 in attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair
201 icfg.httpdName (mkIf icfg.enable {
203 listen = map (ip: { inherit ip; port = 443; }) icfg.ips;
204 stateDir = "/run/httpd_${name}";
205 logPerVirtualHost = true;
206 multiProcessingModule = "worker";
207 inherit (icfg) adminAddr;
208 logFormat = "combinedVhost";
209 extraModules = lists.unique icfg.modules;
210 extraConfig = builtins.concatStringsSep "\n" icfg.extraConfig;
211 virtualHosts = [ (toVhost icfg.ips icfg.fallbackVhost) ]
212 ++ optionals (icfg.nosslVhost.enable) [ (nosslVhost icfg.ips icfg.nosslVhost) ]
213 ++ (attrsets.mapAttrsToList (n: v: toVhostNoSSL icfg.ips v) icfg.vhostNoSSLConfs)
214 ++ (attrsets.mapAttrsToList (n: v: toVhost icfg.ips v) icfg.vhostConfs)
215 ++ [ (redirectVhost icfg.ips) ];
219 config.services.filesWatcher = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair
220 "httpd${icfg.httpdName}" {
221 paths = icfg.watchPaths;
226 config.security.acme.certs = let
227 typesToManage = attrsets.filterAttrs (k: v: v.enable) cfg.env;
228 flatVhosts = lists.flatten (attrsets.mapAttrsToList (k: v:
229 attrValues v.vhostConfs
231 groupedCerts = attrsets.filterAttrs
232 (_: group: builtins.any (v: v.addToCerts || !isNull v.certMainHost) group)
233 (lists.groupBy (v: v.certName) flatVhosts);
234 groupToDomain = group:
236 nonNull = builtins.filter (v: !isNull v.certMainHost) group;
237 domains = lists.unique (map (v: v.certMainHost) nonNull);
239 if builtins.length domains == 0
241 else assert (builtins.length domains == 1); (elemAt domains 0);
242 extraDomains = group:
244 mainDomain = groupToDomain group;
246 lists.remove mainDomain (
248 lists.flatten (map (c: optionals (c.addToCerts || !isNull c.certMainHost) c.hosts) group)
251 in attrsets.mapAttrs (k: g:
252 if (!isNull (groupToDomain g))
254 domain = groupToDomain g;
255 extraDomains = builtins.listToAttrs (
256 map (d: attrsets.nameValuePair d null) (extraDomains g));
259 extraDomains = builtins.listToAttrs (
260 map (d: attrsets.nameValuePair d null) (extraDomains g));
264 config.system.extraSystemBuilderCmds = lib.mkIf (builtins.length (builtins.attrValues cfg.webappDirs) > 0) ''
265 mkdir -p $out/${cfg.webappDirsName}
266 ${builtins.concatStringsSep "\n"
267 (attrsets.mapAttrsToList
268 (name: path: "ln -s ${path} $out/${cfg.webappDirsName}/${name}") cfg.webappDirs)