--- /dev/null
+{ lib, pkgs, config, mypackages-lib, ... }:
+let
+ www_root = ./_www;
+ theme_root = (mypackages-lib.apache-theme {}).theme;
+ apacheConfig = {
+ shutdownconfig = {
+ # Only give 5 seconds to workers to finish their work
+ extraConfig = ''
+ GracefulShutdownTimeout 5
+ '';
+ };
+ cache = {
+ # This setting permits to ignore time-based cache for files in the
+ # nix store:
+ # If a client requires an If-Modified-Since from timestamp 1, then
+ # this header is removed, and if the response contains a
+ # too old Last-Modified tag, then it is removed too
+ extraConfig = ''
+ <If "%{HTTP:If-Modified-Since} =~ /01 Jan 1970 00:00:01/" >
+ RequestHeader unset If-Modified-Since
+ </If>
+ Header unset Last-Modified "expr=%{LAST_MODIFIED} < 19991231235959"
+ '';
+ };
+ gzip = {
+ modules = [ "deflate" "filter" ];
+ extraConfig = ''
+ AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
+ '';
+ };
+ macros = {
+ modules = [ "macro" ];
+ };
+ stats = {
+ extraConfig = ''
+ <Macro Stats %{domain}>
+ Alias /webstats ${config.services.webstats.dataDir}/%{domain}
+ <Directory ${config.services.webstats.dataDir}/%{domain}>
+ DirectoryIndex index.html
+ AllowOverride None
+ Require all granted
+ </Directory>
+ <Location /webstats>
+ Use LDAPConnect
+ Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
+ </Location>
+ </Macro>
+ '';
+ };
+ ldap = {
+ modules = [ "ldap" "authnz_ldap" ];
+ extraConfig = ''
+ <IfModule ldap_module>
+ LDAPSharedCacheSize 500000
+ LDAPCacheEntries 1024
+ LDAPCacheTTL 600
+ LDAPOpCacheEntries 1024
+ LDAPOpCacheTTL 600
+ </IfModule>
+
+ Include ${config.secrets.fullPaths."apache-ldap"}
+ '';
+ };
+ global = {
+ extraConfig = ''
+ ErrorDocument 500 /maintenance_immae.html
+ ErrorDocument 501 /maintenance_immae.html
+ ErrorDocument 502 /maintenance_immae.html
+ ErrorDocument 503 /maintenance_immae.html
+ ErrorDocument 504 /maintenance_immae.html
+ Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
+ ProxyPass /maintenance_immae.html !
+
+ AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
+ <Directory ${www_root}>
+ AllowOverride None
+ Require all granted
+ </Directory>
+ '';
+ };
+ apaxy = {
+ extraConfig = (mypackages-lib.apache-theme { inherit theme_root; }).apacheConfig;
+ };
+ http2 = {
+ modules = [ "http2" ];
+ extraConfig = ''
+ Protocols h2 http/1.1
+ '';
+ };
+ customLog = {
+ extraConfig = ''
+ LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
+ '';
+ };
+ };
+ makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
+ makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
+ moomin = let
+ lines = lib.splitString "\n" (lib.fileContents ./moomin.txt);
+ pad = width: str: let
+ padWidth = width - lib.stringLength str;
+ padding = lib.concatStrings (lib.genList (lib.const "0") padWidth);
+ in lib.optionalString (padWidth > 0) padding + str;
+ in
+ lib.imap0 (i: e: ''Header always set "X-Moomin-${pad 2 (builtins.toString i)}" "${e}"'') lines;
+in
+{
+ imports = [
+ ./immae/production.nix
+ ./immae/release.nix
+
+ # Tools
+ ./assets
+ ./cloud
+ ./cloud/farm.nix
+ ./cryptpad
+ ./cryptpad/farm.nix
+ ./commento
+ ./dav
+ ./vpn
+ ./db
+ ./diaspora
+ ./ether
+ ./git
+ ./im
+ ./mastodon
+ ./mgoblin
+ ./peertube
+ ./performance
+ ./tools
+ ./mail
+ ./stats
+ ./visio
+ ./kanboard/farm.nix
+
+ # Games
+ ./games/codenames
+ ./games/terraforming-mars
+ ];
+
+ options.myServices.websites.enable = lib.mkEnableOption "enable websites";
+
+ config = lib.mkIf config.myServices.websites.enable {
+ myServices.dns.zones."immae.eu".subdomains = with config.myServices.dns.helpers;
+ {
+ games = ips servers.eldiron.ips.main;
+ nossl = ips servers.eldiron.ips.main;
+ };
+
+ myServices.chatonsProperties.hostings.web = {
+ file.datetime = "2022-08-22T01:30:00";
+ hosting = {
+ name = "Hébergement Web";
+ description = "Service d'hébergement web avec php/mysql/postgresql";
+ website = "https://www.immae.eu";
+ status.level = "OK";
+ status.description = "OK";
+ registration.load = "OPEN";
+ install.type = "PACKAGE";
+ };
+ software = {
+ name = "Apache Httpd";
+ website = "https://httpd.apache.org/";
+ license.url = "https://www.apache.org/licenses/";
+ license.name = "Apache License Version 2";
+ version = pkgs.apacheHttpd.version;
+ source.url = "https://httpd.apache.org/download.cgi";
+ modules = "openssh,pure-ftpd";
+ };
+ };
+ users.users.wwwrun.extraGroups = [ "keys" ];
+ networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+ secrets.keys."apache-ldap" = {
+ user = "wwwrun";
+ group = "wwwrun";
+ permissions = "0400";
+ text = ''
+ <Macro LDAPConnect>
+ <IfModule authnz_ldap_module>
+ AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
+ AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
+ AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
+ AuthType Basic
+ AuthName "Authentification requise (Acces LDAP)"
+ AuthBasicProvider ldap
+ </IfModule>
+ </Macro>
+ '';
+ };
+
+ system.activationScripts = {
+ httpd = ''
+ install -d -m 0755 /var/lib/acme/acme-challenges
+ install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
+ '';
+ };
+
+ services.phpfpm = {
+ phpOptions = ''
+ session.save_path = "/var/lib/php/sessions"
+ post_max_size = 20M
+ ; 15 days (seconds)
+ session.gc_maxlifetime = 1296000
+ ; 30 days (minutes)
+ session.cache_expire = 43200
+ '';
+ settings = {
+ log_level = "notice";
+ };
+ };
+
+ services.websites.env.production = {
+ enable = true;
+ moduleType = "container";
+ adminAddr = "httpd@immae.eu";
+ bindMounts."/var/lib/ftp" = {};
+ # FIXME: Bind directly the needed files
+ bindMounts."/var/secrets" = {};
+ bindMounts."/var/lib/goaccess" = {};
+ bindMounts."/var/lib/acme" = {};
+ bindMounts."/run/phpfpm" = {};
+ ips =
+ let ips = config.myEnv.servers.eldiron.ips.production;
+ in (ips.ip4 or []) ++ (ips.ip6 or []);
+ modules = makeModules;
+ extraConfig = makeExtraConfig;
+ fallbackVhost = {
+ certName = "eldiron";
+ hosts = ["eldiron.immae.eu" ];
+ root = www_root;
+ extraConfig = [ "DirectoryIndex index.htm" ];
+ };
+ };
+
+ services.websites.env.integration = {
+ enable = true;
+ moduleType = "container";
+ adminAddr = "httpd@immae.eu";
+ bindMounts."/var/lib/ftp" = {};
+ bindMounts."/var/secrets" = {};
+ bindMounts."/var/lib/goaccess" = {};
+ bindMounts."/var/lib/acme" = {};
+ bindMounts."/run/phpfpm" = {};
+ ips =
+ let ips = config.myEnv.servers.eldiron.ips.integration;
+ in (ips.ip4 or []) ++ (ips.ip6 or []);
+ modules = makeModules;
+ extraConfig = makeExtraConfig ++ moomin;
+ fallbackVhost = {
+ certName = "integration";
+ hosts = ["eldiron.immae.eu" ];
+ root = www_root;
+ extraConfig = [ "DirectoryIndex index.htm" ];
+ };
+ watchPaths = [ config.secrets.fullPaths."apache-ldap" ];
+ };
+
+ services.websites.env.tools = {
+ enable = true;
+ moduleType = "main";
+ adminAddr = "httpd@immae.eu";
+ ips =
+ let ips = config.myEnv.servers.eldiron.ips.main;
+ in (ips.ip4 or []) ++ (ips.ip6 or []);
+ modules = makeModules;
+ extraConfig = makeExtraConfig ++
+ [ ''
+ RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
+ RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
+ RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
+ RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
+ RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
+ RedirectMatch ^/CGU$ https://www.immae.eu/CGU
+ ''
+ ];
+ nosslVhost = {
+ enable = true;
+ host = "nossl.immae.eu";
+ root = ./nossl;
+ };
+ fallbackVhost = {
+ certName = "eldiron";
+ hosts = ["eldiron.immae.eu" ];
+ root = www_root;
+ extraConfig = [ "DirectoryIndex index.htm" ];
+ };
+ watchPaths = [ config.secrets.fullPaths."apache-ldap" ];
+ };
+
+ myServices.websites = {
+ immae = {
+ production.enable = true;
+ release.enable = true;
+ };
+
+ tools.assets.enable = true;
+ tools.cloud.enable = true;
+ tools.commento.enable = true;
+ tools.cryptpad.enable = true;
+ tools.dav.enable = true;
+ tools.db.enable = true;
+ tools.diaspora.enable = true;
+ tools.etherpad-lite.enable = true;
+ tools.git.enable = true;
+ tools.mastodon.enable = true;
+ tools.mediagoblin.enable = true;
+ tools.peertube.enable = true;
+ tools.performance.enable = true;
+ tools.tools.enable = true;
+ tools.email.enable = true;
+ tools.stats.enable = false;
+ tools.visio.enable = true;
+
+ games.codenames.enable = true;
+ games.terraforming-mars.enable = true;
+ };
+ };
+}