virtual/eldiron.nix

   1 {
   2   network = {
   3     description = "Immae's network";
   4     enableRollback = true;
   5   };
   6
   7   eldiron = { config, pkgs, mylibs, ... }:
   8     with mylibs;
   9     let
  10         mypkgs = pkgs.callPackage ./packages.nix {
  11           inherit checkEnv fetchedGit fetchedGitPrivate fetchedGithub;
  12         };
  13     in
  14   {
  15     _module.args = {
  16       mylibs = import ../libs.nix;
  17     };
  18
  19     imports = [
  20       ./modules/certificates.nix
  21       ./modules/gitolite.nix
  22       ./modules/gitweb.nix
  23       ./modules/databases.nix
  24       ./modules/websites.nix
  25     ];
  26     services.myGitolite.enable = true;
  27     services.myGitweb.enable = true;
  28     services.myDatabases.enable = true;
  29     services.myWebsites.production.enable = true;
  30     services.myWebsites.integration.enable = true;
  31
  32     nixpkgs.config.packageOverrides = oldpkgs: rec {
  33       goaccess = oldpkgs.goaccess.overrideAttrs(old: rec {
  34         name = "goaccess-${version}";
  35         version = "1.3";
  36         src = pkgs.fetchurl {
  37           url = "https://tar.goaccess.io/${name}.tar.gz";
  38           sha256 = "16vv3pj7pbraq173wlxa89jjsd279004j4kgzlrsk1dz4if5qxwc";
  39         };
  40         configureFlags = old.configureFlags ++ [ "--enable-tcb=btree" ];
  41         buildInputs = old.buildInputs ++ [ pkgs.tokyocabinet pkgs.bzip2 ];
  42       });
  43     };
  44
  45     networking = {
  46       firewall = {
  47         enable = true;
  48         allowedTCPPorts = [ 22 80 443 9418 ];
  49       };
  50     };
  51
  52     deployment = {
  53       targetEnv = "hetzner";
  54       hetzner = {
  55         #robotUser = "defined in HETZNER_ROBOT_USER";
  56         #robotPass = "defined in HETZNER_ROBOT_PASS";
  57         mainIPv4 = "176.9.151.89";
  58         partitions = ''
  59           clearpart --all --initlabel --drives=sda,sdb
  60
  61           part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
  62           part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
  63
  64           part raid.1 --grow --ondisk=sda
  65           part raid.2 --grow --ondisk=sdb
  66
  67           raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  68         '';
  69       };
  70     };
  71
  72     environment.systemPackages = let
  73       # FIXME: move it to nextcloud
  74       occ = pkgs.writeScriptBin "nextcloud-occ" ''
  75         #! ${pkgs.stdenv.shell}
  76         cd ${mypkgs.nextcloud.webRoot}
  77         NEXTCLOUD_CONFIG_DIR="${mypkgs.nextcloud.webRoot}/config" \
  78           exec \
  79           ${config.services.phpfpm.phpPackage}/bin/php \
  80           -c ${config.services.phpfpm.phpPackage}/etc/php.ini \
  81           occ $*
  82         '';
  83     in [
  84       pkgs.telnet
  85       pkgs.htop
  86       pkgs.vim
  87       pkgs.goaccess
  88       occ
  89     ];
  90
  91     security.acme.certs."eldiron".extraDomains = {
  92       "db-1.immae.eu" = null;
  93       "tools.immae.eu" = null;
  94       "cloud.immae.eu" = null;
  95       "dav.immae.eu" = null;
  96     };
  97
  98     services.openssh.extraConfig = ''
  99       AuthorizedKeysCommand     /etc/ssh/ldap_authorized_keys
 100       AuthorizedKeysCommandUser nobody
 101       '';
 102
 103     services.ympd = mypkgs.ympd.config // { enable = false; };
 104
 105     services.phpfpm = {
 106       # FIXME: move session files to separate dirs
 107       # /!\ phppackage is used in nextcloud configuation
 108       phpOptions = ''
 109         session.save_path = "/var/lib/php/sessions"
 110         session.gc_maxlifetime = 60*60*24*15
 111         session.cache_expire = 60*24*30
 112         ; For nextcloud
 113         extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
 114         ; For nextcloud
 115         extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
 116         ; For nextcloud
 117         zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
 118         '';
 119       extraConfig = ''
 120         log_level = notice
 121         '';
 122       poolConfigs = {
 123         adminer = mypkgs.adminer.phpFpm.pool;
 124         nextcloud = mypkgs.nextcloud.phpFpm.pool;
 125         mantisbt = mypkgs.mantisbt.phpFpm.pool;
 126         ttrss = mypkgs.ttrss.phpFpm.pool;
 127         roundcubemail = mypkgs.roundcubemail.phpFpm.pool;
 128         davical = mypkgs.davical.phpFpm.pool;
 129       };
 130     };
 131
 132     system.activationScripts = {
 133       nextcloud = mypkgs.nextcloud.activationScript;
 134       ttrss = mypkgs.ttrss.activationScript;
 135       roundcubemail = mypkgs.roundcubemail.activationScript;
 136       httpd = ''
 137         install -d -m 0755 /var/lib/acme/acme-challenge
 138         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 139         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
 140         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
 141         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/ttrss
 142         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
 143         '';
 144       # FIXME: initial sync
 145       goaccess = ''
 146         mkdir -p /var/lib/goaccess
 147         mkdir -p /var/lib/goaccess/aten.pro
 148         mkdir -p /var/lib/goaccess/ludivinecassal.com
 149         mkdir -p /var/lib/goaccess/piedsjaloux.fr
 150         mkdir -p /var/lib/goaccess/osteopathe-cc.fr
 151         mkdir -p /var/lib/goaccess/connexionswing.com
 152         '';
 153     };
 154
 155     environment.etc."ssh/ldap_authorized_keys" = let
 156       ldap_authorized_keys =
 157         assert checkEnv "NIXOPS_SSHD_LDAP_PASSWORD";
 158         wrap {
 159           name = "ldap_authorized_keys";
 160           file = ./ldap_authorized_keys.sh;
 161           vars = {
 162             LDAP_PASS = builtins.getEnv "NIXOPS_SSHD_LDAP_PASSWORD";
 163             GITOLITE_SHELL = "${pkgs.gitolite}/bin/gitolite-shell";
 164             ECHO = "${pkgs.coreutils}/bin/echo";
 165           };
 166           paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ];
 167         };
 168     in {
 169       enable = true;
 170       mode = "0755";
 171       user = "root";
 172       source = ldap_authorized_keys;
 173     };
 174
 175     services.gitDaemon = {
 176       enable = true;
 177       user = "gitolite";
 178       group = "gitolite";
 179       basePath = "${mypkgs.git.web.varDir}/repositories";
 180     };
 181
 182     # FIXME: logrotate
 183     services.httpd = let
 184       withConf = domain: {
 185         enableSSL = true;
 186         sslServerCert = "/var/lib/acme/${domain}/cert.pem";
 187         sslServerKey = "/var/lib/acme/${domain}/key.pem";
 188         sslServerChain = "/var/lib/acme/${domain}/fullchain.pem";
 189         logFormat = "combinedVhost";
 190         listen = [ { ip = "*"; port = 443; } ];
 191       };
 192       apacheConfig = config.services.myWebsites.apacheConfig;
 193     in rec {
 194       enable = true;
 195       logPerVirtualHost = true;
 196       multiProcessingModule = "worker";
 197       adminAddr = "httpd@immae.eu";
 198       logFormat = "combinedVhost";
 199       extraModules = pkgs.lib.lists.unique (
 200         mypkgs.adminer.apache.modules ++
 201         mypkgs.nextcloud.apache.modules ++
 202         mypkgs.ympd.apache.modules ++
 203         mypkgs.git.web.apache.modules ++
 204         mypkgs.mantisbt.apache.modules ++
 205         mypkgs.ttrss.apache.modules ++
 206         mypkgs.roundcubemail.apache.modules ++
 207         pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig));
 208       extraConfig = builtins.concatStringsSep "\n"
 209         (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
 210       virtualHosts = [
 211         (withConf "eldiron" // {
 212           hostName = "eldiron.immae.eu";
 213           documentRoot = ./www;
 214           extraConfig = ''
 215             DirectoryIndex index.htm
 216             '';
 217         })
 218         (withConf "eldiron" // {
 219           hostName = "db-1.immae.eu";
 220           documentRoot = null;
 221           extraConfig = builtins.concatStringsSep "\n" [
 222             mypkgs.adminer.apache.vhostConf
 223           ];
 224         })
 225         (withConf "eldiron" // {
 226           hostName = "tools.immae.eu";
 227           documentRoot = null;
 228           extraConfig = builtins.concatStringsSep "\n" [
 229             mypkgs.adminer.apache.vhostConf
 230             mypkgs.ympd.apache.vhostConf
 231             mypkgs.ttrss.apache.vhostConf
 232             mypkgs.roundcubemail.apache.vhostConf
 233           ];
 234         })
 235         (withConf "eldiron" // {
 236           hostName = "dav.immae.eu";
 237           documentRoot = null;
 238           extraConfig = builtins.concatStringsSep "\n" [
 239             mypkgs.infcloud.apache.vhostConf
 240             mypkgs.davical.apache.vhostConf
 241           ];
 242         })
 243         (withConf "eldiron" // {
 244           hostName = "connexionswing.immae.eu";
 245           serverAliases = [ "sandetludo.immae.eu" ];
 246           documentRoot = mypkgs.connexionswing_dev.webRoot;
 247           extraConfig = builtins.concatStringsSep "\n" [
 248             mypkgs.connexionswing_dev.apache.vhostConf
 249           ];
 250         })
 251         (withConf "connexionswing" // {
 252           hostName = "connexionswing.com";
 253           serverAliases = [ "sandetludo.com" "www.connexionswing.com" "www.sandetludo.com" ];
 254           documentRoot = mypkgs.connexionswing_prod.webRoot;
 255           extraConfig = builtins.concatStringsSep "\n" [
 256             mypkgs.connexionswing_prod.apache.vhostConf
 257           ];
 258         })
 259         (withConf "eldiron" // {
 260           hostName = "ludivine.immae.eu";
 261           documentRoot = mypkgs.ludivinecassal_dev.webRoot;
 262           extraConfig = builtins.concatStringsSep "\n" [
 263             mypkgs.ludivinecassal_dev.apache.vhostConf
 264           ];
 265         })
 266         (withConf "ludivinecassal" // {
 267           hostName = "ludivinecassal.com";
 268           serverAliases = [ "www.ludivinecassal.com" ];
 269           documentRoot = mypkgs.ludivinecassal_prod.webRoot;
 270           extraConfig = builtins.concatStringsSep "\n" [
 271             mypkgs.ludivinecassal_prod.apache.vhostConf
 272           ];
 273         })
 274         (withConf "eldiron" // {
 275           hostName = "piedsjaloux.immae.eu";
 276           documentRoot = mypkgs.piedsjaloux_dev.webRoot;
 277           extraConfig = builtins.concatStringsSep "\n" [
 278             mypkgs.piedsjaloux_dev.apache.vhostConf
 279           ];
 280         })
 281         (withConf "piedsjaloux" // {
 282           hostName = "piedsjaloux.fr";
 283           serverAliases = [ "www.piedsjaloux.fr" ];
 284           documentRoot = mypkgs.piedsjaloux_prod.webRoot;
 285           extraConfig = builtins.concatStringsSep "\n" [
 286             mypkgs.piedsjaloux_prod.apache.vhostConf
 287           ];
 288         })
 289         (withConf "eldiron" // {
 290           hostName = "chloe.immae.eu";
 291           documentRoot = mypkgs.chloe_dev.webRoot;
 292           extraConfig = builtins.concatStringsSep "\n" [
 293             mypkgs.chloe_dev.apache.vhostConf
 294           ];
 295         })
 296         (withConf "chloe" // {
 297           hostName = "osteopathe-cc.fr";
 298           serverAliases = [ "www.osteopathe-cc.fr" ];
 299           documentRoot = mypkgs.chloe_prod.webRoot;
 300           extraConfig = builtins.concatStringsSep "\n" [
 301             mypkgs.chloe_prod.apache.vhostConf
 302           ];
 303         })
 304         (withConf "eldiron" // {
 305           hostName = "dev.aten.pro";
 306           documentRoot = mypkgs.aten_dev.webRoot;
 307           extraConfig = builtins.concatStringsSep "\n" [
 308             mypkgs.aten_dev.apache.vhostConf
 309           ];
 310         })
 311         (withConf "aten" // {
 312           hostName = "aten.pro";
 313           serverAliases = [ "www.aten.pro" ];
 314           documentRoot = mypkgs.aten_prod.webRoot;
 315           extraConfig = builtins.concatStringsSep "\n" [
 316             mypkgs.aten_prod.apache.vhostConf
 317           ];
 318         })
 319         (withConf "eldiron" // {
 320           hostName = "cloud.immae.eu";
 321           documentRoot = mypkgs.nextcloud.webRoot;
 322           extraConfig = builtins.concatStringsSep "\n" [
 323             mypkgs.nextcloud.apache.vhostConf
 324           ];
 325         })
 326         (withConf "eldiron" // {
 327           hostName = "git.immae.eu";
 328           documentRoot = mypkgs.git.web.webRoot;
 329           extraConfig = builtins.concatStringsSep "\n" [
 330             mypkgs.git.web.apache.vhostConf
 331             mypkgs.mantisbt.apache.vhostConf
 332           ] + ''
 333             RewriteEngine on
 334             RewriteCond %{REQUEST_URI}       ^/releases
 335             RewriteRule /releases(.*)        https://release.immae.eu$1 [P,L]
 336             '';
 337         })
 338         { # Should go last, default fallback
 339           listen = [ { ip = "*"; port = 80; } ];
 340           hostName = "redirectSSL";
 341           serverAliases = [ "*" ];
 342           enableSSL = false;
 343           logFormat = "combinedVhost";
 344           documentRoot = "/var/lib/acme/acme-challenge";
 345           extraConfig = ''
 346             RewriteEngine on
 347             RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
 348             RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
 349             # To redirect in specific "VirtualHost *:80", do
 350             #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
 351             # rather than rewrite
 352             '';
 353         }
 354       ];
 355     };
 356
 357     services.cron = {
 358       enable = true;
 359       systemCronJobs = let
 360         stats = domain: conf: let
 361           d = pkgs.writeScriptBin "stats-${domain}" ''
 362             #!${pkgs.stdenv.shell}
 363             set -e
 364             shopt -s nullglob
 365             date_regex=$(LC_ALL=C date -d yesterday +'%d\/%b\/%Y')
 366             TMPFILE=$(mktemp)
 367             trap "rm -f $TMPFILE" EXIT
 368
 369             cat /var/log/httpd/access_log-${domain} | sed -n "/\\[$date_regex/ p" > $TMPFILE
 370             for i in /var/log/httpd/access_log-${domain}*.gz; do
 371               zcat "$i" | sed -n "/\\[$date_regex/ p" >> $TMPFILE
 372             done
 373             goaccess $TMPFILE --no-progress -o /var/lib/goaccess/${domain}/index.html -p ${conf}
 374             '';
 375           in "${d}/bin/stats-${domain}";
 376       # FIXME: running several goaccess simultaneously seems to be
 377       # bugged?
 378       in [
 379         "5 0 * * * root ${stats "aten.pro" ./packages/aten_goaccess.conf}"
 380         "6 0 * * * root ${stats "ludivinecassal.com" ./packages/ludivinecassal_goaccess.conf}"
 381         "7 0 * * * root ${stats "piedsjaloux.fr" ./packages/piedsjaloux_goaccess.conf}"
 382         "8 0 * * * root ${stats "osteopathe-cc.fr" ./packages/chloe_goaccess.conf}"
 383         "9 0 * * * root ${stats "connexionswing.com" ./packages/connexionswing_goaccess.conf}"
 384         ];
 385     };
 386
 387     systemd.services.tt-rss = {
 388       description = "Tiny Tiny RSS feeds update daemon";
 389       serviceConfig = {
 390         User = "wwwrun";
 391         ExecStart = "${pkgs.php}/bin/php ${mypkgs.ttrss.webRoot}/update.php --daemon";
 392         StandardOutput = "syslog";
 393         StandardError = "syslog";
 394         PermissionsStartOnly = true;
 395       };
 396
 397       wantedBy = [ "multi-user.target" ];
 398       requires = ["postgresql.service"];
 399       after = ["network.target" "postgresql.service"];
 400     };
 401   };
 402 }