X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=virtual%2Feldiron.nix;h=2e1e68db35d885703236326d88cdb9a450c55da4;hb=6bd6d033ec152e0e0aa60ff48771f46d723c2d7e;hp=51e2bb953e913ab47c7b46bc2b5272e6a9c9fe0b;hpb=ec9ff2b8fdd8c4d21c904f86f14bfbe88a13a6ce;p=perso%2FImmae%2FConfig%2FNix.git diff --git a/virtual/eldiron.nix b/virtual/eldiron.nix index 51e2bb9..2e1e68d 100644 --- a/virtual/eldiron.nix +++ b/virtual/eldiron.nix @@ -12,10 +12,17 @@ }; in { - # FIXME: they are not overriden in packages.nix - # (see nix-store -q --tree /nix/var/nix/profiles/system) nixpkgs.config.packageOverrides = oldpkgs: rec { - gitolite = nixpkgs_unstable.gitolite; + gitolite = oldpkgs.gitolite.overrideAttrs(old: rec { + name = "gitolite-${version}"; + version = "3.6.10"; + src = pkgs.fetchFromGitHub { + owner = "sitaramc"; + repo = "gitolite"; + rev = "v${version}"; + sha256 = "0p2697mn6rwm03ndlv7q137zczai82n41aplq1g006ii7f12xy8h"; + }; + }); gitweb = oldpkgs.gitweb.overrideAttrs(old: { installPhase = old.installPhase + '' cp -r ${./packages/gitweb} $out/gitweb-theme; @@ -35,6 +42,16 @@ cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ]; buildInputs = old.buildInputs ++ [ pkgs.pam ]; }); + goaccess = oldpkgs.goaccess.overrideAttrs(old: rec { + name = "goaccess-${version}"; + version = "1.3"; + src = pkgs.fetchurl { + url = "https://tar.goaccess.io/${name}.tar.gz"; + sha256 = "16vv3pj7pbraq173wlxa89jjsd279004j4kgzlrsk1dz4if5qxwc"; + }; + configureFlags = old.configureFlags ++ [ "--enable-tcb=btree" ]; + buildInputs = old.buildInputs ++ [ pkgs.tokyocabinet pkgs.bzip2 ]; + }); }; networking = { @@ -78,10 +95,15 @@ in [ pkgs.telnet pkgs.vim + pkgs.goaccess occ ]; + # FIXME: doesn't work with httpd? + security.acme.preliminarySelfsigned = true; security.acme.certs = { + # FIXME: /!\ To create a new certificate, create it before using + # it in httpd "eldiron" = { webroot = "/var/lib/acme/acme-challenge"; email = "ismael@bouya.org"; @@ -97,6 +119,58 @@ "connexionswing.immae.eu" = null; "sandetludo.immae.eu" = null; "cloud.immae.eu" = null; + "ludivine.immae.eu" = null; + "dev.aten.pro" = null; + "piedsjaloux.immae.eu" = null; + "chloe.immae.eu" = null; + }; + }; + "ludivinecassal" = { + webroot = "/var/lib/acme/acme-challenge"; + email = "ismael@bouya.org"; + domain = "ludivinecassal.com"; + plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ]; + postRun = '' + systemctl reload httpd.service + ''; + extraDomains = { + "www.ludivinecassal.com" = null; + }; + }; + "aten" = { + webroot = "/var/lib/acme/acme-challenge"; + email = "ismael@bouya.org"; + domain = "aten.pro"; + plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ]; + postRun = '' + systemctl reload httpd.service + ''; + extraDomains = { + "www.aten.pro" = null; + }; + }; + "piedsjaloux" = { + webroot = "/var/lib/acme/acme-challenge"; + email = "ismael@bouya.org"; + domain = "piedsjaloux.fr"; + plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ]; + postRun = '' + systemctl reload httpd.service + ''; + extraDomains = { + "www.piedsjaloux.fr" = null; + }; + }; + "chloe" = { + webroot = "/var/lib/acme/acme-challenge"; + email = "ismael@bouya.org"; + domain = "osteopathe-cc.fr"; + plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ]; + postRun = '' + systemctl reload httpd.service + ''; + extraDomains = { + "www.osteopathe-cc.fr" = null; }; }; # "connexionswing" = { @@ -165,6 +239,14 @@ adminer = mypkgs.adminer.phpFpm.pool; connexionswing_dev = mypkgs.connexionswing_dev.phpFpm.pool; connexionswing_prod = mypkgs.connexionswing_prod.phpFpm.pool; + ludivinecassal_dev = mypkgs.ludivinecassal_dev.phpFpm.pool; + ludivinecassal_prod = mypkgs.ludivinecassal_prod.phpFpm.pool; + piedsjaloux_dev = mypkgs.piedsjaloux_dev.phpFpm.pool; + piedsjaloux_prod = mypkgs.piedsjaloux_prod.phpFpm.pool; + chloe_dev = mypkgs.chloe_dev.phpFpm.pool; + chloe_prod = mypkgs.chloe_prod.phpFpm.pool; + aten_dev = mypkgs.aten_dev.phpFpm.pool; + aten_prod = mypkgs.aten_prod.phpFpm.pool; nextcloud = mypkgs.nextcloud.phpFpm.pool; mantisbt = mypkgs.mantisbt.phpFpm.pool; }; @@ -173,6 +255,14 @@ system.activationScripts = { connexionswing_dev = mypkgs.connexionswing_dev.activationScript; connexionswing_prod = mypkgs.connexionswing_prod.activationScript; + ludivinecassal_dev = mypkgs.ludivinecassal_dev.activationScript; + ludivinecassal_prod = mypkgs.ludivinecassal_prod.activationScript; + piedsjaloux_dev = mypkgs.piedsjaloux_dev.activationScript; + piedsjaloux_prod = mypkgs.piedsjaloux_prod.activationScript; + chloe_dev = mypkgs.chloe_dev.activationScript; + chloe_prod = mypkgs.chloe_prod.activationScript; + aten_dev = mypkgs.aten_dev.activationScript; + aten_prod = mypkgs.aten_prod.activationScript; nextcloud = mypkgs.nextcloud.activationScript; httpd = '' install -d -m 0755 /var/lib/acme/acme-challenge @@ -204,6 +294,14 @@ fi ''; }; + # FIXME: initial sync + goaccess = '' + mkdir -p /var/lib/goaccess + mkdir -p /var/lib/goaccess/aten.pro + mkdir -p /var/lib/goaccess/ludivinecassal.com + mkdir -p /var/lib/goaccess/piedsjaloux.fr + mkdir -p /var/lib/goaccess/osteopathe-cc.fr + ''; }; environment.etc."ssh/ldap_authorized_keys" = let @@ -234,11 +332,13 @@ }; services.httpd = let - withSSL = domain: { + withConf = domain: { enableSSL = true; sslServerCert = "/var/lib/acme/${domain}/cert.pem"; sslServerKey = "/var/lib/acme/${domain}/key.pem"; sslServerChain = "/var/lib/acme/${domain}/fullchain.pem"; + logFormat = "combinedVhost"; + listen = [ { ip = "*"; port = 443; } ]; }; apacheConfig = { gzip = { @@ -268,6 +368,31 @@ AuthBasicProvider ldap + + + Alias /awstats /var/lib/goaccess/%{domain} + + DirectoryIndex index.html + AllowOverride None + Require all granted + + + Use LDAPConnect + Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu + + + ''; + }; + http2 = { + modules = [ "http2" ]; + extraConfig = '' + Protocols h2 http/1.1 + ''; + }; + customLog = { + modules = []; + extraConfig = '' + LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost ''; }; }; @@ -276,28 +401,20 @@ logPerVirtualHost = true; multiProcessingModule = "worker"; adminAddr = "httpd@immae.eu"; - # FIXME: http2 - # FIXME: voir les autres modules: - # authz_core_module - # reqtimeout_module - # http2_module - # version_module - # proxy_connect_module - # proxy_ftp_module - # proxy_scgi_module - # proxy_ajp_module - # proxy_balancer_module - # proxy_express_module - # lbmethod_byrequests_module - # lbmethod_bytraffic_module - # lbmethod_bybusyness_module - # lbmethod_heartbeat_module - + logFormat = "combinedVhost"; extraModules = pkgs.lib.lists.unique ( mypkgs.adminer.apache.modules ++ mypkgs.nextcloud.apache.modules ++ mypkgs.connexionswing_dev.apache.modules ++ mypkgs.connexionswing_prod.apache.modules ++ + mypkgs.ludivinecassal_dev.apache.modules ++ + mypkgs.ludivinecassal_prod.apache.modules ++ + mypkgs.piedsjaloux_dev.apache.modules ++ + mypkgs.piedsjaloux_prod.apache.modules ++ + mypkgs.chloe_dev.apache.modules ++ + mypkgs.chloe_prod.apache.modules ++ + mypkgs.aten_dev.apache.modules ++ + mypkgs.aten_prod.apache.modules ++ mypkgs.ympd.apache.modules ++ mypkgs.git.web.apache.modules ++ mypkgs.mantisbt.apache.modules ++ @@ -306,24 +423,21 @@ extraConfig = builtins.concatStringsSep "\n" (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig) apacheConfig); virtualHosts = [ - (withSSL "eldiron" // { - listen = [ { ip = "*"; port = 443; } ]; + (withConf "eldiron" // { hostName = "eldiron.immae.eu"; documentRoot = ./www; extraConfig = '' DirectoryIndex index.htm ''; }) - (withSSL "eldiron" // { - listen = [ { ip = "*"; port = 443; } ]; + (withConf "eldiron" // { hostName = "db-1.immae.eu"; documentRoot = null; extraConfig = builtins.concatStringsSep "\n" [ mypkgs.adminer.apache.vhostConf ]; }) - (withSSL "eldiron" // { - listen = [ { ip = "*"; port = 443; } ]; + (withConf "eldiron" // { hostName = "tools.immae.eu"; documentRoot = null; extraConfig = builtins.concatStringsSep "\n" [ @@ -331,8 +445,7 @@ mypkgs.ympd.apache.vhostConf ]; }) - (withSSL "eldiron" // { - listen = [ { ip = "*"; port = 443; } ]; + (withConf "eldiron" // { hostName = "connexionswing.immae.eu"; serverAliases = [ "sandetludo.immae.eu" ]; documentRoot = mypkgs.connexionswing_dev.webRoot; @@ -340,16 +453,74 @@ mypkgs.connexionswing_dev.apache.vhostConf ]; }) - (withSSL "eldiron" // { - listen = [ { ip = "*"; port = 443; } ]; + (withConf "eldiron" // { + hostName = "ludivine.immae.eu"; + documentRoot = mypkgs.ludivinecassal_dev.webRoot; + extraConfig = builtins.concatStringsSep "\n" [ + mypkgs.ludivinecassal_dev.apache.vhostConf + ]; + }) + (withConf "ludivinecassal" // { + hostName = "ludivinecassal.com"; + serverAliases = [ "www.ludivinecassal.com" ]; + documentRoot = mypkgs.ludivinecassal_prod.webRoot; + extraConfig = builtins.concatStringsSep "\n" [ + mypkgs.ludivinecassal_prod.apache.vhostConf + ]; + }) + (withConf "eldiron" // { + hostName = "piedsjaloux.immae.eu"; + documentRoot = mypkgs.piedsjaloux_dev.webRoot; + extraConfig = builtins.concatStringsSep "\n" [ + mypkgs.piedsjaloux_dev.apache.vhostConf + ]; + }) + (withConf "piedsjaloux" // { + hostName = "piedsjaloux.fr"; + serverAliases = [ "www.piedsjaloux.fr" ]; + documentRoot = mypkgs.piedsjaloux_prod.webRoot; + extraConfig = builtins.concatStringsSep "\n" [ + mypkgs.piedsjaloux_prod.apache.vhostConf + ]; + }) + (withConf "eldiron" // { + hostName = "chloe.immae.eu"; + documentRoot = mypkgs.chloe_dev.webRoot; + extraConfig = builtins.concatStringsSep "\n" [ + mypkgs.chloe_dev.apache.vhostConf + ]; + }) + (withConf "chloe" // { + hostName = "osteopathe-cc.fr"; + serverAliases = [ "www.osteopathe-cc.fr" ]; + documentRoot = mypkgs.chloe_prod.webRoot; + extraConfig = builtins.concatStringsSep "\n" [ + mypkgs.chloe_prod.apache.vhostConf + ]; + }) + (withConf "eldiron" // { + hostName = "dev.aten.pro"; + documentRoot = mypkgs.aten_dev.webRoot; + extraConfig = builtins.concatStringsSep "\n" [ + mypkgs.aten_dev.apache.vhostConf + ]; + }) + (withConf "aten" // { + hostName = "aten.pro"; + serverAliases = [ "www.aten.pro" ]; + documentRoot = mypkgs.aten_prod.webRoot; + extraConfig = builtins.concatStringsSep "\n" [ + mypkgs.aten_prod.apache.vhostConf + ]; + }) + (withConf "eldiron" // { hostName = "cloud.immae.eu"; documentRoot = mypkgs.nextcloud.webRoot; extraConfig = builtins.concatStringsSep "\n" [ mypkgs.nextcloud.apache.vhostConf ]; }) - (withSSL "eldiron" // { - listen = [ { ip = "*"; port = 443; } ]; + (withConf "eldiron" // { hostName = "git.immae.eu"; documentRoot = mypkgs.git.web.webRoot; extraConfig = builtins.concatStringsSep "\n" [ @@ -366,6 +537,7 @@ hostName = "redirectSSL"; serverAliases = [ "*" ]; enableSSL = false; + logFormat = "combinedVhost"; documentRoot = "/var/lib/acme/acme-challenge"; extraConfig = '' RewriteEngine on @@ -455,5 +627,19 @@ #host all all all pam ''; }; + + services.cron = { + enable = true; + systemCronJobs = let + stats = domain: conf: let + d = pkgs.writeScriptBin "stats-${domain}" "${pkgs.gnused}/bin/sed -n '/\\['$(LC_ALL=C ${pkgs.coreutils}/bin/date -d yesterday +'%d\\/%b\\/%Y')'/ p' /var/log/httpd/access_log-${domain} | ${pkgs.goaccess}/bin/goaccess -o /var/lib/goaccess/${domain}/index.html -p ${conf}"; + in "${d}/bin/stats-${domain}"; + in [ + "5 0 * * * root ${stats "aten.pro" ./packages/aten_goaccess.conf}" + "5 0 * * * root ${stats "ludivinecassal.com" ./packages/ludivinecassal_goaccess.conf}" + "5 0 * * * root ${stats "piedsjaloux.fr" ./packages/piedsjaloux_goaccess.conf}" + "5 0 * * * root ${stats "osteopathe-cc.fr" ./packages/chloe_goaccess.conf}" + ]; + }; }; }