X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=virtual%2Feldiron.nix;h=292b31aa55d521d2c4f39b786ad04dc7f2f90d95;hb=5566d26d9cb4f992e974ad8a8720c5970d566105;hp=0c71f87b78c2f1fdd45dd5f8e15e1c7ce89254f7;hpb=5f3e023d3b5dd48b6024c7cea8a61cfdb1019b38;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/virtual/eldiron.nix b/virtual/eldiron.nix
index 0c71f87..292b31a 100644
--- a/virtual/eldiron.nix
+++ b/virtual/eldiron.nix
@@ -36,9 +36,21 @@
       };
     };
 
-    environment.systemPackages = [
+    environment.systemPackages = let
+      # FIXME: move it to nextcloud
+      occ = pkgs.writeScriptBin "nextcloud-occ" ''
+        #! ${pkgs.stdenv.shell}
+        cd ${mypkgs.nextcloud.webRoot}
+        NEXTCLOUD_CONFIG_DIR="${mypkgs.nextcloud.webRoot}/config" \
+          exec \
+          ${config.services.phpfpm.phpPackage}/bin/php \
+          -c ${config.services.phpfpm.phpPackage}/etc/php.ini \
+          occ $*
+        '';
+    in [
       pkgs.telnet
       pkgs.vim
+      occ
     ];
 
     security.acme.certs = {
@@ -55,6 +67,7 @@
           "tools.immae.eu" = null;
           "connexionswing.immae.eu" = null;
           "sandetludo.immae.eu" = null;
+          "cloud.immae.eu" = null;
         };
       };
       # "connexionswing" = {
@@ -73,9 +86,36 @@
       # };
     };
 
+    services.openssh.extraConfig = ''
+      AuthorizedKeysCommand     /etc/ssh/ldap_authorized_keys
+      AuthorizedKeysCommandUser nobody
+      '';
+
+    # FIXME: after initial install, need to
+    # (1) copy rc file (adjust gitolite_ldap_groups.sh)
+    # (2) (mark old readonly and) sync repos except gitolite-admin
+    #     rsync -av --exclude=gitolite-admin.git old:/var/lib/gitolite/repositories /var/lib/gitolite/
+    #     chown -R gitolite:gitolite /var/lib/gitolite
+    # (3) push force the gitolite-admin to new location (from external point)
+    #     Don't use an existing key, it will take precedence over
+    #     gitolite-admin
+    # (4) su -u gitolite gitolite setup
+    services.gitolite = {
+      enable = true;
+      # FIXME: key from ./ssh
+      adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXqRbiHw7QoHADNIEuo4nUT9fSOIEBMdJZH0bkQAxXyJFyCM1IMz0pxsHV0wu9tdkkr36bPEUj2aV5bkYLBN6nxcV2Y49X8bjOSCPfx3n6Own1h+NeZVBj4ZByrFmqCbTxUJIZ2bZKcWOFncML39VmWdsVhNjg0X4NBBehqXRIKr2gt3E/ESAxTYJFm0BnU0baciw9cN0bsRGqvFgf5h2P48CIAfwhVcGmPQnnAwabnosYQzRWxR0OygH5Kd8mePh6FheIRIigfXsDO8f/jdxwut8buvNIf3m5EBr3tUbTsvM+eV3M5vKGt7sk8T64DVtepTSdOOWtp+47ktsnHOMh immae@immae.eu";
+    };
+
     services.ympd = mypkgs.ympd.config // { enable = true; };
 
     services.phpfpm = {
+      # /!\ phppackage is used in nextcloud configuation
+      phpOptions = ''
+        ; For nextcloud
+        extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
+        ; For nextcloud
+        extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
+        '';
       extraConfig = ''
         log_level = notice
         '';
@@ -83,32 +123,60 @@
         adminer = mypkgs.adminer.phpFpm.pool;
         connexionswing_dev = mypkgs.connexionswing_dev.phpFpm.pool;
         connexionswing_prod = mypkgs.connexionswing_prod.phpFpm.pool;
-        www = ''
-          listen = /var/run/phpfpm/www.sock
-          user = wwwrun
-          group = wwwrun
-          listen.owner = wwwrun
-          listen.group = wwwrun
-          pm = ondemand
-          pm.max_children = 5
-          pm.process_idle_timeout = 60
-          ;php_admin_flag[log_errors] = on
-          php_admin_value[open_basedir] = "/var/www"
-          '';
+        nextcloud = mypkgs.nextcloud.phpFpm.pool;
       };
     };
 
     system.activationScripts = {
       connexionswing_dev  = mypkgs.connexionswing_dev.activationScript;
       connexionswing_prod = mypkgs.connexionswing_prod.activationScript;
+      nextcloud = mypkgs.nextcloud.activationScript;
       httpd = ''
         install -d -m 0755 /var/lib/acme/acme-challenge
-        install -d -m 0755 /var/www
         '';
       redis = ''
         mkdir -p /run/redis
         chown redis /run/redis
         '';
+      gitolite =
+        assert mylibs.checkEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
+        let
+        gitolite_ldap_groups = mylibs.wrap {
+          name = "gitolite_ldap_groups.sh";
+          file = ./packages/gitolite_ldap_groups.sh;
+          vars = {
+            LDAP_PASS = builtins.getEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
+          };
+          paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ];
+        };
+      in {
+        deps = [ "users" ];
+        text = ''
+          if [ -d /var/lib/gitolite ]; then
+            ln -sf ${gitolite_ldap_groups} /var/lib/gitolite/gitolite_ldap_groups.sh
+          fi
+        '';
+      };
+    };
+
+    environment.etc."ssh/ldap_authorized_keys" = let
+      ldap_authorized_keys =
+        assert mylibs.checkEnv "NIXOPS_SSHD_LDAP_PASSWORD";
+        mylibs.wrap {
+          name = "ldap_authorized_keys";
+          file = ./ldap_authorized_keys.sh;
+          vars = {
+            LDAP_PASS = builtins.getEnv "NIXOPS_SSHD_LDAP_PASSWORD";
+            GITOLITE_SHELL = "${pkgs.gitolite}/bin/gitolite-shell";
+            ECHO = "${pkgs.coreutils}/bin/echo";
+          };
+          paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ];
+        };
+    in {
+      enable = true;
+      mode = "0755";
+      user = "root";
+      source = ldap_authorized_keys;
     };
 
     services.httpd = let
@@ -173,6 +241,7 @@
 
       extraModules = pkgs.lib.lists.unique (
         mypkgs.adminer.apache.modules ++
+        mypkgs.nextcloud.apache.modules ++
         mypkgs.connexionswing_dev.apache.modules ++
         mypkgs.connexionswing_prod.apache.modules ++
         mypkgs.ympd.apache.modules ++
@@ -184,8 +253,10 @@
         (withSSL "eldiron" // {
           listen = [ { ip = "*"; port = 443; } ];
           hostName = "eldiron.immae.eu";
-          # FIXME: directory needs to exist
-          documentRoot = "/var/www";
+          documentRoot = ./www;
+          extraConfig = ''
+            DirectoryIndex index.htm
+            '';
         })
         (withSSL "eldiron" // {
           listen = [ { ip = "*"; port = 443; } ];
@@ -213,6 +284,14 @@
             mypkgs.connexionswing_dev.apache.vhostConf
           ];
         })
+        (withSSL "eldiron" // {
+          listen = [ { ip = "*"; port = 443; } ];
+          hostName = "cloud.immae.eu";
+          documentRoot = mypkgs.nextcloud.webRoot;
+          extraConfig = builtins.concatStringsSep "\n" [
+            mypkgs.nextcloud.apache.vhostConf
+          ];
+        })
         { # Should go last, default fallback
           listen = [ { ip = "*"; port = 80; } ];
           hostName = "redirectSSL";