[perso/Immae/Config/Nix.git] / nixops / modules / websites / default.nix

{ lib, pkgs, config, mylibs, myconfig, ... }:
let
  cfg = config.services.myWebsites;
  makeService = name: cfg: let
    toVhost = vhostConf: {
      enableSSL = true;
      sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
      sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
      sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem";
      logFormat = "combinedVhost";
      listen = [
        { ip = cfg.ip;  port = 443; }
      ];
      hostName = builtins.head vhostConf.hosts;
      serverAliases = builtins.tail vhostConf.hosts or [];
      documentRoot = vhostConf.root;
      extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
    };
    redirectVhost = { # Should go last, catchall http -> https redirect
      listen = [ { ip = cfg.ip; port = 80; } ];
      hostName = "redirectSSL";
      serverAliases = [ "*" ];
      enableSSL = false;
      logFormat = "combinedVhost";
      documentRoot = "/var/lib/acme/acme-challenge";
      extraConfig = ''
        RewriteEngine on
        RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
        RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
        # To redirect in specific "VirtualHost *:80", do
        #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
        # rather than rewrite
      '';
    };
    fallbackVhost = toVhost { # Should go first, default choice
      certName    = "eldiron";
      hosts       = ["eldiron.immae.eu" ];
      root        = ../../www;
      extraConfig = [ "DirectoryIndex index.htm" ];
    };
  in rec {
    enable = true;
    listen = [
      { ip = cfg.ip;  port = 443; }
    ];
    stateDir = "/run/httpd_${name}";
    logPerVirtualHost = true;
    multiProcessingModule = "worker";
    adminAddr = "httpd@immae.eu";
    logFormat = "combinedVhost";
    extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
    extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
    virtualHosts = [ fallbackVhost ]
      ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
      ++ [ redirectVhost ];
  };
  makeServiceOptions = name: ip: {
    enable = lib.mkEnableOption "enable websites in ${name}";
    ip = lib.mkOption {
      type = lib.types.string;
      default = ip;
      description = "${name} ip to listen to";
    };
    modules = lib.mkOption {
      type = lib.types.listOf (lib.types.str);
      default = [];
    };
    extraConfig = lib.mkOption {
      type = lib.types.listOf (lib.types.lines);
      default = [];
    };
    vhostConfs = lib.mkOption {
      type = lib.types.attrsOf (lib.types.submodule {
        options = {
          certName = lib.mkOption { type = lib.types.string; };
          hosts    = lib.mkOption { type = lib.types.listOf lib.types.string; };
          root     = lib.mkOption { type = lib.types.nullOr lib.types.path; };
          extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
        };
      });
    };
  };
  makeModules = cfg: pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
  makeExtraConfig = cfg: (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
in
{
  imports = [
    ./chloe
    ./ludivine
    ./aten
    ./piedsjaloux
    ./connexionswing
    ./tellesflorian
    ./emilia
    ./capitaines
    ./ftp/jerome.nix
    ./ftp/nassime.nix
    ./ftp/florian.nix
    ./ftp/denisejerome.nix
    ./ftp/immae.nix
    ./tools/db
    ./tools/tools
    ./tools/dav
    ./tools/cloud
    ./tools/git
    ./tools/mastodon
    ./tools/mediagoblin
    ./tools/diaspora
    ./tools/ether
    # built using:
    # sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
    # Removed allGranted
    # And removed users / groups
    ./apache/httpd_prod.nix
    ./apache/httpd_inte.nix
    # except for this one for users/groups
    ./apache/httpd_tools.nix
    # Adapted from base phpfpm
    ./phpfpm
  ];

  options.services.myWebsites = {
    production = makeServiceOptions "production" myconfig.ips.production;
    integration = makeServiceOptions "integration" myconfig.ips.integration;
    tools = makeServiceOptions "tools" myconfig.ips.main;

    apacheConfig = lib.mkOption {
      type = lib.types.attrsOf (lib.types.submodule {
        options = {
          modules = lib.mkOption {
            type = lib.types.listOf (lib.types.str);
            default = [];
          };
          extraConfig = lib.mkOption {
            type = lib.types.nullOr lib.types.lines;
            default = null;
          };
        };
      });
      default = {};
      description = "Extra global config";
    };

  };

  config = {
    networking = {
      firewall = {
        enable = true;
        allowedTCPPorts = [ 80 443 ];
      };
      interfaces."eth0".ipv4.addresses = [
        # 176.9.151.89 declared in nixops -> infra / tools
        { address = myconfig.ips.production; prefixLength = 32; }
        { address = myconfig.ips.integration; prefixLength = 32; }
      ];
    };

    nixpkgs.config.packageOverrides = oldpkgs: rec {
      php = php72;
      php72 = (oldpkgs.php72.override {
        mysql.connector-c = pkgs.mariadb;
        config.php.mysqlnd = false;
        config.php.mysqli = false;
      }).overrideAttrs(old: rec {
        # Didn't manage to build with mysqli + mysql_config connector
        configureFlags = old.configureFlags ++ [
          "--with-mysqli=shared,mysqlnd"
          ];
        # preConfigure = (old.preConfigure or "") + ''
        #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
        #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
        #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
        #   '';
      });
      phpPackages = oldpkgs.php72Packages.override { inherit php; };
      composerEnv = import ./commons/composer-env.nix {
        inherit (pkgs) stdenv writeTextFile fetchurl php unzip;
      };
    };

    services.myWebsites.tools.databases.enable = true;
    services.myWebsites.tools.tools.enable = true;
    services.myWebsites.tools.dav.enable = true;
    services.myWebsites.tools.cloud.enable = true;
    services.myWebsites.tools.git.enable = true;
    services.myWebsites.tools.mastodon.enable = true;
    services.myWebsites.tools.mediagoblin.enable = true;
    services.myWebsites.tools.diaspora.enable = true;
    services.myWebsites.tools.etherpad-lite.enable = true;

    services.myWebsites.Chloe.production.enable = cfg.production.enable;
    services.myWebsites.Ludivine.production.enable = cfg.production.enable;
    services.myWebsites.Aten.production.enable = cfg.production.enable;
    services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
    services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
    services.myWebsites.Jerome.production.enable = cfg.production.enable;
    services.myWebsites.Nassime.production.enable = cfg.production.enable;
    services.myWebsites.Florian.production.enable = cfg.production.enable;
    services.myWebsites.DeniseJerome.production.enable = cfg.production.enable;
    services.myWebsites.Emilia.production.enable = cfg.production.enable;
    services.myWebsites.Capitaines.production.enable = cfg.production.enable;
    services.myWebsites.Immae.production.enable = cfg.production.enable;

    services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
    services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
    services.myWebsites.Aten.integration.enable = cfg.integration.enable;
    services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
    services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
    services.myWebsites.TellesFlorian.integration.enable = true;
    services.myWebsites.Florian.integration.enable = true;

    services.myWebsites.apacheConfig = {
      gzip = {
        modules = [ "deflate" "filter" ];
        extraConfig = ''
          AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
        '';
      };
      macros = {
        modules = [ "macro" ];
      };
      ldap = {
        modules = [ "ldap" "authnz_ldap" ];
        extraConfig = ''
          <IfModule ldap_module>
            LDAPSharedCacheSize 500000
            LDAPCacheEntries 1024
            LDAPCacheTTL 600
            LDAPOpCacheEntries 1024
            LDAPOpCacheTTL 600
          </IfModule>

          <Macro LDAPConnect>
            <IfModule authnz_ldap_module>
              AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
              AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
              AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
              AuthType             Basic
              AuthName             "Authentification requise (Acces LDAP)"
              AuthBasicProvider    ldap
            </IfModule>
          </Macro>

          <Macro Stats %{domain}>
            Alias /awstats /var/lib/goaccess/%{domain}
            <Directory /var/lib/goaccess/%{domain}>
              DirectoryIndex index.html
              AllowOverride None
              Require all granted
            </Directory>
            <Location /awstats>
              Use LDAPConnect
              Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
            </Location>
          </Macro>

          ErrorDocument 500 /maintenance_immae.html
          ErrorDocument 501 /maintenance_immae.html
          ErrorDocument 502 /maintenance_immae.html
          ErrorDocument 503 /maintenance_immae.html
          ErrorDocument 504 /maintenance_immae.html
          Alias /maintenance_immae.html ${../../www}/maintenance_immae.html
          ProxyPass /maintenance_immae.html !

          AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${../../www}/googleb6d69446ff4ca3e5.html
        '';
      };
      http2 = {
        modules = [ "http2" ];
        extraConfig = ''
          Protocols h2 http/1.1
        '';
      };
      customLog = {
        extraConfig = ''
          LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
        '';
      };
    };

    system.activationScripts = {
      httpd = ''
        install -d -m 0755 /var/lib/acme/acme-challenge
        install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
        install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
        install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
        install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
        '';
    };

    services.myPhpfpm = {
      phpPackage = pkgs.php;
      phpOptions = ''
        session.save_path = "/var/lib/php/sessions"
        session.gc_maxlifetime = 60*60*24*15
        session.cache_expire = 60*24*30
        '';
      extraConfig = ''
        log_level = notice
        '';
    };

    services.httpdProd = makeService "production" config.services.myWebsites.production;
    services.myWebsites.production.modules = makeModules cfg;
    services.myWebsites.production.extraConfig = makeExtraConfig cfg;

    services.httpdInte = makeService "integration" config.services.myWebsites.integration;
    services.myWebsites.integration.modules = makeModules cfg;
    services.myWebsites.integration.extraConfig = makeExtraConfig cfg;

    services.httpdTools = makeService "tools" config.services.myWebsites.tools;
    services.myWebsites.tools.modules = makeModules cfg;
    services.myWebsites.tools.extraConfig = makeExtraConfig cfg ++
    [ ''
        RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
        RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
        RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
        RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
        RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
        RedirectMatch ^/CGU$ https://www.immae.eu/CGU
      ''
      ]
    ;
  };
}
Commit	Line	Data
f8bde3d6	1	{ lib, pkgs, config, mylibs, myconfig, ... }:
42429ef0 IB	2	let
42429ef0 IB	3	cfg = config.services.myWebsites;
f8bde3d6 IB	4	makeService = name: cfg: let
	5	toVhost = vhostConf: {
	6	enableSSL = true;
	7	sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
	8	sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
	9	sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem";
	10	logFormat = "combinedVhost";
	11	listen = [
	12	{ ip = cfg.ip; port = 443; }
	13	];
	14	hostName = builtins.head vhostConf.hosts;
	15	serverAliases = builtins.tail vhostConf.hosts or [];
	16	documentRoot = vhostConf.root;
	17	extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
	18	};
950ca5ee IB	19	redirectVhost = { # Should go last, catchall http -> https redirect
	20	listen = [ { ip = cfg.ip; port = 80; } ];
	21	hostName = "redirectSSL";
	22	serverAliases = [ "*" ];
	23	enableSSL = false;
	24	logFormat = "combinedVhost";
	25	documentRoot = "/var/lib/acme/acme-challenge";
	26	extraConfig = ''
	27	RewriteEngine on
	28	RewriteCond "%{REQUEST_URI}" "!^/\.well-known"
	29	RewriteRule ^(.+) https://%{HTTP_HOST}$1 [R=301]
	30	# To redirect in specific "VirtualHost *:80", do
	31	# RedirectMatch 301 ^/((?!\.well-known.$).)$ https://host/$1
	32	# rather than rewrite
	33	'';
	34	};
	35	fallbackVhost = toVhost { # Should go first, default choice
	36	certName = "eldiron";
	37	hosts = ["eldiron.immae.eu" ];
	38	root = ../../www;
	39	extraConfig = [ "DirectoryIndex index.htm" ];
	40	};
f8bde3d6 IB	41	in rec {
	42	enable = true;
	43	listen = [
	44	{ ip = cfg.ip; port = 443; }
	45	];
	46	stateDir = "/run/httpd_${name}";
	47	logPerVirtualHost = true;
	48	multiProcessingModule = "worker";
	49	adminAddr = "httpd@immae.eu";
	50	logFormat = "combinedVhost";
	51	extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
	52	extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
950ca5ee IB	53	virtualHosts = [ fallbackVhost ]
	54	++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
	55	++ [ redirectVhost ];
f8bde3d6 IB	56	};
	57	makeServiceOptions = name: ip: {
	58	enable = lib.mkEnableOption "enable websites in ${name}";
	59	ip = lib.mkOption {
	60	type = lib.types.string;
	61	default = ip;
	62	description = "${name} ip to listen to";
	63	};
	64	modules = lib.mkOption {
	65	type = lib.types.listOf (lib.types.str);
	66	default = [];
	67	};
	68	extraConfig = lib.mkOption {
	69	type = lib.types.listOf (lib.types.lines);
	70	default = [];
	71	};
	72	vhostConfs = lib.mkOption {
	73	type = lib.types.attrsOf (lib.types.submodule {
	74	options = {
	75	certName = lib.mkOption { type = lib.types.string; };
	76	hosts = lib.mkOption { type = lib.types.listOf lib.types.string; };
	77	root = lib.mkOption { type = lib.types.nullOr lib.types.path; };
	78	extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
	79	};
	80	});
	81	};
	82	};
f8d3b61a IB	83	makeModules = cfg: pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
f8d3b61a IB	84	makeExtraConfig = cfg: (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
42429ef0 IB	85	in
	86	{
	87	imports = [
54307da4 IB	88	./chloe
	89	./ludivine
	90	./aten
	91	./piedsjaloux
	92	./connexionswing
2f0f1c48	93	./tellesflorian
9a35b8f9	94	./emilia
10bd8c08	95	./capitaines
d578d270	96	./ftp/jerome.nix
53b8fad9	97	./ftp/nassime.nix
79f239be	98	./ftp/florian.nix
dc9fb826	99	./ftp/denisejerome.nix
f759f52e	100	./ftp/immae.nix
10889174 IB	101	./tools/db
	102	./tools/tools
	103	./tools/dav
	104	./tools/cloud
	105	./tools/git
35a397cd	106	./tools/mastodon
56eba416	107	./tools/mediagoblin
a7f7fdae	108	./tools/diaspora
17146204	109	./tools/ether
f8bde3d6 IB	110	# built using:
f8bde3d6 IB	111	# sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
273e2c61	112	# Removed allGranted
f8bde3d6	113	# And removed users / groups
54307da4 IB	114	./apache/httpd_prod.nix
54307da4 IB	115	./apache/httpd_inte.nix
273e2c61 IB	116	# except for this one for users/groups
273e2c61 IB	117	./apache/httpd_tools.nix
10889174 IB	118	# Adapted from base phpfpm
10889174 IB	119	./phpfpm
42429ef0 IB	120	];
	121
	122	options.services.myWebsites = {
f8bde3d6 IB	123	production = makeServiceOptions "production" myconfig.ips.production;
f8bde3d6 IB	124	integration = makeServiceOptions "integration" myconfig.ips.integration;
950ca5ee	125	tools = makeServiceOptions "tools" myconfig.ips.main;
42429ef0 IB	126
	127	apacheConfig = lib.mkOption {
	128	type = lib.types.attrsOf (lib.types.submodule {
	129	options = {
	130	modules = lib.mkOption {
	131	type = lib.types.listOf (lib.types.str);
	132	default = [];
	133	};
	134	extraConfig = lib.mkOption {
	135	type = lib.types.nullOr lib.types.lines;
	136	default = null;
	137	};
	138	};
	139	});
	140	default = {};
	141	description = "Extra global config";
	142	};
	143
	144	};
	145
	146	config = {
54307da4 IB	147	networking = {
	148	firewall = {
	149	enable = true;
	150	allowedTCPPorts = [ 80 443 ];
	151	};
	152	interfaces."eth0".ipv4.addresses = [
	153	# 176.9.151.89 declared in nixops -> infra / tools
	154	{ address = myconfig.ips.production; prefixLength = 32; }
	155	{ address = myconfig.ips.integration; prefixLength = 32; }
	156	];
	157	};
	158
98584540 IB	159	nixpkgs.config.packageOverrides = oldpkgs: rec {
	160	php = php72;
	161	php72 = (oldpkgs.php72.override {
	162	mysql.connector-c = pkgs.mariadb;
	163	config.php.mysqlnd = false;
	164	config.php.mysqli = false;
	165	}).overrideAttrs(old: rec {
	166	# Didn't manage to build with mysqli + mysql_config connector
	167	configureFlags = old.configureFlags ++ [
912921a7	168	"--with-mysqli=shared,mysqlnd"
98584540 IB	169	];
	170	# preConfigure = (old.preConfigure or "") + ''
	171	# export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
	172	# sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
	173	# ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
	174	# '';
	175	});
	176	phpPackages = oldpkgs.php72Packages.override { inherit php; };
d78128ec IB	177	composerEnv = import ./commons/composer-env.nix {
	178	inherit (pkgs) stdenv writeTextFile fetchurl php unzip;
	179	};
98584540 IB	180	};
98584540 IB	181
10889174 IB	182	services.myWebsites.tools.databases.enable = true;
	183	services.myWebsites.tools.tools.enable = true;
	184	services.myWebsites.tools.dav.enable = true;
	185	services.myWebsites.tools.cloud.enable = true;
	186	services.myWebsites.tools.git.enable = true;
35a397cd	187	services.myWebsites.tools.mastodon.enable = true;
56eba416	188	services.myWebsites.tools.mediagoblin.enable = true;
a7f7fdae	189	services.myWebsites.tools.diaspora.enable = true;
17146204	190	services.myWebsites.tools.etherpad-lite.enable = true;
10889174	191
42429ef0 IB	192	services.myWebsites.Chloe.production.enable = cfg.production.enable;
	193	services.myWebsites.Ludivine.production.enable = cfg.production.enable;
	194	services.myWebsites.Aten.production.enable = cfg.production.enable;
	195	services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
	196	services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
d578d270	197	services.myWebsites.Jerome.production.enable = cfg.production.enable;
53b8fad9	198	services.myWebsites.Nassime.production.enable = cfg.production.enable;
79f239be	199	services.myWebsites.Florian.production.enable = cfg.production.enable;
dc9fb826	200	services.myWebsites.DeniseJerome.production.enable = cfg.production.enable;
9a35b8f9	201	services.myWebsites.Emilia.production.enable = cfg.production.enable;
10bd8c08	202	services.myWebsites.Capitaines.production.enable = cfg.production.enable;
f759f52e	203	services.myWebsites.Immae.production.enable = cfg.production.enable;
42429ef0 IB	204
	205	services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
	206	services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
	207	services.myWebsites.Aten.integration.enable = cfg.integration.enable;
	208	services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
	209	services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
2f0f1c48	210	services.myWebsites.TellesFlorian.integration.enable = true;
79f239be	211	services.myWebsites.Florian.integration.enable = true;
42429ef0 IB	212
	213	services.myWebsites.apacheConfig = {
	214	gzip = {
	215	modules = [ "deflate" "filter" ];
	216	extraConfig = ''
	217	AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
	218	'';
	219	};
	220	macros = {
	221	modules = [ "macro" ];
	222	};
	223	ldap = {
	224	modules = [ "ldap" "authnz_ldap" ];
9d90e7e2	225	extraConfig = ''
42429ef0 IB	226	<IfModule ldap_module>
	227	LDAPSharedCacheSize 500000
	228	LDAPCacheEntries 1024
	229	LDAPCacheTTL 600
	230	LDAPOpCacheEntries 1024
	231	LDAPOpCacheTTL 600
	232	</IfModule>
	233
	234	<Macro LDAPConnect>
	235	<IfModule authnz_ldap_module>
	236	AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
	237	AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
9d90e7e2	238	AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
42429ef0 IB	239	AuthType Basic
	240	AuthName "Authentification requise (Acces LDAP)"
	241	AuthBasicProvider ldap
	242	</IfModule>
	243	</Macro>
	244
	245	<Macro Stats %{domain}>
	246	Alias /awstats /var/lib/goaccess/%{domain}
	247	<Directory /var/lib/goaccess/%{domain}>
	248	DirectoryIndex index.html
	249	AllowOverride None
	250	Require all granted
	251	</Directory>
	252	<Location /awstats>
	253	Use LDAPConnect
	254	Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
	255	</Location>
	256	</Macro>
646bdf3e IB	257
	258	ErrorDocument 500 /maintenance_immae.html
	259	ErrorDocument 501 /maintenance_immae.html
	260	ErrorDocument 502 /maintenance_immae.html
	261	ErrorDocument 503 /maintenance_immae.html
	262	ErrorDocument 504 /maintenance_immae.html
	263	Alias /maintenance_immae.html ${../../www}/maintenance_immae.html
	264	ProxyPass /maintenance_immae.html !
	265
	266	AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${../../www}/googleb6d69446ff4ca3e5.html
42429ef0 IB	267	'';
	268	};
	269	http2 = {
	270	modules = [ "http2" ];
	271	extraConfig = ''
	272	Protocols h2 http/1.1
	273	'';
	274	};
	275	customLog = {
	276	extraConfig = ''
	277	LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
	278	'';
	279	};
	280	};
f8bde3d6	281
10889174 IB	282	system.activationScripts = {
	283	httpd = ''
	284	install -d -m 0755 /var/lib/acme/acme-challenge
	285	install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
	286	install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
	287	install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
	288	install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
	289	'';
	290	};
	291
	292	services.myPhpfpm = {
	293	phpPackage = pkgs.php;
	294	phpOptions = ''
	295	session.save_path = "/var/lib/php/sessions"
	296	session.gc_maxlifetime = 606024*15
	297	session.cache_expire = 602430
	298	'';
	299	extraConfig = ''
	300	log_level = notice
	301	'';
	302	};
	303
f8bde3d6	304	services.httpdProd = makeService "production" config.services.myWebsites.production;
f8d3b61a IB	305	services.myWebsites.production.modules = makeModules cfg;
f8d3b61a IB	306	services.myWebsites.production.extraConfig = makeExtraConfig cfg;
f8bde3d6 IB	307
f8bde3d6 IB	308	services.httpdInte = makeService "integration" config.services.myWebsites.integration;
f8d3b61a IB	309	services.myWebsites.integration.modules = makeModules cfg;
f8d3b61a IB	310	services.myWebsites.integration.extraConfig = makeExtraConfig cfg;
950ca5ee	311
273e2c61	312	services.httpdTools = makeService "tools" config.services.myWebsites.tools;
f8d3b61a IB	313	services.myWebsites.tools.modules = makeModules cfg;
f8d3b61a IB	314	services.myWebsites.tools.extraConfig = makeExtraConfig cfg ++
646bdf3e IB	315	[ ''
	316	RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
	317	RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
	318	RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
	319	RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
	320	RedirectMatch ^/(mentions\|mentions_legales\|legal)$ https://www.immae.eu/mentions.html
	321	RedirectMatch ^/CGU$ https://www.immae.eu/CGU
	322	''
	323	]
	324	;
42429ef0 IB	325	};
42429ef0 IB	326	}