1 { lib, pkgs, config, mypackages-lib, ... }:
4 theme_root = (mypackages-lib.apache-theme {}).theme;
7 # Only give 5 seconds to workers to finish their work
9 GracefulShutdownTimeout 5
13 # This setting permits to ignore time-based cache for files in the
15 # If a client requires an If-Modified-Since from timestamp 1, then
16 # this header is removed, and if the response contains a
17 # too old Last-Modified tag, then it is removed too
19 <If "%{HTTP:If-Modified-Since} =~ /01 Jan 1970 00:00:01/" >
20 RequestHeader unset If-Modified-Since
22 Header unset Last-Modified "expr=%{LAST_MODIFIED} < 19991231235959"
26 modules = [ "deflate" "filter" ];
28 AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
32 modules = [ "macro" ];
36 <Macro Stats %{domain}>
37 Alias /webstats ${config.services.webstats.dataDir}/%{domain}
38 <Directory ${config.services.webstats.dataDir}/%{domain}>
39 DirectoryIndex index.html
45 Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
51 modules = [ "ldap" "authnz_ldap" ];
53 <IfModule ldap_module>
54 LDAPSharedCacheSize 500000
57 LDAPOpCacheEntries 1024
61 Include ${config.secrets.fullPaths."apache-ldap"}
66 ErrorDocument 500 /maintenance_immae.html
67 ErrorDocument 501 /maintenance_immae.html
68 ErrorDocument 502 /maintenance_immae.html
69 ErrorDocument 503 /maintenance_immae.html
70 ErrorDocument 504 /maintenance_immae.html
71 Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
72 ProxyPass /maintenance_immae.html !
74 AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
75 <Directory ${www_root}>
83 autoconfig = pkgs.writeTextDir "config-v1.1.xml" ''
85 <clientConfig version="1.1">
86 <emailProvider id="mail.immae.eu">
87 <domain>mail.immae.eu</domain>
88 <domain>%EMAILDOMAIN%</domain>
89 <displayName>Immae E-mail</displayName>
90 <displayShortName>Immae E-mail</displayShortName>
92 <incomingServer type="imap">
93 <hostname>imap.immae.eu</hostname>
95 <socketType>STARTTLS</socketType>
96 <username>%EMAILADDRESS%</username>
97 <authentication>password-cleartext</authentication>
100 <incomingServer type="imap">
101 <hostname>imap.immae.eu</hostname>
103 <socketType>SSL</socketType>
104 <username>%EMAILADDRESS%</username>
105 <authentication>password-cleartext</authentication>
108 <incomingServer type="pop3">
109 <hostname>pop.immae.eu</hostname>
111 <socketType>STARTTLS</socketType>
112 <username>%EMAILADDRESS%</username>
113 <authentication>password-cleartext</authentication>
116 <incomingServer type="pop3">
117 <hostname>pop.immae.eu</hostname>
119 <socketType>SSL</socketType>
120 <username>%EMAILADDRESS%</username>
121 <authentication>password-cleartext</authentication>
124 <outgoingServer type="smtp">
125 <hostname>smtp.immae.eu</hostname>
127 <socketType>STARTTLS</socketType>
128 <username>%EMAILADDRESS%</username>
129 <authentication>password-cleartext</authentication>
132 <outgoingServer type="smtp">
133 <hostname>smtp.immae.eu</hostname>
135 <socketType>SSL</socketType>
136 <username>%EMAILADDRESS%</username>
137 <authentication>password-cleartext</authentication>
143 Alias /.well-known/autoconfig/mail "${autoconfig}"
144 <Directory ${autoconfig}>
151 extraConfig = (mypackages-lib.apache-theme { inherit theme_root; }).apacheConfig;
154 modules = [ "http2" ];
156 Protocols h2 http/1.1
161 LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
165 makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
166 makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
168 lines = lib.splitString "\n" (lib.fileContents ./moomin.txt);
169 pad = width: str: let
170 padWidth = width - lib.stringLength str;
171 padding = lib.concatStrings (lib.genList (lib.const "0") padWidth);
172 in lib.optionalString (padWidth > 0) padding + str;
174 lib.imap0 (i: e: ''Header always set "X-Moomin-${pad 2 (builtins.toString i)}" "${e}"'') lines;
178 ./immae/production.nix
207 ./games/terraforming-mars
210 options.myServices.websites.enable = lib.mkEnableOption "enable websites";
212 config = lib.mkIf config.myServices.websites.enable {
213 myServices.dns.zones."immae.eu".subdomains = with config.myServices.dns.helpers;
215 games = ips servers.eldiron.ips.main;
216 nossl = ips servers.eldiron.ips.main;
219 myServices.chatonsProperties.hostings.web = {
220 file.datetime = "2022-08-22T01:30:00";
222 name = "Hébergement Web";
223 description = "Service d'hébergement web avec php/mysql/postgresql";
224 website = "https://www.immae.eu";
226 status.description = "OK";
227 registration.load = "OPEN";
228 install.type = "PACKAGE";
231 name = "Apache Httpd";
232 website = "https://httpd.apache.org/";
233 license.url = "https://www.apache.org/licenses/";
234 license.name = "Apache License Version 2";
235 version = pkgs.apacheHttpd.version;
236 source.url = "https://httpd.apache.org/download.cgi";
237 modules = "openssh,pure-ftpd";
240 users.users.wwwrun.extraGroups = [ "keys" ];
241 networking.firewall.allowedTCPPorts = [ 80 443 ];
243 secrets.keys."apache-ldap" = {
246 permissions = "0400";
249 <IfModule authnz_ldap_module>
250 AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
251 AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
252 AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
254 AuthName "Authentification requise (Acces LDAP)"
255 AuthBasicProvider ldap
261 system.activationScripts = {
263 install -d -m 0755 /var/lib/acme/acme-challenges
264 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
270 session.save_path = "/var/lib/php/sessions"
273 session.gc_maxlifetime = 1296000
275 session.cache_expire = 43200
278 log_level = "notice";
282 services.websites.env.production = {
284 moduleType = "container";
285 adminAddr = "httpd@immae.eu";
286 bindMounts."/var/lib/ftp" = {};
287 # FIXME: Bind directly the needed files
288 bindMounts."/var/secrets" = {};
289 bindMounts."/var/lib/goaccess" = {};
290 bindMounts."/var/lib/acme" = {};
291 bindMounts."/run/phpfpm" = {};
293 let ips = config.myEnv.servers.eldiron.ips.production;
294 in (ips.ip4 or []) ++ (ips.ip6 or []);
295 modules = makeModules;
296 extraConfig = makeExtraConfig;
298 certName = "eldiron";
299 hosts = ["eldiron.immae.eu" ];
301 extraConfig = [ "DirectoryIndex index.htm" ];
305 services.websites.env.integration = {
307 moduleType = "container";
308 adminAddr = "httpd@immae.eu";
309 bindMounts."/var/lib/ftp" = {};
310 bindMounts."/var/secrets" = {};
311 bindMounts."/var/lib/goaccess" = {};
312 bindMounts."/var/lib/acme" = {};
313 bindMounts."/run/phpfpm" = {};
315 let ips = config.myEnv.servers.eldiron.ips.integration;
316 in (ips.ip4 or []) ++ (ips.ip6 or []);
317 modules = makeModules;
318 extraConfig = makeExtraConfig ++ moomin;
320 certName = "integration";
321 hosts = ["eldiron.immae.eu" ];
323 extraConfig = [ "DirectoryIndex index.htm" ];
325 watchPaths = [ config.secrets.fullPaths."apache-ldap" ];
328 services.websites.env.tools = {
331 adminAddr = "httpd@immae.eu";
333 let ips = config.myEnv.servers.eldiron.ips.main;
334 in (ips.ip4 or []) ++ (ips.ip6 or []);
335 modules = makeModules;
336 extraConfig = makeExtraConfig ++
338 RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
339 RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
340 RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
341 RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
342 RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
343 RedirectMatch ^/CGU$ https://www.immae.eu/CGU
348 host = "nossl.immae.eu";
352 certName = "eldiron";
353 hosts = ["eldiron.immae.eu" ];
355 extraConfig = [ "DirectoryIndex index.htm" ];
357 watchPaths = [ config.secrets.fullPaths."apache-ldap" ];
360 myServices.websites = {
362 production.enable = true;
363 release.enable = true;
366 tools.assets.enable = true;
367 tools.cloud.enable = true;
368 tools.commento.enable = true;
369 tools.cryptpad.enable = true;
370 tools.dav.enable = true;
371 tools.db.enable = true;
372 tools.diaspora.enable = true;
373 tools.etherpad-lite.enable = true;
374 tools.git.enable = true;
375 tools.mastodon.enable = true;
376 tools.mediagoblin.enable = true;
377 tools.peertube.enable = true;
378 tools.performance.enable = true;
379 tools.tools.enable = true;
380 tools.email.enable = true;
381 tools.stats.enable = false;
382 tools.visio.enable = true;
384 games.codenames.enable = true;
385 games.terraforming-mars.enable = true;