eldiron = { config, pkgs, ... }:
let mypkgs = import ./packages.nix;
+ mylibs = import ../libs.nix;
in
{
networking = {
};
};
- # FIXME: how to run it? currently set as timer
+ environment.systemPackages = [
+ pkgs.telnet
+ pkgs.vim
+ ];
+
security.acme.certs = {
"eldiron" = {
webroot = "/var/lib/acme/acme-challenge";
domain = "eldiron.immae.eu";
plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
postRun = ''
- "systemctl reload httpd.service"
+ systemctl reload httpd.service
'';
extraDomains = {
"db-1.immae.eu" = null;
"tools.immae.eu" = null;
+ "connexionswing.immae.eu" = null;
+ "sandetludo.immae.eu" = null;
};
};
+ # "connexionswing" = {
+ # webroot = "/var/lib/acme/acme-challenge";
+ # email = "ismael@bouya.org";
+ # domain = "connexionswing.com";
+ # plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
+ # postRun = ''
+ # systemctl reload httpd.service
+ # '';
+ # extraDomains = {
+ # "www.connexionswing.com" = null;
+ # "sandetludo.com" = null;
+ # "www.sandetludo.com" = null;
+ # };
+ # };
};
services.ympd = mypkgs.ympd.config // { enable = true; };
- # FIXME: open_basedir
services.phpfpm = {
extraConfig = ''
log_level = notice
'';
poolConfigs = {
adminer = mypkgs.adminer.phpFpm.pool;
+ connexionswing_dev = mypkgs.connexionswing_dev.phpFpm.pool;
+ connexionswing_prod = mypkgs.connexionswing_prod.phpFpm.pool;
www = ''
listen = /var/run/phpfpm/www.sock
user = wwwrun
};
};
+ system.activationScripts = {
+ connexionswing_dev = mypkgs.connexionswing_dev.activationScript;
+ connexionswing_prod = mypkgs.connexionswing_prod.activationScript;
+ httpd = ''
+ install -d -m 0755 /var/lib/acme/acme-challenge
+ install -d -m 0755 /var/www
+ '';
+ };
+
services.httpd = let
withSSL = domain: {
enableSSL = true;
- sslServerCert = "/var/lib/acme/${domain}/full.pem"; # FIXME: cert only?
+ sslServerCert = "/var/lib/acme/${domain}/cert.pem";
sslServerKey = "/var/lib/acme/${domain}/key.pem";
sslServerChain = "/var/lib/acme/${domain}/fullchain.pem";
};
# FIXME: http2
extraModules = pkgs.lib.lists.unique (
mypkgs.adminer.apache.modules ++
+ mypkgs.connexionswing_dev.apache.modules ++
+ mypkgs.connexionswing_prod.apache.modules ++
[
"macro"
"ldap"
"authnz_ldap"
]);
- extraConfig = ''
+ extraConfig = assert mylibs.checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; ''
<IfModule ldap_module>
LDAPSharedCacheSize 500000
LDAPCacheEntries 1024
mypkgs.ympd.apache.vhostConf
];
})
+ (withSSL "eldiron" // {
+ listen = [ { ip = "*"; port = 443; } ];
+ hostName = "connexionswing.immae.eu";
+ serverAliases = [ "sandetludo.immae.eu" ];
+ documentRoot = mypkgs.connexionswing_dev.webRoot;
+ extraConfig = builtins.concatStringsSep "\n" [
+ mypkgs.connexionswing_dev.apache.vhostConf
+ ];
+ })
{ # Should go last, default fallback
listen = [ { ip = "*"; port = 80; } ];
hostName = "redirectSSL";
serverAliases = [ "*" ];
enableSSL = false;
- # FIXME: directory needs to exist
documentRoot = "/var/lib/acme/acme-challenge";
extraConfig = ''
RewriteEngine on
];
};
- # FIXME: environment variables ?
security.pam.services = let
pam_ldap = pkgs.pam_ldap;
- pam_ldap_mysql = pkgs.writeText "mysql.conf" ''
+ pam_ldap_mysql = assert mylibs.checkEnv "NIXOPS_MYSQL_PAM_PASSWORD";
+ pkgs.writeText "mysql.conf" ''
host ldap.immae.eu
base dc=immae,dc=eu
binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu