[perso/Immae/Config/Nix.git] / modules / private / websites / default.nix

{ lib, pkgs, config, ... }:
let
  www_root = "/run/current-system/webapps/_www";
  theme_root = "/run/current-system/webapps/_theme";
  apacheConfig = {
    cache = {
      # This setting permits to ignore time-based cache for files in the
      # nix store:
      # If a client requires an If-Modified-Since from timestamp 1, then
      # this header is removed, and if the response contains a
      # too old Last-Modified tag, then it is removed too
      extraConfig = ''
        <If "%{HTTP:If-Modified-Since} =~ /01 Jan 1970 00:00:01/" >
          RequestHeader unset If-Modified-Since
        </If>
        Header unset Last-Modified "expr=%{LAST_MODIFIED} < 19991231235959"
      '';
    };
    gzip = {
      modules = [ "deflate" "filter" ];
      extraConfig = ''
        AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
      '';
    };
    macros = {
      modules = [ "macro" ];
    };
    stats = {
      extraConfig = ''
        <Macro Stats %{domain}>
          Alias /webstats ${config.services.webstats.dataDir}/%{domain}
          <Directory ${config.services.webstats.dataDir}/%{domain}>
            DirectoryIndex index.html
            AllowOverride None
            Require all granted
          </Directory>
          <Location /webstats>
            Use LDAPConnect
            Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
          </Location>
        </Macro>
      '';
    };
    ldap = {
      modules = [ "ldap" "authnz_ldap" ];
      extraConfig = ''
        <IfModule ldap_module>
          LDAPSharedCacheSize 500000
          LDAPCacheEntries 1024
          LDAPCacheTTL 600
          LDAPOpCacheEntries 1024
          LDAPOpCacheTTL 600
        </IfModule>

        Include /var/secrets/apache-ldap
      '';
    };
    global = {
      extraConfig = ''
        ErrorDocument 500 /maintenance_immae.html
        ErrorDocument 501 /maintenance_immae.html
        ErrorDocument 502 /maintenance_immae.html
        ErrorDocument 503 /maintenance_immae.html
        ErrorDocument 504 /maintenance_immae.html
        Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
        ProxyPass /maintenance_immae.html !

        AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
        <Directory ${www_root}>
          AllowOverride None
          Require all granted
        </Directory>
      '';
    };
    apaxy = {
      extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
    };
    http2 = {
      modules = [ "http2" ];
      extraConfig = ''
        Protocols h2 http/1.1
      '';
    };
    customLog = {
      extraConfig = ''
        LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
      '';
    };
  };
  makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
  makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
in
{
  options.myServices.websites.enable = lib.mkEnableOption "enable websites";

  config = lib.mkIf config.myServices.websites.enable {
    services.duplyBackup.profiles.php = {
      rootDir = "/var/lib/php";
    };
    users.users.wwwrun.extraGroups = [ "keys" ];
    networking.firewall.allowedTCPPorts = [ 80 443 ];

    nixpkgs.overlays = [ (self: super: rec {
      php72 = (super.php72.override {
        config.php.mysqlnd = true;
        config.php.mysqli = false;
        config.php.mhash = true; # Is it needed?
      }).overrideAttrs(old: rec {
        # Didn't manage to build with mysqli + mysql_config connector
        configureFlags = old.configureFlags ++ [
          "--with-mysqli=shared,mysqlnd"
          ];
        # preConfigure = (old.preConfigure or "") + ''
        #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
        #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
        #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
        #   '';
      });
    }) ];

    secrets.keys = [{
      dest = "apache-ldap";
      user = "wwwrun";
      group = "wwwrun";
      permissions = "0400";
      text = ''
        <Macro LDAPConnect>
          <IfModule authnz_ldap_module>
            AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
            AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
            AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
            AuthType             Basic
            AuthName             "Authentification requise (Acces LDAP)"
            AuthBasicProvider    ldap
          </IfModule>
        </Macro>
        '';
    }];

    system.activationScripts = {
      httpd = ''
        install -d -m 0755 /var/lib/acme/acme-challenges
        install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
        '';
    };

    services.phpfpm = {
      phpOptions = ''
        session.save_path = "/var/lib/php/sessions"
        post_max_size = 20M
        ; 15 days (seconds)
        session.gc_maxlifetime = 1296000
        ; 30 days (minutes)
        session.cache_expire = 43200
        '';
      settings = {
        log_level = "notice";
      };
    };

    services.filesWatcher.httpdProd.paths = [ "/var/secrets/apache-ldap" ];
    services.filesWatcher.httpdInte.paths = [ "/var/secrets/apache-ldap" ];
    services.filesWatcher.httpdTools.paths = [ "/var/secrets/apache-ldap" ];

    services.websites.env.production = {
      enable = true;
      adminAddr = "httpd@immae.eu";
      httpdName = "Prod";
      ips =
        let ips = config.myEnv.servers.eldiron.ips.production;
        in [ips.ip4] ++ (ips.ip6 or []);
      modules = makeModules;
      extraConfig = makeExtraConfig;
      fallbackVhost = {
        certName    = "eldiron";
        hosts       = ["eldiron.immae.eu" ];
        root        = www_root;
        extraConfig = [ "DirectoryIndex index.htm" ];
      };
    };

    services.websites.env.integration = {
      enable = true;
      adminAddr = "httpd@immae.eu";
      httpdName = "Inte";
      ips =
        let ips = config.myEnv.servers.eldiron.ips.integration;
        in [ips.ip4] ++ (ips.ip6 or []);
      modules = makeModules;
      extraConfig = makeExtraConfig;
      fallbackVhost = {
        certName    = "eldiron";
        hosts       = ["eldiron.immae.eu" ];
        root        = www_root;
        extraConfig = [ "DirectoryIndex index.htm" ];
      };
    };

    services.websites.env.tools = {
      enable = true;
      adminAddr = "httpd@immae.eu";
      httpdName = "Tools";
      ips =
        let ips = config.myEnv.servers.eldiron.ips.main;
        in [ips.ip4] ++ (ips.ip6 or []);
      modules = makeModules;
      extraConfig = makeExtraConfig ++
        [ ''
            RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
            RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
            RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
            RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
            RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
            RedirectMatch ^/CGU$ https://www.immae.eu/CGU
          ''
          ];
      nosslVhost = {
        enable = true;
        host = "nossl.immae.eu";
      };
      fallbackVhost = {
        certName    = "eldiron";
        hosts       = ["eldiron.immae.eu" ];
        root        = www_root;
        extraConfig = [ "DirectoryIndex index.htm" ];
      };
    };

    services.websites.webappDirs = {
      _www = ./_www;
      _theme = pkgs.webapps.apache-theme.theme;
    };
    myServices.websites = {
      capitaines.landing_pages.enable = true;

      chloe = {
        integration.enable = true;
        production.enable = true;
      };

      connexionswing = {
        integration.enable = true;
        production.enable = true;
      };

      denise = {
        evariste.enable = true;
        denisejerome.enable = true;
      };

      emilia.moodle.enable = true;

      florian = {
        app.enable = true;
        integration.enable = true;
        production.enable = true;
      };

      immae = {
        production.enable = true;
        release.enable = true;
        temp.enable = true;
      };

      isabelle = {
        aten_integration.enable = true;
        aten_production.enable = true;
        iridologie.enable = true;
      };

      jerome.naturaloutil.enable = true;

      leila.production.enable = true;

      ludivine = {
        integration.enable = true;
        production.enable = true;
      };

      nassime.production.enable = true;

      nathanael.villon.enable = true;

      papa = {
        surveillance.enable = true;
        maison_bbc.enable = true;
      };

      piedsjaloux = {
        integration.enable = true;
        production.enable = true;
      };

      richie.production.enable = true;

      syden.peertube.enable = true;

      telio_tortay.production.enable = true;

      tools.cloud.enable = true;
      tools.dav.enable = true;
      tools.db.enable = true;
      tools.diaspora.enable = true;
      tools.etherpad-lite.enable = true;
      tools.git.enable = true;
      tools.mastodon.enable = true;
      tools.mediagoblin.enable = true;
      tools.peertube.enable = true;
      tools.tools.enable = true;
      tools.email.enable = true;

      games.codenames.enable = true;
    };
  };
}
Commit	Line	Data
ab8f306d	1	{ lib, pkgs, config, ... }:
4288c2f2 IB	2	let
	3	www_root = "/run/current-system/webapps/_www";
	4	theme_root = "/run/current-system/webapps/_theme";
	5	apacheConfig = {
9271611c IB	6	cache = {
	7	# This setting permits to ignore time-based cache for files in the
	8	# nix store:
	9	# If a client requires an If-Modified-Since from timestamp 1, then
	10	# this header is removed, and if the response contains a
	11	# too old Last-Modified tag, then it is removed too
	12	extraConfig = ''
	13	<If "%{HTTP:If-Modified-Since} =~ /01 Jan 1970 00:00:01/" >
	14	RequestHeader unset If-Modified-Since
	15	</If>
	16	Header unset Last-Modified "expr=%{LAST_MODIFIED} < 19991231235959"
	17	'';
	18	};
4288c2f2 IB	19	gzip = {
	20	modules = [ "deflate" "filter" ];
	21	extraConfig = ''
	22	AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
	23	'';
	24	};
	25	macros = {
	26	modules = [ "macro" ];
	27	};
	28	stats = {
	29	extraConfig = ''
	30	<Macro Stats %{domain}>
	31	Alias /webstats ${config.services.webstats.dataDir}/%{domain}
	32	<Directory ${config.services.webstats.dataDir}/%{domain}>
	33	DirectoryIndex index.html
	34	AllowOverride None
	35	Require all granted
	36	</Directory>
	37	<Location /webstats>
	38	Use LDAPConnect
	39	Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
	40	</Location>
	41	</Macro>
	42	'';
	43	};
	44	ldap = {
	45	modules = [ "ldap" "authnz_ldap" ];
	46	extraConfig = ''
	47	<IfModule ldap_module>
	48	LDAPSharedCacheSize 500000
	49	LDAPCacheEntries 1024
	50	LDAPCacheTTL 600
	51	LDAPOpCacheEntries 1024
	52	LDAPOpCacheTTL 600
	53	</IfModule>
	54
	55	Include /var/secrets/apache-ldap
	56	'';
	57	};
	58	global = {
d3452fc5 IB	59	extraConfig = ''
	60	ErrorDocument 500 /maintenance_immae.html
	61	ErrorDocument 501 /maintenance_immae.html
	62	ErrorDocument 502 /maintenance_immae.html
	63	ErrorDocument 503 /maintenance_immae.html
	64	ErrorDocument 504 /maintenance_immae.html
	65	Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
	66	ProxyPass /maintenance_immae.html !
	67
	68	AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
	69	<Directory ${www_root}>
	70	AllowOverride None
	71	Require all granted
	72	</Directory>
	73	'';
4288c2f2 IB	74	};
	75	apaxy = {
	76	extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
	77	};
	78	http2 = {
	79	modules = [ "http2" ];
	80	extraConfig = ''
	81	Protocols h2 http/1.1
	82	'';
	83	};
	84	customLog = {
	85	extraConfig = ''
494d0718	86	LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
4288c2f2 IB	87	'';
	88	};
	89	};
	90	makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
	91	makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
	92	in
f8026b6e	93	{
d3452fc5	94	options.myServices.websites.enable = lib.mkEnableOption "enable websites";
4288c2f2	95
8415083e	96	config = lib.mkIf config.myServices.websites.enable {
d2e703c5	97	services.duplyBackup.profiles.php = {
6a8252b1 IB	98	rootDir = "/var/lib/php";
6a8252b1 IB	99	};
4288c2f2 IB	100	users.users.wwwrun.extraGroups = [ "keys" ];
	101	networking.firewall.allowedTCPPorts = [ 80 443 ];
	102
	103	nixpkgs.overlays = [ (self: super: rec {
4288c2f2	104	php72 = (super.php72.override {
5400b9b6	105	config.php.mysqlnd = true;
4288c2f2	106	config.php.mysqli = false;
5400b9b6	107	config.php.mhash = true; # Is it needed?
4288c2f2 IB	108	}).overrideAttrs(old: rec {
	109	# Didn't manage to build with mysqli + mysql_config connector
	110	configureFlags = old.configureFlags ++ [
	111	"--with-mysqli=shared,mysqlnd"
	112	];
	113	# preConfigure = (old.preConfigure or "") + ''
	114	# export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
	115	# sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
	116	# ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
	117	# '';
	118	});
4288c2f2 IB	119	}) ];
	120
	121	secrets.keys = [{
	122	dest = "apache-ldap";
	123	user = "wwwrun";
	124	group = "wwwrun";
	125	permissions = "0400";
	126	text = ''
	127	<Macro LDAPConnect>
	128	<IfModule authnz_ldap_module>
	129	AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
	130	AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
ab8f306d	131	AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
4288c2f2 IB	132	AuthType Basic
	133	AuthName "Authentification requise (Acces LDAP)"
	134	AuthBasicProvider ldap
	135	</IfModule>
	136	</Macro>
	137	'';
	138	}];
	139
	140	system.activationScripts = {
	141	httpd = ''
3ffa15ba	142	install -d -m 0755 /var/lib/acme/acme-challenges
4288c2f2 IB	143	install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
	144	'';
	145	};
	146
	147	services.phpfpm = {
4288c2f2 IB	148	phpOptions = ''
	149	session.save_path = "/var/lib/php/sessions"
	150	post_max_size = 20M
	151	; 15 days (seconds)
	152	session.gc_maxlifetime = 1296000
	153	; 30 days (minutes)
	154	session.cache_expire = 43200
	155	'';
5400b9b6 IB	156	settings = {
	157	log_level = "notice";
	158	};
4288c2f2 IB	159	};
4288c2f2 IB	160
17f6eae9 IB	161	services.filesWatcher.httpdProd.paths = [ "/var/secrets/apache-ldap" ];
	162	services.filesWatcher.httpdInte.paths = [ "/var/secrets/apache-ldap" ];
	163	services.filesWatcher.httpdTools.paths = [ "/var/secrets/apache-ldap" ];
	164
29f8cb85	165	services.websites.env.production = {
4288c2f2 IB	166	enable = true;
	167	adminAddr = "httpd@immae.eu";
	168	httpdName = "Prod";
	169	ips =
ab8f306d	170	let ips = config.myEnv.servers.eldiron.ips.production;
4288c2f2 IB	171	in [ips.ip4] ++ (ips.ip6 or []);
	172	modules = makeModules;
	173	extraConfig = makeExtraConfig;
	174	fallbackVhost = {
	175	certName = "eldiron";
	176	hosts = ["eldiron.immae.eu" ];
	177	root = www_root;
	178	extraConfig = [ "DirectoryIndex index.htm" ];
	179	};
	180	};
	181
29f8cb85	182	services.websites.env.integration = {
4288c2f2 IB	183	enable = true;
	184	adminAddr = "httpd@immae.eu";
	185	httpdName = "Inte";
	186	ips =
ab8f306d	187	let ips = config.myEnv.servers.eldiron.ips.integration;
4288c2f2 IB	188	in [ips.ip4] ++ (ips.ip6 or []);
	189	modules = makeModules;
	190	extraConfig = makeExtraConfig;
	191	fallbackVhost = {
	192	certName = "eldiron";
	193	hosts = ["eldiron.immae.eu" ];
	194	root = www_root;
	195	extraConfig = [ "DirectoryIndex index.htm" ];
	196	};
	197	};
	198
29f8cb85	199	services.websites.env.tools = {
4288c2f2 IB	200	enable = true;
	201	adminAddr = "httpd@immae.eu";
	202	httpdName = "Tools";
	203	ips =
ab8f306d	204	let ips = config.myEnv.servers.eldiron.ips.main;
4288c2f2 IB	205	in [ips.ip4] ++ (ips.ip6 or []);
	206	modules = makeModules;
	207	extraConfig = makeExtraConfig ++
	208	[ ''
	209	RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
	210	RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
	211	RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
	212	RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
	213	RedirectMatch ^/(mentions\|mentions_legales\|legal)$ https://www.immae.eu/mentions.html
	214	RedirectMatch ^/CGU$ https://www.immae.eu/CGU
	215	''
	216	];
	217	nosslVhost = {
	218	enable = true;
	219	host = "nossl.immae.eu";
	220	};
	221	fallbackVhost = {
	222	certName = "eldiron";
	223	hosts = ["eldiron.immae.eu" ];
	224	root = www_root;
	225	extraConfig = [ "DirectoryIndex index.htm" ];
	226	};
	227	};
	228
d3452fc5 IB	229	services.websites.webappDirs = {
	230	_www = ./_www;
	231	_theme = pkgs.webapps.apache-theme.theme;
	232	};
4288c2f2	233	myServices.websites = {
d3452fc5	234	capitaines.landing_pages.enable = true;
4288c2f2	235
d3452fc5 IB	236	chloe = {
	237	integration.enable = true;
	238	production.enable = true;
	239	};
4288c2f2	240
d3452fc5 IB	241	connexionswing = {
	242	integration.enable = true;
	243	production.enable = true;
	244	};
f8026b6e	245
d3452fc5 IB	246	denise = {
	247	evariste.enable = true;
	248	denisejerome.enable = true;
	249	};
f8026b6e	250
d3452fc5	251	emilia.moodle.enable = true;
f8026b6e	252
d3452fc5 IB	253	florian = {
	254	app.enable = true;
	255	integration.enable = true;
	256	production.enable = true;
	257	};
f8026b6e	258
d3452fc5 IB	259	immae = {
	260	production.enable = true;
	261	release.enable = true;
	262	temp.enable = true;
	263	};
f8026b6e	264
d3452fc5 IB	265	isabelle = {
	266	aten_integration.enable = true;
	267	aten_production.enable = true;
	268	iridologie.enable = true;
	269	};
f8026b6e	270
d3452fc5	271	jerome.naturaloutil.enable = true;
f8026b6e	272
4288c2f2	273	leila.production.enable = true;
f8026b6e	274
d3452fc5 IB	275	ludivine = {
	276	integration.enable = true;
	277	production.enable = true;
	278	};
f8026b6e	279
4288c2f2	280	nassime.production.enable = true;
f8026b6e	281
8722d693 IB	282	nathanael.villon.enable = true;
8722d693 IB	283
d3452fc5 IB	284	papa = {
	285	surveillance.enable = true;
	286	maison_bbc.enable = true;
	287	};
f8026b6e	288
d3452fc5 IB	289	piedsjaloux = {
	290	integration.enable = true;
	291	production.enable = true;
	292	};
f8026b6e	293
d3452fc5	294	richie.production.enable = true;
f8026b6e	295
8a05c7fb IB	296	syden.peertube.enable = true;
8a05c7fb IB	297
d3452fc5 IB	298	telio_tortay.production.enable = true;
d3452fc5 IB	299
4288c2f2 IB	300	tools.cloud.enable = true;
	301	tools.dav.enable = true;
	302	tools.db.enable = true;
	303	tools.diaspora.enable = true;
	304	tools.etherpad-lite.enable = true;
	305	tools.git.enable = true;
	306	tools.mastodon.enable = true;
	307	tools.mediagoblin.enable = true;
	308	tools.peertube.enable = true;
	309	tools.tools.enable = true;
afcc5de0	310	tools.email.enable = true;
de6002a1 IB	311
de6002a1 IB	312	games.codenames.enable = true;
4288c2f2 IB	313	};
4288c2f2 IB	314	};
f8026b6e	315	}