+ services.httpd = let
+ withSSL = domain: {
+ enableSSL = true;
+ sslServerCert = "/var/lib/acme/${domain}/full.pem"; # FIXME: cert only?
+ sslServerKey = "/var/lib/acme/${domain}/key.pem";
+ sslServerChain = "/var/lib/acme/${domain}/fullchain.pem";
+ };
+ in rec {
+ enable = true;
+ logPerVirtualHost = true;
+ multiProcessingModule = "worker";
+ adminAddr = "httpd@immae.eu";
+ # FIXME: http2
+ extraModules = pkgs.lib.lists.unique (
+ mypkgs.adminer.apache.modules ++
+ [
+ "macro"
+ "ldap"
+ "authnz_ldap"
+ ]);
+ extraConfig = ''
+ <IfModule ldap_module>
+ LDAPSharedCacheSize 500000
+ LDAPCacheEntries 1024
+ LDAPCacheTTL 600
+ LDAPOpCacheEntries 1024
+ LDAPOpCacheTTL 600
+ </IfModule>
+
+ <Macro LDAPConnect>
+ <IfModule authnz_ldap_module>
+ AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu
+ AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
+ AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
+ AuthType Basic
+ AuthName "Authentification requise (Acces LDAP)"
+ AuthBasicProvider ldap
+ </IfModule>
+ </Macro>
+ '';
+ virtualHosts = [
+ (withSSL "eldiron" // {
+ listen = [ { ip = "*"; port = 443; } ];
+ hostName = "eldiron.immae.eu";
+ # FIXME: directory needs to exist
+ documentRoot = "/var/www";
+ })
+ (withSSL "eldiron" // {
+ listen = [ { ip = "*"; port = 443; } ];
+ hostName = "db-1.immae.eu";
+ documentRoot = null;
+ extraConfig = builtins.concatStringsSep "\n" [
+ mypkgs.adminer.apache.vhostConf
+ ];
+ })
+ (withSSL "eldiron" // {
+ listen = [ { ip = "*"; port = 443; } ];
+ hostName = "tools.immae.eu";
+ documentRoot = null;
+ extraConfig = builtins.concatStringsSep "\n" [
+ mypkgs.adminer.apache.vhostConf
+ mypkgs.ympd.apache.vhostConf
+ ];
+ })
+ { # Should go last, default fallback
+ listen = [ { ip = "*"; port = 80; } ];
+ hostName = "redirectSSL";
+ serverAliases = [ "*" ];
+ enableSSL = false;
+ # FIXME: directory needs to exist
+ documentRoot = "/var/lib/acme/acme-challenge";
+ extraConfig = ''
+ RewriteEngine on
+ RewriteCond "%{REQUEST_URI}" "!^/\.well-known"
+ RewriteRule ^(.+) https://%{HTTP_HOST}$1 [R=301]
+ # To redirect in specific "VirtualHost *:80", do
+ # RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
+ # rather than rewrite
+ '';
+ }
+ ];
+ };
+