modules/private/websites/default.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   www_root = "/run/current-system/webapps/_www";
   4   theme_root = "/run/current-system/webapps/_theme";
   5   apacheConfig = {
   6     cache = {
   7       # This setting permits to ignore time-based cache for files in the
   8       # nix store:
   9       # If a client requires an If-Modified-Since from timestamp 1, then
  10       # this header is removed, and if the response contains a
  11       # too old Last-Modified tag, then it is removed too
  12       extraConfig = ''
  13         <If "%{HTTP:If-Modified-Since} =~ /01 Jan 1970 00:00:01/" >
  14           RequestHeader unset If-Modified-Since
  15         </If>
  16         Header unset Last-Modified "expr=%{LAST_MODIFIED} < 19991231235959"
  17       '';
  18     };
  19     gzip = {
  20       modules = [ "deflate" "filter" ];
  21       extraConfig = ''
  22         AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
  23       '';
  24     };
  25     macros = {
  26       modules = [ "macro" ];
  27     };
  28     stats = {
  29       extraConfig = ''
  30         <Macro Stats %{domain}>
  31           Alias /webstats ${config.services.webstats.dataDir}/%{domain}
  32           <Directory ${config.services.webstats.dataDir}/%{domain}>
  33             DirectoryIndex index.html
  34             AllowOverride None
  35             Require all granted
  36           </Directory>
  37           <Location /webstats>
  38             Use LDAPConnect
  39             Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
  40           </Location>
  41         </Macro>
  42       '';
  43     };
  44     ldap = {
  45       modules = [ "ldap" "authnz_ldap" ];
  46       extraConfig = ''
  47         <IfModule ldap_module>
  48           LDAPSharedCacheSize 500000
  49           LDAPCacheEntries 1024
  50           LDAPCacheTTL 600
  51           LDAPOpCacheEntries 1024
  52           LDAPOpCacheTTL 600
  53         </IfModule>
  54
  55         Include /var/secrets/apache-ldap
  56       '';
  57     };
  58     global = {
  59       extraConfig = ''
  60         ErrorDocument 500 /maintenance_immae.html
  61         ErrorDocument 501 /maintenance_immae.html
  62         ErrorDocument 502 /maintenance_immae.html
  63         ErrorDocument 503 /maintenance_immae.html
  64         ErrorDocument 504 /maintenance_immae.html
  65         Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
  66         ProxyPass /maintenance_immae.html !
  67
  68         AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
  69         <Directory ${www_root}>
  70           AllowOverride None
  71           Require all granted
  72         </Directory>
  73       '';
  74     };
  75     apaxy = {
  76       extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
  77     };
  78     http2 = {
  79       modules = [ "http2" ];
  80       extraConfig = ''
  81         Protocols h2 http/1.1
  82       '';
  83     };
  84     customLog = {
  85       extraConfig = ''
  86         LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
  87       '';
  88     };
  89   };
  90   makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
  91   makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
  92 in
  93 {
  94   options.myServices.websites.enable = lib.mkEnableOption "enable websites";
  95
  96   config = lib.mkIf config.myServices.websites.enable {
  97     services.duplyBackup.profiles.php = {
  98       rootDir = "/var/lib/php";
  99     };
 100     users.users.wwwrun.extraGroups = [ "keys" ];
 101     networking.firewall.allowedTCPPorts = [ 80 443 ];
 102
 103     nixpkgs.overlays = [ (self: super: rec {
 104       #openssl = self.openssl_1_1;
 105       php = php72;
 106       php72 = (super.php72.override {
 107         config.php.mysqlnd = true;
 108         config.php.mysqli = false;
 109         config.php.mhash = true; # Is it needed?
 110       }).overrideAttrs(old: rec {
 111         # Didn't manage to build with mysqli + mysql_config connector
 112         configureFlags = old.configureFlags ++ [
 113           "--with-mysqli=shared,mysqlnd"
 114           ];
 115         # preConfigure = (old.preConfigure or "") + ''
 116         #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
 117         #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
 118         #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
 119         #   '';
 120       });
 121       phpPackages = super.php72Packages.override { inherit php; };
 122     }) ];
 123
 124     secrets.keys = [{
 125       dest = "apache-ldap";
 126       user = "wwwrun";
 127       group = "wwwrun";
 128       permissions = "0400";
 129       text = ''
 130         <Macro LDAPConnect>
 131           <IfModule authnz_ldap_module>
 132             AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 133             AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 134             AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
 135             AuthType             Basic
 136             AuthName             "Authentification requise (Acces LDAP)"
 137             AuthBasicProvider    ldap
 138           </IfModule>
 139         </Macro>
 140         '';
 141     }];
 142
 143     system.activationScripts = {
 144       httpd = ''
 145         install -d -m 0755 /var/lib/acme/acme-challenges
 146         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 147         '';
 148     };
 149
 150     services.phpfpm = {
 151       phpPackage = pkgs.php;
 152       phpOptions = ''
 153         session.save_path = "/var/lib/php/sessions"
 154         post_max_size = 20M
 155         ; 15 days (seconds)
 156         session.gc_maxlifetime = 1296000
 157         ; 30 days (minutes)
 158         session.cache_expire = 43200
 159         '';
 160       settings = {
 161         log_level = "notice";
 162       };
 163     };
 164
 165     services.filesWatcher.httpdProd.paths = [ "/var/secrets/apache-ldap" ];
 166     services.filesWatcher.httpdInte.paths = [ "/var/secrets/apache-ldap" ];
 167     services.filesWatcher.httpdTools.paths = [ "/var/secrets/apache-ldap" ];
 168
 169     services.websites.env.production = {
 170       enable = true;
 171       adminAddr = "httpd@immae.eu";
 172       httpdName = "Prod";
 173       ips =
 174         let ips = config.myEnv.servers.eldiron.ips.production;
 175         in [ips.ip4] ++ (ips.ip6 or []);
 176       modules = makeModules;
 177       extraConfig = makeExtraConfig;
 178       fallbackVhost = {
 179         certName    = "eldiron";
 180         hosts       = ["eldiron.immae.eu" ];
 181         root        = www_root;
 182         extraConfig = [ "DirectoryIndex index.htm" ];
 183       };
 184     };
 185
 186     services.websites.env.integration = {
 187       enable = true;
 188       adminAddr = "httpd@immae.eu";
 189       httpdName = "Inte";
 190       ips =
 191         let ips = config.myEnv.servers.eldiron.ips.integration;
 192         in [ips.ip4] ++ (ips.ip6 or []);
 193       modules = makeModules;
 194       extraConfig = makeExtraConfig;
 195       fallbackVhost = {
 196         certName    = "eldiron";
 197         hosts       = ["eldiron.immae.eu" ];
 198         root        = www_root;
 199         extraConfig = [ "DirectoryIndex index.htm" ];
 200       };
 201     };
 202
 203     services.websites.env.tools = {
 204       enable = true;
 205       adminAddr = "httpd@immae.eu";
 206       httpdName = "Tools";
 207       ips =
 208         let ips = config.myEnv.servers.eldiron.ips.main;
 209         in [ips.ip4] ++ (ips.ip6 or []);
 210       modules = makeModules;
 211       extraConfig = makeExtraConfig ++
 212         [ ''
 213             RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 214             RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 215             RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 216             RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 217             RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 218             RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 219           ''
 220           ];
 221       nosslVhost = {
 222         enable = true;
 223         host = "nossl.immae.eu";
 224       };
 225       fallbackVhost = {
 226         certName    = "eldiron";
 227         hosts       = ["eldiron.immae.eu" ];
 228         root        = www_root;
 229         extraConfig = [ "DirectoryIndex index.htm" ];
 230       };
 231     };
 232
 233     services.websites.webappDirs = {
 234       _www = ./_www;
 235       _theme = pkgs.webapps.apache-theme.theme;
 236     };
 237     myServices.websites = {
 238       capitaines.landing_pages.enable = true;
 239
 240       chloe = {
 241         integration.enable = true;
 242         production.enable = true;
 243       };
 244
 245       connexionswing = {
 246         integration.enable = true;
 247         production.enable = true;
 248       };
 249
 250       denise = {
 251         evariste.enable = true;
 252         denisejerome.enable = true;
 253       };
 254
 255       emilia.moodle.enable = true;
 256
 257       florian = {
 258         app.enable = true;
 259         integration.enable = true;
 260         production.enable = true;
 261       };
 262
 263       immae = {
 264         production.enable = true;
 265         release.enable = true;
 266         temp.enable = true;
 267       };
 268
 269       isabelle = {
 270         aten_integration.enable = true;
 271         aten_production.enable = true;
 272         iridologie.enable = true;
 273       };
 274
 275       jerome.naturaloutil.enable = true;
 276
 277       leila.production.enable = true;
 278
 279       ludivine = {
 280         integration.enable = true;
 281         production.enable = true;
 282       };
 283
 284       nassime.production.enable = true;
 285
 286       nathanael.villon.enable = true;
 287
 288       papa = {
 289         surveillance.enable = true;
 290         maison_bbc.enable = true;
 291       };
 292
 293       piedsjaloux = {
 294         integration.enable = true;
 295         production.enable = true;
 296       };
 297
 298       richie.production.enable = true;
 299
 300       syden.peertube.enable = true;
 301
 302       telio_tortay.production.enable = true;
 303
 304       tools.cloud.enable = true;
 305       tools.dav.enable = true;
 306       tools.db.enable = true;
 307       tools.diaspora.enable = true;
 308       tools.etherpad-lite.enable = true;
 309       tools.git.enable = true;
 310       tools.mastodon.enable = true;
 311       tools.mediagoblin.enable = true;
 312       tools.peertube.enable = true;
 313       tools.tools.enable = true;
 314       tools.email.enable = true;
 315
 316       games.codenames.enable = true;
 317     };
 318   };
 319 }