modules/private/websites/default.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   www_root = "/run/current-system/webapps/_www";
   4   theme_root = "/run/current-system/webapps/_theme";
   5   apacheConfig = {
   6     gzip = {
   7       modules = [ "deflate" "filter" ];
   8       extraConfig = ''
   9         AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
  10       '';
  11     };
  12     macros = {
  13       modules = [ "macro" ];
  14     };
  15     stats = {
  16       extraConfig = ''
  17         <Macro Stats %{domain}>
  18           Alias /webstats ${config.services.webstats.dataDir}/%{domain}
  19           <Directory ${config.services.webstats.dataDir}/%{domain}>
  20             DirectoryIndex index.html
  21             AllowOverride None
  22             Require all granted
  23           </Directory>
  24           <Location /webstats>
  25             Use LDAPConnect
  26             Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
  27           </Location>
  28         </Macro>
  29       '';
  30     };
  31     ldap = {
  32       modules = [ "ldap" "authnz_ldap" ];
  33       extraConfig = ''
  34         <IfModule ldap_module>
  35           LDAPSharedCacheSize 500000
  36           LDAPCacheEntries 1024
  37           LDAPCacheTTL 600
  38           LDAPOpCacheEntries 1024
  39           LDAPOpCacheTTL 600
  40         </IfModule>
  41
  42         Include /var/secrets/apache-ldap
  43       '';
  44     };
  45     global = {
  46       extraConfig = (pkgs.webapps.apache-default.override { inherit www_root;}).apacheConfig;
  47     };
  48     apaxy = {
  49       extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
  50     };
  51     http2 = {
  52       modules = [ "http2" ];
  53       extraConfig = ''
  54         Protocols h2 http/1.1
  55       '';
  56     };
  57     customLog = {
  58       extraConfig = ''
  59         LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
  60       '';
  61     };
  62   };
  63   makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
  64   makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
  65 in
  66 {
  67   options.myServices.websites = {
  68     enable = lib.mkEnableOption "enable websites";
  69
  70     webappDirs = lib.mkOption {
  71       type = lib.types.attrsOf lib.types.path;
  72       description = ''
  73         Webapp paths to create in /run/current-system/webapps
  74         '';
  75       default = {};
  76     };
  77   };
  78
  79   config = lib.mkIf config.myServices.websites.enable {
  80     services.duplyBackup.profiles.php = {
  81       rootDir = "/var/lib/php";
  82     };
  83     users.users.wwwrun.extraGroups = [ "keys" ];
  84     networking.firewall.allowedTCPPorts = [ 80 443 ];
  85
  86     nixpkgs.overlays = [ (self: super: rec {
  87       #openssl = self.openssl_1_1;
  88       php = php72;
  89       php72 = (super.php72.override {
  90         config.php.mysqlnd = true;
  91         config.php.mysqli = false;
  92         config.php.mhash = true; # Is it needed?
  93       }).overrideAttrs(old: rec {
  94         # Didn't manage to build with mysqli + mysql_config connector
  95         configureFlags = old.configureFlags ++ [
  96           "--with-mysqli=shared,mysqlnd"
  97           ];
  98         # preConfigure = (old.preConfigure or "") + ''
  99         #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
 100         #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
 101         #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
 102         #   '';
 103       });
 104       phpPackages = super.php72Packages.override { inherit php; };
 105     }) ];
 106
 107     secrets.keys = [{
 108       dest = "apache-ldap";
 109       user = "wwwrun";
 110       group = "wwwrun";
 111       permissions = "0400";
 112       text = ''
 113         <Macro LDAPConnect>
 114           <IfModule authnz_ldap_module>
 115             AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 116             AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 117             AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
 118             AuthType             Basic
 119             AuthName             "Authentification requise (Acces LDAP)"
 120             AuthBasicProvider    ldap
 121           </IfModule>
 122         </Macro>
 123         '';
 124     }];
 125
 126     system.activationScripts = {
 127       httpd = ''
 128         install -d -m 0755 /var/lib/acme/acme-challenge
 129         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 130         '';
 131     };
 132
 133     services.phpfpm = {
 134       phpPackage = pkgs.php;
 135       phpOptions = ''
 136         session.save_path = "/var/lib/php/sessions"
 137         post_max_size = 20M
 138         ; 15 days (seconds)
 139         session.gc_maxlifetime = 1296000
 140         ; 30 days (minutes)
 141         session.cache_expire = 43200
 142         '';
 143       settings = {
 144         log_level = "notice";
 145       };
 146     };
 147
 148     services.filesWatcher.httpdProd.paths = [ "/var/secrets/apache-ldap" ];
 149     services.filesWatcher.httpdInte.paths = [ "/var/secrets/apache-ldap" ];
 150     services.filesWatcher.httpdTools.paths = [ "/var/secrets/apache-ldap" ];
 151
 152     services.websites.env.production = {
 153       enable = true;
 154       adminAddr = "httpd@immae.eu";
 155       httpdName = "Prod";
 156       ips =
 157         let ips = config.myEnv.servers.eldiron.ips.production;
 158         in [ips.ip4] ++ (ips.ip6 or []);
 159       modules = makeModules;
 160       extraConfig = makeExtraConfig;
 161       fallbackVhost = {
 162         certName    = "eldiron";
 163         hosts       = ["eldiron.immae.eu" ];
 164         root        = www_root;
 165         extraConfig = [ "DirectoryIndex index.htm" ];
 166       };
 167     };
 168
 169     services.websites.env.integration = {
 170       enable = true;
 171       adminAddr = "httpd@immae.eu";
 172       httpdName = "Inte";
 173       ips =
 174         let ips = config.myEnv.servers.eldiron.ips.integration;
 175         in [ips.ip4] ++ (ips.ip6 or []);
 176       modules = makeModules;
 177       extraConfig = makeExtraConfig;
 178       fallbackVhost = {
 179         certName    = "eldiron";
 180         hosts       = ["eldiron.immae.eu" ];
 181         root        = www_root;
 182         extraConfig = [ "DirectoryIndex index.htm" ];
 183       };
 184     };
 185
 186     services.websites.env.tools = {
 187       enable = true;
 188       adminAddr = "httpd@immae.eu";
 189       httpdName = "Tools";
 190       ips =
 191         let ips = config.myEnv.servers.eldiron.ips.main;
 192         in [ips.ip4] ++ (ips.ip6 or []);
 193       modules = makeModules;
 194       extraConfig = makeExtraConfig ++
 195         [ ''
 196             RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 197             RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 198             RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 199             RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 200             RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 201             RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 202           ''
 203           ];
 204       nosslVhost = {
 205         enable = true;
 206         host = "nossl.immae.eu";
 207       };
 208       fallbackVhost = {
 209         certName    = "eldiron";
 210         hosts       = ["eldiron.immae.eu" ];
 211         root        = www_root;
 212         extraConfig = [ "DirectoryIndex index.htm" ];
 213       };
 214     };
 215
 216     system.extraSystemBuilderCmds = lib.mkIf (builtins.length (builtins.attrValues config.myServices.websites.webappDirs) > 0) ''
 217     mkdir -p $out/webapps
 218     ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList (name: path: "ln -s ${path} $out/webapps/${name}") config.myServices.websites.webappDirs)}
 219     '';
 220
 221     myServices.websites = {
 222       webappDirs = {
 223         _www = pkgs.webapps.apache-default.www;
 224         _theme = pkgs.webapps.apache-theme.theme;
 225       };
 226
 227       isabelle.aten_integration.enable = true;
 228       isabelle.aten_production.enable = true;
 229       isabelle.iridologie.enable = true;
 230
 231       capitaines.production.enable = true;
 232
 233       chloe.integration.enable = true;
 234       chloe.production.enable = true;
 235
 236       connexionswing.integration.enable = true;
 237       connexionswing.production.enable = true;
 238
 239       denisejerome.production.enable = true;
 240
 241       emilia.production.enable = true;
 242       emilia.richie_production.enable = true;
 243
 244       florian.app.enable = true;
 245       florian.integration.enable = true;
 246       florian.production.enable = true;
 247
 248       immae.production.enable = true;
 249       immae.release.enable = true;
 250       immae.temp.enable = true;
 251
 252       leila.production.enable = true;
 253
 254       ludivinecassal.integration.enable = true;
 255       ludivinecassal.production.enable = true;
 256
 257       nassime.production.enable = true;
 258
 259       evariste.production.enable = true;
 260       naturaloutil.production.enable = true;
 261       telioTortay.production.enable = true;
 262
 263       papa.surveillance.enable = true;
 264       papa.maison_bbc.enable = true;
 265
 266       piedsjaloux.integration.enable = true;
 267       piedsjaloux.production.enable = true;
 268
 269       tools.cloud.enable = true;
 270       tools.dav.enable = true;
 271       tools.db.enable = true;
 272       tools.diaspora.enable = true;
 273       tools.etherpad-lite.enable = true;
 274       tools.git.enable = true;
 275       tools.mastodon.enable = true;
 276       tools.mediagoblin.enable = true;
 277       tools.peertube.enable = true;
 278       tools.tools.enable = true;
 279       tools.email.enable = true;
 280     };
 281   };
 282 }