webroot = "/var/lib/acme/acme-challenge";
email = "ismael@bouya.org";
domain = "eldiron.immae.eu";
+ plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
+ postRun = ''
+ "systemctl reload httpd.service"
+ '';
extraDomains = {
"db-1.immae.eu" = null;
+ "tools.immae.eu" = null;
};
};
};
log_level = notice
'';
poolConfigs = {
- adminer = ''
- listen = /var/run/phpfpm/adminer.sock
- user = wwwrun
- group = wwwrun
- listen.owner = wwwrun
- listen.group = wwwrun
- pm = ondemand
- pm.max_children = 5
- pm.process_idle_timeout = 60
- ;php_admin_flag[log_errors] = on
- php_admin_value[open_basedir] = "${mypkgs.adminer}:/tmp"
- '';
+ adminer = mypkgs.adminer.phpFpm.pool;
www = ''
listen = /var/run/phpfpm/www.sock
user = wwwrun
adminAddr = "httpd@immae.eu";
extraModules = [
"proxy_fcgi" # for PHP
+ "macro"
+ "ldap"
+ "authnz_ldap"
];
+ extraConfig = ''
+ <IfModule ldap_module>
+ LDAPSharedCacheSize 500000
+ LDAPCacheEntries 1024
+ LDAPCacheTTL 600
+ LDAPOpCacheEntries 1024
+ LDAPOpCacheTTL 600
+ </IfModule>
+
+ <Macro LDAPConnect>
+ <IfModule authnz_ldap_module>
+ AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu
+ AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
+ AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
+ AuthType Basic
+ AuthName "Authentification requise (Acces LDAP)"
+ AuthBasicProvider ldap
+ </IfModule>
+ </Macro>
+ '';
virtualHosts = [
(withSSL "eldiron" // {
listen = [ { ip = "*"; port = 443; } ];
listen = [ { ip = "*"; port = 443; } ];
hostName = "db-1.immae.eu";
documentRoot = null;
- extraConfig = ''
- Alias /adminer ${mypkgs.adminer}
- <Directory ${mypkgs.adminer}>
- DirectoryIndex = index.php
- <FilesMatch "\.php$">
- SetHandler "proxy:unix:/var/run/phpfpm/adminer.sock|fcgi://localhost"
- </FilesMatch>
- </Directory>
- '';
+ extraConfig = builtins.concatStringsSep "\n" [
+ mypkgs.adminer.apache.vhostConf
+ ];
+ })
+ (withSSL "eldiron" // {
+ listen = [ { ip = "*"; port = 443; } ];
+ hostName = "tools.immae.eu";
+ documentRoot = null;
+ extraConfig = builtins.concatStringsSep "\n" [
+ mypkgs.adminer.apache.vhostConf
+ ];
})
{ # Should go last, default fallback
listen = [ { ip = "*"; port = 80; } ];
# FIXME: backup
# FIXME: restart after pam
# FIXME: pam access doesn’t work (because of php module)
+ # FIXME: ssl
services.mysql = rec {
enable = true;
package = pkgs.mariadb.overrideAttrs(old: rec {
# FIXME: initial sync
# FIXME: backup
+ # FIXME: ssl
services.postgresql = rec {
enable = true;
package = pkgs.postgresql100.overrideAttrs(old: rec {