X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;ds=sidebyside;f=virtual%2Feldiron.nix;h=51e2bb953e913ab47c7b46bc2b5272e6a9c9fe0b;hb=ec9ff2b8fdd8c4d21c904f86f14bfbe88a13a6ce;hp=3d480fd6161e1d366b72ddab26c3da90e1fedb7d;hpb=60f67ae37a68ce0f57e7e7392953fd8ae5a7a4d4;p=perso%2FImmae%2FConfig%2FNix.git diff --git a/virtual/eldiron.nix b/virtual/eldiron.nix index 3d480fd..51e2bb9 100644 --- a/virtual/eldiron.nix +++ b/virtual/eldiron.nix @@ -5,14 +5,42 @@ }; eldiron = { config, pkgs, ... }: - let mypkgs = import ./packages.nix; - mylibs = import ../libs.nix; + with import ../libs.nix; + let + mypkgs = pkgs.callPackage ./packages.nix { + inherit checkEnv fetchedGitPrivate fetchedGithub; + }; in { + # FIXME: they are not overriden in packages.nix + # (see nix-store -q --tree /nix/var/nix/profiles/system) + nixpkgs.config.packageOverrides = oldpkgs: rec { + gitolite = nixpkgs_unstable.gitolite; + gitweb = oldpkgs.gitweb.overrideAttrs(old: { + installPhase = old.installPhase + '' + cp -r ${./packages/gitweb} $out/gitweb-theme; + ''; + }); + postgresql = postgresql111; + postgresql111 = oldpkgs.postgresql100.overrideAttrs(old: rec { + passthru = old.passthru // { psqlSchema = "11.0"; }; + name = "postgresql-11.1"; + src = pkgs.fetchurl { + url = "mirror://postgresql/source/v11.1/${name}.tar.bz2"; + sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch"; + }; + }); + mariadb = mariadbPAM; + mariadbPAM = oldpkgs.mariadb.overrideAttrs(old: rec { + cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ]; + buildInputs = old.buildInputs ++ [ pkgs.pam ]; + }); + }; + networking = { firewall = { enable = true; - allowedTCPPorts = [ 22 80 443 3306 5432 ]; + allowedTCPPorts = [ 22 80 443 3306 5432 9418 ]; }; }; @@ -36,9 +64,21 @@ }; }; - environment.systemPackages = [ + environment.systemPackages = let + # FIXME: move it to nextcloud + occ = pkgs.writeScriptBin "nextcloud-occ" '' + #! ${pkgs.stdenv.shell} + cd ${mypkgs.nextcloud.webRoot} + NEXTCLOUD_CONFIG_DIR="${mypkgs.nextcloud.webRoot}/config" \ + exec \ + ${config.services.phpfpm.phpPackage}/bin/php \ + -c ${config.services.phpfpm.phpPackage}/etc/php.ini \ + occ $* + ''; + in [ pkgs.telnet pkgs.vim + occ ]; security.acme.certs = { @@ -52,9 +92,11 @@ ''; extraDomains = { "db-1.immae.eu" = null; + "git.immae.eu" = null; "tools.immae.eu" = null; "connexionswing.immae.eu" = null; "sandetludo.immae.eu" = null; + "cloud.immae.eu" = null; }; }; # "connexionswing" = { @@ -73,9 +115,49 @@ # }; }; + services.openssh.extraConfig = '' + AuthorizedKeysCommand /etc/ssh/ldap_authorized_keys + AuthorizedKeysCommandUser nobody + ''; + + users.users.wwwrun.extraGroups = [ "gitolite" ]; + + users.users.gitolite.packages = let + python-packages = python-packages: with python-packages; [ + simplejson + urllib3 + ]; + in + [ + (pkgs.python3.withPackages python-packages) + ]; + # FIXME: after initial install, need to + # (1) copy rc file (adjust gitolite_ldap_groups.sh) + # (2) (mark old readonly and) sync repos except gitolite-admin + # rsync -av --exclude=gitolite-admin.git old:/var/lib/gitolite/repositories /var/lib/gitolite/ + # chown -R gitolite:gitolite /var/lib/gitolite + # (3) push force the gitolite-admin to new location (from external point) + # Don't use an existing key, it will take precedence over + # gitolite-admin + # (4) su -u gitolite gitolite setup + services.gitolite = { + enable = true; + # FIXME: key from ./ssh + adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXqRbiHw7QoHADNIEuo4nUT9fSOIEBMdJZH0bkQAxXyJFyCM1IMz0pxsHV0wu9tdkkr36bPEUj2aV5bkYLBN6nxcV2Y49X8bjOSCPfx3n6Own1h+NeZVBj4ZByrFmqCbTxUJIZ2bZKcWOFncML39VmWdsVhNjg0X4NBBehqXRIKr2gt3E/ESAxTYJFm0BnU0baciw9cN0bsRGqvFgf5h2P48CIAfwhVcGmPQnnAwabnosYQzRWxR0OygH5Kd8mePh6FheIRIigfXsDO8f/jdxwut8buvNIf3m5EBr3tUbTsvM+eV3M5vKGt7sk8T64DVtepTSdOOWtp+47ktsnHOMh immae@immae.eu"; + }; + services.ympd = mypkgs.ympd.config // { enable = true; }; services.phpfpm = { + # /!\ phppackage is used in nextcloud configuation + phpOptions = '' + ; For nextcloud + extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so + ; For nextcloud + extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so + ; For nextcloud + zend_extension=${pkgs.php}/lib/php/extensions/opcache.so + ''; extraConfig = '' log_level = notice ''; @@ -83,32 +165,72 @@ adminer = mypkgs.adminer.phpFpm.pool; connexionswing_dev = mypkgs.connexionswing_dev.phpFpm.pool; connexionswing_prod = mypkgs.connexionswing_prod.phpFpm.pool; - www = '' - listen = /var/run/phpfpm/www.sock - user = wwwrun - group = wwwrun - listen.owner = wwwrun - listen.group = wwwrun - pm = ondemand - pm.max_children = 5 - pm.process_idle_timeout = 60 - ;php_admin_flag[log_errors] = on - php_admin_value[open_basedir] = "/var/www" - ''; + nextcloud = mypkgs.nextcloud.phpFpm.pool; + mantisbt = mypkgs.mantisbt.phpFpm.pool; }; }; system.activationScripts = { connexionswing_dev = mypkgs.connexionswing_dev.activationScript; connexionswing_prod = mypkgs.connexionswing_prod.activationScript; + nextcloud = mypkgs.nextcloud.activationScript; httpd = '' install -d -m 0755 /var/lib/acme/acme-challenge - install -d -m 0755 /var/www ''; redis = '' mkdir -p /run/redis chown redis /run/redis ''; + gitolite = + assert checkEnv "NIXOPS_GITOLITE_LDAP_PASSWORD"; + let + gitolite_ldap_groups = wrap { + name = "gitolite_ldap_groups.sh"; + file = ./packages/gitolite_ldap_groups.sh; + vars = { + LDAP_PASS = builtins.getEnv "NIXOPS_GITOLITE_LDAP_PASSWORD"; + }; + paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ]; + }; + in { + deps = [ "users" ]; + text = '' + if [ -d /var/lib/gitolite ]; then + ln -sf ${gitolite_ldap_groups} /var/lib/gitolite/gitolite_ldap_groups.sh + chmod g+rx /var/lib/gitolite + fi + if [ -f /var/lib/gitolite/projects.list ]; then + chmod g+r /var/lib/gitolite/projects.list + fi + ''; + }; + }; + + environment.etc."ssh/ldap_authorized_keys" = let + ldap_authorized_keys = + assert checkEnv "NIXOPS_SSHD_LDAP_PASSWORD"; + wrap { + name = "ldap_authorized_keys"; + file = ./ldap_authorized_keys.sh; + vars = { + LDAP_PASS = builtins.getEnv "NIXOPS_SSHD_LDAP_PASSWORD"; + GITOLITE_SHELL = "${pkgs.gitolite}/bin/gitolite-shell"; + ECHO = "${pkgs.coreutils}/bin/echo"; + }; + paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ]; + }; + in { + enable = true; + mode = "0755"; + user = "root"; + source = ldap_authorized_keys; + }; + + services.gitDaemon = { + enable = true; + user = "gitolite"; + group = "gitolite"; + basePath = "${mypkgs.git.web.varDir}/repositories"; }; services.httpd = let @@ -127,7 +249,7 @@ }; ldap = { modules = [ "ldap" "authnz_ldap" ]; - extraConfig = assert mylibs.checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; '' + extraConfig = assert checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; '' LDAPSharedCacheSize 500000 LDAPCacheEntries 1024 @@ -173,8 +295,12 @@ extraModules = pkgs.lib.lists.unique ( mypkgs.adminer.apache.modules ++ + mypkgs.nextcloud.apache.modules ++ mypkgs.connexionswing_dev.apache.modules ++ mypkgs.connexionswing_prod.apache.modules ++ + mypkgs.ympd.apache.modules ++ + mypkgs.git.web.apache.modules ++ + mypkgs.mantisbt.apache.modules ++ pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules) apacheConfig) ++ [ "macro" ]); extraConfig = builtins.concatStringsSep "\n" @@ -183,8 +309,10 @@ (withSSL "eldiron" // { listen = [ { ip = "*"; port = 443; } ]; hostName = "eldiron.immae.eu"; - # FIXME: directory needs to exist - documentRoot = "/var/www"; + documentRoot = ./www; + extraConfig = '' + DirectoryIndex index.htm + ''; }) (withSSL "eldiron" // { listen = [ { ip = "*"; port = 443; } ]; @@ -212,6 +340,27 @@ mypkgs.connexionswing_dev.apache.vhostConf ]; }) + (withSSL "eldiron" // { + listen = [ { ip = "*"; port = 443; } ]; + hostName = "cloud.immae.eu"; + documentRoot = mypkgs.nextcloud.webRoot; + extraConfig = builtins.concatStringsSep "\n" [ + mypkgs.nextcloud.apache.vhostConf + ]; + }) + (withSSL "eldiron" // { + listen = [ { ip = "*"; port = 443; } ]; + hostName = "git.immae.eu"; + documentRoot = mypkgs.git.web.webRoot; + extraConfig = builtins.concatStringsSep "\n" [ + mypkgs.git.web.apache.vhostConf + mypkgs.mantisbt.apache.vhostConf + ] + '' + RewriteEngine on + RewriteCond %{REQUEST_URI} ^/releases + RewriteRule /releases(.*) https://release.immae.eu$1 [P,L] + ''; + }) { # Should go last, default fallback listen = [ { ip = "*"; port = 80; } ]; hostName = "redirectSSL"; @@ -232,7 +381,7 @@ security.pam.services = let pam_ldap = pkgs.pam_ldap; - pam_ldap_mysql = assert mylibs.checkEnv "NIXOPS_MYSQL_PAM_PASSWORD"; + pam_ldap_mysql = assert checkEnv "NIXOPS_MYSQL_PAM_PASSWORD"; pkgs.writeText "mysql.conf" '' host ldap.immae.eu base dc=immae,dc=eu @@ -269,10 +418,7 @@ # FIXME: ssl services.mysql = rec { enable = true; - package = pkgs.mariadb.overrideAttrs(old: rec { - cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ]; - buildInputs = old.buildInputs ++ [ pkgs.pam ]; - }); + package = pkgs.mariadb; }; # FIXME: initial sync @@ -280,14 +426,7 @@ # FIXME: ssl services.postgresql = rec { enable = true; - package = pkgs.postgresql100.overrideAttrs(old: rec { - passthru = old.passthru // { psqlSchema = "11.0"; }; - name = "postgresql-11.1"; - src = pkgs.fetchurl { - url = "mirror://postgresql/source/v11.1/${name}.tar.bz2"; - sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch"; - }; - }); + package = pkgs.postgresql; enableTCPIP = true; extraConfig = '' max_connections = 100 @@ -310,6 +449,7 @@ authentication = '' local all postgres ident local all all md5 + host all all samehost md5 host all all 178.33.252.96/32 md5 host all all 188.165.209.148/32 md5 #host all all all pam