[perso/Immae/Config/Nix.git] / nixops / modules / websites / default.nix

{ lib, pkgs, config, mylibs, myconfig, ... }:
let
  cfg = config.services.myWebsites;
  www_root = "/run/current-system/webapps/_www";
  theme_root = "/run/current-system/webapps/_theme";
  makeService = name: cfg: let
    toVhost = vhostConf: {
      enableSSL = true;
      sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
      sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
      sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem";
      logFormat = "combinedVhost";
      listen = [
        { ip = cfg.ip;  port = 443; }
      ];
      hostName = builtins.head vhostConf.hosts;
      serverAliases = builtins.tail vhostConf.hosts or [];
      documentRoot = vhostConf.root;
      extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
    };
    nosslVhost = {
      listen = [ { ip = cfg.ip; port = 80; } ];
      hostName = "nossl.immae.eu";
      enableSSL = false;
      logFormat = "combinedVhost";
      documentRoot = www_root;
      extraConfig = ''
        <Directory ${www_root}>
          DirectoryIndex nossl.html
          AllowOverride None
          Require all granted

          RewriteEngine on
          RewriteRule ^/(.+)   /   [L]
        </Directory>
        '';
    };
    redirectVhost = { # Should go last, catchall http -> https redirect
      listen = [ { ip = cfg.ip; port = 80; } ];
      hostName = "redirectSSL";
      serverAliases = [ "*" ];
      enableSSL = false;
      logFormat = "combinedVhost";
      documentRoot = "/var/lib/acme/acme-challenge";
      extraConfig = ''
        RewriteEngine on
        RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
        RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
        # To redirect in specific "VirtualHost *:80", do
        #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
        # rather than rewrite
      '';
    };
    fallbackVhost = toVhost { # Should go first, default choice
      certName    = "eldiron";
      hosts       = ["eldiron.immae.eu" ];
      root        = www_root;
      extraConfig = [ "DirectoryIndex index.htm" ];
    };
  in rec {
    enable = true;
    listen = [
      { ip = cfg.ip;  port = 443; }
    ];
    stateDir = "/run/httpd_${name}";
    logPerVirtualHost = true;
    multiProcessingModule = "worker";
    adminAddr = "httpd@immae.eu";
    logFormat = "combinedVhost";
    extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
    extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
    virtualHosts = [ fallbackVhost ]
      ++ lib.optionals (name == "tools") [ nosslVhost ]
      ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
      ++ [ redirectVhost ];
  };
  makeServiceOptions = name: ip: {
    enable = lib.mkEnableOption "enable websites in ${name}";
    ip = lib.mkOption {
      type = lib.types.string;
      default = ip;
      description = "${name} ip to listen to";
    };
    modules = lib.mkOption {
      type = lib.types.listOf (lib.types.str);
      default = [];
    };
    extraConfig = lib.mkOption {
      type = lib.types.listOf (lib.types.lines);
      default = [];
    };
    vhostConfs = lib.mkOption {
      type = lib.types.attrsOf (lib.types.submodule {
        options = {
          certName = lib.mkOption { type = lib.types.string; };
          hosts    = lib.mkOption { type = lib.types.listOf lib.types.string; };
          root     = lib.mkOption { type = lib.types.nullOr lib.types.path; };
          extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
        };
      });
    };
  };
  makeModules = cfg: pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
  makeExtraConfig = cfg: (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
in
{
  imports = [
    ./chloe
    ./ludivine
    ./aten
    ./piedsjaloux
    ./connexionswing
    ./tellesflorian
    ./emilia
    ./capitaines
    ./ftp/jerome.nix
    ./ftp/nassime.nix
    ./ftp/florian.nix
    ./ftp/denisejerome.nix
    ./ftp/immae.nix
    ./ftp/release.nix
    ./ftp/temp.nix
    ./tools/db
    ./tools/tools
    ./tools/dav
    ./tools/cloud
    ./tools/git
    ./tools/mastodon
    ./tools/mediagoblin
    ./tools/diaspora
    ./tools/ether
    ./tools/peertube
    # built using:
    # sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
    # Removed allGranted
    # And removed users / groups
    ./apache/httpd_prod.nix
    ./apache/httpd_inte.nix
    # except for this one for users/groups
    ./apache/httpd_tools.nix
    # Adapted from base phpfpm
    ./phpfpm
  ];

  options.services.myWebsites = {
    production = makeServiceOptions "production" myconfig.ips.production;
    integration = makeServiceOptions "integration" myconfig.ips.integration;
    tools = makeServiceOptions "tools" myconfig.ips.main;

    apacheConfig = lib.mkOption {
      type = lib.types.attrsOf (lib.types.submodule {
        options = {
          modules = lib.mkOption {
            type = lib.types.listOf (lib.types.str);
            default = [];
          };
          extraConfig = lib.mkOption {
            type = lib.types.nullOr lib.types.lines;
            default = null;
          };
        };
      });
      default = {};
      description = "Extra global config";
    };

  };

  config = {
    networking = {
      firewall = {
        enable = true;
        allowedTCPPorts = [ 80 443 ];
      };
      interfaces."eth0".ipv4.addresses = [
        # 176.9.151.89 declared in nixops -> infra / tools
        { address = myconfig.ips.production; prefixLength = 32; }
        { address = myconfig.ips.integration; prefixLength = 32; }
      ];
    };

    nixpkgs.config.packageOverrides = oldpkgs: rec {
      php = php72;
      php72 = (oldpkgs.php72.override {
        mysql.connector-c = pkgs.mariadb;
        config.php.mysqlnd = false;
        config.php.mysqli = false;
      }).overrideAttrs(old: rec {
        # Didn't manage to build with mysqli + mysql_config connector
        configureFlags = old.configureFlags ++ [
          "--with-mysqli=shared,mysqlnd"
          ];
        # preConfigure = (old.preConfigure or "") + ''
        #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
        #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
        #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
        #   '';
      });
      phpPackages = oldpkgs.php72Packages.override { inherit php; };
      composerEnv = import ./commons/composer-env.nix {
        inherit (pkgs) stdenv writeTextFile fetchurl php unzip;
      };
    };

    services.myWebsites.tools.databases.enable = true;
    services.myWebsites.tools.tools.enable = true;
    services.myWebsites.tools.dav.enable = true;
    services.myWebsites.tools.cloud.enable = true;
    services.myWebsites.tools.git.enable = true;
    services.myWebsites.tools.mastodon.enable = true;
    services.myWebsites.tools.mediagoblin.enable = true;
    services.myWebsites.tools.diaspora.enable = true;
    services.myWebsites.tools.etherpad-lite.enable = true;
    services.myWebsites.tools.peertube.enable = true;

    services.myWebsites.Chloe.production.enable = cfg.production.enable;
    services.myWebsites.Ludivine.production.enable = cfg.production.enable;
    services.myWebsites.Aten.production.enable = cfg.production.enable;
    services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
    services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
    services.myWebsites.Jerome.production.enable = cfg.production.enable;
    services.myWebsites.Nassime.production.enable = cfg.production.enable;
    services.myWebsites.Florian.production.enable = cfg.production.enable;
    services.myWebsites.DeniseJerome.production.enable = cfg.production.enable;
    services.myWebsites.Emilia.production.enable = cfg.production.enable;
    services.myWebsites.Capitaines.production.enable = cfg.production.enable;
    services.myWebsites.Immae.production.enable = cfg.production.enable;
    services.myWebsites.Release.production.enable = cfg.production.enable;
    services.myWebsites.Temp.production.enable = cfg.production.enable;

    services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
    services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
    services.myWebsites.Aten.integration.enable = cfg.integration.enable;
    services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
    services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
    services.myWebsites.TellesFlorian.integration.enable = true;
    services.myWebsites.Florian.integration.enable = true;

    services.myWebsites.apacheConfig = {
      gzip = {
        modules = [ "deflate" "filter" ];
        extraConfig = ''
          AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
        '';
      };
      macros = {
        modules = [ "macro" ];
      };
      stats = {
        extraConfig = ''
          <Macro Stats %{domain}>
            Alias /awstats /var/lib/goaccess/%{domain}
            <Directory /var/lib/goaccess/%{domain}>
              DirectoryIndex index.html
              AllowOverride None
              Require all granted
            </Directory>
            <Location /awstats>
              Use LDAPConnect
              Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
            </Location>
          </Macro>
        '';
      };
      ldap = {
        modules = [ "ldap" "authnz_ldap" ];
        extraConfig = ''
          <IfModule ldap_module>
            LDAPSharedCacheSize 500000
            LDAPCacheEntries 1024
            LDAPCacheTTL 600
            LDAPOpCacheEntries 1024
            LDAPOpCacheTTL 600
          </IfModule>

          <Macro LDAPConnect>
            <IfModule authnz_ldap_module>
              AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
              AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
              AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
              AuthType             Basic
              AuthName             "Authentification requise (Acces LDAP)"
              AuthBasicProvider    ldap
            </IfModule>
          </Macro>
        '';
      };
      global = {
        extraConfig = ''
          ErrorDocument 500 /maintenance_immae.html
          ErrorDocument 501 /maintenance_immae.html
          ErrorDocument 502 /maintenance_immae.html
          ErrorDocument 503 /maintenance_immae.html
          ErrorDocument 504 /maintenance_immae.html
          Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
          ProxyPass /maintenance_immae.html !

          AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
          <Directory ${www_root}>
            AllowOverride None
            Require all granted
          </Directory>
        '';
      };
      apaxy = {
        extraConfig = ''
          <Macro Apaxy %{folder} %{ignored}>
            Alias /theme ${theme_root}
            <Directory ${theme_root}>
              Options -Indexes
              AllowOverride None
              Require all granted
            </Directory>

            # mod_autoindex
            <Directory %{folder}>
              Options Indexes
              AllowOverride None
              Require all granted

              # Inspired from Apaxy by @adamwhitcroft

              IndexOptions +Charset=UTF-8 +FancyIndexing +IgnoreCase +FoldersFirst +XHTML +HTMLTable +SuppressRules +SuppressDescription +NameWidth=* +IconsAreLinks +ShowForbidden

              IndexHeadInsert "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />"

              IndexIgnoreReset ON
              IndexIgnore /theme .htaccess %{ignored}

              AddIcon /theme/icons/blank.png ^^BLANKICON^^
              AddIcon /theme/icons/folder.png ^^DIRECTORY^^
              AddIcon /theme/icons/folder-home.png ..

              AddIconByType (TXT,/theme/icons/text.png) text/*
              AddIconByType (IMG,/theme/icons/image.png) image/*
              AddIconByType (SND,/theme/icons/audio.png) audio/*
              AddIconByType (VID,/theme/icons/video.png) video/*

              AddIcon /theme/icons/archive.png .7z .bz2 .cab .gz .tar
              AddIcon /theme/icons/audio.png .aac .aif .aifc .aiff .ape .au .flac .iff .m4a .mid .mp3 .mpa .ra .wav .wma .f4a .f4b .oga .ogg .xm .it .s3m .mod
              AddIcon /theme/icons/bin.png .bin .hex
              AddIcon /theme/icons/bmp.png .bmp
              AddIcon /theme/icons/c.png .c
              AddIcon /theme/icons/calc.png .xlsx .xlsm .xltx .xltm .xlam .xlr .xls .csv
              AddIcon /theme/icons/cd.png .iso
              AddIcon /theme/icons/cpp.png .cpp
              AddIcon /theme/icons/css.png .css .sass .scss
              AddIcon /theme/icons/deb.png .deb
              AddIcon /theme/icons/doc.png .doc .docx .docm .dot .dotx .dotm .log .msg .odt .pages .rtf .tex .wpd .wps
              AddIcon /theme/icons/draw.png .svg .svgz
              AddIcon /theme/icons/eps.png .ai .eps
              AddIcon /theme/icons/exe.png .exe
              AddIcon /theme/icons/gif.png .gif
              AddIcon /theme/icons/h.png .h
              AddIcon /theme/icons/html.png .html .xhtml .shtml .htm .URL .url
              AddIcon /theme/icons/ico.png .ico
              AddIcon /theme/icons/java.png .jar
              AddIcon /theme/icons/jpg.png .jpg .jpeg .jpe
              AddIcon /theme/icons/js.png .js .json
              AddIcon /theme/icons/markdown.png .md
              AddIcon /theme/icons/package.png .pkg .dmg
              AddIcon /theme/icons/pdf.png .pdf
              AddIcon /theme/icons/php.png .php .phtml
              AddIcon /theme/icons/playlist.png .m3u .m3u8 .pls .pls8
              AddIcon /theme/icons/png.png .png
              AddIcon /theme/icons/ps.png .ps
              AddIcon /theme/icons/psd.png .psd
              AddIcon /theme/icons/py.png .py
              AddIcon /theme/icons/rar.png .rar
              AddIcon /theme/icons/rb.png .rb
              AddIcon /theme/icons/rpm.png .rpm
              AddIcon /theme/icons/rss.png .rss
              AddIcon /theme/icons/script.png .bat .cmd .sh
              AddIcon /theme/icons/sql.png .sql
              AddIcon /theme/icons/tiff.png .tiff .tif
              AddIcon /theme/icons/text.png .txt .nfo
              AddIcon /theme/icons/video.png .asf .asx .avi .flv .mkv .mov .mp4 .mpg .rm .srt .swf .vob .wmv .m4v .f4v .f4p .ogv
              AddIcon /theme/icons/xml.png .xml
              AddIcon /theme/icons/zip.png .zip
              DefaultIcon /theme/icons/default.png

              HeaderName /theme/header.html
              ReadmeName /theme/footer.html
              IndexStyleSheet /theme/style.css
            </Directory>
          </Macro>
        '';
      };
      http2 = {
        modules = [ "http2" ];
        extraConfig = ''
          Protocols h2 http/1.1
        '';
      };
      customLog = {
        extraConfig = ''
          LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
        '';
      };
    };

    system.activationScripts = {
      httpd = ''
        install -d -m 0755 /var/lib/acme/acme-challenge
        install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
        install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
        install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
        install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
        '';
    };

    system.extraSystemBuilderCmds = let
      adminer = pkgs.callPackage ./commons/adminer.nix {};
    in ''
      mkdir -p $out/webapps
      ln -s ${../../www} $out/webapps/_www
      ln -s ${./apache/theme} $out/webapps/_theme
      ln -s ${adminer.webRoot} $out/webapps/${adminer.apache.webappName}
      '';

    services.myPhpfpm = {
      phpPackage = pkgs.php;
      phpOptions = ''
        session.save_path = "/var/lib/php/sessions"
        post_max_size = 20M
        session.gc_maxlifetime = 60*60*24*15
        session.cache_expire = 60*24*30
        '';
      extraConfig = ''
        log_level = notice
        '';
    };

    services.httpdProd = makeService "production" config.services.myWebsites.production;
    services.myWebsites.production.modules = makeModules cfg;
    services.myWebsites.production.extraConfig = makeExtraConfig cfg;

    services.httpdInte = makeService "integration" config.services.myWebsites.integration;
    services.myWebsites.integration.modules = makeModules cfg;
    services.myWebsites.integration.extraConfig = makeExtraConfig cfg;

    services.httpdTools = makeService "tools" config.services.myWebsites.tools;
    services.myWebsites.tools.modules = makeModules cfg;
    services.myWebsites.tools.extraConfig = makeExtraConfig cfg ++
    [ ''
        RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
        RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
        RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
        RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
        RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
        RedirectMatch ^/CGU$ https://www.immae.eu/CGU
      ''
      ]
    ;
  };
}
Commit	Line	Data
f8bde3d6	1	{ lib, pkgs, config, mylibs, myconfig, ... }:
42429ef0 IB	2	let
42429ef0 IB	3	cfg = config.services.myWebsites;
7da3ceec IB	4	www_root = "/run/current-system/webapps/_www";
7da3ceec IB	5	theme_root = "/run/current-system/webapps/_theme";
f8bde3d6 IB	6	makeService = name: cfg: let
	7	toVhost = vhostConf: {
	8	enableSSL = true;
	9	sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
	10	sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
	11	sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem";
	12	logFormat = "combinedVhost";
	13	listen = [
	14	{ ip = cfg.ip; port = 443; }
	15	];
	16	hostName = builtins.head vhostConf.hosts;
	17	serverAliases = builtins.tail vhostConf.hosts or [];
	18	documentRoot = vhostConf.root;
	19	extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
	20	};
e2f5cc37 IB	21	nosslVhost = {
	22	listen = [ { ip = cfg.ip; port = 80; } ];
	23	hostName = "nossl.immae.eu";
	24	enableSSL = false;
	25	logFormat = "combinedVhost";
7da3ceec	26	documentRoot = www_root;
e2f5cc37	27	extraConfig = ''
7da3ceec	28	<Directory ${www_root}>
e2f5cc37 IB	29	DirectoryIndex nossl.html
	30	AllowOverride None
	31	Require all granted
	32
	33	RewriteEngine on
	34	RewriteRule ^/(.+) / [L]
	35	</Directory>
	36	'';
	37	};
950ca5ee IB	38	redirectVhost = { # Should go last, catchall http -> https redirect
	39	listen = [ { ip = cfg.ip; port = 80; } ];
	40	hostName = "redirectSSL";
	41	serverAliases = [ "*" ];
	42	enableSSL = false;
	43	logFormat = "combinedVhost";
	44	documentRoot = "/var/lib/acme/acme-challenge";
	45	extraConfig = ''
	46	RewriteEngine on
	47	RewriteCond "%{REQUEST_URI}" "!^/\.well-known"
	48	RewriteRule ^(.+) https://%{HTTP_HOST}$1 [R=301]
	49	# To redirect in specific "VirtualHost *:80", do
	50	# RedirectMatch 301 ^/((?!\.well-known.$).)$ https://host/$1
	51	# rather than rewrite
	52	'';
	53	};
	54	fallbackVhost = toVhost { # Should go first, default choice
	55	certName = "eldiron";
	56	hosts = ["eldiron.immae.eu" ];
7da3ceec	57	root = www_root;
950ca5ee IB	58	extraConfig = [ "DirectoryIndex index.htm" ];
950ca5ee IB	59	};
f8bde3d6 IB	60	in rec {
	61	enable = true;
	62	listen = [
	63	{ ip = cfg.ip; port = 443; }
	64	];
	65	stateDir = "/run/httpd_${name}";
	66	logPerVirtualHost = true;
	67	multiProcessingModule = "worker";
	68	adminAddr = "httpd@immae.eu";
	69	logFormat = "combinedVhost";
	70	extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
	71	extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
950ca5ee	72	virtualHosts = [ fallbackVhost ]
e2f5cc37	73	++ lib.optionals (name == "tools") [ nosslVhost ]
950ca5ee IB	74	++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
950ca5ee IB	75	++ [ redirectVhost ];
f8bde3d6 IB	76	};
	77	makeServiceOptions = name: ip: {
	78	enable = lib.mkEnableOption "enable websites in ${name}";
	79	ip = lib.mkOption {
	80	type = lib.types.string;
	81	default = ip;
	82	description = "${name} ip to listen to";
	83	};
	84	modules = lib.mkOption {
	85	type = lib.types.listOf (lib.types.str);
	86	default = [];
	87	};
	88	extraConfig = lib.mkOption {
	89	type = lib.types.listOf (lib.types.lines);
	90	default = [];
	91	};
	92	vhostConfs = lib.mkOption {
	93	type = lib.types.attrsOf (lib.types.submodule {
	94	options = {
	95	certName = lib.mkOption { type = lib.types.string; };
	96	hosts = lib.mkOption { type = lib.types.listOf lib.types.string; };
	97	root = lib.mkOption { type = lib.types.nullOr lib.types.path; };
	98	extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
	99	};
	100	});
	101	};
	102	};
f8d3b61a IB	103	makeModules = cfg: pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
f8d3b61a IB	104	makeExtraConfig = cfg: (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
42429ef0 IB	105	in
	106	{
	107	imports = [
54307da4 IB	108	./chloe
	109	./ludivine
	110	./aten
	111	./piedsjaloux
	112	./connexionswing
2f0f1c48	113	./tellesflorian
9a35b8f9	114	./emilia
10bd8c08	115	./capitaines
d578d270	116	./ftp/jerome.nix
53b8fad9	117	./ftp/nassime.nix
79f239be	118	./ftp/florian.nix
dc9fb826	119	./ftp/denisejerome.nix
f759f52e	120	./ftp/immae.nix
ce493c5d IB	121	./ftp/release.nix
ce493c5d IB	122	./ftp/temp.nix
10889174 IB	123	./tools/db
	124	./tools/tools
	125	./tools/dav
	126	./tools/cloud
	127	./tools/git
35a397cd	128	./tools/mastodon
56eba416	129	./tools/mediagoblin
a7f7fdae	130	./tools/diaspora
17146204	131	./tools/ether
0eaac6ba	132	./tools/peertube
f8bde3d6 IB	133	# built using:
f8bde3d6 IB	134	# sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
273e2c61	135	# Removed allGranted
f8bde3d6	136	# And removed users / groups
54307da4 IB	137	./apache/httpd_prod.nix
54307da4 IB	138	./apache/httpd_inte.nix
273e2c61 IB	139	# except for this one for users/groups
273e2c61 IB	140	./apache/httpd_tools.nix
10889174 IB	141	# Adapted from base phpfpm
10889174 IB	142	./phpfpm
42429ef0 IB	143	];
	144
	145	options.services.myWebsites = {
f8bde3d6 IB	146	production = makeServiceOptions "production" myconfig.ips.production;
f8bde3d6 IB	147	integration = makeServiceOptions "integration" myconfig.ips.integration;
950ca5ee	148	tools = makeServiceOptions "tools" myconfig.ips.main;
42429ef0 IB	149
	150	apacheConfig = lib.mkOption {
	151	type = lib.types.attrsOf (lib.types.submodule {
	152	options = {
	153	modules = lib.mkOption {
	154	type = lib.types.listOf (lib.types.str);
	155	default = [];
	156	};
	157	extraConfig = lib.mkOption {
	158	type = lib.types.nullOr lib.types.lines;
	159	default = null;
	160	};
	161	};
	162	});
	163	default = {};
	164	description = "Extra global config";
	165	};
	166
	167	};
	168
	169	config = {
54307da4 IB	170	networking = {
	171	firewall = {
	172	enable = true;
	173	allowedTCPPorts = [ 80 443 ];
	174	};
	175	interfaces."eth0".ipv4.addresses = [
	176	# 176.9.151.89 declared in nixops -> infra / tools
	177	{ address = myconfig.ips.production; prefixLength = 32; }
	178	{ address = myconfig.ips.integration; prefixLength = 32; }
	179	];
	180	};
	181
98584540 IB	182	nixpkgs.config.packageOverrides = oldpkgs: rec {
	183	php = php72;
	184	php72 = (oldpkgs.php72.override {
	185	mysql.connector-c = pkgs.mariadb;
	186	config.php.mysqlnd = false;
	187	config.php.mysqli = false;
	188	}).overrideAttrs(old: rec {
	189	# Didn't manage to build with mysqli + mysql_config connector
	190	configureFlags = old.configureFlags ++ [
912921a7	191	"--with-mysqli=shared,mysqlnd"
98584540 IB	192	];
	193	# preConfigure = (old.preConfigure or "") + ''
	194	# export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
	195	# sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
	196	# ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
	197	# '';
	198	});
	199	phpPackages = oldpkgs.php72Packages.override { inherit php; };
d78128ec IB	200	composerEnv = import ./commons/composer-env.nix {
	201	inherit (pkgs) stdenv writeTextFile fetchurl php unzip;
	202	};
98584540 IB	203	};
98584540 IB	204
10889174 IB	205	services.myWebsites.tools.databases.enable = true;
	206	services.myWebsites.tools.tools.enable = true;
	207	services.myWebsites.tools.dav.enable = true;
	208	services.myWebsites.tools.cloud.enable = true;
	209	services.myWebsites.tools.git.enable = true;
35a397cd	210	services.myWebsites.tools.mastodon.enable = true;
56eba416	211	services.myWebsites.tools.mediagoblin.enable = true;
a7f7fdae	212	services.myWebsites.tools.diaspora.enable = true;
17146204	213	services.myWebsites.tools.etherpad-lite.enable = true;
0eaac6ba	214	services.myWebsites.tools.peertube.enable = true;
10889174	215
42429ef0 IB	216	services.myWebsites.Chloe.production.enable = cfg.production.enable;
	217	services.myWebsites.Ludivine.production.enable = cfg.production.enable;
	218	services.myWebsites.Aten.production.enable = cfg.production.enable;
	219	services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
	220	services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
d578d270	221	services.myWebsites.Jerome.production.enable = cfg.production.enable;
53b8fad9	222	services.myWebsites.Nassime.production.enable = cfg.production.enable;
79f239be	223	services.myWebsites.Florian.production.enable = cfg.production.enable;
dc9fb826	224	services.myWebsites.DeniseJerome.production.enable = cfg.production.enable;
9a35b8f9	225	services.myWebsites.Emilia.production.enable = cfg.production.enable;
10bd8c08	226	services.myWebsites.Capitaines.production.enable = cfg.production.enable;
f759f52e	227	services.myWebsites.Immae.production.enable = cfg.production.enable;
ce493c5d IB	228	services.myWebsites.Release.production.enable = cfg.production.enable;
ce493c5d IB	229	services.myWebsites.Temp.production.enable = cfg.production.enable;
42429ef0 IB	230
	231	services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
	232	services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
	233	services.myWebsites.Aten.integration.enable = cfg.integration.enable;
	234	services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
	235	services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
2f0f1c48	236	services.myWebsites.TellesFlorian.integration.enable = true;
79f239be	237	services.myWebsites.Florian.integration.enable = true;
42429ef0 IB	238
	239	services.myWebsites.apacheConfig = {
	240	gzip = {
	241	modules = [ "deflate" "filter" ];
	242	extraConfig = ''
	243	AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
	244	'';
	245	};
	246	macros = {
	247	modules = [ "macro" ];
	248	};
ce493c5d IB	249	stats = {
	250	extraConfig = ''
	251	<Macro Stats %{domain}>
	252	Alias /awstats /var/lib/goaccess/%{domain}
	253	<Directory /var/lib/goaccess/%{domain}>
	254	DirectoryIndex index.html
	255	AllowOverride None
	256	Require all granted
	257	</Directory>
	258	<Location /awstats>
	259	Use LDAPConnect
	260	Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
	261	</Location>
	262	</Macro>
	263	'';
	264	};
42429ef0 IB	265	ldap = {
42429ef0 IB	266	modules = [ "ldap" "authnz_ldap" ];
9d90e7e2	267	extraConfig = ''
42429ef0 IB	268	<IfModule ldap_module>
	269	LDAPSharedCacheSize 500000
	270	LDAPCacheEntries 1024
	271	LDAPCacheTTL 600
	272	LDAPOpCacheEntries 1024
	273	LDAPOpCacheTTL 600
	274	</IfModule>
	275
	276	<Macro LDAPConnect>
	277	<IfModule authnz_ldap_module>
	278	AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
	279	AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
9d90e7e2	280	AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
42429ef0 IB	281	AuthType Basic
	282	AuthName "Authentification requise (Acces LDAP)"
	283	AuthBasicProvider ldap
	284	</IfModule>
	285	</Macro>
ce493c5d IB	286	'';
	287	};
	288	global = {
	289	extraConfig = ''
646bdf3e IB	290	ErrorDocument 500 /maintenance_immae.html
	291	ErrorDocument 501 /maintenance_immae.html
	292	ErrorDocument 502 /maintenance_immae.html
	293	ErrorDocument 503 /maintenance_immae.html
	294	ErrorDocument 504 /maintenance_immae.html
7da3ceec	295	Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
646bdf3e IB	296	ProxyPass /maintenance_immae.html !
646bdf3e IB	297
7da3ceec IB	298	AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
7da3ceec IB	299	<Directory ${www_root}>
d06ed384 IB	300	AllowOverride None
	301	Require all granted
	302	</Directory>
42429ef0 IB	303	'';
42429ef0 IB	304	};
ce493c5d IB	305	apaxy = {
	306	extraConfig = ''
	307	<Macro Apaxy %{folder} %{ignored}>
7da3ceec IB	308	Alias /theme ${theme_root}
7da3ceec IB	309	<Directory ${theme_root}>
ce493c5d IB	310	Options -Indexes
	311	AllowOverride None
	312	Require all granted
	313	</Directory>
	314
	315	# mod_autoindex
	316	<Directory %{folder}>
	317	Options Indexes
	318	AllowOverride None
	319	Require all granted
	320
	321	# Inspired from Apaxy by @adamwhitcroft
	322
	323	IndexOptions +Charset=UTF-8 +FancyIndexing +IgnoreCase +FoldersFirst +XHTML +HTMLTable +SuppressRules +SuppressDescription +NameWidth=* +IconsAreLinks +ShowForbidden
	324
	325	IndexHeadInsert "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />"
	326
	327	IndexIgnoreReset ON
	328	IndexIgnore /theme .htaccess %{ignored}
	329
	330	AddIcon /theme/icons/blank.png ^^BLANKICON^^
	331	AddIcon /theme/icons/folder.png ^^DIRECTORY^^
	332	AddIcon /theme/icons/folder-home.png ..
	333
	334	AddIconByType (TXT,/theme/icons/text.png) text/*
	335	AddIconByType (IMG,/theme/icons/image.png) image/*
	336	AddIconByType (SND,/theme/icons/audio.png) audio/*
	337	AddIconByType (VID,/theme/icons/video.png) video/*
	338
	339	AddIcon /theme/icons/archive.png .7z .bz2 .cab .gz .tar
	340	AddIcon /theme/icons/audio.png .aac .aif .aifc .aiff .ape .au .flac .iff .m4a .mid .mp3 .mpa .ra .wav .wma .f4a .f4b .oga .ogg .xm .it .s3m .mod
	341	AddIcon /theme/icons/bin.png .bin .hex
	342	AddIcon /theme/icons/bmp.png .bmp
	343	AddIcon /theme/icons/c.png .c
	344	AddIcon /theme/icons/calc.png .xlsx .xlsm .xltx .xltm .xlam .xlr .xls .csv
	345	AddIcon /theme/icons/cd.png .iso
	346	AddIcon /theme/icons/cpp.png .cpp
	347	AddIcon /theme/icons/css.png .css .sass .scss
	348	AddIcon /theme/icons/deb.png .deb
	349	AddIcon /theme/icons/doc.png .doc .docx .docm .dot .dotx .dotm .log .msg .odt .pages .rtf .tex .wpd .wps
	350	AddIcon /theme/icons/draw.png .svg .svgz
	351	AddIcon /theme/icons/eps.png .ai .eps
	352	AddIcon /theme/icons/exe.png .exe
	353	AddIcon /theme/icons/gif.png .gif
	354	AddIcon /theme/icons/h.png .h
	355	AddIcon /theme/icons/html.png .html .xhtml .shtml .htm .URL .url
	356	AddIcon /theme/icons/ico.png .ico
	357	AddIcon /theme/icons/java.png .jar
	358	AddIcon /theme/icons/jpg.png .jpg .jpeg .jpe
	359	AddIcon /theme/icons/js.png .js .json
	360	AddIcon /theme/icons/markdown.png .md
	361	AddIcon /theme/icons/package.png .pkg .dmg
	362	AddIcon /theme/icons/pdf.png .pdf
	363	AddIcon /theme/icons/php.png .php .phtml
	364	AddIcon /theme/icons/playlist.png .m3u .m3u8 .pls .pls8
	365	AddIcon /theme/icons/png.png .png
	366	AddIcon /theme/icons/ps.png .ps
	367	AddIcon /theme/icons/psd.png .psd
	368	AddIcon /theme/icons/py.png .py
	369	AddIcon /theme/icons/rar.png .rar
	370	AddIcon /theme/icons/rb.png .rb
	371	AddIcon /theme/icons/rpm.png .rpm
	372	AddIcon /theme/icons/rss.png .rss
	373	AddIcon /theme/icons/script.png .bat .cmd .sh
374	AddIcon /theme/icons/sql.png .sql
375	AddIcon /theme/icons/tiff.png .tiff .tif
376	AddIcon /theme/icons/text.png .txt .nfo
377	AddIcon /theme/icons/video.png .asf .asx .avi .flv .mkv .mov .mp4 .mpg .rm .srt .swf .vob .wmv .m4v .f4v .f4p .ogv
378	AddIcon /theme/icons/xml.png .xml
379	AddIcon /theme/icons/zip.png .zip
380	DefaultIcon /theme/icons/default.png
381
382	HeaderName /theme/header.html
383	ReadmeName /theme/footer.html
384	IndexStyleSheet /theme/style.css
385	</Directory>
386	</Macro>
387	'';
388	};
42429ef0 IB	389	http2 = {
	390	modules = [ "http2" ];
	391	extraConfig = ''
	392	Protocols h2 http/1.1
	393	'';
	394	};
	395	customLog = {
	396	extraConfig = ''
	397	LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
	398	'';
	399	};
	400	};
f8bde3d6	401
10889174 IB	402	system.activationScripts = {
	403	httpd = ''
	404	install -d -m 0755 /var/lib/acme/acme-challenge
	405	install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
	406	install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
	407	install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
	408	install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
	409	'';
	410	};
	411
7da3ceec IB	412	system.extraSystemBuilderCmds = let
	413	adminer = pkgs.callPackage ./commons/adminer.nix {};
	414	in ''
	415	mkdir -p $out/webapps
	416	ln -s ${../../www} $out/webapps/_www
	417	ln -s ${./apache/theme} $out/webapps/_theme
	418	ln -s ${adminer.webRoot} $out/webapps/${adminer.apache.webappName}
	419	'';
	420
10889174 IB	421	services.myPhpfpm = {
	422	phpPackage = pkgs.php;
	423	phpOptions = ''
	424	session.save_path = "/var/lib/php/sessions"
95b20e17	425	post_max_size = 20M
10889174 IB	426	session.gc_maxlifetime = 606024*15
	427	session.cache_expire = 602430
	428	'';
	429	extraConfig = ''
	430	log_level = notice
	431	'';
	432	};
	433
f8bde3d6	434	services.httpdProd = makeService "production" config.services.myWebsites.production;
f8d3b61a IB	435	services.myWebsites.production.modules = makeModules cfg;
f8d3b61a IB	436	services.myWebsites.production.extraConfig = makeExtraConfig cfg;
f8bde3d6 IB	437
f8bde3d6 IB	438	services.httpdInte = makeService "integration" config.services.myWebsites.integration;
f8d3b61a IB	439	services.myWebsites.integration.modules = makeModules cfg;
f8d3b61a IB	440	services.myWebsites.integration.extraConfig = makeExtraConfig cfg;
950ca5ee	441
273e2c61	442	services.httpdTools = makeService "tools" config.services.myWebsites.tools;
f8d3b61a IB	443	services.myWebsites.tools.modules = makeModules cfg;
f8d3b61a IB	444	services.myWebsites.tools.extraConfig = makeExtraConfig cfg ++
646bdf3e IB	445	[ ''
	446	RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
	447	RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
	448	RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
	449	RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
	450	RedirectMatch ^/(mentions\|mentions_legales\|legal)$ https://www.immae.eu/mentions.html
	451	RedirectMatch ^/CGU$ https://www.immae.eu/CGU
	452	''
	453	]
	454	;
42429ef0 IB	455	};
42429ef0 IB	456	}