X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fwebsites%2Ftools%2Ftools%2Fdefault.nix;h=1f499fbb76abd2b9e2cb08e615bbd258b7d31f99;hb=4c4652aabf2cb3ac8b40f2856eca07a1df9c27e0;hp=e2a39131d4958d50ba6aaaee95f348f7181b0459;hpb=c7627e14666fe7dedb91ecc9f3fbd8949182f6e4;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/modules/private/websites/tools/tools/default.nix b/modules/private/websites/tools/tools/default.nix
index e2a3913..1f499fb 100644
--- a/modules/private/websites/tools/tools/default.nix
+++ b/modules/private/websites/tools/tools/default.nix
@@ -1,5 +1,7 @@
 { lib, pkgs, config, ... }:
 let
+  flakeCompat = import ../../../../../lib/flake-compat.nix;
+
   adminer = pkgs.callPackage ./adminer.nix {
     inherit (pkgs.webapps) adminer;
   };
@@ -9,17 +11,26 @@ let
   ttrss = pkgs.callPackage ./ttrss.nix {
     inherit (pkgs.webapps) ttrss ttrss-plugins;
     env = config.myEnv.tools.ttrss;
+    php = pkgs.php72;
+    inherit config;
   };
   kanboard = pkgs.callPackage ./kanboard.nix  {
+    inherit config;
     env = config.myEnv.tools.kanboard;
   };
   wallabag = pkgs.callPackage ./wallabag.nix {
-    inherit (pkgs.webapps) wallabag;
+    wallabag = pkgs.webapps.wallabag.override {
+      composerEnv = pkgs.composerEnv.override {
+        php = pkgs.php73.withExtensions({ enabled, all }: enabled ++ [all.tidy]);
+      };
+    };
     env = config.myEnv.tools.wallabag;
+    inherit config;
   };
   yourls = pkgs.callPackage ./yourls.nix {
     inherit (pkgs.webapps) yourls yourls-plugins;
     env = config.myEnv.tools.yourls;
+    inherit config;
   };
   rompr = pkgs.callPackage ./rompr.nix {
     inherit (pkgs.webapps) rompr;
@@ -27,6 +38,7 @@ let
   };
   shaarli = pkgs.callPackage ./shaarli.nix {
     env = config.myEnv.tools.shaarli;
+    inherit config;
   };
   dokuwiki = pkgs.callPackage ./dokuwiki.nix {
     inherit (pkgs.webapps) dokuwiki dokuwiki-plugins;
@@ -34,13 +46,36 @@ let
   ldap = pkgs.callPackage ./ldap.nix {
     inherit (pkgs.webapps) phpldapadmin;
     env = config.myEnv.tools.phpldapadmin;
+    inherit config;
   };
   grocy = pkgs.callPackage ./grocy.nix {
-    inherit (pkgs.webapps) grocy;
+    grocy = pkgs.webapps.grocy.override { composerEnv = pkgs.composerEnv.override { php = pkgs.php72; }; };
+  };
+  phpbb = pkgs.callPackage ./phpbb.nix {
+    phpbb = (pkgs.webapps.phpbb.withLangs (l: [ l.fr ])).withExts (e: [
+      e.alfredoramos.markdown e.davidiq.mailinglist e.dmzx.mchat
+      e.empteintesduweb.monitoranswers e.lr94.autosubscribe
+      e.phpbbmodders.adduser ]);
+  };
+  webhooks = pkgs.callPackage ./webhooks.nix {
+    env = config.myEnv.tools.webhooks;
+  };
+  dmarc-reports = pkgs.callPackage ./dmarc_reports.nix {
+    env = config.myEnv.tools.dmarc_reports;
+    inherit config;
   };
+  csp-reports = pkgs.callPackage ./csp_reports.nix {
+    env = config.myEnv.tools.csp_reports;
+  };
+
+  landing = pkgs.callPackage ./landing.nix {};
 
   cfg = config.myServices.websites.tools.tools;
+  pcfg = config.services.phpfpm.pools;
 in {
+  imports =
+    builtins.attrValues (flakeCompat ../../../../../flakes/private/paste).nixosModules;
+
   options.myServices.websites.tools.tools = {
     enable = lib.mkEnableOption "enable tools website";
   };
@@ -48,11 +83,14 @@ in {
   config = lib.mkIf cfg.enable {
     secrets.keys =
       kanboard.keys
-      ++ ldap.keys
-      ++ shaarli.keys
-      ++ ttrss.keys
-      ++ wallabag.keys
-      ++ yourls.keys;
+      // ldap.keys
+      // shaarli.keys
+      // ttrss.keys
+      // wallabag.keys
+      // yourls.keys
+      // dmarc-reports.keys
+      // csp-reports.keys
+      // webhooks.keys;
 
     services.duplyBackup.profiles = {
       dokuwiki = dokuwiki.backups;
@@ -62,6 +100,7 @@ in {
       shaarli = shaarli.backups;
       ttrss = ttrss.backups;
       wallabag = wallabag.backups;
+      phpbb = phpbb.backups;
     };
 
     services.websites.env.tools.modules =
@@ -74,6 +113,8 @@ in {
       ++ rompr.apache.modules
       ++ shaarli.apache.modules
       ++ dokuwiki.apache.modules
+      ++ dmarc-reports.apache.modules
+      ++ phpbb.apache.modules
       ++ ldap.apache.modules
       ++ kanboard.apache.modules;
 
@@ -85,14 +126,16 @@ in {
       root         = "/var/lib/ftp/devtools.immae.eu";
       extraConfig  = [
         ''
+          Use Apaxy "/var/lib/ftp/devtools.immae.eu" "title"
           Timeout 600
           ProxyTimeout 600
+          Header always set Content-Security-Policy-Report-Only "${config.myEnv.tools.csp_reports.policies.inline}"
           <Directory "/var/lib/ftp/devtools.immae.eu">
             DirectoryIndex index.php index.htm index.html
             AllowOverride all
             Require all granted
             <FilesMatch "\.php$">
-              SetHandler "proxy:unix:/var/run/phpfpm/devtools.sock|fcgi://localhost"
+              SetHandler "proxy:unix:${pcfg.devtools.socket}|fcgi://localhost"
             </FilesMatch>
           </Directory>
           ''
@@ -103,33 +146,65 @@ in {
       certName    = "eldiron";
       addToCerts  = true;
       hosts       = ["tools.immae.eu" ];
-      root        = "/var/lib/ftp/tools.immae.eu";
+      root        = landing;
       extraConfig = [
         ''
           RedirectMatch 301 ^/vpn(.*)$         https://vpn.immae.eu$1
           RedirectMatch 301 ^/roundcube(.*)$   https://mail.immae.eu/roundcube$1
           RedirectMatch 301 ^/jappix(.*)$      https://im.immae.fr/converse
 
-          <Directory "/var/lib/ftp/tools.immae.eu">
-            DirectoryIndex index.php index.htm index.html
-            AllowOverride all
+          <Directory "${landing}">
+            DirectoryIndex index.html
+            AllowOverride None
             Require all granted
+
             <FilesMatch "\.php$">
-              SetHandler "proxy:unix:/var/run/phpfpm/tools.sock|fcgi://localhost"
+              SetHandler "proxy:unix:${pcfg.tools.socket}|fcgi://localhost"
             </FilesMatch>
           </Directory>
           ''
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf pcfg.adminer.socket)
         ympd.apache.vhostConf
-        ttrss.apache.vhostConf
-        wallabag.apache.vhostConf
-        yourls.apache.vhostConf
-        rompr.apache.vhostConf
-        shaarli.apache.vhostConf
-        dokuwiki.apache.vhostConf
-        ldap.apache.vhostConf
-        kanboard.apache.vhostConf
-        grocy.apache.vhostConf
+        (ttrss.apache.vhostConf pcfg.ttrss.socket)
+        (wallabag.apache.vhostConf pcfg.wallabag.socket)
+        (yourls.apache.vhostConf pcfg.yourls.socket)
+        (rompr.apache.vhostConf pcfg.rompr.socket)
+        (shaarli.apache.vhostConf pcfg.shaarli.socket)
+        (dokuwiki.apache.vhostConf pcfg.dokuwiki.socket)
+        (ldap.apache.vhostConf pcfg.ldap.socket)
+        (kanboard.apache.vhostConf pcfg.kanboard.socket)
+        (grocy.apache.vhostConf pcfg.grocy.socket)
+        (phpbb.apache.vhostConf pcfg.phpbb.socket)
+        (dmarc-reports.apache.vhostConf pcfg.dmarc-reports.socket)
+        ''
+          <Location "/paste/">
+            ProxyPass unix://${config.services.paste.sockets.gunicorn}|http://tools.immae.eu/paste/
+            ProxyPassReverse unix://${config.services.paste.sockets.gunicorn}|http://tools.immae.eu/paste/
+            ProxyPreserveHost on
+          </Location>
+          <Location "/paste">
+            ProxyPass unix://${config.services.paste.sockets.gunicorn}|http://tools.immae.eu/paste/
+            ProxyPassReverse unix://${config.services.paste.sockets.gunicorn}|http://tools.immae.eu/paste/
+            ProxyPreserveHost on
+          </Location>
+
+          Alias /BIP39 /var/lib/buildbot/outputs/immae/bip39
+          <Directory "/var/lib/buildbot/outputs/immae/bip39">
+            DirectoryIndex index.html
+            AllowOverride None
+            Require all granted
+          </Directory>
+
+          Alias /webhooks ${config.secrets.fullPaths."webapps/webhooks"}
+          <Directory "${config.secrets.fullPaths."webapps/webhooks"}">
+            Options -Indexes
+            Require all granted
+            AllowOverride None
+            <FilesMatch "\.php$">
+              SetHandler "proxy:unix:${pcfg.tools.socket}|fcgi://localhost"
+            </FilesMatch>
+          </Directory>
+        ''
       ];
     };
 
@@ -170,6 +245,10 @@ in {
         after = lib.mkAfter dokuwiki.phpFpm.serviceDeps;
         wants = dokuwiki.phpFpm.serviceDeps;
       };
+      phpfpm-phpbb = {
+        after = lib.mkAfter phpbb.phpFpm.serviceDeps;
+        wants = phpbb.phpFpm.serviceDeps;
+      };
       phpfpm-kanboard = {
         after = lib.mkAfter kanboard.phpFpm.serviceDeps;
         wants = kanboard.phpFpm.serviceDeps;
@@ -199,7 +278,7 @@ in {
         description = "Standalone MPD Web GUI written in C";
         wantedBy = [ "multi-user.target" ];
         script = ''
-          export MPD_PASSWORD=$(cat /var/secrets/mpd)
+          export MPD_PASSWORD=$(cat ${config.secrets.fullPaths."mpd"})
           ${pkgs.ympd}/bin/ympd --host ${ympd.config.host} --port ${toString ympd.config.port} --webport ${ympd.config.webPort} --user nobody
           '';
       };
@@ -207,7 +286,7 @@ in {
         description = "Tiny Tiny RSS feeds update daemon";
         serviceConfig = {
           User = "wwwrun";
-          ExecStart = "${pkgs.php}/bin/php ${ttrss.webRoot}/update.php --daemon";
+          ExecStart = "${pkgs.php72}/bin/php ${ttrss.webRoot}/update.php --daemon";
           StandardOutput = "syslog";
           StandardError = "syslog";
           PermissionsStartOnly = true;
@@ -221,59 +300,119 @@ in {
 
     services.filesWatcher.ympd = {
       restart = true;
-      paths = [ "/var/secrets/mpd" ];
+      paths = [ config.secrets.fullPaths."mpd" ];
     };
 
-    services.phpfpm.pools.devtools = {
-      listen = "/var/run/phpfpm/devtools.sock";
-      extraConfig = ''
-        user = wwwrun
-        group = wwwrun
-        listen.owner = wwwrun
-        listen.group = wwwrun
-        pm = dynamic
-        pm.max_children = 60
-        pm.start_servers = 2
-        pm.min_spare_servers = 1
-        pm.max_spare_servers = 10
-
-        php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp"
-        '';
-      phpOptions = config.services.phpfpm.phpOptions + ''
-        extension=${pkgs.php}/lib/php/extensions/mysqli.so
-        extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
-        extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
-        zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
-        '';
-    };
+    services.phpfpm.pools = {
+      tools = {
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = {
+          "listen.owner" = "wwwrun";
+          "listen.group" = "wwwrun";
+          "pm" = "dynamic";
+          "pm.max_children" = "60";
+          "pm.start_servers" = "2";
+          "pm.min_spare_servers" = "1";
+          "pm.max_spare_servers" = "10";
 
-    services.phpfpm.poolConfigs = {
-      adminer = adminer.phpFpm.pool;
-      ttrss = ttrss.phpFpm.pool;
-      wallabag = wallabag.phpFpm.pool;
-      yourls = yourls.phpFpm.pool;
-      rompr = rompr.phpFpm.pool;
-      shaarli = shaarli.phpFpm.pool;
-      dokuwiki = dokuwiki.phpFpm.pool;
-      ldap = ldap.phpFpm.pool;
-      kanboard = kanboard.phpFpm.pool;
-      grocy = grocy.phpFpm.pool;
-      tools = ''
-        listen = /var/run/phpfpm/tools.sock
-        user = wwwrun
-        group = wwwrun
-        listen.owner = wwwrun
-        listen.group = wwwrun
-        pm = dynamic
-        pm.max_children = 60
-        pm.start_servers = 2
-        pm.min_spare_servers = 1
-        pm.max_spare_servers = 10
-
-        ; Needed to avoid clashes in browser cookies (same domain)
-        php_value[session.name] = ToolsPHPSESSID
-        php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/tools.immae.eu:/tmp"
-        '';
+          # Needed to avoid clashes in browser cookies (same domain)
+          "php_value[session.name]" = "ToolsPHPSESSID";
+          "php_admin_value[open_basedir]" = builtins.concatStringsSep ":" [
+            "/run/wrappers/bin/sendmail" landing "/tmp"
+            config.secrets.fullPaths."webapps/webhooks"
+          ];
+          "include" = config.secrets.fullPaths."webapps/tools-csp-reports.conf";
+        };
+        phpEnv = {
+          CONTACT_EMAIL = config.myEnv.tools.contact;
+        };
+        phpPackage = pkgs.php72;
+      };
+      devtools = {
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = {
+          "listen.owner" = "wwwrun";
+          "listen.group" = "wwwrun";
+          "pm" = "dynamic";
+          "pm.max_children" = "60";
+          "pm.start_servers" = "2";
+          "pm.min_spare_servers" = "1";
+          "pm.max_spare_servers" = "10";
+
+          "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp";
+        };
+        phpPackage = pkgs.php72.withExtensions({ enabled, all }: enabled ++ [all.mysqli all.redis all.apcu all.opcache ]);
+      };
+      adminer = adminer.phpFpm;
+      ttrss = {
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = ttrss.phpFpm.pool;
+        phpPackage = pkgs.php72;
+      };
+      wallabag = {
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = wallabag.phpFpm.pool;
+        phpPackage = pkgs.php73.withExtensions({ enabled, all }: enabled ++ [all.tidy]);
+      };
+      yourls = {
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = yourls.phpFpm.pool;
+        phpPackage = pkgs.php72;
+      };
+      rompr = {
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = rompr.phpFpm.pool;
+        phpPackage = pkgs.php72;
+      };
+      shaarli = {
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = shaarli.phpFpm.pool;
+        phpPackage = pkgs.php72;
+      };
+      dmarc-reports = {
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = dmarc-reports.phpFpm.pool;
+        phpEnv = dmarc-reports.phpFpm.phpEnv;
+        phpPackage = pkgs.php72;
+      };
+      dokuwiki = {
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = dokuwiki.phpFpm.pool;
+        phpPackage = pkgs.php72;
+      };
+      phpbb = {
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = phpbb.phpFpm.pool;
+        phpPackage = pkgs.php72;
+      };
+      ldap = {
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = ldap.phpFpm.pool;
+        phpPackage = pkgs.php72;
+      };
+      kanboard = {
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = kanboard.phpFpm.pool;
+        phpPackage = pkgs.php72;
+      };
+      grocy = {
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = grocy.phpFpm.pool;
+        phpPackage = pkgs.php72;
+      };
     };
 
     system.activationScripts = {
@@ -285,13 +424,16 @@ in {
       rompr = rompr.activationScript;
       shaarli = shaarli.activationScript;
       dokuwiki = dokuwiki.activationScript;
+      phpbb = phpbb.activationScript;
       kanboard = kanboard.activationScript;
       ldap = ldap.activationScript;
     };
 
-    myServices.websites.webappDirs = {
+    services.websites.webappDirs = {
       _adminer = adminer.webRoot;
+      "${dmarc-reports.apache.webappName}" = dmarc-reports.webRoot;
       "${dokuwiki.apache.webappName}" = dokuwiki.webRoot;
+      "${phpbb.apache.webappName}" = phpbb.webRoot;
       "${ldap.apache.webappName}" = "${ldap.webRoot}/htdocs";
       "${rompr.apache.webappName}" = rompr.webRoot;
       "${shaarli.apache.webappName}" = shaarli.webRoot;
@@ -303,12 +445,13 @@ in {
     };
 
     services.websites.env.tools.watchPaths = [
-      "/var/secrets/webapps/tools-shaarli"
+      config.secrets.fullPaths."webapps/tools-shaarli"
     ];
     services.filesWatcher.phpfpm-wallabag = {
       restart = true;
-      paths = [ "/var/secrets/webapps/tools-wallabag" ];
+      paths = [ config.secrets.fullPaths."webapps/tools-wallabag" ];
     };
+
   };
 }