virtual/packages.nix

   1 with import ../libs.nix;
   2 with nixpkgs_unstable;
   3 let
   4   connexionswing = { environment ? "dev" }: rec {
   5     varDir = "/var/lib/connexionswing_${environment}";
   6     envName= lib.strings.toUpper environment;
   7     configRoot =
   8       # FIXME: spool emails in prod for when immae.eu is down?
   9       assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_PASSWORD";
  10       assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_USER";
  11       assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_NAME";
  12       assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_SECRET";
  13       assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_EMAIL";
  14       pkgs.writeText "parameters.yml" ''
  15         # This file is auto-generated during the composer install
  16         parameters:
  17             database_host: db-1.immae.eu
  18             database_port: null
  19             database_name: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_NAME"}
  20             database_user: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_USER"}
  21             database_password: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_PASSWORD"}
  22             mailer_transport: smtp
  23             mailer_host: mail.immae.eu
  24             mailer_user: null
  25             mailer_password: null
  26             subscription_email: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_EMAIL"}
  27             allow_robots: true
  28             secret: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_SECRET"}
  29       '';
  30     phpFpm = rec {
  31       socket = "/var/run/phpfpm/connexionswing-${environment}.sock";
  32       pool = ''
  33         listen = ${socket}
  34         user = ${apache.user}
  35         group = ${apache.group}
  36         listen.owner = ${apache.user}
  37         listen.group = ${apache.group}
  38         php_admin_value[upload_max_filesize] = 20M
  39         php_admin_value[post_max_size] = 20M
  40         ;php_admin_flag[log_errors] = on
  41         php_admin_value[open_basedir] = "${configRoot}:${webappDir}:${varDir}:/tmp"
  42         ${if environment == "dev" then ''
  43         pm = ondemand
  44         pm.max_children = 5
  45         pm.process_idle_timeout = 60
  46         env[SYMFONY_DEBUG_MODE] = "yes"
  47         '' else ''
  48         pm = dynamic
  49         pm.max_children = 20
  50         pm.start_servers = 2
  51         pm.min_spare_servers = 1
  52         pm.max_spare_servers = 3
  53         ''}'';
  54     };
  55     apache = {
  56       user = "wwwrun";
  57       group = "wwwrun";
  58       modules = [ "proxy_fcgi" ];
  59       vhostConf = ''
  60       <FilesMatch "\.php$">
  61         SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
  62       </FilesMatch>
  63
  64       <Directory ${varDir}/medias>
  65         Options FollowSymLinks
  66         AllowOverride None
  67         Require all granted
  68       </Directory>
  69
  70       <Directory ${varDir}/uploads>
  71         Options FollowSymLinks
  72         AllowOverride None
  73         Require all granted
  74       </Directory>
  75
  76       ${if environment == "dev" then ''
  77       <Location />
  78         Use LDAPConnect
  79         Require ldap-group   cn=connexionswing.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
  80         ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://connexionswing.com\"></html>"
  81       </Location>
  82
  83       <Directory ${webRoot}>
  84         Options Indexes FollowSymLinks MultiViews Includes
  85         AllowOverride None
  86         Require all granted
  87
  88         DirectoryIndex app_dev.php
  89
  90         <IfModule mod_negotiation.c>
  91         Options -MultiViews
  92         </IfModule>
  93
  94         <IfModule mod_rewrite.c>
  95           RewriteEngine On
  96
  97           RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
  98           RewriteRule ^(.*) - [E=BASE:%1]
  99
 100           # Maintenance script
 101           RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
 102           RewriteCond %{SCRIPT_FILENAME} !maintenance.php
 103           RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
 104           ErrorDocument 503 /maintenance.php
 105
 106           # Sets the HTTP_AUTHORIZATION header removed by Apache
 107           RewriteCond %{HTTP:Authorization} .
 108           RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
 109
 110           RewriteCond %{ENV:REDIRECT_STATUS} ^$
 111           RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 112
 113           # If the requested filename exists, simply serve it.
 114           # We only want to let Apache serve files and not directories.
 115           RewriteCond %{REQUEST_FILENAME} -f
 116           RewriteRule ^ - [L]
 117
 118           # Rewrite all other queries to the front controller.
 119           RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
 120         </IfModule>
 121
 122       </Directory>
 123       '' else ""}
 124       '';
 125     };
 126     activationScript = {
 127       deps = [ "wrappers" ];
 128       text = ''
 129       install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir} \
 130         ${varDir}/medias \
 131         ${varDir}/uploads \
 132         ${varDir}/var
 133       if [ ! -f "${varDir}/currentWebappDir" -o \
 134           "${webappDir}" != "$(cat ${varDir}/currentWebappDir 2>/dev/null)" ]; then
 135         pushd ${webappDir} > /dev/null
 136         $wrapperDir/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
 137         popd > /dev/null
 138         echo -n "${webappDir}" > ${varDir}/currentWebappDir
 139       fi
 140       '';
 141     };
 142     webappDir = pkgs.stdenv.mkDerivation (fetchedGitPrivate ./connexionswing_master.json // rec {
 143       # FIXME: can we do better than symlink?
 144       # FIXME: imagick optional
 145       # FIXME: initial sync
 146       # FIXME: backup
 147       buildPhase = ''
 148         export GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
 149         export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
 150
 151         ln -sf ../../../../../${varDir}/{medias,uploads} web/images/
 152         ln -sf ${configRoot} app/config/parameters.yml
 153         ${if environment == "dev" then "php bin/composer install" else ''
 154         SYMFONY_ENV=prod php bin/composer install --no-dev
 155         ./bin/console assetic:dump --env=prod --no-debug
 156         ''}
 157         rm -rf var
 158         ln -sf ../../../../../${varDir}/var var
 159         '';
 160       installPhase = ''
 161         cp -a . $out
 162         '';
 163       buildInputs = [
 164         pkgs.php pkgs.git pkgs.cacert
 165       ];
 166     });
 167     webRoot = "${webappDir}/web";
 168   };
 169
 170   nextcloud = let
 171     # FIXME: initial sync
 172     # FIXME: backup
 173     buildApp = { appName, version, url, sha256, installPhase ? "mkdir -p $out && cp -R . $out/" }:
 174       pkgs.stdenv.mkDerivation rec {
 175         name = "nextcloud-app-${appName}-${version}";
 176         inherit version;
 177         phases = "unpackPhase installPhase";
 178         inherit installPhase;
 179         src = fetchurl { inherit url sha256; };
 180       };
 181     apps = {
 182       # FIXME: nextcloud complains that he cannot write into config
 183       # directory when an app needs upgrade
 184       # /!\ Attention, just changing the version number is not
 185       # sufficient when the downloaded file doesn’t contain the version
 186       # number in it, sha256 needs to be recomputed
 187       audioplayer = buildApp rec {
 188         appName = "audioplayer";
 189         version = "2.5.0";
 190         url = "https://github.com/Rello/${appName}/releases/download/${version}/${appName}-${version}.tar.gz";
 191         sha256 = "1pg4y51cv3agy28n4gfc8i7x1ya1yijxrmhpblm1n846vhmwdcm8";
 192       };
 193       bookmarks = buildApp rec {
 194         appName = "bookmarks";
 195         version = "0.14.3";
 196         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}-${version}.tar.gz";
 197         sha256 = "0s7lkcl70izlkihnml1par0cac0wvckllyyga3jkb7k9vdg7d40c";
 198       };
 199       calendar = buildApp rec {
 200         appName = "calendar";
 201         version = "1.6.4";
 202         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
 203         sha256 = "00dijvcvy7snsjslfbyzvpp9anhms22zp1f0zkj89ln33jmana63";
 204       };
 205       contacts = buildApp rec {
 206         appName = "contacts";
 207         version = "3.0.0";
 208         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
 209         sha256 = "0fafy5kgzr5ldr3hxxxgmnw4y3qpjnv5ha1f1dlmqbc65s8frw7s";
 210       };
 211       deck = buildApp rec {
 212         appName = "deck";
 213         version = "0.5.2";
 214         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
 215         sha256 = "1kygzixxdkp3dbma009p3pw0fj8wgcqcv39n7pay78lh6zi3nic7";
 216       };
 217       files_markdown = buildApp rec {
 218         appName = "files_markdown";
 219         version = "2.0.5";
 220         url = "https://github.com/icewind1991/${appName}/releases/download/v${version}/${appName}.tar.gz";
 221         sha256 = "1dzvy4c6vff2qmkwqw13dx92xdkafaxgnipswjw44mh0ncc2n9ym";
 222       };
 223       gpxedit = buildApp rec {
 224         appName = "gpxedit";
 225         version = "0.0.10";
 226         url = "https://gitlab.com/eneiluj/gpxedit-oc/wikis/uploads/33d187268c5f6f6a55350d656305701c/${appName}-${version}.tar.gz";
 227         sha256 = "0ynpaxm0xhvcj8xax6rm1w0p6j57wbqidhi7bhn268n483gwl2sw";
 228       };
 229       gpxpod = buildApp rec {
 230         appName = "gpxpod";
 231         version = "3.0.0";
 232         url = "https://gitlab.com/eneiluj/gpxpod-oc/-/archive/v${version}/${appName}-oc-v${version}.tar.gz";
 233         sha256 = "0smpi4r3z7zfl1612fb30cwm1xmpiq95c81zzqiwzjf288iys74k";
 234       };
 235       keeweb = buildApp rec {
 236         appName = "keeweb";
 237         version = "0.4.0";
 238         url = "https://github.com/jhass/nextcloud-keeweb/releases/download/v${version}/${appName}-${version}.tar.gz";
 239         sha256 = "0453kkb0a8vfivmibpwpx4bvhyn64jhns6cdfjacmnvbm6d75nj1";
 240       };
 241       notes = buildApp rec {
 242         appName = "notes";
 243         version = "2.5.1";
 244         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
 245         sha256 = "1albzqqsdirzyw8vhvs7r0qm2wqp8vm9vmxm4crhncd85bk01hmh";
 246       };
 247       ocsms = buildApp rec {
 248         appName = "ocsms";
 249         version = "2.1.0";
 250         url = "https://github.com/nextcloud/${appName}/releases/download/${version}/${appName}-${version}.tar.gz";
 251         sha256 = "19xgs82js4sdf6j9478vg9li7za7csvcaa1hbq9nmrq441sbxk9c";
 252       };
 253       spreed = buildApp rec {
 254         appName = "spreed";
 255         version = "5.0.0";
 256         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}-${version}.tar.gz";
 257         sha256 = "1d48mak1fnf1b28r2687yqamm4pxfg3qyxcj9ny31a6xg2cm0xa7";
 258       };
 259       tasks = buildApp rec {
 260         appName = "tasks";
 261         version = "0.9.8";
 262         url = "https://github.com/nextcloud/${appName}/releases/download/v${version}/${appName}.tar.gz";
 263         sha256 = "089m124lfsfk09fqj50x9n7zndq97jp5afgb8s001rpmzym4g6ny";
 264       };
 265     };
 266   in rec {
 267     varDir = "/var/lib/nextcloud";
 268     config_php =
 269       assert checkEnv "NIXOPS_NEXTCLOUD_PASSWORD_SALT";
 270       assert checkEnv "NIXOPS_NEXTCLOUD_DB_USER";
 271       assert checkEnv "NIXOPS_NEXTCLOUD_DB_PASSWORD";
 272       assert checkEnv "NIXOPS_NEXTCLOUD_INSTANCE_ID";
 273       assert checkEnv "NIXOPS_NEXTCLOUD_SECRET";
 274       assert checkEnv "NIXOPS_NEXTCLOUD_REDIS_DB_INDEX";
 275       pkgs.writeText "config.php" ''
 276       <?php
 277       $CONFIG = array (
 278         'instanceid' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_INSTANCE_ID"}',
 279         'datadirectory' => '/var/lib/nextcloud/',
 280         'passwordsalt' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_PASSWORD_SALT"}',
 281         'debug' => false,
 282         'dbtype' => 'pgsql',
 283         'version' => '15.0.0.10',
 284         'dbname' => 'webapps',
 285         'dbhost' => '/tmp',
 286         'dbtableprefix' => 'oc_',
 287         'dbuser' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_DB_USER"}',
 288         'dbpassword' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_DB_PASSWORD"}',
 289         'installed' => true,
 290         'maxZipInputSize' => 0,
 291         'allowZipDownload' => true,
 292         'forcessl' => true,
 293         'theme' => ${"''"},
 294         'maintenance' => false,
 295         'trusted_domains' =>
 296         array (
 297           0 => 'cloud.immae.eu',
 298         ),
 299         'secret' => '${builtins.getEnv "NIXOPS_NEXTCLOUD_SECRET"}',
 300         'appstoreenabled' => false,
 301         'appstore.experimental.enabled' => true,
 302         'loglevel' => 0,
 303         'trashbin_retention_obligation' => 'auto',
 304         'htaccess.RewriteBase' => '/',
 305         'mail_smtpmode' => 'smtp',
 306         'mail_smtphost' => 'mail.immae.eu',
 307         'mail_smtpname' => ${"''"},
 308         'mail_smtppassword' => ${"''"},
 309         'mail_from_address' => 'owncloud',
 310         'mail_smtpauth' => false,
 311         'mail_domain' => 'immae.eu',
 312         'memcache.local' => '\\OC\\Memcache\\APCu',
 313         'memcache.locking' => '\\OC\\Memcache\\Redis',
 314         'filelocking.enabled' => true,
 315         'redis' =>
 316         array (
 317           'host' => 'localhost',
 318           'port' => 6379,
 319           'dbindex' => ${builtins.getEnv "NIXOPS_NEXTCLOUD_REDIS_DB_INDEX"},
 320         ),
 321         'overwrite.cli.url' => 'https://cloud.immae.eu',
 322         'ldapIgnoreNamingRules' => false,
 323         'ldapProviderFactory' => '\\OCA\\User_LDAP\\LDAPProviderFactory',
 324         'config_is_read_only' => true,
 325       );
 326       '';
 327     config = stdenv.mkDerivation rec {
 328       name = "nextcloud-config";
 329       src = ./nextcloudConfig;
 330       phases = "installPhase";
 331       installPhase = ''
 332         mkdir -p $out
 333         cp -r $src/* $out
 334         cp ${config_php} $out/config.php
 335       '';
 336     };
 337     webRoot = stdenv.mkDerivation rec {
 338       name = "nextcloud-${version}";
 339       version = "15.0.0";
 340
 341       src = fetchurl {
 342         url = "https://download.nextcloud.com/server/releases/${name}.tar.bz2";
 343         sha256 = "0y7bk1588n5rmmranmmrkajh50074460hr4v052ahg9mf60wbc2v";
 344       };
 345
 346       installPhase = ''
 347         mkdir -p $out/
 348         cp -R . $out/
 349         rm -r $out/config
 350         ln -sf ${config} $out/config
 351         ${builtins.concatStringsSep "\n" (
 352           pkgs.lib.attrsets.mapAttrsToList (name: value: "ln -sf ${value} $out/apps/${name}") apps
 353         )}
 354       '';
 355
 356       meta = {
 357         description = "Sharing solution for files, calendars, contacts and more";
 358         homepage = https://nextcloud.com;
 359         maintainers = with stdenv.lib.maintainers; [ schneefux bachp globin fpletz ];
 360         license = stdenv.lib.licenses.agpl3Plus;
 361         platforms = with stdenv.lib.platforms; unix;
 362       };
 363     };
 364     activationScript = {
 365       deps = [ ];
 366       text = ''
 367         install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir}
 368       '';
 369     };
 370     apache = {
 371       user = "wwwrun";
 372       group = "wwwrun";
 373       modules = [ "proxy_fcgi" ];
 374       vhostConf = ''
 375         <Directory ${webRoot}>
 376           AcceptPathInfo On
 377           DirectoryIndex index.php
 378           Options FollowSymlinks
 379           Require all granted
 380           AllowOverride all
 381
 382           <IfModule mod_headers.c>
 383             Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
 384           </IfModule>
 385           <FilesMatch "\.php$">
 386             CGIPassAuth on
 387             SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
 388           </FilesMatch>
 389
 390         </Directory>
 391
 392         '';
 393     };
 394     phpFpm = rec {
 395       basedir = builtins.concatStringsSep ":" (
 396         [ webRoot varDir config ]
 397         ++ pkgs.lib.attrsets.mapAttrsToList (name: value: value) apps);
 398       socket = "/var/run/phpfpm/nextcloud.sock";
 399       pool = ''
 400         listen = ${socket}
 401         user = ${apache.user}
 402         group = ${apache.group}
 403         listen.owner = ${apache.user}
 404         listen.group = ${apache.group}
 405         pm = ondemand
 406         pm.max_children = 60
 407         pm.process_idle_timeout = 60
 408
 409         php_admin_value[output_buffering] = 0
 410         php_admin_value[max_execution_time] = 1800
 411         php_admin_value[zend_extension] = "opcache"
 412         ;php_value[opcache.enable] = 1
 413         php_value[opcache.enable_cli] = 1
 414         php_value[opcache.interned_strings_buffer] = 8
 415         php_value[opcache.max_accelerated_files] = 10000
 416         php_value[opcache.memory_consumption] = 128
 417         php_value[opcache.save_comments] = 1
 418         php_value[opcache.revalidate_freq] = 1
 419         php_admin_value[memory_limit] = 512M
 420
 421         php_admin_value[open_basedir] = "${basedir}:/proc/meminfo:/dev/urandom:/proc/self/fd:/tmp"
 422         '';
 423     };
 424   };
 425
 426   adminer = rec {
 427     webRoot = pkgs.stdenv.mkDerivation rec {
 428       version = "4.7.0";
 429       name = "adminer-${version}";
 430       src = pkgs.fetchurl {
 431         url = "https://www.adminer.org/static/download/${version}/${name}.php";
 432         sha256 = "1qq2g7rbfh2vrqfm3g0bz0qs057b049n0mhabnsbd1sgnpvnc5z7";
 433       };
 434       phases = "installPhase";
 435       installPhase = ''
 436         mkdir -p $out
 437         cp $src $out/index.php
 438       '';
 439     };
 440     phpFpm = rec {
 441       socket = "/var/run/phpfpm/adminer.sock";
 442       pool = ''
 443         listen = ${socket}
 444         user = ${apache.user}
 445         group = ${apache.group}
 446         listen.owner = ${apache.user}
 447         listen.group = ${apache.group}
 448         pm = ondemand
 449         pm.max_children = 5
 450         pm.process_idle_timeout = 60
 451         ;php_admin_flag[log_errors] = on
 452         php_admin_value[open_basedir] = "${webRoot}:/tmp"
 453         '';
 454     };
 455     apache = {
 456       user = "wwwrun";
 457       group = "wwwrun";
 458       modules = [ "proxy_fcgi" ];
 459       vhostConf = ''
 460         Alias /adminer ${webRoot}
 461         <Directory ${webRoot}>
 462           DirectoryIndex = index.php
 463           <FilesMatch "\.php$">
 464             SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
 465           </FilesMatch>
 466         </Directory>
 467         '';
 468     };
 469     nginxConf = {
 470       alias = webRoot;
 471       index = "index.php";
 472       extraConfig = ''
 473         include ${pkgs.nginx}/conf/fastcgi.conf;
 474         fastcgi_split_path_info ^(.+?\.php)(/.*)$;
 475         fastcgi_param HTTP_PROXY "";
 476         fastcgi_param SCRIPT_FILENAME ${webRoot}/index.php;
 477         fastcgi_pass unix:${phpFpm.socket};
 478         fastcgi_index index.php;
 479         fastcgi_intercept_errors on;
 480         '';
 481     };
 482   };
 483
 484   ympd = rec {
 485     config = {
 486       webPort = "localhost:18001";
 487       mpd = {
 488         host = "malige.home.immae.eu";
 489         port = 6600;
 490       };
 491     };
 492     apache = {
 493       modules = [
 494         "proxy_wstunnel"
 495         ];
 496       vhostConf = ''
 497         <LocationMatch "^/mpd">
 498           Use LDAPConnect
 499           Require ldap-group   cn=users,cn=mpd,ou=services,dc=immae,dc=eu
 500           Require local
 501         </LocationMatch>
 502
 503         RedirectMatch permanent "^/mpd$" "/mpd/"
 504         <Location "/mpd/">
 505           ProxyPass http://${config.webPort}/
 506           ProxyPassReverse http://${config.webPort}/
 507           ProxyPreserveHost on
 508         </Location>
 509         <Location "/mpd/ws">
 510           ProxyPass ws://${config.webPort}/ws
 511         </Location>
 512       '';
 513     };
 514   };
 515 in
 516   {
 517     inherit adminer;
 518     inherit ympd;
 519     connexionswing_dev  = connexionswing { environment = "dev"; };
 520     connexionswing_prod = connexionswing { environment = "prod"; };
 521     inherit nextcloud;
 522   }