enableRollback = true;
};
- eldiron = { config, pkgs, mylibs, ... }:
+ eldiron = { config, pkgs, mylibs, myconfig, ... }:
with mylibs;
let
mypkgs = pkgs.callPackage ./packages.nix {
{
_module.args = {
mylibs = import ../libs.nix;
+ myconfig = {
+ ips = {
+ main = "176.9.151.89";
+ production = "176.9.151.154";
+ integration = "176.9.151.155";
+ };
+ };
};
imports = [
./modules/gitolite.nix
./modules/gitweb.nix
./modules/databases.nix
- ./modules/websites/chloe.nix
- ./modules/websites/ludivine.nix
- ./modules/websites/aten.nix
- ./modules/websites/piedsjaloux.nix
- ./modules/websites/connexionswing.nix
+ ./modules/websites.nix
];
services.myGitolite.enable = true;
services.myGitweb.enable = true;
services.myDatabases.enable = true;
- services.myWebsites.Chloe.production.enable = true;
- services.myWebsites.Chloe.integration.enable = true;
- services.myWebsites.Ludivine.production.enable = true;
- services.myWebsites.Ludivine.integration.enable = true;
- services.myWebsites.Aten.production.enable = true;
- services.myWebsites.Aten.integration.enable = true;
- services.myWebsites.PiedsJaloux.production.enable = true;
- services.myWebsites.PiedsJaloux.integration.enable = true;
- services.myWebsites.Connexionswing.production.enable = true;
- services.myWebsites.Connexionswing.integration.enable = true;
+ services.myWebsites.production.enable = true;
+ services.myWebsites.integration.enable = true;
nixpkgs.config.packageOverrides = oldpkgs: rec {
goaccess = oldpkgs.goaccess.overrideAttrs(old: rec {
enable = true;
allowedTCPPorts = [ 22 80 443 9418 ];
};
+ interfaces."eth0".ipv4.addresses = [
+ # 176.9.151.89 declared in nixops -> infra / tools
+ { address = myconfig.ips.production; prefixLength = 32; }
+ { address = myconfig.ips.integration; prefixLength = 32; }
+ ];
};
deployment = {
hetzner = {
#robotUser = "defined in HETZNER_ROBOT_USER";
#robotPass = "defined in HETZNER_ROBOT_PASS";
- mainIPv4 = "176.9.151.89";
+ mainIPv4 = myconfig.ips.main;
partitions = ''
clearpart --all --initlabel --drives=sda,sdb
'';
poolConfigs = {
adminer = mypkgs.adminer.phpFpm.pool;
- connexionswing_dev = mypkgs.connexionswing_dev.phpFpm.pool;
- connexionswing_prod = mypkgs.connexionswing_prod.phpFpm.pool;
- ludivinecassal_dev = mypkgs.ludivinecassal_dev.phpFpm.pool;
- ludivinecassal_prod = mypkgs.ludivinecassal_prod.phpFpm.pool;
- piedsjaloux_dev = mypkgs.piedsjaloux_dev.phpFpm.pool;
- piedsjaloux_prod = mypkgs.piedsjaloux_prod.phpFpm.pool;
- chloe_dev = mypkgs.chloe_dev.phpFpm.pool;
- chloe_prod = mypkgs.chloe_prod.phpFpm.pool;
- aten_dev = mypkgs.aten_dev.phpFpm.pool;
- aten_prod = mypkgs.aten_prod.phpFpm.pool;
nextcloud = mypkgs.nextcloud.phpFpm.pool;
mantisbt = mypkgs.mantisbt.phpFpm.pool;
ttrss = mypkgs.ttrss.phpFpm.pool;
};
system.activationScripts = {
- connexionswing_dev = mypkgs.connexionswing_dev.activationScript;
- connexionswing_prod = mypkgs.connexionswing_prod.activationScript;
- ludivinecassal_dev = mypkgs.ludivinecassal_dev.activationScript;
- ludivinecassal_prod = mypkgs.ludivinecassal_prod.activationScript;
- piedsjaloux_dev = mypkgs.piedsjaloux_dev.activationScript;
- piedsjaloux_prod = mypkgs.piedsjaloux_prod.activationScript;
- chloe_dev = mypkgs.chloe_dev.activationScript;
- chloe_prod = mypkgs.chloe_prod.activationScript;
- aten_dev = mypkgs.aten_dev.activationScript;
- aten_prod = mypkgs.aten_prod.activationScript;
nextcloud = mypkgs.nextcloud.activationScript;
ttrss = mypkgs.ttrss.activationScript;
roundcubemail = mypkgs.roundcubemail.activationScript;
install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
- install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/ttrss
install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
'';
- redis = ''
- mkdir -p /run/redis
- chown redis /run/redis
- '';
# FIXME: initial sync
goaccess = ''
mkdir -p /var/lib/goaccess
sslServerKey = "/var/lib/acme/${domain}/key.pem";
sslServerChain = "/var/lib/acme/${domain}/fullchain.pem";
logFormat = "combinedVhost";
- listen = [ { ip = "*"; port = 443; } ];
- };
- apacheConfig = {
- gzip = {
- modules = [ "deflate" "filter" ];
- extraConfig = ''
- AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
- '';
- };
- ldap = {
- modules = [ "ldap" "authnz_ldap" ];
- extraConfig = assert checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; ''
- <IfModule ldap_module>
- LDAPSharedCacheSize 500000
- LDAPCacheEntries 1024
- LDAPCacheTTL 600
- LDAPOpCacheEntries 1024
- LDAPOpCacheTTL 600
- </IfModule>
-
- <Macro LDAPConnect>
- <IfModule authnz_ldap_module>
- AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu
- AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
- AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
- AuthType Basic
- AuthName "Authentification requise (Acces LDAP)"
- AuthBasicProvider ldap
- </IfModule>
- </Macro>
-
- <Macro Stats %{domain}>
- Alias /awstats /var/lib/goaccess/%{domain}
- <Directory /var/lib/goaccess/%{domain}>
- DirectoryIndex index.html
- AllowOverride None
- Require all granted
- </Directory>
- <Location /awstats>
- Use LDAPConnect
- Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
- </Location>
- </Macro>
- '';
- };
- http2 = {
- modules = [ "http2" ];
- extraConfig = ''
- Protocols h2 http/1.1
- '';
- };
- customLog = {
- modules = [];
- extraConfig = ''
- LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
- '';
- };
+ listen = [
+ { ip = "176.9.151.89"; port = 443; }
+ ];
};
+ apacheConfig = config.services.myWebsites.apacheConfig;
in rec {
enable = true;
logPerVirtualHost = true;
extraModules = pkgs.lib.lists.unique (
mypkgs.adminer.apache.modules ++
mypkgs.nextcloud.apache.modules ++
- mypkgs.connexionswing_dev.apache.modules ++
- mypkgs.connexionswing_prod.apache.modules ++
- mypkgs.ludivinecassal_dev.apache.modules ++
- mypkgs.ludivinecassal_prod.apache.modules ++
- mypkgs.piedsjaloux_dev.apache.modules ++
- mypkgs.piedsjaloux_prod.apache.modules ++
- mypkgs.chloe_dev.apache.modules ++
- mypkgs.chloe_prod.apache.modules ++
- mypkgs.aten_dev.apache.modules ++
- mypkgs.aten_prod.apache.modules ++
mypkgs.ympd.apache.modules ++
mypkgs.git.web.apache.modules ++
mypkgs.mantisbt.apache.modules ++
mypkgs.ttrss.apache.modules ++
mypkgs.roundcubemail.apache.modules ++
- pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules) apacheConfig) ++
- [ "macro" ]);
+ pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig));
extraConfig = builtins.concatStringsSep "\n"
- (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig) apacheConfig);
+ (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
virtualHosts = [
(withConf "eldiron" // {
hostName = "eldiron.immae.eu";
mypkgs.davical.apache.vhostConf
];
})
- (withConf "eldiron" // {
- hostName = "connexionswing.immae.eu";
- serverAliases = [ "sandetludo.immae.eu" ];
- documentRoot = mypkgs.connexionswing_dev.webRoot;
- extraConfig = builtins.concatStringsSep "\n" [
- mypkgs.connexionswing_dev.apache.vhostConf
- ];
- })
(withConf "connexionswing" // {
hostName = "connexionswing.com";
serverAliases = [ "sandetludo.com" "www.connexionswing.com" "www.sandetludo.com" ];
mypkgs.connexionswing_prod.apache.vhostConf
];
})
- (withConf "eldiron" // {
- hostName = "ludivine.immae.eu";
- documentRoot = mypkgs.ludivinecassal_dev.webRoot;
- extraConfig = builtins.concatStringsSep "\n" [
- mypkgs.ludivinecassal_dev.apache.vhostConf
- ];
- })
(withConf "ludivinecassal" // {
hostName = "ludivinecassal.com";
serverAliases = [ "www.ludivinecassal.com" ];
mypkgs.ludivinecassal_prod.apache.vhostConf
];
})
- (withConf "eldiron" // {
- hostName = "piedsjaloux.immae.eu";
- documentRoot = mypkgs.piedsjaloux_dev.webRoot;
- extraConfig = builtins.concatStringsSep "\n" [
- mypkgs.piedsjaloux_dev.apache.vhostConf
- ];
- })
(withConf "piedsjaloux" // {
hostName = "piedsjaloux.fr";
serverAliases = [ "www.piedsjaloux.fr" ];
mypkgs.piedsjaloux_prod.apache.vhostConf
];
})
- (withConf "eldiron" // {
- hostName = "chloe.immae.eu";
- documentRoot = mypkgs.chloe_dev.webRoot;
- extraConfig = builtins.concatStringsSep "\n" [
- mypkgs.chloe_dev.apache.vhostConf
- ];
- })
(withConf "chloe" // {
hostName = "osteopathe-cc.fr";
serverAliases = [ "www.osteopathe-cc.fr" ];
mypkgs.chloe_prod.apache.vhostConf
];
})
- (withConf "eldiron" // {
- hostName = "dev.aten.pro";
- documentRoot = mypkgs.aten_dev.webRoot;
- extraConfig = builtins.concatStringsSep "\n" [
- mypkgs.aten_dev.apache.vhostConf
- ];
- })
(withConf "aten" // {
hostName = "aten.pro";
serverAliases = [ "www.aten.pro" ];
projects / perso / Immae / Config / Nix.git / blobdiff