1 { lib, pkgs, config, ... }:
3 www_root = "/run/current-system/webapps/_www";
4 theme_root = "/run/current-system/webapps/_theme";
7 # This setting permits to ignore time-based cache for files in the
9 # If a client requires an If-Modified-Since from timestamp 1, then
10 # this header is removed, and if the response contains a
11 # too old Last-Modified tag, then it is removed too
13 <If "%{HTTP:If-Modified-Since} =~ /01 Jan 1970 00:00:01/" >
14 RequestHeader unset If-Modified-Since
16 Header unset Last-Modified "expr=%{LAST_MODIFIED} < 19991231235959"
20 modules = [ "deflate" "filter" ];
22 AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
26 modules = [ "macro" ];
30 <Macro Stats %{domain}>
31 Alias /webstats ${config.services.webstats.dataDir}/%{domain}
32 <Directory ${config.services.webstats.dataDir}/%{domain}>
33 DirectoryIndex index.html
39 Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
45 modules = [ "ldap" "authnz_ldap" ];
47 <IfModule ldap_module>
48 LDAPSharedCacheSize 500000
51 LDAPOpCacheEntries 1024
55 Include /var/secrets/apache-ldap
60 ErrorDocument 500 /maintenance_immae.html
61 ErrorDocument 501 /maintenance_immae.html
62 ErrorDocument 502 /maintenance_immae.html
63 ErrorDocument 503 /maintenance_immae.html
64 ErrorDocument 504 /maintenance_immae.html
65 Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
66 ProxyPass /maintenance_immae.html !
68 AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
69 <Directory ${www_root}>
76 extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
79 modules = [ "http2" ];
86 LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
90 makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
91 makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
94 options.myServices.websites.enable = lib.mkEnableOption "enable websites";
96 config = lib.mkIf config.myServices.websites.enable {
97 services.duplyBackup.profiles.php = {
98 rootDir = "/var/lib/php";
100 users.users.wwwrun.extraGroups = [ "keys" ];
101 networking.firewall.allowedTCPPorts = [ 80 443 ];
103 nixpkgs.overlays = [ (self: super: rec {
104 php72 = (super.php72.override {
105 config.php.mysqlnd = true;
106 config.php.mysqli = false;
107 config.php.mhash = true; # Is it needed?
108 }).overrideAttrs(old: rec {
109 # Didn't manage to build with mysqli + mysql_config connector
110 configureFlags = old.configureFlags ++ [
111 "--with-mysqli=shared,mysqlnd"
113 # preConfigure = (old.preConfigure or "") + ''
114 # export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
115 # sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
116 # ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
122 dest = "apache-ldap";
125 permissions = "0400";
128 <IfModule authnz_ldap_module>
129 AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
130 AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
131 AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
133 AuthName "Authentification requise (Acces LDAP)"
134 AuthBasicProvider ldap
140 system.activationScripts = {
142 install -d -m 0755 /var/lib/acme/acme-challenges
143 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
149 session.save_path = "/var/lib/php/sessions"
152 session.gc_maxlifetime = 1296000
154 session.cache_expire = 43200
157 log_level = "notice";
161 services.filesWatcher.httpdProd.paths = [ "/var/secrets/apache-ldap" ];
162 services.filesWatcher.httpdInte.paths = [ "/var/secrets/apache-ldap" ];
163 services.filesWatcher.httpdTools.paths = [ "/var/secrets/apache-ldap" ];
165 services.websites.env.production = {
167 adminAddr = "httpd@immae.eu";
170 let ips = config.myEnv.servers.eldiron.ips.production;
171 in [ips.ip4] ++ (ips.ip6 or []);
172 modules = makeModules;
173 extraConfig = makeExtraConfig;
175 certName = "eldiron";
176 hosts = ["eldiron.immae.eu" ];
178 extraConfig = [ "DirectoryIndex index.htm" ];
182 services.websites.env.integration = {
184 adminAddr = "httpd@immae.eu";
187 let ips = config.myEnv.servers.eldiron.ips.integration;
188 in [ips.ip4] ++ (ips.ip6 or []);
189 modules = makeModules;
190 extraConfig = makeExtraConfig;
192 certName = "eldiron";
193 hosts = ["eldiron.immae.eu" ];
195 extraConfig = [ "DirectoryIndex index.htm" ];
199 services.websites.env.tools = {
201 adminAddr = "httpd@immae.eu";
204 let ips = config.myEnv.servers.eldiron.ips.main;
205 in [ips.ip4] ++ (ips.ip6 or []);
206 modules = makeModules;
207 extraConfig = makeExtraConfig ++
209 RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
210 RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
211 RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
212 RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
213 RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
214 RedirectMatch ^/CGU$ https://www.immae.eu/CGU
219 host = "nossl.immae.eu";
222 certName = "eldiron";
223 hosts = ["eldiron.immae.eu" ];
225 extraConfig = [ "DirectoryIndex index.htm" ];
229 services.websites.webappDirs = {
231 _theme = pkgs.webapps.apache-theme.theme;
233 myServices.websites = {
234 capitaines.landing_pages.enable = true;
237 integration.enable = true;
238 production.enable = true;
242 integration.enable = true;
243 production.enable = true;
247 evariste.enable = true;
248 denisejerome.enable = true;
251 emilia.moodle.enable = true;
255 integration.enable = true;
256 production.enable = true;
260 production.enable = true;
261 release.enable = true;
266 aten_integration.enable = true;
267 aten_production.enable = true;
268 iridologie.enable = true;
271 jerome.naturaloutil.enable = true;
273 leila.production.enable = true;
276 integration.enable = true;
277 production.enable = true;
280 nassime.production.enable = true;
282 nathanael.villon.enable = true;
285 surveillance.enable = true;
286 maison_bbc.enable = true;
290 integration.enable = true;
291 production.enable = true;
294 richie.production.enable = true;
296 syden.peertube.enable = true;
298 telio_tortay.production.enable = true;
300 tools.cloud.enable = true;
301 tools.dav.enable = true;
302 tools.db.enable = true;
303 tools.diaspora.enable = true;
304 tools.etherpad-lite.enable = true;
305 tools.git.enable = true;
306 tools.mastodon.enable = true;
307 tools.mediagoblin.enable = true;
308 tools.peertube.enable = true;
309 tools.tools.enable = true;
310 tools.email.enable = true;
312 games.codenames.enable = true;