X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=nixops%2Fmodules%2Fwebsites%2Fdefault.nix;h=891d917467a1672805b3d4e395fe5e54ad4ed245;hb=d7d031b69f7dfa958d38e96e5ace4b2db023dade;hp=1d0c1d73cdd516b69efba74223d5687b5ec27f2c;hpb=d06ed384dd59432aec0cf91b92442382c63421d3;p=perso%2FImmae%2FConfig%2FNix.git diff --git a/nixops/modules/websites/default.nix b/nixops/modules/websites/default.nix index 1d0c1d7..891d917 100644 --- a/nixops/modules/websites/default.nix +++ b/nixops/modules/websites/default.nix @@ -1,29 +1,29 @@ -{ lib, pkgs, config, mylibs, myconfig, ... }: +{ lib, pkgs, config, myconfig, ... }: let cfg = config.services.myWebsites; + www_root = "/run/current-system/webapps/_www"; + theme_root = "/run/current-system/webapps/_theme"; makeService = name: cfg: let toVhost = vhostConf: { enableSSL = true; sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem"; sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem"; - sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem"; + sslServerChain = "/var/lib/acme/${vhostConf.certName}/chain.pem"; logFormat = "combinedVhost"; - listen = [ - { ip = cfg.ip; port = 443; } - ]; + listen = map (ip: { inherit ip; port = 443; }) cfg.ips; hostName = builtins.head vhostConf.hosts; serverAliases = builtins.tail vhostConf.hosts or []; documentRoot = vhostConf.root; extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig; }; nosslVhost = { - listen = [ { ip = cfg.ip; port = 80; } ]; + listen = map (ip: { inherit ip; port = 80; }) cfg.ips; hostName = "nossl.immae.eu"; enableSSL = false; logFormat = "combinedVhost"; - documentRoot = ../../www; + documentRoot = www_root; extraConfig = '' - + DirectoryIndex nossl.html AllowOverride None Require all granted @@ -34,7 +34,7 @@ let ''; }; redirectVhost = { # Should go last, catchall http -> https redirect - listen = [ { ip = cfg.ip; port = 80; } ]; + listen = map (ip: { inherit ip; port = 80; }) cfg.ips; hostName = "redirectSSL"; serverAliases = [ "*" ]; enableSSL = false; @@ -52,14 +52,12 @@ let fallbackVhost = toVhost { # Should go first, default choice certName = "eldiron"; hosts = ["eldiron.immae.eu" ]; - root = ../../www; + root = www_root; extraConfig = [ "DirectoryIndex index.htm" ]; }; in rec { enable = true; - listen = [ - { ip = cfg.ip; port = 443; } - ]; + listen = map (ip: { inherit ip; port = 443; }) cfg.ips; stateDir = "/run/httpd_${name}"; logPerVirtualHost = true; multiProcessingModule = "worker"; @@ -72,12 +70,15 @@ let ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs) ++ [ redirectVhost ]; }; - makeServiceOptions = name: ip: { + makeServiceOptions = name: { enable = lib.mkEnableOption "enable websites in ${name}"; - ip = lib.mkOption { - type = lib.types.string; - default = ip; - description = "${name} ip to listen to"; + ips = lib.mkOption { + type = lib.types.listOf lib.types.string; + default = let + ips = myconfig.env.servers.eldiron.ips.${name}; + in + [ips.ip4] ++ (ips.ip6 or []); + description = "${name} ips to listen to"; }; modules = lib.mkOption { type = lib.types.listOf (lib.types.str); @@ -115,18 +116,21 @@ in ./ftp/nassime.nix ./ftp/florian.nix ./ftp/denisejerome.nix + ./ftp/leila.nix + ./ftp/papa.nix ./ftp/immae.nix ./ftp/release.nix ./ftp/temp.nix - ./tools/db + ./tools/db.nix ./tools/tools ./tools/dav - ./tools/cloud + ./tools/cloud.nix ./tools/git - ./tools/mastodon - ./tools/mediagoblin - ./tools/diaspora - ./tools/ether + ./tools/mastodon.nix + ./tools/mediagoblin.nix + ./tools/diaspora.nix + ./tools/ether.nix + ./tools/peertube.nix # built using: # sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix # Removed allGranted @@ -140,9 +144,9 @@ in ]; options.services.myWebsites = { - production = makeServiceOptions "production" myconfig.ips.production; - integration = makeServiceOptions "integration" myconfig.ips.integration; - tools = makeServiceOptions "tools" myconfig.ips.main; + production = makeServiceOptions "production"; + integration = makeServiceOptions "integration"; + tools = makeServiceOptions "main"; apacheConfig = lib.mkOption { type = lib.types.attrsOf (lib.types.submodule { @@ -164,22 +168,14 @@ in }; config = { - networking = { - firewall = { - enable = true; - allowedTCPPorts = [ 80 443 ]; - }; - interfaces."eth0".ipv4.addresses = [ - # 176.9.151.89 declared in nixops -> infra / tools - { address = myconfig.ips.production; prefixLength = 32; } - { address = myconfig.ips.integration; prefixLength = 32; } - ]; - }; + users.users.wwwrun.extraGroups = [ "keys" ]; + networking.firewall.allowedTCPPorts = [ 80 443 ]; - nixpkgs.config.packageOverrides = oldpkgs: rec { + nixpkgs.overlays = [ (self: super: rec { + #openssl = self.openssl_1_1; php = php72; - php72 = (oldpkgs.php72.override { - mysql.connector-c = pkgs.mariadb; + php72 = (super.php72.override { + mysql.connector-c = self.mariadb; config.php.mysqlnd = false; config.php.mysqli = false; }).overrideAttrs(old: rec { @@ -193,11 +189,8 @@ in # ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c # ''; }); - phpPackages = oldpkgs.php72Packages.override { inherit php; }; - composerEnv = import ./commons/composer-env.nix { - inherit (pkgs) stdenv writeTextFile fetchurl php unzip; - }; - }; + phpPackages = super.php72Packages.override { inherit php; }; + }) ]; services.myWebsites.tools.databases.enable = true; services.myWebsites.tools.tools.enable = true; @@ -208,6 +201,7 @@ in services.myWebsites.tools.mediagoblin.enable = true; services.myWebsites.tools.diaspora.enable = true; services.myWebsites.tools.etherpad-lite.enable = true; + services.myWebsites.tools.peertube.enable = true; services.myWebsites.Chloe.production.enable = cfg.production.enable; services.myWebsites.Ludivine.production.enable = cfg.production.enable; @@ -217,6 +211,8 @@ in services.myWebsites.Jerome.production.enable = cfg.production.enable; services.myWebsites.Nassime.production.enable = cfg.production.enable; services.myWebsites.Florian.production.enable = cfg.production.enable; + services.myWebsites.Leila.production.enable = cfg.production.enable; + services.myWebsites.Papa.production.enable = cfg.production.enable; services.myWebsites.DeniseJerome.production.enable = cfg.production.enable; services.myWebsites.Emilia.production.enable = cfg.production.enable; services.myWebsites.Capitaines.production.enable = cfg.production.enable; @@ -232,6 +228,25 @@ in services.myWebsites.TellesFlorian.integration.enable = true; services.myWebsites.Florian.integration.enable = true; + secrets.keys = [{ + dest = "apache-ldap"; + user = "wwwrun"; + group = "wwwrun"; + permissions = "0400"; + text = '' + + + AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS + AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu + AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}" + AuthType Basic + AuthName "Authentification requise (Acces LDAP)" + AuthBasicProvider ldap + + + ''; + }]; + services.myWebsites.apacheConfig = { gzip = { modules = [ "deflate" "filter" ]; @@ -245,13 +260,13 @@ in stats = { extraConfig = '' - Alias /awstats /var/lib/goaccess/%{domain} - + Alias /webstats ${config.services.webstats.dataDir}/%{domain} + DirectoryIndex index.html AllowOverride None Require all granted - + Use LDAPConnect Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu @@ -269,16 +284,7 @@ in LDAPOpCacheTTL 600 - - - AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS - AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu - AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}" - AuthType Basic - AuthName "Authentification requise (Acces LDAP)" - AuthBasicProvider ldap - - + Include /var/secrets/apache-ldap ''; }; global = { @@ -288,99 +294,18 @@ in ErrorDocument 502 /maintenance_immae.html ErrorDocument 503 /maintenance_immae.html ErrorDocument 504 /maintenance_immae.html - Alias /maintenance_immae.html ${../../www}/maintenance_immae.html + Alias /maintenance_immae.html ${www_root}/maintenance_immae.html ProxyPass /maintenance_immae.html ! - AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${../../www}/googleb6d69446ff4ca3e5.html - + AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html + AllowOverride None Require all granted ''; }; apaxy = { - extraConfig = '' - - Alias /theme ${./apache/theme} - - Options -Indexes - AllowOverride None - Require all granted - - - # mod_autoindex - - Options Indexes - AllowOverride None - Require all granted - - # Inspired from Apaxy by @adamwhitcroft - - IndexOptions +Charset=UTF-8 +FancyIndexing +IgnoreCase +FoldersFirst +XHTML +HTMLTable +SuppressRules +SuppressDescription +NameWidth=* +IconsAreLinks +ShowForbidden - - IndexHeadInsert "" - - IndexIgnoreReset ON - IndexIgnore /theme .htaccess %{ignored} - - AddIcon /theme/icons/blank.png ^^BLANKICON^^ - AddIcon /theme/icons/folder.png ^^DIRECTORY^^ - AddIcon /theme/icons/folder-home.png .. - - AddIconByType (TXT,/theme/icons/text.png) text/* - AddIconByType (IMG,/theme/icons/image.png) image/* - AddIconByType (SND,/theme/icons/audio.png) audio/* - AddIconByType (VID,/theme/icons/video.png) video/* - - AddIcon /theme/icons/archive.png .7z .bz2 .cab .gz .tar - AddIcon /theme/icons/audio.png .aac .aif .aifc .aiff .ape .au .flac .iff .m4a .mid .mp3 .mpa .ra .wav .wma .f4a .f4b .oga .ogg .xm .it .s3m .mod - AddIcon /theme/icons/bin.png .bin .hex - AddIcon /theme/icons/bmp.png .bmp - AddIcon /theme/icons/c.png .c - AddIcon /theme/icons/calc.png .xlsx .xlsm .xltx .xltm .xlam .xlr .xls .csv - AddIcon /theme/icons/cd.png .iso - AddIcon /theme/icons/cpp.png .cpp - AddIcon /theme/icons/css.png .css .sass .scss - AddIcon /theme/icons/deb.png .deb - AddIcon /theme/icons/doc.png .doc .docx .docm .dot .dotx .dotm .log .msg .odt .pages .rtf .tex .wpd .wps - AddIcon /theme/icons/draw.png .svg .svgz - AddIcon /theme/icons/eps.png .ai .eps - AddIcon /theme/icons/exe.png .exe - AddIcon /theme/icons/gif.png .gif - AddIcon /theme/icons/h.png .h - AddIcon /theme/icons/html.png .html .xhtml .shtml .htm .URL .url - AddIcon /theme/icons/ico.png .ico - AddIcon /theme/icons/java.png .jar - AddIcon /theme/icons/jpg.png .jpg .jpeg .jpe - AddIcon /theme/icons/js.png .js .json - AddIcon /theme/icons/markdown.png .md - AddIcon /theme/icons/package.png .pkg .dmg - AddIcon /theme/icons/pdf.png .pdf - AddIcon /theme/icons/php.png .php .phtml - AddIcon /theme/icons/playlist.png .m3u .m3u8 .pls .pls8 - AddIcon /theme/icons/png.png .png - AddIcon /theme/icons/ps.png .ps - AddIcon /theme/icons/psd.png .psd - AddIcon /theme/icons/py.png .py - AddIcon /theme/icons/rar.png .rar - AddIcon /theme/icons/rb.png .rb - AddIcon /theme/icons/rpm.png .rpm - AddIcon /theme/icons/rss.png .rss - AddIcon /theme/icons/script.png .bat .cmd .sh - AddIcon /theme/icons/sql.png .sql - AddIcon /theme/icons/tiff.png .tiff .tif - AddIcon /theme/icons/text.png .txt .nfo - AddIcon /theme/icons/video.png .asf .asx .avi .flv .mkv .mov .mp4 .mpg .rm .srt .swf .vob .wmv .m4v .f4v .f4p .ogv - AddIcon /theme/icons/xml.png .xml - AddIcon /theme/icons/zip.png .zip - DefaultIcon /theme/icons/default.png - - HeaderName /theme/header.html - ReadmeName /theme/footer.html - IndexStyleSheet /theme/style.css - - - ''; + extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig; }; http2 = { modules = [ "http2" ]; @@ -400,18 +325,31 @@ in install -d -m 0755 /var/lib/acme/acme-challenge install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer + install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/tmp/adminer install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical + install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/phpldapadmin ''; }; + system.extraSystemBuilderCmds = let + adminer = pkgs.callPackage ./commons/adminer.nix {}; + in '' + mkdir -p $out/webapps + ln -s ${../../www} $out/webapps/_www + ln -s ${pkgs.webapps.apache-theme.theme} $out/webapps/_theme + ln -s ${adminer.webRoot} $out/webapps/${adminer.apache.webappName} + ''; + services.myPhpfpm = { phpPackage = pkgs.php; phpOptions = '' session.save_path = "/var/lib/php/sessions" post_max_size = 20M - session.gc_maxlifetime = 60*60*24*15 - session.cache_expire = 60*24*30 + ; 15 days (seconds) + session.gc_maxlifetime = 1296000 + ; 30 days (minutes) + session.cache_expire = 43200 ''; extraConfig = '' log_level = notice