X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;ds=sidebyside;f=virtual%2Feldiron.nix;h=097052124b5b8878294e9e3be54ecb64b3bac1f5;hb=108891744eaa7410e305871212d5b81c1b67a095;hp=ad94fb2799b74bf21d122b3741ec57bdb5ab2919;hpb=ad915416a6886010139413f4fbc41ed827336aa2;p=perso%2FImmae%2FConfig%2FNix.git diff --git a/virtual/eldiron.nix b/virtual/eldiron.nix index ad94fb2..0970521 100644 --- a/virtual/eldiron.nix +++ b/virtual/eldiron.nix @@ -4,13 +4,11 @@ enableRollback = true; }; + # Full backup: + # The star after /var/lib/* avoids deleting all folders in case of problem + # rsync -e "ssh -i /root/.ssh/id_charon_vpn" -aAXvz --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* immae@immae.eu: eldiron = { config, pkgs, mylibs, myconfig, ... }: with mylibs; - let - mypkgs = pkgs.callPackage ./packages.nix { - inherit checkEnv fetchedGit fetchedGithub; - }; - in { _module.args = { mylibs = import ../libs.nix; @@ -25,27 +23,21 @@ imports = [ ./modules/certificates.nix - ./modules/gitolite.nix - ./modules/gitweb.nix - ./modules/databases.nix - ./modules/websites.nix + ./modules/gitolite + ./modules/databases + ./modules/websites ]; services.myGitolite.enable = true; - services.myGitweb.enable = true; services.myDatabases.enable = true; services.myWebsites.production.enable = true; services.myWebsites.integration.enable = true; + services.myWebsites.tools.enable = true; networking = { firewall = { enable = true; - allowedTCPPorts = [ 22 80 443 9418 ]; + allowedTCPPorts = [ 22 ]; }; - interfaces."eth0".ipv4.addresses = [ - # 176.9.151.89 declared in nixops -> infra / tools - { address = myconfig.ips.production; prefixLength = 32; } - { address = myconfig.ips.integration; prefixLength = 32; } - ]; }; deployment = { @@ -68,78 +60,17 @@ }; }; - environment.systemPackages = let - # FIXME: move it to nextcloud - occ = pkgs.writeScriptBin "nextcloud-occ" '' - #! ${pkgs.stdenv.shell} - cd ${mypkgs.nextcloud.webRoot} - NEXTCLOUD_CONFIG_DIR="${mypkgs.nextcloud.webRoot}/config" \ - exec \ - ${config.services.phpfpm.phpPackage}/bin/php \ - -c ${config.services.phpfpm.phpPackage}/etc/php.ini \ - occ $* - ''; - in [ + environment.systemPackages = [ pkgs.telnet pkgs.htop pkgs.vim - occ ]; - security.acme.certs."eldiron".extraDomains = { - "db-1.immae.eu" = null; - "tools.immae.eu" = null; - "cloud.immae.eu" = null; - "dav.immae.eu" = null; - }; - services.openssh.extraConfig = '' AuthorizedKeysCommand /etc/ssh/ldap_authorized_keys AuthorizedKeysCommandUser nobody ''; - services.ympd = mypkgs.ympd.config // { enable = false; }; - - services.phpfpm = { - # FIXME: move session files to separate dirs - # /!\ phppackage is used in nextcloud configuation - phpOptions = '' - session.save_path = "/var/lib/php/sessions" - session.gc_maxlifetime = 60*60*24*15 - session.cache_expire = 60*24*30 - ; For nextcloud - extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so - ; For nextcloud - extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so - ; For nextcloud - zend_extension=${pkgs.php}/lib/php/extensions/opcache.so - ''; - extraConfig = '' - log_level = notice - ''; - poolConfigs = { - adminer = mypkgs.adminer.phpFpm.pool; - nextcloud = mypkgs.nextcloud.phpFpm.pool; - mantisbt = mypkgs.mantisbt.phpFpm.pool; - ttrss = mypkgs.ttrss.phpFpm.pool; - roundcubemail = mypkgs.roundcubemail.phpFpm.pool; - davical = mypkgs.davical.phpFpm.pool; - }; - }; - - system.activationScripts = { - nextcloud = mypkgs.nextcloud.activationScript; - ttrss = mypkgs.ttrss.activationScript; - roundcubemail = mypkgs.roundcubemail.activationScript; - httpd = '' - install -d -m 0755 /var/lib/acme/acme-challenge - install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions - install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer - install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt - install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical - ''; - }; - environment.etc."ssh/ldap_authorized_keys" = let ldap_authorized_keys = assert checkEnv "NIXOPS_SSHD_LDAP_PASSWORD"; @@ -160,127 +91,5 @@ source = ldap_authorized_keys; }; - services.gitDaemon = { - enable = true; - user = "gitolite"; - group = "gitolite"; - basePath = "${mypkgs.git.web.varDir}/repositories"; - }; - - # FIXME: logrotate - services.httpd = let - withConf = domain: { - enableSSL = true; - sslServerCert = "/var/lib/acme/${domain}/cert.pem"; - sslServerKey = "/var/lib/acme/${domain}/key.pem"; - sslServerChain = "/var/lib/acme/${domain}/fullchain.pem"; - logFormat = "combinedVhost"; - listen = [ - { ip = "176.9.151.89"; port = 443; } - ]; - }; - apacheConfig = config.services.myWebsites.apacheConfig; - in rec { - enable = true; - logPerVirtualHost = true; - multiProcessingModule = "worker"; - adminAddr = "httpd@immae.eu"; - logFormat = "combinedVhost"; - extraModules = pkgs.lib.lists.unique ( - mypkgs.adminer.apache.modules ++ - mypkgs.nextcloud.apache.modules ++ - mypkgs.ympd.apache.modules ++ - mypkgs.git.web.apache.modules ++ - mypkgs.mantisbt.apache.modules ++ - mypkgs.ttrss.apache.modules ++ - mypkgs.roundcubemail.apache.modules ++ - pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig)); - extraConfig = builtins.concatStringsSep "\n" - (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig)); - virtualHosts = [ - (withConf "eldiron" // { - hostName = "eldiron.immae.eu"; - documentRoot = ./www; - extraConfig = '' - DirectoryIndex index.htm - ''; - }) - (withConf "eldiron" // { - hostName = "db-1.immae.eu"; - documentRoot = null; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.adminer.apache.vhostConf - ]; - }) - (withConf "eldiron" // { - hostName = "tools.immae.eu"; - documentRoot = null; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.adminer.apache.vhostConf - mypkgs.ympd.apache.vhostConf - mypkgs.ttrss.apache.vhostConf - mypkgs.roundcubemail.apache.vhostConf - ]; - }) - (withConf "eldiron" // { - hostName = "dav.immae.eu"; - documentRoot = null; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.infcloud.apache.vhostConf - mypkgs.davical.apache.vhostConf - ]; - }) - (withConf "eldiron" // { - hostName = "cloud.immae.eu"; - documentRoot = mypkgs.nextcloud.webRoot; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.nextcloud.apache.vhostConf - ]; - }) - (withConf "eldiron" // { - hostName = "git.immae.eu"; - documentRoot = mypkgs.git.web.webRoot; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.git.web.apache.vhostConf - mypkgs.mantisbt.apache.vhostConf - ] + '' - RewriteEngine on - RewriteCond %{REQUEST_URI} ^/releases - RewriteRule /releases(.*) https://release.immae.eu$1 [P,L] - ''; - }) - { # Should go last, default fallback - listen = [ { ip = "*"; port = 80; } ]; - hostName = "redirectSSL"; - serverAliases = [ "*" ]; - enableSSL = false; - logFormat = "combinedVhost"; - documentRoot = "/var/lib/acme/acme-challenge"; - extraConfig = '' - RewriteEngine on - RewriteCond "%{REQUEST_URI}" "!^/\.well-known" - RewriteRule ^(.+) https://%{HTTP_HOST}$1 [R=301] - # To redirect in specific "VirtualHost *:80", do - # RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1 - # rather than rewrite - ''; - } - ]; - }; - - systemd.services.tt-rss = { - description = "Tiny Tiny RSS feeds update daemon"; - serviceConfig = { - User = "wwwrun"; - ExecStart = "${pkgs.php}/bin/php ${mypkgs.ttrss.webRoot}/update.php --daemon"; - StandardOutput = "syslog"; - StandardError = "syslog"; - PermissionsStartOnly = true; - }; - - wantedBy = [ "multi-user.target" ]; - requires = ["postgresql.service"]; - after = ["network.target" "postgresql.service"]; - }; }; }