modules/private/websites/default.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   www_root = "/run/current-system/webapps/_www";
   4   theme_root = "/run/current-system/webapps/_theme";
   5   apacheConfig = {
   6     cache = {
   7       # This setting permits to ignore time-based cache for files in the
   8       # nix store:
   9       # If a client requires an If-Modified-Since from timestamp 1, then
  10       # this header is removed, and if the response contains a
  11       # too old Last-Modified tag, then it is removed too
  12       extraConfig = ''
  13         <If "%{HTTP:If-Modified-Since} =~ /01 Jan 1970 00:00:01/" >
  14           RequestHeader unset If-Modified-Since
  15         </If>
  16         Header unset Last-Modified "expr=%{LAST_MODIFIED} < 19991231235959"
  17       '';
  18     };
  19     gzip = {
  20       modules = [ "deflate" "filter" ];
  21       extraConfig = ''
  22         AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
  23       '';
  24     };
  25     macros = {
  26       modules = [ "macro" ];
  27     };
  28     stats = {
  29       extraConfig = ''
  30         <Macro Stats %{domain}>
  31           Alias /webstats ${config.services.webstats.dataDir}/%{domain}
  32           <Directory ${config.services.webstats.dataDir}/%{domain}>
  33             DirectoryIndex index.html
  34             AllowOverride None
  35             Require all granted
  36           </Directory>
  37           <Location /webstats>
  38             Use LDAPConnect
  39             Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
  40           </Location>
  41         </Macro>
  42       '';
  43     };
  44     ldap = {
  45       modules = [ "ldap" "authnz_ldap" ];
  46       extraConfig = ''
  47         <IfModule ldap_module>
  48           LDAPSharedCacheSize 500000
  49           LDAPCacheEntries 1024
  50           LDAPCacheTTL 600
  51           LDAPOpCacheEntries 1024
  52           LDAPOpCacheTTL 600
  53         </IfModule>
  54
  55         Include /var/secrets/apache-ldap
  56       '';
  57     };
  58     global = {
  59       extraConfig = ''
  60         ErrorDocument 500 /maintenance_immae.html
  61         ErrorDocument 501 /maintenance_immae.html
  62         ErrorDocument 502 /maintenance_immae.html
  63         ErrorDocument 503 /maintenance_immae.html
  64         ErrorDocument 504 /maintenance_immae.html
  65         Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
  66         ProxyPass /maintenance_immae.html !
  67
  68         AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
  69         <Directory ${www_root}>
  70           AllowOverride None
  71           Require all granted
  72         </Directory>
  73       '';
  74     };
  75     apaxy = {
  76       extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
  77     };
  78     http2 = {
  79       modules = [ "http2" ];
  80       extraConfig = ''
  81         Protocols h2 http/1.1
  82       '';
  83     };
  84     customLog = {
  85       extraConfig = ''
  86         LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
  87       '';
  88     };
  89   };
  90   makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
  91   makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
  92 in
  93 {
  94   options.myServices.websites.enable = lib.mkEnableOption "enable websites";
  95
  96   config = lib.mkIf config.myServices.websites.enable {
  97     services.duplyBackup.profiles.php = {
  98       rootDir = "/var/lib/php";
  99     };
 100     users.users.wwwrun.extraGroups = [ "keys" ];
 101     networking.firewall.allowedTCPPorts = [ 80 443 ];
 102
 103     secrets.keys = [{
 104       dest = "apache-ldap";
 105       user = "wwwrun";
 106       group = "wwwrun";
 107       permissions = "0400";
 108       text = ''
 109         <Macro LDAPConnect>
 110           <IfModule authnz_ldap_module>
 111             AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 112             AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 113             AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
 114             AuthType             Basic
 115             AuthName             "Authentification requise (Acces LDAP)"
 116             AuthBasicProvider    ldap
 117           </IfModule>
 118         </Macro>
 119         '';
 120     }];
 121
 122     system.activationScripts = {
 123       httpd = ''
 124         install -d -m 0755 /var/lib/acme/acme-challenges
 125         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 126         '';
 127     };
 128
 129     services.phpfpm = {
 130       phpOptions = ''
 131         session.save_path = "/var/lib/php/sessions"
 132         post_max_size = 20M
 133         ; 15 days (seconds)
 134         session.gc_maxlifetime = 1296000
 135         ; 30 days (minutes)
 136         session.cache_expire = 43200
 137         '';
 138       settings = {
 139         log_level = "notice";
 140       };
 141     };
 142
 143     services.filesWatcher.httpdProd.paths = [ "/var/secrets/apache-ldap" ];
 144     services.filesWatcher.httpdInte.paths = [ "/var/secrets/apache-ldap" ];
 145     services.filesWatcher.httpdTools.paths = [ "/var/secrets/apache-ldap" ];
 146
 147     services.websites.env.production = {
 148       enable = true;
 149       adminAddr = "httpd@immae.eu";
 150       httpdName = "Prod";
 151       ips =
 152         let ips = config.myEnv.servers.eldiron.ips.production;
 153         in [ips.ip4] ++ (ips.ip6 or []);
 154       modules = makeModules;
 155       extraConfig = makeExtraConfig;
 156       fallbackVhost = {
 157         certName    = "eldiron";
 158         hosts       = ["eldiron.immae.eu" ];
 159         root        = www_root;
 160         extraConfig = [ "DirectoryIndex index.htm" ];
 161       };
 162     };
 163
 164     services.websites.env.integration = {
 165       enable = true;
 166       adminAddr = "httpd@immae.eu";
 167       httpdName = "Inte";
 168       ips =
 169         let ips = config.myEnv.servers.eldiron.ips.integration;
 170         in [ips.ip4] ++ (ips.ip6 or []);
 171       modules = makeModules;
 172       extraConfig = makeExtraConfig;
 173       fallbackVhost = {
 174         certName    = "eldiron";
 175         hosts       = ["eldiron.immae.eu" ];
 176         root        = www_root;
 177         extraConfig = [ "DirectoryIndex index.htm" ];
 178       };
 179     };
 180
 181     services.websites.env.tools = {
 182       enable = true;
 183       adminAddr = "httpd@immae.eu";
 184       httpdName = "Tools";
 185       ips =
 186         let ips = config.myEnv.servers.eldiron.ips.main;
 187         in [ips.ip4] ++ (ips.ip6 or []);
 188       modules = makeModules;
 189       extraConfig = makeExtraConfig ++
 190         [ ''
 191             RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 192             RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 193             RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 194             RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 195             RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 196             RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 197           ''
 198           ];
 199       nosslVhost = {
 200         enable = true;
 201         host = "nossl.immae.eu";
 202       };
 203       fallbackVhost = {
 204         certName    = "eldiron";
 205         hosts       = ["eldiron.immae.eu" ];
 206         root        = www_root;
 207         extraConfig = [ "DirectoryIndex index.htm" ];
 208       };
 209     };
 210
 211     services.websites.webappDirs = {
 212       _www = ./_www;
 213       _theme = pkgs.webapps.apache-theme.theme;
 214     };
 215     myServices.websites = {
 216       capitaines.landing_pages.enable = true;
 217
 218       chloe = {
 219         integration.enable = true;
 220         production.enable = true;
 221       };
 222
 223       cip-ca = {
 224         sympa.enable = true;
 225       };
 226
 227       connexionswing = {
 228         integration.enable = true;
 229         production.enable = true;
 230       };
 231
 232       denise = {
 233         evariste.enable = true;
 234         denisejerome.enable = true;
 235         oms.enable = true;
 236         production.enable = true;
 237       };
 238
 239       emilia.moodle.enable = true;
 240
 241       florian = {
 242         app.enable = true;
 243         integration.enable = true;
 244         production.enable = true;
 245       };
 246
 247       immae = {
 248         production.enable = true;
 249         release.enable = true;
 250         temp.enable = true;
 251       };
 252
 253       isabelle = {
 254         aten_integration.enable = true;
 255         aten_production.enable = true;
 256         iridologie.enable = true;
 257       };
 258
 259       jerome.naturaloutil.enable = true;
 260
 261       leila.production.enable = true;
 262
 263       ludivine = {
 264         integration.enable = true;
 265         production.enable = true;
 266       };
 267
 268       nassime.production.enable = true;
 269
 270       nathanael.villon.enable = true;
 271
 272       papa = {
 273         surveillance.enable = true;
 274         maison_bbc.enable = true;
 275       };
 276
 277       piedsjaloux = {
 278         integration.enable = true;
 279         production.enable = true;
 280       };
 281
 282       richie.production.enable = true;
 283
 284       syden.peertube.enable = true;
 285
 286       telio_tortay.production.enable = true;
 287
 288       tools.cloud.enable = true;
 289       tools.commento.enable = true;
 290       tools.dav.enable = true;
 291       tools.db.enable = true;
 292       tools.diaspora.enable = true;
 293       tools.etherpad-lite.enable = true;
 294       tools.git.enable = true;
 295       tools.mastodon.enable = true;
 296       tools.mediagoblin.enable = true;
 297       tools.peertube.enable = true;
 298       tools.tools.enable = true;
 299       tools.email.enable = true;
 300
 301       games.codenames.enable = true;
 302     };
 303   };
 304 }