1 { lib, pkgs, config, mylibs, myconfig, ... }:
3 cfg = config.services.myWebsites;
4 makeService = name: cfg: let
7 sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
8 sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
9 sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem";
10 logFormat = "combinedVhost";
12 { ip = cfg.ip; port = 443; }
14 hostName = builtins.head vhostConf.hosts;
15 serverAliases = builtins.tail vhostConf.hosts or [];
16 documentRoot = vhostConf.root;
17 extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
20 listen = [ { ip = cfg.ip; port = 80; } ];
21 hostName = "nossl.immae.eu";
23 logFormat = "combinedVhost";
24 documentRoot = ../../www;
26 <Directory ${../../www}>
27 DirectoryIndex nossl.html
32 RewriteRule ^/(.+) / [L]
36 redirectVhost = { # Should go last, catchall http -> https redirect
37 listen = [ { ip = cfg.ip; port = 80; } ];
38 hostName = "redirectSSL";
39 serverAliases = [ "*" ];
41 logFormat = "combinedVhost";
42 documentRoot = "/var/lib/acme/acme-challenge";
45 RewriteCond "%{REQUEST_URI}" "!^/\.well-known"
46 RewriteRule ^(.+) https://%{HTTP_HOST}$1 [R=301]
47 # To redirect in specific "VirtualHost *:80", do
48 # RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
52 fallbackVhost = toVhost { # Should go first, default choice
54 hosts = ["eldiron.immae.eu" ];
56 extraConfig = [ "DirectoryIndex index.htm" ];
61 { ip = cfg.ip; port = 443; }
63 stateDir = "/run/httpd_${name}";
64 logPerVirtualHost = true;
65 multiProcessingModule = "worker";
66 adminAddr = "httpd@immae.eu";
67 logFormat = "combinedVhost";
68 extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
69 extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
70 virtualHosts = [ fallbackVhost ]
71 ++ lib.optionals (name == "tools") [ nosslVhost ]
72 ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
75 makeServiceOptions = name: ip: {
76 enable = lib.mkEnableOption "enable websites in ${name}";
78 type = lib.types.string;
80 description = "${name} ip to listen to";
82 modules = lib.mkOption {
83 type = lib.types.listOf (lib.types.str);
86 extraConfig = lib.mkOption {
87 type = lib.types.listOf (lib.types.lines);
90 vhostConfs = lib.mkOption {
91 type = lib.types.attrsOf (lib.types.submodule {
93 certName = lib.mkOption { type = lib.types.string; };
94 hosts = lib.mkOption { type = lib.types.listOf lib.types.string; };
95 root = lib.mkOption { type = lib.types.nullOr lib.types.path; };
96 extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
101 makeModules = cfg: pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
102 makeExtraConfig = cfg: (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
117 ./ftp/denisejerome.nix
132 # sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
134 # And removed users / groups
135 ./apache/httpd_prod.nix
136 ./apache/httpd_inte.nix
137 # except for this one for users/groups
138 ./apache/httpd_tools.nix
139 # Adapted from base phpfpm
143 options.services.myWebsites = {
144 production = makeServiceOptions "production" myconfig.ips.production;
145 integration = makeServiceOptions "integration" myconfig.ips.integration;
146 tools = makeServiceOptions "tools" myconfig.ips.main;
148 apacheConfig = lib.mkOption {
149 type = lib.types.attrsOf (lib.types.submodule {
151 modules = lib.mkOption {
152 type = lib.types.listOf (lib.types.str);
155 extraConfig = lib.mkOption {
156 type = lib.types.nullOr lib.types.lines;
162 description = "Extra global config";
171 allowedTCPPorts = [ 80 443 ];
173 interfaces."eth0".ipv4.addresses = [
174 # 176.9.151.89 declared in nixops -> infra / tools
175 { address = myconfig.ips.production; prefixLength = 32; }
176 { address = myconfig.ips.integration; prefixLength = 32; }
180 nixpkgs.config.packageOverrides = oldpkgs: rec {
182 php72 = (oldpkgs.php72.override {
183 mysql.connector-c = pkgs.mariadb;
184 config.php.mysqlnd = false;
185 config.php.mysqli = false;
186 }).overrideAttrs(old: rec {
187 # Didn't manage to build with mysqli + mysql_config connector
188 configureFlags = old.configureFlags ++ [
189 "--with-mysqli=shared,mysqlnd"
191 # preConfigure = (old.preConfigure or "") + ''
192 # export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
193 # sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
194 # ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
197 phpPackages = oldpkgs.php72Packages.override { inherit php; };
198 composerEnv = import ./commons/composer-env.nix {
199 inherit (pkgs) stdenv writeTextFile fetchurl php unzip;
203 services.myWebsites.tools.databases.enable = true;
204 services.myWebsites.tools.tools.enable = true;
205 services.myWebsites.tools.dav.enable = true;
206 services.myWebsites.tools.cloud.enable = true;
207 services.myWebsites.tools.git.enable = true;
208 services.myWebsites.tools.mastodon.enable = true;
209 services.myWebsites.tools.mediagoblin.enable = true;
210 services.myWebsites.tools.diaspora.enable = true;
211 services.myWebsites.tools.etherpad-lite.enable = true;
212 services.myWebsites.tools.peertube.enable = true;
214 services.myWebsites.Chloe.production.enable = cfg.production.enable;
215 services.myWebsites.Ludivine.production.enable = cfg.production.enable;
216 services.myWebsites.Aten.production.enable = cfg.production.enable;
217 services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
218 services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
219 services.myWebsites.Jerome.production.enable = cfg.production.enable;
220 services.myWebsites.Nassime.production.enable = cfg.production.enable;
221 services.myWebsites.Florian.production.enable = cfg.production.enable;
222 services.myWebsites.DeniseJerome.production.enable = cfg.production.enable;
223 services.myWebsites.Emilia.production.enable = cfg.production.enable;
224 services.myWebsites.Capitaines.production.enable = cfg.production.enable;
225 services.myWebsites.Immae.production.enable = cfg.production.enable;
226 services.myWebsites.Release.production.enable = cfg.production.enable;
227 services.myWebsites.Temp.production.enable = cfg.production.enable;
229 services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
230 services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
231 services.myWebsites.Aten.integration.enable = cfg.integration.enable;
232 services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
233 services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
234 services.myWebsites.TellesFlorian.integration.enable = true;
235 services.myWebsites.Florian.integration.enable = true;
237 services.myWebsites.apacheConfig = {
239 modules = [ "deflate" "filter" ];
241 AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
245 modules = [ "macro" ];
249 <Macro Stats %{domain}>
250 Alias /awstats /var/lib/goaccess/%{domain}
251 <Directory /var/lib/goaccess/%{domain}>
252 DirectoryIndex index.html
258 Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
264 modules = [ "ldap" "authnz_ldap" ];
266 <IfModule ldap_module>
267 LDAPSharedCacheSize 500000
268 LDAPCacheEntries 1024
270 LDAPOpCacheEntries 1024
275 <IfModule authnz_ldap_module>
276 AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
277 AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
278 AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
280 AuthName "Authentification requise (Acces LDAP)"
281 AuthBasicProvider ldap
288 ErrorDocument 500 /maintenance_immae.html
289 ErrorDocument 501 /maintenance_immae.html
290 ErrorDocument 502 /maintenance_immae.html
291 ErrorDocument 503 /maintenance_immae.html
292 ErrorDocument 504 /maintenance_immae.html
293 Alias /maintenance_immae.html ${../../www}/maintenance_immae.html
294 ProxyPass /maintenance_immae.html !
296 AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${../../www}/googleb6d69446ff4ca3e5.html
297 <Directory ${../../www}>
305 <Macro Apaxy %{folder} %{ignored}>
306 Alias /theme ${./apache/theme}
307 <Directory ${./apache/theme}>
314 <Directory %{folder}>
319 # Inspired from Apaxy by @adamwhitcroft
321 IndexOptions +Charset=UTF-8 +FancyIndexing +IgnoreCase +FoldersFirst +XHTML +HTMLTable +SuppressRules +SuppressDescription +NameWidth=* +IconsAreLinks +ShowForbidden
323 IndexHeadInsert "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />"
326 IndexIgnore /theme .htaccess %{ignored}
328 AddIcon /theme/icons/blank.png ^^BLANKICON^^
329 AddIcon /theme/icons/folder.png ^^DIRECTORY^^
330 AddIcon /theme/icons/folder-home.png ..
332 AddIconByType (TXT,/theme/icons/text.png) text/*
333 AddIconByType (IMG,/theme/icons/image.png) image/*
334 AddIconByType (SND,/theme/icons/audio.png) audio/*
335 AddIconByType (VID,/theme/icons/video.png) video/*
337 AddIcon /theme/icons/archive.png .7z .bz2 .cab .gz .tar
338 AddIcon /theme/icons/audio.png .aac .aif .aifc .aiff .ape .au .flac .iff .m4a .mid .mp3 .mpa .ra .wav .wma .f4a .f4b .oga .ogg .xm .it .s3m .mod
339 AddIcon /theme/icons/bin.png .bin .hex
340 AddIcon /theme/icons/bmp.png .bmp
341 AddIcon /theme/icons/c.png .c
342 AddIcon /theme/icons/calc.png .xlsx .xlsm .xltx .xltm .xlam .xlr .xls .csv
343 AddIcon /theme/icons/cd.png .iso
344 AddIcon /theme/icons/cpp.png .cpp
345 AddIcon /theme/icons/css.png .css .sass .scss
346 AddIcon /theme/icons/deb.png .deb
347 AddIcon /theme/icons/doc.png .doc .docx .docm .dot .dotx .dotm .log .msg .odt .pages .rtf .tex .wpd .wps
348 AddIcon /theme/icons/draw.png .svg .svgz
349 AddIcon /theme/icons/eps.png .ai .eps
350 AddIcon /theme/icons/exe.png .exe
351 AddIcon /theme/icons/gif.png .gif
352 AddIcon /theme/icons/h.png .h
353 AddIcon /theme/icons/html.png .html .xhtml .shtml .htm .URL .url
354 AddIcon /theme/icons/ico.png .ico
355 AddIcon /theme/icons/java.png .jar
356 AddIcon /theme/icons/jpg.png .jpg .jpeg .jpe
357 AddIcon /theme/icons/js.png .js .json
358 AddIcon /theme/icons/markdown.png .md
359 AddIcon /theme/icons/package.png .pkg .dmg
360 AddIcon /theme/icons/pdf.png .pdf
361 AddIcon /theme/icons/php.png .php .phtml
362 AddIcon /theme/icons/playlist.png .m3u .m3u8 .pls .pls8
363 AddIcon /theme/icons/png.png .png
364 AddIcon /theme/icons/ps.png .ps
365 AddIcon /theme/icons/psd.png .psd
366 AddIcon /theme/icons/py.png .py
367 AddIcon /theme/icons/rar.png .rar
368 AddIcon /theme/icons/rb.png .rb
369 AddIcon /theme/icons/rpm.png .rpm
370 AddIcon /theme/icons/rss.png .rss
371 AddIcon /theme/icons/script.png .bat .cmd .sh
372 AddIcon /theme/icons/sql.png .sql
373 AddIcon /theme/icons/tiff.png .tiff .tif
374 AddIcon /theme/icons/text.png .txt .nfo
375 AddIcon /theme/icons/video.png .asf .asx .avi .flv .mkv .mov .mp4 .mpg .rm .srt .swf .vob .wmv .m4v .f4v .f4p .ogv
376 AddIcon /theme/icons/xml.png .xml
377 AddIcon /theme/icons/zip.png .zip
378 DefaultIcon /theme/icons/default.png
380 HeaderName /theme/header.html
381 ReadmeName /theme/footer.html
382 IndexStyleSheet /theme/style.css
388 modules = [ "http2" ];
390 Protocols h2 http/1.1
395 LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
400 system.activationScripts = {
402 install -d -m 0755 /var/lib/acme/acme-challenge
403 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
404 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
405 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
406 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
410 services.myPhpfpm = {
411 phpPackage = pkgs.php;
413 session.save_path = "/var/lib/php/sessions"
415 session.gc_maxlifetime = 60*60*24*15
416 session.cache_expire = 60*24*30
423 services.httpdProd = makeService "production" config.services.myWebsites.production;
424 services.myWebsites.production.modules = makeModules cfg;
425 services.myWebsites.production.extraConfig = makeExtraConfig cfg;
427 services.httpdInte = makeService "integration" config.services.myWebsites.integration;
428 services.myWebsites.integration.modules = makeModules cfg;
429 services.myWebsites.integration.extraConfig = makeExtraConfig cfg;
431 services.httpdTools = makeService "tools" config.services.myWebsites.tools;
432 services.myWebsites.tools.modules = makeModules cfg;
433 services.myWebsites.tools.extraConfig = makeExtraConfig cfg ++
435 RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
436 RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
437 RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
438 RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
439 RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
440 RedirectMatch ^/CGU$ https://www.immae.eu/CGU