X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=virtual%2Feldiron.nix;h=68eddf607446c5630f46ac13b9659271893c6377;hb=6c672f344e2de6852cfa97ed789726bcd54cc83c;hp=280b69a989f15cfc48ebbc34eb3d7caf68eaca46;hpb=712ccefd39a5a71287ada2c7441c28e5cdd80f08;p=perso%2FImmae%2FConfig%2FNix.git diff --git a/virtual/eldiron.nix b/virtual/eldiron.nix index 280b69a..68eddf6 100644 --- a/virtual/eldiron.nix +++ b/virtual/eldiron.nix @@ -12,10 +12,17 @@ }; in { - # FIXME: they are not overriden in packages.nix - # (see nix-store -q --tree /nix/var/nix/profiles/system) nixpkgs.config.packageOverrides = oldpkgs: rec { - gitolite = nixpkgs_unstable.gitolite; + gitolite = oldpkgs.gitolite.overrideAttrs(old: rec { + name = "gitolite-${version}"; + version = "3.6.10"; + src = pkgs.fetchFromGitHub { + owner = "sitaramc"; + repo = "gitolite"; + rev = "v${version}"; + sha256 = "0p2697mn6rwm03ndlv7q137zczai82n41aplq1g006ii7f12xy8h"; + }; + }); gitweb = oldpkgs.gitweb.overrideAttrs(old: { installPhase = old.installPhase + '' cp -r ${./packages/gitweb} $out/gitweb-theme; @@ -82,6 +89,8 @@ ]; security.acme.certs = { + # /!\ To create a new certificate, add first the domain to an + # existing certificate, deploy, and then use it in httpd. "eldiron" = { webroot = "/var/lib/acme/acme-challenge"; email = "ismael@bouya.org"; @@ -97,6 +106,32 @@ "connexionswing.immae.eu" = null; "sandetludo.immae.eu" = null; "cloud.immae.eu" = null; + "ludivine.immae.eu" = null; + "dev.aten.pro" = null; + }; + }; + "ludivinecassal" = { + webroot = "/var/lib/acme/acme-challenge"; + email = "ismael@bouya.org"; + domain = "ludivinecassal.com"; + plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ]; + postRun = '' + systemctl reload httpd.service + ''; + extraDomains = { + "www.ludivinecassal.com" = null; + }; + }; + "aten" = { + webroot = "/var/lib/acme/acme-challenge"; + email = "ismael@bouya.org"; + domain = "aten.pro"; + plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ]; + postRun = '' + systemctl reload httpd.service + ''; + extraDomains = { + "www.aten.pro" = null; }; }; # "connexionswing" = { @@ -155,6 +190,8 @@ extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so ; For nextcloud extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so + ; For nextcloud + zend_extension=${pkgs.php}/lib/php/extensions/opcache.so ''; extraConfig = '' log_level = notice @@ -163,6 +200,10 @@ adminer = mypkgs.adminer.phpFpm.pool; connexionswing_dev = mypkgs.connexionswing_dev.phpFpm.pool; connexionswing_prod = mypkgs.connexionswing_prod.phpFpm.pool; + ludivinecassal_dev = mypkgs.ludivinecassal_dev.phpFpm.pool; + ludivinecassal_prod = mypkgs.ludivinecassal_prod.phpFpm.pool; + aten_dev = mypkgs.aten_dev.phpFpm.pool; + aten_prod = mypkgs.aten_prod.phpFpm.pool; nextcloud = mypkgs.nextcloud.phpFpm.pool; mantisbt = mypkgs.mantisbt.phpFpm.pool; }; @@ -171,6 +212,10 @@ system.activationScripts = { connexionswing_dev = mypkgs.connexionswing_dev.activationScript; connexionswing_prod = mypkgs.connexionswing_prod.activationScript; + ludivinecassal_dev = mypkgs.ludivinecassal_dev.activationScript; + ludivinecassal_prod = mypkgs.ludivinecassal_prod.activationScript; + aten_dev = mypkgs.aten_dev.activationScript; + aten_prod = mypkgs.aten_prod.activationScript; nextcloud = mypkgs.nextcloud.activationScript; httpd = '' install -d -m 0755 /var/lib/acme/acme-challenge @@ -232,11 +277,13 @@ }; services.httpd = let - withSSL = domain: { + withConf = domain: { enableSSL = true; sslServerCert = "/var/lib/acme/${domain}/cert.pem"; sslServerKey = "/var/lib/acme/${domain}/key.pem"; sslServerChain = "/var/lib/acme/${domain}/fullchain.pem"; + logFormat = "combinedVhost"; + listen = [ { ip = "*"; port = 443; } ]; }; apacheConfig = { gzip = { @@ -268,34 +315,34 @@ ''; }; + http2 = { + modules = [ "http2" ]; + extraConfig = '' + Protocols h2 http/1.1 + ''; + }; + customLog = { + modules = []; + extraConfig = '' + LogFormat "%v %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %p" combinedVhost + ''; + }; }; in rec { enable = true; logPerVirtualHost = true; multiProcessingModule = "worker"; adminAddr = "httpd@immae.eu"; - # FIXME: http2 - # FIXME: voir les autres modules: - # authz_core_module - # reqtimeout_module - # http2_module - # version_module - # proxy_connect_module - # proxy_ftp_module - # proxy_scgi_module - # proxy_ajp_module - # proxy_balancer_module - # proxy_express_module - # lbmethod_byrequests_module - # lbmethod_bytraffic_module - # lbmethod_bybusyness_module - # lbmethod_heartbeat_module - + logFormat = "combinedVhost"; extraModules = pkgs.lib.lists.unique ( mypkgs.adminer.apache.modules ++ mypkgs.nextcloud.apache.modules ++ mypkgs.connexionswing_dev.apache.modules ++ mypkgs.connexionswing_prod.apache.modules ++ + mypkgs.ludivinecassal_dev.apache.modules ++ + mypkgs.ludivinecassal_prod.apache.modules ++ + mypkgs.aten_dev.apache.modules ++ + mypkgs.aten_prod.apache.modules ++ mypkgs.ympd.apache.modules ++ mypkgs.git.web.apache.modules ++ mypkgs.mantisbt.apache.modules ++ @@ -304,24 +351,21 @@ extraConfig = builtins.concatStringsSep "\n" (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig) apacheConfig); virtualHosts = [ - (withSSL "eldiron" // { - listen = [ { ip = "*"; port = 443; } ]; + (withConf "eldiron" // { hostName = "eldiron.immae.eu"; documentRoot = ./www; extraConfig = '' DirectoryIndex index.htm ''; }) - (withSSL "eldiron" // { - listen = [ { ip = "*"; port = 443; } ]; + (withConf "eldiron" // { hostName = "db-1.immae.eu"; documentRoot = null; extraConfig = builtins.concatStringsSep "\n" [ mypkgs.adminer.apache.vhostConf ]; }) - (withSSL "eldiron" // { - listen = [ { ip = "*"; port = 443; } ]; + (withConf "eldiron" // { hostName = "tools.immae.eu"; documentRoot = null; extraConfig = builtins.concatStringsSep "\n" [ @@ -329,8 +373,7 @@ mypkgs.ympd.apache.vhostConf ]; }) - (withSSL "eldiron" // { - listen = [ { ip = "*"; port = 443; } ]; + (withConf "eldiron" // { hostName = "connexionswing.immae.eu"; serverAliases = [ "sandetludo.immae.eu" ]; documentRoot = mypkgs.connexionswing_dev.webRoot; @@ -338,16 +381,44 @@ mypkgs.connexionswing_dev.apache.vhostConf ]; }) - (withSSL "eldiron" // { - listen = [ { ip = "*"; port = 443; } ]; + (withConf "eldiron" // { + hostName = "ludivine.immae.eu"; + documentRoot = mypkgs.ludivinecassal_dev.webRoot; + extraConfig = builtins.concatStringsSep "\n" [ + mypkgs.ludivinecassal_dev.apache.vhostConf + ]; + }) + (withConf "ludivinecassal" // { + hostName = "ludivinecassal.com"; + serverAliases = [ "www.ludivinecassal.com" ]; + documentRoot = mypkgs.ludivinecassal_prod.webRoot; + extraConfig = builtins.concatStringsSep "\n" [ + mypkgs.ludivinecassal_prod.apache.vhostConf + ]; + }) + (withConf "eldiron" // { + hostName = "dev.aten.pro"; + documentRoot = mypkgs.aten_dev.webRoot; + extraConfig = builtins.concatStringsSep "\n" [ + mypkgs.aten_dev.apache.vhostConf + ]; + }) + (withConf "aten" // { + hostName = "aten.pro"; + serverAliases = [ "www.aten.pro" ]; + documentRoot = mypkgs.aten_prod.webRoot; + extraConfig = builtins.concatStringsSep "\n" [ + mypkgs.aten_prod.apache.vhostConf + ]; + }) + (withConf "eldiron" // { hostName = "cloud.immae.eu"; documentRoot = mypkgs.nextcloud.webRoot; extraConfig = builtins.concatStringsSep "\n" [ mypkgs.nextcloud.apache.vhostConf ]; }) - (withSSL "eldiron" // { - listen = [ { ip = "*"; port = 443; } ]; + (withConf "eldiron" // { hostName = "git.immae.eu"; documentRoot = mypkgs.git.web.webRoot; extraConfig = builtins.concatStringsSep "\n" [ @@ -364,6 +435,7 @@ hostName = "redirectSSL"; serverAliases = [ "*" ]; enableSSL = false; + logFormat = "combinedVhost"; documentRoot = "/var/lib/acme/acme-challenge"; extraConfig = '' RewriteEngine on