};
};
- services.nginx = rec {
- enable = true;
- virtualHosts = {
- "_" = {
- serverName = "_";
- useACMEHost = "eldiron";
- };
- "eldiron.immae.eu" = {
- forceSSL = true;
- useACMEHost = "eldiron";
- locations."/" = {
- # FIXME: directory needs to exist
- root = "/var/www";
- };
- };
+ # FIXME: open_basedir
+ services.phpfpm = {
+ extraConfig = ''
+ log_level = notice
+ '';
+ poolConfigs = {
+ adminer = mypkgs.adminer.phpFpm.pool;
+ www = ''
+ listen = /var/run/phpfpm/www.sock
+ user = wwwrun
+ group = wwwrun
+ listen.owner = wwwrun
+ listen.group = wwwrun
+ pm = ondemand
+ pm.max_children = 5
+ pm.process_idle_timeout = 60
+ ;php_admin_flag[log_errors] = on
+ php_admin_value[open_basedir] = "/var/www"
+ '';
};
};
+ services.httpd = let
+ withSSL = domain: {
+ enableSSL = true;
+ sslServerCert = "/var/lib/acme/${domain}/full.pem"; # FIXME: cert only?
+ sslServerKey = "/var/lib/acme/${domain}/key.pem";
+ sslServerChain = "/var/lib/acme/${domain}/fullchain.pem";
+ };
+ in rec {
+ enable = true;
+ logPerVirtualHost = true;
+ multiProcessingModule = "worker";
+ adminAddr = "httpd@immae.eu";
+ extraModules = [
+ "proxy_fcgi" # for PHP
+ ];
+ virtualHosts = [
+ (withSSL "eldiron" // {
+ listen = [ { ip = "*"; port = 443; } ];
+ hostName = "eldiron.immae.eu";
+ # FIXME: directory needs to exist
+ documentRoot = "/var/www";
+ })
+ (withSSL "eldiron" // {
+ listen = [ { ip = "*"; port = 443; } ];
+ hostName = "db-1.immae.eu";
+ documentRoot = null;
+ extraConfig = builtins.concatStringsSep "\n" [
+ mypkgs.adminer.apacheConf
+ ];
+ })
+ { # Should go last, default fallback
+ listen = [ { ip = "*"; port = 80; } ];
+ hostName = "redirectSSL";
+ serverAliases = [ "*" ];
+ enableSSL = false;
+ # FIXME: directory needs to exist
+ documentRoot = "/var/lib/acme/acme-challenge";
+ extraConfig = ''
+ RewriteEngine on
+ RewriteCond "%{REQUEST_URI}" "!^/\.well-known"
+ RewriteRule ^(.+) https://%{HTTP_HOST}$1 [R=301]
+ # To redirect in specific "VirtualHost *:80", do
+ # RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
+ # rather than rewrite
+ '';
+ }
+ ];
+ };
+
# FIXME: environment variables ?
security.pam.services = let
pam_ldap = pkgs.pam_ldap;
# FIXME: backup
# FIXME: restart after pam
# FIXME: pam access doesn’t work (because of php module)
+ # FIXME: ssl
services.mysql = rec {
enable = true;
package = pkgs.mariadb.overrideAttrs(old: rec {
# FIXME: initial sync
# FIXME: backup
+ # FIXME: ssl
services.postgresql = rec {
enable = true;
package = pkgs.postgresql100.overrideAttrs(old: rec {