1 { lib, config, ... }: with lib;
4 certs = config.services.websitesCerts;
5 webappDirs = config.services.websitesWebappDirs;
6 env = config.services.websites;
10 options.services.websitesCerts = mkOption {
11 description = "Default websites configuration for certificates as accepted by acme";
13 options.services.websitesWebappDirs = mkOption {
15 Defines a symlink between /run/current-system/webapps and a store
16 app directory to be used in http configuration. Permits to avoid
17 restarting httpd when only the folder name changes.
19 type = types.attrsOf types.path;
22 # TODO: ajouter /run/current-system/webapps (RO) et webapps (RW)
23 options.services.websites = with types; mkOption {
25 description = "Each type of website to enable will target a distinct httpd server";
26 type = attrsOf (submodule {
28 enable = mkEnableOption "Enable websites of this type";
29 adminAddr = mkOption {
31 description = "Admin e-mail address of the instance";
33 httpdName = mkOption {
35 description = "Name of the httpd instance to assign this type to";
40 description = "ips to listen to";
45 description = "Additional modules to load in Apache";
47 extraConfig = mkOption {
50 description = "Additional configuration to append to Apache";
52 nosslVhost = mkOption {
53 description = "A default nossl vhost for captive portals";
57 enable = mkEnableOption "Add default no-ssl vhost for this instance";
60 description = "The hostname to use for this vhost";
64 default = ./nosslVhost;
65 description = "The root folder to serve";
67 indexFile = mkOption {
69 default = "index.html";
70 description = "The index file to show.";
75 fallbackVhost = mkOption {
76 description = "The fallback vhost that will be defined as first vhost in Apache";
79 certName = mkOption { type = string; };
80 hosts = mkOption { type = listOf string; };
81 root = mkOption { type = nullOr path; };
82 extraConfig = mkOption { type = listOf lines; default = []; };
86 vhostConfs = mkOption {
88 description = "List of vhosts to define for Apache";
89 type = attrsOf (submodule {
91 certName = mkOption { type = string; };
92 addToCerts = mkOption {
95 description = "Use these to certificates. Is ignored (considered true) if certMainHost is not null";
97 certMainHost = mkOption {
99 description = "Use that host as 'main host' for acme certs";
102 hosts = mkOption { type = listOf string; };
103 root = mkOption { type = nullOr path; };
104 extraConfig = mkOption { type = listOf lines; default = []; };
108 watchPaths = mkOption {
109 type = listOf string;
112 Paths to watch that should trigger a reload of httpd
119 config.services.httpd = let
120 redirectVhost = ips: { # Should go last, catchall http -> https redirect
121 listen = map (ip: { inherit ip; port = 80; }) ips;
122 hostName = "redirectSSL";
123 serverAliases = [ "*" ];
125 logFormat = "combinedVhost";
126 documentRoot = "${config.security.acme.directory}/acme-challenge";
129 RewriteCond "%{REQUEST_URI}" "!^/\.well-known"
130 RewriteRule ^(.+) https://%{HTTP_HOST}$1 [R=301]
131 # To redirect in specific "VirtualHost *:80", do
132 # RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
133 # rather than rewrite
136 nosslVhost = ips: cfg: {
137 listen = map (ip: { inherit ip; port = 80; }) ips;
140 logFormat = "combinedVhost";
141 documentRoot = cfg.root;
143 <Directory ${cfg.root}>
144 DirectoryIndex ${cfg.indexFile}
149 RewriteRule ^/(.+) / [L]
153 toVhost = ips: vhostConf: {
155 sslServerCert = "${config.security.acme.directory}/${vhostConf.certName}/cert.pem";
156 sslServerKey = "${config.security.acme.directory}/${vhostConf.certName}/key.pem";
157 sslServerChain = "${config.security.acme.directory}/${vhostConf.certName}/chain.pem";
158 logFormat = "combinedVhost";
159 listen = map (ip: { inherit ip; port = 443; }) ips;
160 hostName = builtins.head vhostConf.hosts;
161 serverAliases = builtins.tail vhostConf.hosts or [];
162 documentRoot = vhostConf.root;
163 extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
165 in attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair
166 icfg.httpdName (mkIf icfg.enable {
168 listen = map (ip: { inherit ip; port = 443; }) icfg.ips;
169 stateDir = "/run/httpd_${name}";
170 logPerVirtualHost = true;
171 multiProcessingModule = "worker";
172 inherit (icfg) adminAddr;
173 logFormat = "combinedVhost";
174 extraModules = lists.unique icfg.modules;
175 extraConfig = builtins.concatStringsSep "\n" icfg.extraConfig;
176 virtualHosts = [ (toVhost icfg.ips icfg.fallbackVhost) ]
177 ++ optionals (icfg.nosslVhost.enable) [ (nosslVhost icfg.ips icfg.nosslVhost) ]
178 ++ (attrsets.mapAttrsToList (n: v: toVhost icfg.ips v) icfg.vhostConfs)
179 ++ [ (redirectVhost icfg.ips) ];
183 config.services.filesWatcher = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair
184 "httpd${icfg.httpdName}" {
185 paths = icfg.watchPaths;
190 config.security.acme.certs = let
191 typesToManage = attrsets.filterAttrs (k: v: v.enable) cfg.env;
192 flatVhosts = lists.flatten (attrsets.mapAttrsToList (k: v:
193 attrValues v.vhostConfs
195 groupedCerts = attrsets.filterAttrs
196 (_: group: builtins.any (v: v.addToCerts || !isNull v.certMainHost) group)
197 (lists.groupBy (v: v.certName) flatVhosts);
198 groupToDomain = group:
200 nonNull = builtins.filter (v: !isNull v.certMainHost) group;
201 domains = lists.unique (map (v: v.certMainHost) nonNull);
203 if builtins.length domains == 0
205 else assert (builtins.length domains == 1); (elemAt domains 0);
206 extraDomains = group:
208 mainDomain = groupToDomain group;
210 lists.remove mainDomain (
212 lists.flatten (map (c: optionals (c.addToCerts || !isNull c.certMainHost) c.hosts) group)
215 in attrsets.mapAttrs (k: g:
216 if (!isNull (groupToDomain g))
218 domain = groupToDomain g;
219 extraDomains = builtins.listToAttrs (
220 map (d: attrsets.nameValuePair d null) (extraDomains g));
223 extraDomains = builtins.listToAttrs (
224 map (d: attrsets.nameValuePair d null) (extraDomains g));
228 config.system.extraSystemBuilderCmds = lib.mkIf (builtins.length (builtins.attrValues cfg.webappDirs) > 0) ''
229 mkdir -p $out/webapps
230 ${builtins.concatStringsSep "\n" (attrsets.mapAttrsToList (name: path: "ln -s ${path} $out/webapps/${name}") cfg.webappDirs)}