X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=virtual%2Feldiron.nix;h=c9075cfcd89bdbadf7e583937dcd82a3b7249161;hb=985845405f0ddd6531e4392e899a31179cde70d6;hp=efaa0686aa899e3b8800b77c8ce80c8ae4d7866e;hpb=42429ef0756d9ee41cf0ff0b38210edb3b1637e5;p=perso%2FImmae%2FConfig%2FNix.git diff --git a/virtual/eldiron.nix b/virtual/eldiron.nix index efaa068..c9075cf 100644 --- a/virtual/eldiron.nix +++ b/virtual/eldiron.nix @@ -4,16 +4,26 @@ enableRollback = true; }; - eldiron = { config, pkgs, mylibs, ... }: + # Full backup: + # The star after /var/lib/* avoids deleting all folders in case of problem + # rsync -e "ssh -i /root/.ssh/id_charon_vpn" -aAXvz --delete --numeric-ids --super --rsync-path="sudo rsync" /var/lib/* immae@immae.eu: + eldiron = { config, pkgs, mylibs, myconfig, ... }: with mylibs; let mypkgs = pkgs.callPackage ./packages.nix { - inherit checkEnv fetchedGit fetchedGitPrivate fetchedGithub; + inherit checkEnv fetchedGit fetchedGithub; }; in { _module.args = { mylibs = import ../libs.nix; + myconfig = { + ips = { + main = "176.9.151.89"; + production = "176.9.151.154"; + integration = "176.9.151.155"; + }; + }; }; imports = [ @@ -21,7 +31,8 @@ ./modules/gitolite.nix ./modules/gitweb.nix ./modules/databases.nix - ./modules/websites.nix + ./modules/websites + ./modules/websites/phpfpm ]; services.myGitolite.enable = true; services.myGitweb.enable = true; @@ -29,23 +40,10 @@ services.myWebsites.production.enable = true; services.myWebsites.integration.enable = true; - nixpkgs.config.packageOverrides = oldpkgs: rec { - goaccess = oldpkgs.goaccess.overrideAttrs(old: rec { - name = "goaccess-${version}"; - version = "1.3"; - src = pkgs.fetchurl { - url = "https://tar.goaccess.io/${name}.tar.gz"; - sha256 = "16vv3pj7pbraq173wlxa89jjsd279004j4kgzlrsk1dz4if5qxwc"; - }; - configureFlags = old.configureFlags ++ [ "--enable-tcb=btree" ]; - buildInputs = old.buildInputs ++ [ pkgs.tokyocabinet pkgs.bzip2 ]; - }); - }; - networking = { firewall = { enable = true; - allowedTCPPorts = [ 22 80 443 9418 ]; + allowedTCPPorts = [ 22 9418 ]; }; }; @@ -54,7 +52,7 @@ hetzner = { #robotUser = "defined in HETZNER_ROBOT_USER"; #robotPass = "defined in HETZNER_ROBOT_PASS"; - mainIPv4 = "176.9.151.89"; + mainIPv4 = myconfig.ips.main; partitions = '' clearpart --all --initlabel --drives=sda,sdb @@ -76,15 +74,14 @@ cd ${mypkgs.nextcloud.webRoot} NEXTCLOUD_CONFIG_DIR="${mypkgs.nextcloud.webRoot}/config" \ exec \ - ${config.services.phpfpm.phpPackage}/bin/php \ - -c ${config.services.phpfpm.phpPackage}/etc/php.ini \ + ${pkgs.php}/bin/php \ + -c ${pkgs.php}/etc/php.ini \ occ $* ''; in [ pkgs.telnet pkgs.htop pkgs.vim - pkgs.goaccess occ ]; @@ -102,23 +99,19 @@ services.ympd = mypkgs.ympd.config // { enable = false; }; - services.phpfpm = { - # FIXME: move session files to separate dirs - # /!\ phppackage is used in nextcloud configuation + services.myPhpfpm = { + phpPackage = pkgs.php; phpOptions = '' session.save_path = "/var/lib/php/sessions" session.gc_maxlifetime = 60*60*24*15 session.cache_expire = 60*24*30 - ; For nextcloud - extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so - ; For nextcloud - extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so - ; For nextcloud - zend_extension=${pkgs.php}/lib/php/extensions/opcache.so ''; extraConfig = '' log_level = notice ''; + poolPhpConfigs = { + nextcloud = mypkgs.nextcloud.phpFpm.phpConfig; + }; poolConfigs = { adminer = mypkgs.adminer.phpFpm.pool; nextcloud = mypkgs.nextcloud.phpFpm.pool; @@ -138,18 +131,8 @@ install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt - install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/ttrss install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical ''; - # FIXME: initial sync - goaccess = '' - mkdir -p /var/lib/goaccess - mkdir -p /var/lib/goaccess/aten.pro - mkdir -p /var/lib/goaccess/ludivinecassal.com - mkdir -p /var/lib/goaccess/piedsjaloux.fr - mkdir -p /var/lib/goaccess/osteopathe-cc.fr - mkdir -p /var/lib/goaccess/connexionswing.com - ''; }; environment.etc."ssh/ldap_authorized_keys" = let @@ -187,7 +170,9 @@ sslServerKey = "/var/lib/acme/${domain}/key.pem"; sslServerChain = "/var/lib/acme/${domain}/fullchain.pem"; logFormat = "combinedVhost"; - listen = [ { ip = "*"; port = 443; } ]; + listen = [ + { ip = "176.9.151.89"; port = 443; } + ]; }; apacheConfig = config.services.myWebsites.apacheConfig; in rec { @@ -240,82 +225,6 @@ mypkgs.davical.apache.vhostConf ]; }) - (withConf "eldiron" // { - hostName = "connexionswing.immae.eu"; - serverAliases = [ "sandetludo.immae.eu" ]; - documentRoot = mypkgs.connexionswing_dev.webRoot; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.connexionswing_dev.apache.vhostConf - ]; - }) - (withConf "connexionswing" // { - hostName = "connexionswing.com"; - serverAliases = [ "sandetludo.com" "www.connexionswing.com" "www.sandetludo.com" ]; - documentRoot = mypkgs.connexionswing_prod.webRoot; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.connexionswing_prod.apache.vhostConf - ]; - }) - (withConf "eldiron" // { - hostName = "ludivine.immae.eu"; - documentRoot = mypkgs.ludivinecassal_dev.webRoot; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.ludivinecassal_dev.apache.vhostConf - ]; - }) - (withConf "ludivinecassal" // { - hostName = "ludivinecassal.com"; - serverAliases = [ "www.ludivinecassal.com" ]; - documentRoot = mypkgs.ludivinecassal_prod.webRoot; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.ludivinecassal_prod.apache.vhostConf - ]; - }) - (withConf "eldiron" // { - hostName = "piedsjaloux.immae.eu"; - documentRoot = mypkgs.piedsjaloux_dev.webRoot; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.piedsjaloux_dev.apache.vhostConf - ]; - }) - (withConf "piedsjaloux" // { - hostName = "piedsjaloux.fr"; - serverAliases = [ "www.piedsjaloux.fr" ]; - documentRoot = mypkgs.piedsjaloux_prod.webRoot; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.piedsjaloux_prod.apache.vhostConf - ]; - }) - (withConf "eldiron" // { - hostName = "chloe.immae.eu"; - documentRoot = mypkgs.chloe_dev.webRoot; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.chloe_dev.apache.vhostConf - ]; - }) - (withConf "chloe" // { - hostName = "osteopathe-cc.fr"; - serverAliases = [ "www.osteopathe-cc.fr" ]; - documentRoot = mypkgs.chloe_prod.webRoot; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.chloe_prod.apache.vhostConf - ]; - }) - (withConf "eldiron" // { - hostName = "dev.aten.pro"; - documentRoot = mypkgs.aten_dev.webRoot; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.aten_dev.apache.vhostConf - ]; - }) - (withConf "aten" // { - hostName = "aten.pro"; - serverAliases = [ "www.aten.pro" ]; - documentRoot = mypkgs.aten_prod.webRoot; - extraConfig = builtins.concatStringsSep "\n" [ - mypkgs.aten_prod.apache.vhostConf - ]; - }) (withConf "eldiron" // { hostName = "cloud.immae.eu"; documentRoot = mypkgs.nextcloud.webRoot; @@ -354,36 +263,6 @@ ]; }; - services.cron = { - enable = true; - systemCronJobs = let - stats = domain: conf: let - d = pkgs.writeScriptBin "stats-${domain}" '' - #!${pkgs.stdenv.shell} - set -e - shopt -s nullglob - date_regex=$(LC_ALL=C date -d yesterday +'%d\/%b\/%Y') - TMPFILE=$(mktemp) - trap "rm -f $TMPFILE" EXIT - - cat /var/log/httpd/access_log-${domain} | sed -n "/\\[$date_regex/ p" > $TMPFILE - for i in /var/log/httpd/access_log-${domain}*.gz; do - zcat "$i" | sed -n "/\\[$date_regex/ p" >> $TMPFILE - done - goaccess $TMPFILE --no-progress -o /var/lib/goaccess/${domain}/index.html -p ${conf} - ''; - in "${d}/bin/stats-${domain}"; - # FIXME: running several goaccess simultaneously seems to be - # bugged? - in [ - "5 0 * * * root ${stats "aten.pro" ./packages/aten_goaccess.conf}" - "6 0 * * * root ${stats "ludivinecassal.com" ./packages/ludivinecassal_goaccess.conf}" - "7 0 * * * root ${stats "piedsjaloux.fr" ./packages/piedsjaloux_goaccess.conf}" - "8 0 * * * root ${stats "osteopathe-cc.fr" ./packages/chloe_goaccess.conf}" - "9 0 * * * root ${stats "connexionswing.com" ./packages/connexionswing_goaccess.conf}" - ]; - }; - systemd.services.tt-rss = { description = "Tiny Tiny RSS feeds update daemon"; serviceConfig = {