[perso/Immae/Config/Nix.git] / virtual / modules / websites / default.nix

{ lib, pkgs, config, mylibs, myconfig, ... }:
let
  mypkgs = pkgs.callPackage ../../packages.nix {
    inherit (mylibs) checkEnv fetchedGit fetchedGithub;
  };
  cfg = config.services.myWebsites;
  makeService = name: cfg: let
    toVhost = vhostConf: {
      enableSSL = true;
      sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
      sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
      sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem";
      logFormat = "combinedVhost";
      listen = [
        { ip = cfg.ip;  port = 443; }
      ];
      hostName = builtins.head vhostConf.hosts;
      serverAliases = builtins.tail vhostConf.hosts or [];
      documentRoot = vhostConf.root;
      extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
    };
    redirectVhost = { # Should go last, catchall http -> https redirect
      listen = [ { ip = cfg.ip; port = 80; } ];
      hostName = "redirectSSL";
      serverAliases = [ "*" ];
      enableSSL = false;
      logFormat = "combinedVhost";
      documentRoot = "/var/lib/acme/acme-challenge";
      extraConfig = ''
        RewriteEngine on
        RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
        RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
        # To redirect in specific "VirtualHost *:80", do
        #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
        # rather than rewrite
      '';
    };
    fallbackVhost = toVhost { # Should go first, default choice
      certName    = "eldiron";
      hosts       = ["eldiron.immae.eu" ];
      root        = ../../www;
      extraConfig = [ "DirectoryIndex index.htm" ];
    };
  in rec {
    enable = true;
    listen = [
      { ip = cfg.ip;  port = 443; }
    ];
    stateDir = "/run/httpd_${name}";
    logPerVirtualHost = true;
    multiProcessingModule = "worker";
    adminAddr = "httpd@immae.eu";
    logFormat = "combinedVhost";
    extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
    extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
    virtualHosts = [ fallbackVhost ]
      ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
      ++ [ redirectVhost ];
  };
  makeServiceOptions = name: ip: {
    enable = lib.mkEnableOption "enable websites in ${name}";
    ip = lib.mkOption {
      type = lib.types.string;
      default = ip;
      description = "${name} ip to listen to";
    };
    modules = lib.mkOption {
      type = lib.types.listOf (lib.types.str);
      default = [];
    };
    extraConfig = lib.mkOption {
      type = lib.types.listOf (lib.types.lines);
      default = [];
    };
    vhostConfs = lib.mkOption {
      type = lib.types.attrsOf (lib.types.submodule {
        options = {
          certName = lib.mkOption { type = lib.types.string; };
          hosts    = lib.mkOption { type = lib.types.listOf lib.types.string; };
          root     = lib.mkOption { type = lib.types.nullOr lib.types.path; };
          extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
        };
      });
    };
  };
in
{
  imports = [
    ./chloe
    ./ludivine
    ./aten
    ./piedsjaloux
    ./connexionswing
    # built using:
    # sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
    # And removed users / groups
    ./apache/httpd_prod.nix
    ./apache/httpd_inte.nix
  ];

  options.services.myWebsites = {
    production = makeServiceOptions "production" myconfig.ips.production;
    integration = makeServiceOptions "integration" myconfig.ips.integration;
    tools = makeServiceOptions "tools" myconfig.ips.main;

    apacheConfig = lib.mkOption {
      type = lib.types.attrsOf (lib.types.submodule {
        options = {
          modules = lib.mkOption {
            type = lib.types.listOf (lib.types.str);
            default = [];
          };
          extraConfig = lib.mkOption {
            type = lib.types.nullOr lib.types.lines;
            default = null;
          };
        };
      });
      default = {};
      description = "Extra global config";
    };

  };

  config = {
    networking = {
      firewall = {
        enable = true;
        allowedTCPPorts = [ 80 443 ];
      };
      interfaces."eth0".ipv4.addresses = [
        # 176.9.151.89 declared in nixops -> infra / tools
        { address = myconfig.ips.production; prefixLength = 32; }
        { address = myconfig.ips.integration; prefixLength = 32; }
      ];
    };

    nixpkgs.config.packageOverrides = oldpkgs: rec {
      php = php72;
      php72 = (oldpkgs.php72.override {
        mysql.connector-c = pkgs.mariadb;
        config.php.mysqlnd = false;
        config.php.mysqli = false;
      }).overrideAttrs(old: rec {
        # Didn't manage to build with mysqli + mysql_config connector
        configureFlags = old.configureFlags ++ [
          "--with-mysqli=shared,mysqlnd"
          ];
        # preConfigure = (old.preConfigure or "") + ''
        #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
        #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
        #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
        #   '';
      });
      phpPackages = oldpkgs.php72Packages.override { inherit php; };
    };

    services.myWebsites.Chloe.production.enable = cfg.production.enable;
    services.myWebsites.Ludivine.production.enable = cfg.production.enable;
    services.myWebsites.Aten.production.enable = cfg.production.enable;
    services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
    services.myWebsites.Connexionswing.production.enable = cfg.production.enable;

    services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
    services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
    services.myWebsites.Aten.integration.enable = cfg.integration.enable;
    services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
    services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;

    services.myWebsites.apacheConfig = {
      gzip = {
        modules = [ "deflate" "filter" ];
        extraConfig = ''
          AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
        '';
      };
      macros = {
        modules = [ "macro" ];
      };
      ldap = {
        modules = [ "ldap" "authnz_ldap" ];
        # FIXME: starttls
        extraConfig = assert mylibs.checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; ''
          <IfModule ldap_module>
            LDAPSharedCacheSize 500000
            LDAPCacheEntries 1024
            LDAPCacheTTL 600
            LDAPOpCacheEntries 1024
            LDAPOpCacheTTL 600
          </IfModule>

          <Macro LDAPConnect>
            <IfModule authnz_ldap_module>
              AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
              AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
              AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
              AuthType             Basic
              AuthName             "Authentification requise (Acces LDAP)"
              AuthBasicProvider    ldap
            </IfModule>
          </Macro>

          <Macro Stats %{domain}>
            Alias /awstats /var/lib/goaccess/%{domain}
            <Directory /var/lib/goaccess/%{domain}>
              DirectoryIndex index.html
              AllowOverride None
              Require all granted
            </Directory>
            <Location /awstats>
              Use LDAPConnect
              Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
            </Location>
          </Macro>
        '';
      };
      http2 = {
        modules = [ "http2" ];
        extraConfig = ''
          Protocols h2 http/1.1
        '';
      };
      customLog = {
        extraConfig = ''
          LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
        '';
      };
    };

    # FIXME: logrotate
    # FIXME: ipv6
    services.httpdProd = makeService "production" config.services.myWebsites.production;
    services.myWebsites.production.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
    services.myWebsites.production.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));

    services.httpdInte = makeService "integration" config.services.myWebsites.integration;
    services.myWebsites.integration.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
    services.myWebsites.integration.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));

    services.httpd = makeService "tools" config.services.myWebsites.tools;
    services.myWebsites.tools.modules =
      mypkgs.adminer.apache.modules ++
      mypkgs.nextcloud.apache.modules ++
      mypkgs.ympd.apache.modules ++
      mypkgs.mantisbt.apache.modules ++
      mypkgs.ttrss.apache.modules ++
      mypkgs.roundcubemail.apache.modules ++
      pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
    services.myWebsites.tools.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
    # FIXME: move them all to separate modules
    services.myWebsites.tools.vhostConfs.eldiron = {
      certName    = "eldiron";
      hosts       = ["eldiron.immae.eu" ];
      root        = ../../www;
      extraConfig = [ "DirectoryIndex index.htm" ];
    };
    services.myWebsites.tools.vhostConfs.db-1 = {
      certName    = "eldiron";
      hosts       = ["db-1.immae.eu" ];
      root        = null;
      extraConfig = [ mypkgs.adminer.apache.vhostConf ];
    };
    services.myWebsites.tools.vhostConfs.tools = {
      certName    = "eldiron";
      hosts       = ["tools.immae.eu" ];
      root        = null;
      extraConfig = [
        mypkgs.adminer.apache.vhostConf
        mypkgs.ympd.apache.vhostConf
        mypkgs.ttrss.apache.vhostConf
        mypkgs.roundcubemail.apache.vhostConf
      ];
    };
    services.myWebsites.tools.vhostConfs.dav = {
      certName    = "eldiron";
      hosts       = ["dav.immae.eu" ];
      root        = null;
      extraConfig = [
        mypkgs.infcloud.apache.vhostConf
        mypkgs.davical.apache.vhostConf
      ];
    };
    services.myWebsites.tools.vhostConfs.cloud = {
      certName    = "eldiron";
      hosts       = ["cloud.immae.eu" ];
      root        = mypkgs.nextcloud.webRoot;
      extraConfig = [
        mypkgs.nextcloud.apache.vhostConf
      ];
    };
    services.myWebsites.tools.vhostConfs.git.extraConfig = [
      mypkgs.mantisbt.apache.vhostConf
      ''
        RewriteEngine on
        RewriteCond %{REQUEST_URI}       ^/releases
        RewriteRule /releases(.*)        https://release.immae.eu$1 [P,L]
        ''
    ];
  };
}
Commit	Line	Data
f8bde3d6	1	{ lib, pkgs, config, mylibs, myconfig, ... }:
42429ef0	2	let
950ca5ee IB	3	mypkgs = pkgs.callPackage ../../packages.nix {
	4	inherit (mylibs) checkEnv fetchedGit fetchedGithub;
	5	};
42429ef0	6	cfg = config.services.myWebsites;
f8bde3d6 IB	7	makeService = name: cfg: let
	8	toVhost = vhostConf: {
	9	enableSSL = true;
	10	sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
	11	sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
	12	sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem";
	13	logFormat = "combinedVhost";
	14	listen = [
	15	{ ip = cfg.ip; port = 443; }
	16	];
	17	hostName = builtins.head vhostConf.hosts;
	18	serverAliases = builtins.tail vhostConf.hosts or [];
	19	documentRoot = vhostConf.root;
	20	extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
	21	};
950ca5ee IB	22	redirectVhost = { # Should go last, catchall http -> https redirect
	23	listen = [ { ip = cfg.ip; port = 80; } ];
	24	hostName = "redirectSSL";
	25	serverAliases = [ "*" ];
	26	enableSSL = false;
	27	logFormat = "combinedVhost";
	28	documentRoot = "/var/lib/acme/acme-challenge";
	29	extraConfig = ''
	30	RewriteEngine on
	31	RewriteCond "%{REQUEST_URI}" "!^/\.well-known"
	32	RewriteRule ^(.+) https://%{HTTP_HOST}$1 [R=301]
	33	# To redirect in specific "VirtualHost *:80", do
	34	# RedirectMatch 301 ^/((?!\.well-known.$).)$ https://host/$1
	35	# rather than rewrite
	36	'';
	37	};
	38	fallbackVhost = toVhost { # Should go first, default choice
	39	certName = "eldiron";
	40	hosts = ["eldiron.immae.eu" ];
	41	root = ../../www;
	42	extraConfig = [ "DirectoryIndex index.htm" ];
	43	};
f8bde3d6 IB	44	in rec {
	45	enable = true;
	46	listen = [
	47	{ ip = cfg.ip; port = 443; }
	48	];
	49	stateDir = "/run/httpd_${name}";
	50	logPerVirtualHost = true;
	51	multiProcessingModule = "worker";
	52	adminAddr = "httpd@immae.eu";
	53	logFormat = "combinedVhost";
	54	extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
	55	extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
950ca5ee IB	56	virtualHosts = [ fallbackVhost ]
	57	++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
	58	++ [ redirectVhost ];
f8bde3d6 IB	59	};
	60	makeServiceOptions = name: ip: {
	61	enable = lib.mkEnableOption "enable websites in ${name}";
	62	ip = lib.mkOption {
	63	type = lib.types.string;
	64	default = ip;
	65	description = "${name} ip to listen to";
	66	};
	67	modules = lib.mkOption {
	68	type = lib.types.listOf (lib.types.str);
	69	default = [];
	70	};
	71	extraConfig = lib.mkOption {
	72	type = lib.types.listOf (lib.types.lines);
	73	default = [];
	74	};
	75	vhostConfs = lib.mkOption {
	76	type = lib.types.attrsOf (lib.types.submodule {
	77	options = {
	78	certName = lib.mkOption { type = lib.types.string; };
	79	hosts = lib.mkOption { type = lib.types.listOf lib.types.string; };
	80	root = lib.mkOption { type = lib.types.nullOr lib.types.path; };
	81	extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
	82	};
	83	});
	84	};
	85	};
42429ef0 IB	86	in
	87	{
	88	imports = [
54307da4 IB	89	./chloe
	90	./ludivine
	91	./aten
	92	./piedsjaloux
	93	./connexionswing
f8bde3d6 IB	94	# built using:
	95	# sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
	96	# And removed users / groups
54307da4 IB	97	./apache/httpd_prod.nix
54307da4 IB	98	./apache/httpd_inte.nix
42429ef0 IB	99	];
	100
	101	options.services.myWebsites = {
f8bde3d6 IB	102	production = makeServiceOptions "production" myconfig.ips.production;
f8bde3d6 IB	103	integration = makeServiceOptions "integration" myconfig.ips.integration;
950ca5ee	104	tools = makeServiceOptions "tools" myconfig.ips.main;
42429ef0 IB	105
	106	apacheConfig = lib.mkOption {
	107	type = lib.types.attrsOf (lib.types.submodule {
	108	options = {
	109	modules = lib.mkOption {
	110	type = lib.types.listOf (lib.types.str);
	111	default = [];
	112	};
	113	extraConfig = lib.mkOption {
	114	type = lib.types.nullOr lib.types.lines;
	115	default = null;
	116	};
	117	};
	118	});
	119	default = {};
	120	description = "Extra global config";
	121	};
	122
	123	};
	124
	125	config = {
54307da4 IB	126	networking = {
	127	firewall = {
	128	enable = true;
	129	allowedTCPPorts = [ 80 443 ];
	130	};
	131	interfaces."eth0".ipv4.addresses = [
	132	# 176.9.151.89 declared in nixops -> infra / tools
	133	{ address = myconfig.ips.production; prefixLength = 32; }
	134	{ address = myconfig.ips.integration; prefixLength = 32; }
	135	];
	136	};
	137
98584540 IB	138	nixpkgs.config.packageOverrides = oldpkgs: rec {
	139	php = php72;
	140	php72 = (oldpkgs.php72.override {
	141	mysql.connector-c = pkgs.mariadb;
	142	config.php.mysqlnd = false;
	143	config.php.mysqli = false;
	144	}).overrideAttrs(old: rec {
	145	# Didn't manage to build with mysqli + mysql_config connector
	146	configureFlags = old.configureFlags ++ [
912921a7	147	"--with-mysqli=shared,mysqlnd"
98584540 IB	148	];
	149	# preConfigure = (old.preConfigure or "") + ''
	150	# export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
	151	# sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
	152	# ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
	153	# '';
	154	});
	155	phpPackages = oldpkgs.php72Packages.override { inherit php; };
	156	};
	157
42429ef0 IB	158	services.myWebsites.Chloe.production.enable = cfg.production.enable;
	159	services.myWebsites.Ludivine.production.enable = cfg.production.enable;
	160	services.myWebsites.Aten.production.enable = cfg.production.enable;
	161	services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
	162	services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
	163
	164	services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
	165	services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
	166	services.myWebsites.Aten.integration.enable = cfg.integration.enable;
	167	services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
	168	services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
	169
	170	services.myWebsites.apacheConfig = {
	171	gzip = {
	172	modules = [ "deflate" "filter" ];
	173	extraConfig = ''
	174	AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
	175	'';
	176	};
	177	macros = {
	178	modules = [ "macro" ];
	179	};
	180	ldap = {
	181	modules = [ "ldap" "authnz_ldap" ];
	182	# FIXME: starttls
	183	extraConfig = assert mylibs.checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; ''
	184	<IfModule ldap_module>
	185	LDAPSharedCacheSize 500000
	186	LDAPCacheEntries 1024
	187	LDAPCacheTTL 600
	188	LDAPOpCacheEntries 1024
	189	LDAPOpCacheTTL 600
	190	</IfModule>
	191
	192	<Macro LDAPConnect>
	193	<IfModule authnz_ldap_module>
	194	AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
	195	AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
	196	AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
	197	AuthType Basic
	198	AuthName "Authentification requise (Acces LDAP)"
	199	AuthBasicProvider ldap
	200	</IfModule>
	201	</Macro>
	202
	203	<Macro Stats %{domain}>
	204	Alias /awstats /var/lib/goaccess/%{domain}
	205	<Directory /var/lib/goaccess/%{domain}>
	206	DirectoryIndex index.html
	207	AllowOverride None
	208	Require all granted
	209	</Directory>
	210	<Location /awstats>
	211	Use LDAPConnect
	212	Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
	213	</Location>
	214	</Macro>
	215	'';
	216	};
	217	http2 = {
	218	modules = [ "http2" ];
	219	extraConfig = ''
	220	Protocols h2 http/1.1
	221	'';
222	};
223	customLog = {
224	extraConfig = ''
225	LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
226	'';
227	};
228	};
f8bde3d6 IB	229
	230	# FIXME: logrotate
	231	# FIXME: ipv6
	232	services.httpdProd = makeService "production" config.services.myWebsites.production;
	233	services.myWebsites.production.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
	234	services.myWebsites.production.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
	235
	236	services.httpdInte = makeService "integration" config.services.myWebsites.integration;
	237	services.myWebsites.integration.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
	238	services.myWebsites.integration.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
950ca5ee IB	239
	240	services.httpd = makeService "tools" config.services.myWebsites.tools;
	241	services.myWebsites.tools.modules =
	242	mypkgs.adminer.apache.modules ++
	243	mypkgs.nextcloud.apache.modules ++
	244	mypkgs.ympd.apache.modules ++
	245	mypkgs.mantisbt.apache.modules ++
	246	mypkgs.ttrss.apache.modules ++
	247	mypkgs.roundcubemail.apache.modules ++
	248	pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
	249	services.myWebsites.tools.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
	250	# FIXME: move them all to separate modules
	251	services.myWebsites.tools.vhostConfs.eldiron = {
	252	certName = "eldiron";
	253	hosts = ["eldiron.immae.eu" ];
	254	root = ../../www;
	255	extraConfig = [ "DirectoryIndex index.htm" ];
	256	};
	257	services.myWebsites.tools.vhostConfs.db-1 = {
	258	certName = "eldiron";
	259	hosts = ["db-1.immae.eu" ];
	260	root = null;
	261	extraConfig = [ mypkgs.adminer.apache.vhostConf ];
	262	};
	263	services.myWebsites.tools.vhostConfs.tools = {
	264	certName = "eldiron";
	265	hosts = ["tools.immae.eu" ];
	266	root = null;
	267	extraConfig = [
	268	mypkgs.adminer.apache.vhostConf
	269	mypkgs.ympd.apache.vhostConf
	270	mypkgs.ttrss.apache.vhostConf
	271	mypkgs.roundcubemail.apache.vhostConf
	272	];
	273	};
	274	services.myWebsites.tools.vhostConfs.dav = {
	275	certName = "eldiron";
	276	hosts = ["dav.immae.eu" ];
	277	root = null;
	278	extraConfig = [
	279	mypkgs.infcloud.apache.vhostConf
	280	mypkgs.davical.apache.vhostConf
	281	];
	282	};
	283	services.myWebsites.tools.vhostConfs.cloud = {
	284	certName = "eldiron";
	285	hosts = ["cloud.immae.eu" ];
	286	root = mypkgs.nextcloud.webRoot;
	287	extraConfig = [
	288	mypkgs.nextcloud.apache.vhostConf
	289	];
	290	};
	291	services.myWebsites.tools.vhostConfs.git.extraConfig = [
	292	mypkgs.mantisbt.apache.vhostConf
	293	''
	294	RewriteEngine on
	295	RewriteCond %{REQUEST_URI} ^/releases
	296	RewriteRule /releases(.*) https://release.immae.eu$1 [P,L]
	297	''
	298	];
42429ef0 IB	299	};
42429ef0 IB	300	}