[perso/Immae/Config/Nix.git] / modules / private / websites / default.nix

{ lib, pkgs, config, ... }:
let
  www_root = "/run/current-system/webapps/_www";
  theme_root = "/run/current-system/webapps/_theme";
  apacheConfig = {
    gzip = {
      modules = [ "deflate" "filter" ];
      extraConfig = ''
        AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
      '';
    };
    macros = {
      modules = [ "macro" ];
    };
    stats = {
      extraConfig = ''
        <Macro Stats %{domain}>
          Alias /webstats ${config.services.webstats.dataDir}/%{domain}
          <Directory ${config.services.webstats.dataDir}/%{domain}>
            DirectoryIndex index.html
            AllowOverride None
            Require all granted
          </Directory>
          <Location /webstats>
            Use LDAPConnect
            Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
          </Location>
        </Macro>
      '';
    };
    ldap = {
      modules = [ "ldap" "authnz_ldap" ];
      extraConfig = ''
        <IfModule ldap_module>
          LDAPSharedCacheSize 500000
          LDAPCacheEntries 1024
          LDAPCacheTTL 600
          LDAPOpCacheEntries 1024
          LDAPOpCacheTTL 600
        </IfModule>

        Include /var/secrets/apache-ldap
      '';
    };
    global = {
      extraConfig = (pkgs.webapps.apache-default.override { inherit www_root;}).apacheConfig;
    };
    apaxy = {
      extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
    };
    http2 = {
      modules = [ "http2" ];
      extraConfig = ''
        Protocols h2 http/1.1
      '';
    };
    customLog = {
      extraConfig = ''
        LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
      '';
    };
  };
  makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
  makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
in
{
  options.myServices.websites = {
    enable = lib.mkEnableOption "enable websites";

    webappDirs = lib.mkOption {
      type = lib.types.attrsOf lib.types.path;
      description = ''
        Webapp paths to create in /run/current-system/webapps
        '';
      default = {};
    };
  };

  config = lib.mkIf config.myServices.websites.enable {
    services.duplyBackup.profiles.php = {
      rootDir = "/var/lib/php";
    };
    users.users.wwwrun.extraGroups = [ "keys" ];
    networking.firewall.allowedTCPPorts = [ 80 443 ];

    nixpkgs.overlays = [ (self: super: rec {
      #openssl = self.openssl_1_1;
      php = php72;
      php72 = (super.php72.override {
        config.php.mysqlnd = true;
        config.php.mysqli = false;
        config.php.mhash = true; # Is it needed?
      }).overrideAttrs(old: rec {
        # Didn't manage to build with mysqli + mysql_config connector
        configureFlags = old.configureFlags ++ [
          "--with-mysqli=shared,mysqlnd"
          ];
        # preConfigure = (old.preConfigure or "") + ''
        #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
        #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
        #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
        #   '';
      });
      phpPackages = super.php72Packages.override { inherit php; };
    }) ];

    secrets.keys = [{
      dest = "apache-ldap";
      user = "wwwrun";
      group = "wwwrun";
      permissions = "0400";
      text = ''
        <Macro LDAPConnect>
          <IfModule authnz_ldap_module>
            AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
            AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
            AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
            AuthType             Basic
            AuthName             "Authentification requise (Acces LDAP)"
            AuthBasicProvider    ldap
          </IfModule>
        </Macro>
        '';
    }];

    system.activationScripts = {
      httpd = ''
        install -d -m 0755 /var/lib/acme/acme-challenges
        install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
        '';
    };

    services.phpfpm = {
      phpPackage = pkgs.php;
      phpOptions = ''
        session.save_path = "/var/lib/php/sessions"
        post_max_size = 20M
        ; 15 days (seconds)
        session.gc_maxlifetime = 1296000
        ; 30 days (minutes)
        session.cache_expire = 43200
        '';
      settings = {
        log_level = "notice";
      };
    };

    services.filesWatcher.httpdProd.paths = [ "/var/secrets/apache-ldap" ];
    services.filesWatcher.httpdInte.paths = [ "/var/secrets/apache-ldap" ];
    services.filesWatcher.httpdTools.paths = [ "/var/secrets/apache-ldap" ];

    services.websites.env.production = {
      enable = true;
      adminAddr = "httpd@immae.eu";
      httpdName = "Prod";
      ips =
        let ips = config.myEnv.servers.eldiron.ips.production;
        in [ips.ip4] ++ (ips.ip6 or []);
      modules = makeModules;
      extraConfig = makeExtraConfig;
      fallbackVhost = {
        certName    = "eldiron";
        hosts       = ["eldiron.immae.eu" ];
        root        = www_root;
        extraConfig = [ "DirectoryIndex index.htm" ];
      };
    };

    services.websites.env.integration = {
      enable = true;
      adminAddr = "httpd@immae.eu";
      httpdName = "Inte";
      ips =
        let ips = config.myEnv.servers.eldiron.ips.integration;
        in [ips.ip4] ++ (ips.ip6 or []);
      modules = makeModules;
      extraConfig = makeExtraConfig;
      fallbackVhost = {
        certName    = "eldiron";
        hosts       = ["eldiron.immae.eu" ];
        root        = www_root;
        extraConfig = [ "DirectoryIndex index.htm" ];
      };
    };

    services.websites.env.tools = {
      enable = true;
      adminAddr = "httpd@immae.eu";
      httpdName = "Tools";
      ips =
        let ips = config.myEnv.servers.eldiron.ips.main;
        in [ips.ip4] ++ (ips.ip6 or []);
      modules = makeModules;
      extraConfig = makeExtraConfig ++
        [ ''
            RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
            RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
            RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
            RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
            RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
            RedirectMatch ^/CGU$ https://www.immae.eu/CGU
          ''
          ];
      nosslVhost = {
        enable = true;
        host = "nossl.immae.eu";
      };
      fallbackVhost = {
        certName    = "eldiron";
        hosts       = ["eldiron.immae.eu" ];
        root        = www_root;
        extraConfig = [ "DirectoryIndex index.htm" ];
      };
    };

    system.extraSystemBuilderCmds = lib.mkIf (builtins.length (builtins.attrValues config.myServices.websites.webappDirs) > 0) ''
    mkdir -p $out/webapps
    ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList (name: path: "ln -s ${path} $out/webapps/${name}") config.myServices.websites.webappDirs)}
    '';

    myServices.websites = {
      webappDirs = {
        _www = pkgs.webapps.apache-default.www;
        _theme = pkgs.webapps.apache-theme.theme;
      };

      isabelle.aten_integration.enable = true;
      isabelle.aten_production.enable = true;
      isabelle.iridologie.enable = true;

      capitaines.production.enable = true;

      chloe.integration.enable = true;
      chloe.production.enable = true;

      connexionswing.integration.enable = true;
      connexionswing.production.enable = true;

      denisejerome.production.enable = true;

      emilia.production.enable = true;
      emilia.richie_production.enable = true;

      florian.app.enable = true;
      florian.integration.enable = true;
      florian.production.enable = true;

      immae.production.enable = true;
      immae.release.enable = true;
      immae.temp.enable = true;

      leila.production.enable = true;

      ludivinecassal.integration.enable = true;
      ludivinecassal.production.enable = true;

      nassime.production.enable = true;

      evariste.production.enable = true;
      naturaloutil.production.enable = true;
      telioTortay.production.enable = true;

      papa.surveillance.enable = true;
      papa.maison_bbc.enable = true;

      piedsjaloux.integration.enable = true;
      piedsjaloux.production.enable = true;

      tools.cloud.enable = true;
      tools.dav.enable = true;
      tools.db.enable = true;
      tools.diaspora.enable = true;
      tools.etherpad-lite.enable = true;
      tools.git.enable = true;
      tools.mastodon.enable = true;
      tools.mediagoblin.enable = true;
      tools.peertube.enable = true;
      tools.tools.enable = true;
      tools.email.enable = true;
    };
  };
}
Commit	Line	Data
ab8f306d	1	{ lib, pkgs, config, ... }:
4288c2f2 IB	2	let
	3	www_root = "/run/current-system/webapps/_www";
	4	theme_root = "/run/current-system/webapps/_theme";
	5	apacheConfig = {
	6	gzip = {
	7	modules = [ "deflate" "filter" ];
	8	extraConfig = ''
	9	AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
	10	'';
	11	};
	12	macros = {
	13	modules = [ "macro" ];
	14	};
	15	stats = {
	16	extraConfig = ''
	17	<Macro Stats %{domain}>
	18	Alias /webstats ${config.services.webstats.dataDir}/%{domain}
	19	<Directory ${config.services.webstats.dataDir}/%{domain}>
	20	DirectoryIndex index.html
	21	AllowOverride None
	22	Require all granted
	23	</Directory>
	24	<Location /webstats>
	25	Use LDAPConnect
	26	Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
	27	</Location>
	28	</Macro>
	29	'';
	30	};
	31	ldap = {
	32	modules = [ "ldap" "authnz_ldap" ];
	33	extraConfig = ''
	34	<IfModule ldap_module>
	35	LDAPSharedCacheSize 500000
	36	LDAPCacheEntries 1024
	37	LDAPCacheTTL 600
	38	LDAPOpCacheEntries 1024
	39	LDAPOpCacheTTL 600
	40	</IfModule>
	41
	42	Include /var/secrets/apache-ldap
	43	'';
	44	};
	45	global = {
	46	extraConfig = (pkgs.webapps.apache-default.override { inherit www_root;}).apacheConfig;
	47	};
	48	apaxy = {
	49	extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
	50	};
	51	http2 = {
	52	modules = [ "http2" ];
	53	extraConfig = ''
	54	Protocols h2 http/1.1
	55	'';
	56	};
	57	customLog = {
	58	extraConfig = ''
494d0718	59	LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
4288c2f2 IB	60	'';
	61	};
	62	};
	63	makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
	64	makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
	65	in
f8026b6e	66	{
8415083e IB	67	options.myServices.websites = {
	68	enable = lib.mkEnableOption "enable websites";
	69
	70	webappDirs = lib.mkOption {
	71	type = lib.types.attrsOf lib.types.path;
	72	description = ''
	73	Webapp paths to create in /run/current-system/webapps
	74	'';
	75	default = {};
	76	};
4288c2f2 IB	77	};
4288c2f2 IB	78
8415083e	79	config = lib.mkIf config.myServices.websites.enable {
d2e703c5	80	services.duplyBackup.profiles.php = {
6a8252b1 IB	81	rootDir = "/var/lib/php";
6a8252b1 IB	82	};
4288c2f2 IB	83	users.users.wwwrun.extraGroups = [ "keys" ];
	84	networking.firewall.allowedTCPPorts = [ 80 443 ];
	85
	86	nixpkgs.overlays = [ (self: super: rec {
	87	#openssl = self.openssl_1_1;
	88	php = php72;
	89	php72 = (super.php72.override {
5400b9b6	90	config.php.mysqlnd = true;
4288c2f2	91	config.php.mysqli = false;
5400b9b6	92	config.php.mhash = true; # Is it needed?
4288c2f2 IB	93	}).overrideAttrs(old: rec {
	94	# Didn't manage to build with mysqli + mysql_config connector
	95	configureFlags = old.configureFlags ++ [
	96	"--with-mysqli=shared,mysqlnd"
	97	];
	98	# preConfigure = (old.preConfigure or "") + ''
	99	# export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
	100	# sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
	101	# ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
	102	# '';
	103	});
	104	phpPackages = super.php72Packages.override { inherit php; };
	105	}) ];
	106
	107	secrets.keys = [{
	108	dest = "apache-ldap";
	109	user = "wwwrun";
	110	group = "wwwrun";
	111	permissions = "0400";
	112	text = ''
	113	<Macro LDAPConnect>
	114	<IfModule authnz_ldap_module>
	115	AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
	116	AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
ab8f306d	117	AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
4288c2f2 IB	118	AuthType Basic
	119	AuthName "Authentification requise (Acces LDAP)"
	120	AuthBasicProvider ldap
	121	</IfModule>
	122	</Macro>
	123	'';
	124	}];
	125
	126	system.activationScripts = {
	127	httpd = ''
3ffa15ba	128	install -d -m 0755 /var/lib/acme/acme-challenges
4288c2f2 IB	129	install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
	130	'';
	131	};
	132
	133	services.phpfpm = {
	134	phpPackage = pkgs.php;
	135	phpOptions = ''
	136	session.save_path = "/var/lib/php/sessions"
	137	post_max_size = 20M
	138	; 15 days (seconds)
	139	session.gc_maxlifetime = 1296000
	140	; 30 days (minutes)
	141	session.cache_expire = 43200
	142	'';
5400b9b6 IB	143	settings = {
	144	log_level = "notice";
	145	};
4288c2f2 IB	146	};
4288c2f2 IB	147
17f6eae9 IB	148	services.filesWatcher.httpdProd.paths = [ "/var/secrets/apache-ldap" ];
	149	services.filesWatcher.httpdInte.paths = [ "/var/secrets/apache-ldap" ];
	150	services.filesWatcher.httpdTools.paths = [ "/var/secrets/apache-ldap" ];
	151
29f8cb85	152	services.websites.env.production = {
4288c2f2 IB	153	enable = true;
	154	adminAddr = "httpd@immae.eu";
	155	httpdName = "Prod";
	156	ips =
ab8f306d	157	let ips = config.myEnv.servers.eldiron.ips.production;
4288c2f2 IB	158	in [ips.ip4] ++ (ips.ip6 or []);
	159	modules = makeModules;
	160	extraConfig = makeExtraConfig;
	161	fallbackVhost = {
	162	certName = "eldiron";
	163	hosts = ["eldiron.immae.eu" ];
	164	root = www_root;
	165	extraConfig = [ "DirectoryIndex index.htm" ];
	166	};
	167	};
	168
29f8cb85	169	services.websites.env.integration = {
4288c2f2 IB	170	enable = true;
	171	adminAddr = "httpd@immae.eu";
	172	httpdName = "Inte";
	173	ips =
ab8f306d	174	let ips = config.myEnv.servers.eldiron.ips.integration;
4288c2f2 IB	175	in [ips.ip4] ++ (ips.ip6 or []);
	176	modules = makeModules;
	177	extraConfig = makeExtraConfig;
	178	fallbackVhost = {
	179	certName = "eldiron";
	180	hosts = ["eldiron.immae.eu" ];
	181	root = www_root;
	182	extraConfig = [ "DirectoryIndex index.htm" ];
	183	};
	184	};
	185
29f8cb85	186	services.websites.env.tools = {
4288c2f2 IB	187	enable = true;
	188	adminAddr = "httpd@immae.eu";
	189	httpdName = "Tools";
	190	ips =
ab8f306d	191	let ips = config.myEnv.servers.eldiron.ips.main;
4288c2f2 IB	192	in [ips.ip4] ++ (ips.ip6 or []);
	193	modules = makeModules;
	194	extraConfig = makeExtraConfig ++
	195	[ ''
	196	RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
	197	RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
	198	RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
	199	RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
	200	RedirectMatch ^/(mentions\|mentions_legales\|legal)$ https://www.immae.eu/mentions.html
	201	RedirectMatch ^/CGU$ https://www.immae.eu/CGU
	202	''
	203	];
	204	nosslVhost = {
	205	enable = true;
	206	host = "nossl.immae.eu";
	207	};
	208	fallbackVhost = {
	209	certName = "eldiron";
	210	hosts = ["eldiron.immae.eu" ];
	211	root = www_root;
	212	extraConfig = [ "DirectoryIndex index.htm" ];
	213	};
	214	};
	215
	216	system.extraSystemBuilderCmds = lib.mkIf (builtins.length (builtins.attrValues config.myServices.websites.webappDirs) > 0) ''
	217	mkdir -p $out/webapps
	218	${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList (name: path: "ln -s ${path} $out/webapps/${name}") config.myServices.websites.webappDirs)}
	219	'';
	220
	221	myServices.websites = {
	222	webappDirs = {
	223	_www = pkgs.webapps.apache-default.www;
	224	_theme = pkgs.webapps.apache-theme.theme;
	225	};
	226
829ef7f1 IB	227	isabelle.aten_integration.enable = true;
	228	isabelle.aten_production.enable = true;
	229	isabelle.iridologie.enable = true;
4288c2f2 IB	230
4288c2f2 IB	231	capitaines.production.enable = true;
f8026b6e	232
4288c2f2 IB	233	chloe.integration.enable = true;
4288c2f2 IB	234	chloe.production.enable = true;
f8026b6e	235
4288c2f2 IB	236	connexionswing.integration.enable = true;
4288c2f2 IB	237	connexionswing.production.enable = true;
f8026b6e	238
4288c2f2	239	denisejerome.production.enable = true;
f8026b6e	240
4288c2f2	241	emilia.production.enable = true;
91b75ffe	242	emilia.richie_production.enable = true;
f8026b6e	243
4288c2f2 IB	244	florian.app.enable = true;
	245	florian.integration.enable = true;
	246	florian.production.enable = true;
f8026b6e	247
4288c2f2 IB	248	immae.production.enable = true;
	249	immae.release.enable = true;
	250	immae.temp.enable = true;
f8026b6e	251
4288c2f2	252	leila.production.enable = true;
f8026b6e	253
4288c2f2 IB	254	ludivinecassal.integration.enable = true;
4288c2f2 IB	255	ludivinecassal.production.enable = true;
f8026b6e	256
4288c2f2	257	nassime.production.enable = true;
f8026b6e	258
ab97f6e7	259	evariste.production.enable = true;
4288c2f2	260	naturaloutil.production.enable = true;
93531b30	261	telioTortay.production.enable = true;
f8026b6e	262
4288c2f2	263	papa.surveillance.enable = true;
9a414bd6	264	papa.maison_bbc.enable = true;
f8026b6e	265
4288c2f2 IB	266	piedsjaloux.integration.enable = true;
4288c2f2 IB	267	piedsjaloux.production.enable = true;
f8026b6e	268
4288c2f2 IB	269	tools.cloud.enable = true;
	270	tools.dav.enable = true;
	271	tools.db.enable = true;
	272	tools.diaspora.enable = true;
	273	tools.etherpad-lite.enable = true;
	274	tools.git.enable = true;
	275	tools.mastodon.enable = true;
	276	tools.mediagoblin.enable = true;
	277	tools.peertube.enable = true;
	278	tools.tools.enable = true;
afcc5de0	279	tools.email.enable = true;
4288c2f2 IB	280	};
4288c2f2 IB	281	};
f8026b6e	282	}