X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=virtual%2Feldiron.nix;h=4087be8e9758935dd4652b101230c16cf5e685e0;hb=94818b7506f7284e2115863364b571daf0b5f5fc;hp=fb366b7dffe0ed3826a8e72a2ce3b983d1961fd5;hpb=6cd8d6ce21e3efeda631037851653c04ad64e41c;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/virtual/eldiron.nix b/virtual/eldiron.nix
index fb366b7..4087be8 100644
--- a/virtual/eldiron.nix
+++ b/virtual/eldiron.nix
@@ -36,7 +36,11 @@
       };
     };
 
-    # FIXME: how to run it? currently set as timer
+    environment.systemPackages = [
+      pkgs.telnet
+      pkgs.vim
+    ];
+
     security.acme.certs = {
       "eldiron" = {
         webroot = "/var/lib/acme/acme-challenge";
@@ -44,24 +48,41 @@
         domain = "eldiron.immae.eu";
         plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
         postRun = ''
-          "systemctl reload httpd.service"
+          systemctl reload httpd.service
         '';
         extraDomains = {
           "db-1.immae.eu" = null;
           "tools.immae.eu" = null;
+          "connexionswing.immae.eu" = null;
+          "sandetludo.immae.eu" = null;
         };
       };
+      # "connexionswing" = {
+      #   webroot = "/var/lib/acme/acme-challenge";
+      #   email = "ismael@bouya.org";
+      #   domain = "connexionswing.com";
+      #   plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
+      #   postRun = ''
+      #     systemctl reload httpd.service
+      #   '';
+      #   extraDomains = {
+      #     "www.connexionswing.com" = null;
+      #     "sandetludo.com" = null;
+      #     "www.sandetludo.com" = null;
+      #   };
+      # };
     };
 
     services.ympd = mypkgs.ympd.config // { enable = true; };
 
-    # FIXME: open_basedir
     services.phpfpm = {
       extraConfig = ''
         log_level = notice
         '';
       poolConfigs = {
         adminer = mypkgs.adminer.phpFpm.pool;
+        connexionswing_dev = mypkgs.connexionswing_dev.phpFpm.pool;
+        connexionswing_prod = mypkgs.connexionswing_prod.phpFpm.pool;
         www = ''
           listen = /var/run/phpfpm/www.sock
           user = wwwrun
@@ -77,46 +98,83 @@
       };
     };
 
+    system.activationScripts = {
+      connexionswing_dev  = mypkgs.connexionswing_dev.activationScript;
+      connexionswing_prod = mypkgs.connexionswing_prod.activationScript;
+      httpd = ''
+        install -d -m 0755 /var/lib/acme/acme-challenge
+        install -d -m 0755 /var/www
+        '';
+    };
+
     services.httpd = let
       withSSL = domain: {
         enableSSL = true;
-        sslServerCert = "/var/lib/acme/${domain}/full.pem"; # FIXME: cert only?
+        sslServerCert = "/var/lib/acme/${domain}/cert.pem";
         sslServerKey = "/var/lib/acme/${domain}/key.pem";
         sslServerChain = "/var/lib/acme/${domain}/fullchain.pem";
       };
+      apacheConfig = {
+        gzip = {
+          modules = [ "deflate" "filter" ];
+          extraConfig = ''
+            AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
+          '';
+        };
+        ldap = {
+          modules = [ "ldap" "authnz_ldap" ];
+          extraConfig = assert mylibs.checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; ''
+            <IfModule ldap_module>
+              LDAPSharedCacheSize 500000
+              LDAPCacheEntries 1024
+              LDAPCacheTTL 600
+              LDAPOpCacheEntries 1024
+              LDAPOpCacheTTL 600
+            </IfModule>
+
+            <Macro LDAPConnect>
+              <IfModule authnz_ldap_module>
+                AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu
+                AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
+                AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
+                AuthType             Basic
+                AuthName             "Authentification requise (Acces LDAP)"
+                AuthBasicProvider    ldap
+              </IfModule>
+            </Macro>
+          '';
+        };
+      };
     in rec {
       enable = true;
       logPerVirtualHost = true;
       multiProcessingModule = "worker";
       adminAddr = "httpd@immae.eu";
       # FIXME: http2
+      # FIXME: voir les autres modules:
+      #    authz_core_module
+      #    reqtimeout_module
+      #    http2_module
+      #    version_module
+      #    proxy_connect_module
+      #    proxy_ftp_module
+      #    proxy_scgi_module
+      #    proxy_ajp_module
+      #    proxy_balancer_module
+      #    proxy_express_module
+      #    lbmethod_byrequests_module
+      #    lbmethod_bytraffic_module
+      #    lbmethod_bybusyness_module
+      #    lbmethod_heartbeat_module
+
       extraModules = pkgs.lib.lists.unique (
         mypkgs.adminer.apache.modules ++
-        [
-          "macro"
-          "ldap"
-          "authnz_ldap"
-        ]);
-      extraConfig = assert mylibs.checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; ''
-        <IfModule ldap_module>
-          LDAPSharedCacheSize 500000
-          LDAPCacheEntries 1024
-          LDAPCacheTTL 600
-          LDAPOpCacheEntries 1024
-          LDAPOpCacheTTL 600
-        </IfModule>
-
-        <Macro LDAPConnect>
-          <IfModule authnz_ldap_module>
-            AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu
-            AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
-            AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
-            AuthType             Basic
-            AuthName             "Authentification requise (Acces LDAP)"
-            AuthBasicProvider    ldap
-          </IfModule>
-        </Macro>
-        '';
+        mypkgs.connexionswing_dev.apache.modules ++
+        mypkgs.connexionswing_prod.apache.modules ++
+        pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules) apacheConfig) ++
+        [ "macro" ]);
+      extraConfig = builtins.concatStringsSep "\n"
+        (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig) apacheConfig);
       virtualHosts = [
         (withSSL "eldiron" // {
           listen = [ { ip = "*"; port = 443; } ];
@@ -141,12 +199,20 @@
             mypkgs.ympd.apache.vhostConf
           ];
         })
+        (withSSL "eldiron" // {
+          listen = [ { ip = "*"; port = 443; } ];
+          hostName = "connexionswing.immae.eu";
+          serverAliases = [ "sandetludo.immae.eu" ];
+          documentRoot = mypkgs.connexionswing_dev.webRoot;
+          extraConfig = builtins.concatStringsSep "\n" [
+            mypkgs.connexionswing_dev.apache.vhostConf
+          ];
+        })
         { # Should go last, default fallback
           listen = [ { ip = "*"; port = 80; } ];
           hostName = "redirectSSL";
           serverAliases = [ "*" ];
           enableSSL = false;
-          # FIXME: directory needs to exist
           documentRoot = "/var/lib/acme/acme-challenge";
           extraConfig = ''
             RewriteEngine on
@@ -160,7 +226,6 @@
         ];
     };
 
-    # FIXME: environment variables ?
     security.pam.services = let
       pam_ldap = pkgs.pam_ldap;
       pam_ldap_mysql = assert mylibs.checkEnv "NIXOPS_MYSQL_PAM_PASSWORD";