[perso/Immae/Config/Nix.git] / virtual / modules / websites / default.nix

{ lib, pkgs, config, mylibs, myconfig, ... }:
let
  cfg = config.services.myWebsites;
  makeService = name: cfg: let
    toVhost = vhostConf: {
      enableSSL = true;
      sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
      sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
      sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem";
      logFormat = "combinedVhost";
      listen = [
        { ip = cfg.ip;  port = 443; }
      ];
      hostName = builtins.head vhostConf.hosts;
      serverAliases = builtins.tail vhostConf.hosts or [];
      documentRoot = vhostConf.root;
      extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
    };
  in rec {
    enable = true;
    listen = [
      { ip = cfg.ip;  port = 443; }
    ];
    stateDir = "/run/httpd_${name}";
    logPerVirtualHost = true;
    multiProcessingModule = "worker";
    adminAddr = "httpd@immae.eu";
    logFormat = "combinedVhost";
    extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
    extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
    virtualHosts = pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs;
  };
  makeServiceOptions = name: ip: {
    enable = lib.mkEnableOption "enable websites in ${name}";
    ip = lib.mkOption {
      type = lib.types.string;
      default = ip;
      description = "${name} ip to listen to";
    };
    modules = lib.mkOption {
      type = lib.types.listOf (lib.types.str);
      default = [];
    };
    extraConfig = lib.mkOption {
      type = lib.types.listOf (lib.types.lines);
      default = [];
    };
    vhostConfs = lib.mkOption {
      type = lib.types.attrsOf (lib.types.submodule {
        options = {
          certName = lib.mkOption { type = lib.types.string; };
          hosts    = lib.mkOption { type = lib.types.listOf lib.types.string; };
          root     = lib.mkOption { type = lib.types.nullOr lib.types.path; };
          extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
        };
      });
    };
  };
in
{
  imports = [
    ./chloe
    ./ludivine
    ./aten
    ./piedsjaloux
    ./connexionswing
    # built using:
    # sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
    # And removed users / groups
    ./apache/httpd_prod.nix
    ./apache/httpd_inte.nix
  ];

  options.services.myWebsites = {
    production = makeServiceOptions "production" myconfig.ips.production;
    integration = makeServiceOptions "integration" myconfig.ips.integration;

    apacheConfig = lib.mkOption {
      type = lib.types.attrsOf (lib.types.submodule {
        options = {
          modules = lib.mkOption {
            type = lib.types.listOf (lib.types.str);
            default = [];
          };
          extraConfig = lib.mkOption {
            type = lib.types.nullOr lib.types.lines;
            default = null;
          };
        };
      });
      default = {};
      description = "Extra global config";
    };

  };

  config = {
    networking = {
      firewall = {
        enable = true;
        allowedTCPPorts = [ 80 443 ];
      };
      interfaces."eth0".ipv4.addresses = [
        # 176.9.151.89 declared in nixops -> infra / tools
        { address = myconfig.ips.production; prefixLength = 32; }
        { address = myconfig.ips.integration; prefixLength = 32; }
      ];
    };

    services.myWebsites.Chloe.production.enable = cfg.production.enable;
    services.myWebsites.Ludivine.production.enable = cfg.production.enable;
    services.myWebsites.Aten.production.enable = cfg.production.enable;
    services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
    services.myWebsites.Connexionswing.production.enable = cfg.production.enable;

    services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
    services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
    services.myWebsites.Aten.integration.enable = cfg.integration.enable;
    services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
    services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;

    services.myWebsites.apacheConfig = {
      gzip = {
        modules = [ "deflate" "filter" ];
        extraConfig = ''
          AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
        '';
      };
      macros = {
        modules = [ "macro" ];
      };
      ldap = {
        modules = [ "ldap" "authnz_ldap" ];
        # FIXME: starttls
        extraConfig = assert mylibs.checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; ''
          <IfModule ldap_module>
            LDAPSharedCacheSize 500000
            LDAPCacheEntries 1024
            LDAPCacheTTL 600
            LDAPOpCacheEntries 1024
            LDAPOpCacheTTL 600
          </IfModule>

          <Macro LDAPConnect>
            <IfModule authnz_ldap_module>
              AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
              AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
              AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
              AuthType             Basic
              AuthName             "Authentification requise (Acces LDAP)"
              AuthBasicProvider    ldap
            </IfModule>
          </Macro>

          <Macro Stats %{domain}>
            Alias /awstats /var/lib/goaccess/%{domain}
            <Directory /var/lib/goaccess/%{domain}>
              DirectoryIndex index.html
              AllowOverride None
              Require all granted
            </Directory>
            <Location /awstats>
              Use LDAPConnect
              Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
            </Location>
          </Macro>
        '';
      };
      http2 = {
        modules = [ "http2" ];
        extraConfig = ''
          Protocols h2 http/1.1
        '';
      };
      customLog = {
        extraConfig = ''
          LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
        '';
      };
    };

    # FIXME: logrotate
    # FIXME: ipv6
    services.httpdProd = makeService "production" config.services.myWebsites.production;
    services.myWebsites.production.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
    services.myWebsites.production.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));

    services.httpdInte = makeService "integration" config.services.myWebsites.integration;
    services.myWebsites.integration.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
    services.myWebsites.integration.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
  };
}
Commit	Line	Data
f8bde3d6	1	{ lib, pkgs, config, mylibs, myconfig, ... }:
42429ef0 IB	2	let
42429ef0 IB	3	cfg = config.services.myWebsites;
f8bde3d6 IB	4	makeService = name: cfg: let
	5	toVhost = vhostConf: {
	6	enableSSL = true;
	7	sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
	8	sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
	9	sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem";
	10	logFormat = "combinedVhost";
	11	listen = [
	12	{ ip = cfg.ip; port = 443; }
	13	];
	14	hostName = builtins.head vhostConf.hosts;
	15	serverAliases = builtins.tail vhostConf.hosts or [];
	16	documentRoot = vhostConf.root;
	17	extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
	18	};
	19	in rec {
	20	enable = true;
	21	listen = [
	22	{ ip = cfg.ip; port = 443; }
	23	];
	24	stateDir = "/run/httpd_${name}";
	25	logPerVirtualHost = true;
	26	multiProcessingModule = "worker";
	27	adminAddr = "httpd@immae.eu";
	28	logFormat = "combinedVhost";
	29	extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
	30	extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
	31	virtualHosts = pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs;
	32	};
	33	makeServiceOptions = name: ip: {
	34	enable = lib.mkEnableOption "enable websites in ${name}";
	35	ip = lib.mkOption {
	36	type = lib.types.string;
	37	default = ip;
	38	description = "${name} ip to listen to";
	39	};
	40	modules = lib.mkOption {
	41	type = lib.types.listOf (lib.types.str);
	42	default = [];
	43	};
	44	extraConfig = lib.mkOption {
	45	type = lib.types.listOf (lib.types.lines);
	46	default = [];
	47	};
	48	vhostConfs = lib.mkOption {
	49	type = lib.types.attrsOf (lib.types.submodule {
	50	options = {
	51	certName = lib.mkOption { type = lib.types.string; };
	52	hosts = lib.mkOption { type = lib.types.listOf lib.types.string; };
	53	root = lib.mkOption { type = lib.types.nullOr lib.types.path; };
	54	extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
	55	};
	56	});
	57	};
	58	};
42429ef0 IB	59	in
	60	{
	61	imports = [
54307da4 IB	62	./chloe
	63	./ludivine
	64	./aten
	65	./piedsjaloux
	66	./connexionswing
f8bde3d6 IB	67	# built using:
	68	# sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
	69	# And removed users / groups
54307da4 IB	70	./apache/httpd_prod.nix
54307da4 IB	71	./apache/httpd_inte.nix
42429ef0 IB	72	];
	73
	74	options.services.myWebsites = {
f8bde3d6 IB	75	production = makeServiceOptions "production" myconfig.ips.production;
f8bde3d6 IB	76	integration = makeServiceOptions "integration" myconfig.ips.integration;
42429ef0 IB	77
	78	apacheConfig = lib.mkOption {
	79	type = lib.types.attrsOf (lib.types.submodule {
	80	options = {
	81	modules = lib.mkOption {
	82	type = lib.types.listOf (lib.types.str);
	83	default = [];
	84	};
	85	extraConfig = lib.mkOption {
	86	type = lib.types.nullOr lib.types.lines;
	87	default = null;
	88	};
	89	};
	90	});
	91	default = {};
	92	description = "Extra global config";
	93	};
	94
	95	};
	96
	97	config = {
54307da4 IB	98	networking = {
	99	firewall = {
	100	enable = true;
	101	allowedTCPPorts = [ 80 443 ];
	102	};
	103	interfaces."eth0".ipv4.addresses = [
	104	# 176.9.151.89 declared in nixops -> infra / tools
	105	{ address = myconfig.ips.production; prefixLength = 32; }
	106	{ address = myconfig.ips.integration; prefixLength = 32; }
	107	];
	108	};
	109
42429ef0 IB	110	services.myWebsites.Chloe.production.enable = cfg.production.enable;
	111	services.myWebsites.Ludivine.production.enable = cfg.production.enable;
	112	services.myWebsites.Aten.production.enable = cfg.production.enable;
	113	services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
	114	services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
	115
	116	services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
	117	services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
	118	services.myWebsites.Aten.integration.enable = cfg.integration.enable;
	119	services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
	120	services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
	121
	122	services.myWebsites.apacheConfig = {
	123	gzip = {
	124	modules = [ "deflate" "filter" ];
	125	extraConfig = ''
	126	AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
	127	'';
	128	};
	129	macros = {
	130	modules = [ "macro" ];
	131	};
	132	ldap = {
	133	modules = [ "ldap" "authnz_ldap" ];
	134	# FIXME: starttls
	135	extraConfig = assert mylibs.checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; ''
	136	<IfModule ldap_module>
	137	LDAPSharedCacheSize 500000
	138	LDAPCacheEntries 1024
	139	LDAPCacheTTL 600
	140	LDAPOpCacheEntries 1024
	141	LDAPOpCacheTTL 600
	142	</IfModule>
	143
	144	<Macro LDAPConnect>
	145	<IfModule authnz_ldap_module>
	146	AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
	147	AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
	148	AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
	149	AuthType Basic
	150	AuthName "Authentification requise (Acces LDAP)"
	151	AuthBasicProvider ldap
	152	</IfModule>
	153	</Macro>
	154
	155	<Macro Stats %{domain}>
	156	Alias /awstats /var/lib/goaccess/%{domain}
	157	<Directory /var/lib/goaccess/%{domain}>
	158	DirectoryIndex index.html
	159	AllowOverride None
	160	Require all granted
	161	</Directory>
	162	<Location /awstats>
	163	Use LDAPConnect
	164	Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
	165	</Location>
	166	</Macro>
	167	'';
	168	};
	169	http2 = {
	170	modules = [ "http2" ];
	171	extraConfig = ''
	172	Protocols h2 http/1.1
	173	'';
174	};
175	customLog = {
176	extraConfig = ''
177	LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
178	'';
179	};
180	};
f8bde3d6 IB	181
	182	# FIXME: logrotate
	183	# FIXME: ipv6
	184	services.httpdProd = makeService "production" config.services.myWebsites.production;
	185	services.myWebsites.production.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
	186	services.myWebsites.production.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
	187
	188	services.httpdInte = makeService "integration" config.services.myWebsites.integration;
	189	services.myWebsites.integration.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
	190	services.myWebsites.integration.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
42429ef0 IB	191	};
42429ef0 IB	192	}