modules/private/websites/default.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   www_root = "/run/current-system/webapps/_www";
   4   theme_root = "/run/current-system/webapps/_theme";
   5   apacheConfig = {
   6     gzip = {
   7       modules = [ "deflate" "filter" ];
   8       extraConfig = ''
   9         AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
  10       '';
  11     };
  12     macros = {
  13       modules = [ "macro" ];
  14     };
  15     stats = {
  16       extraConfig = ''
  17         <Macro Stats %{domain}>
  18           Alias /webstats ${config.services.webstats.dataDir}/%{domain}
  19           <Directory ${config.services.webstats.dataDir}/%{domain}>
  20             DirectoryIndex index.html
  21             AllowOverride None
  22             Require all granted
  23           </Directory>
  24           <Location /webstats>
  25             Use LDAPConnect
  26             Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
  27           </Location>
  28         </Macro>
  29       '';
  30     };
  31     ldap = {
  32       modules = [ "ldap" "authnz_ldap" ];
  33       extraConfig = ''
  34         <IfModule ldap_module>
  35           LDAPSharedCacheSize 500000
  36           LDAPCacheEntries 1024
  37           LDAPCacheTTL 600
  38           LDAPOpCacheEntries 1024
  39           LDAPOpCacheTTL 600
  40         </IfModule>
  41
  42         Include /var/secrets/apache-ldap
  43       '';
  44     };
  45     global = {
  46       extraConfig = ''
  47         ErrorDocument 500 /maintenance_immae.html
  48         ErrorDocument 501 /maintenance_immae.html
  49         ErrorDocument 502 /maintenance_immae.html
  50         ErrorDocument 503 /maintenance_immae.html
  51         ErrorDocument 504 /maintenance_immae.html
  52         Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
  53         ProxyPass /maintenance_immae.html !
  54
  55         AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
  56         <Directory ${www_root}>
  57           AllowOverride None
  58           Require all granted
  59         </Directory>
  60       '';
  61     };
  62     apaxy = {
  63       extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
  64     };
  65     http2 = {
  66       modules = [ "http2" ];
  67       extraConfig = ''
  68         Protocols h2 http/1.1
  69       '';
  70     };
  71     customLog = {
  72       extraConfig = ''
  73         LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
  74       '';
  75     };
  76   };
  77   makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
  78   makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
  79 in
  80 {
  81   options.myServices.websites.enable = lib.mkEnableOption "enable websites";
  82
  83   config = lib.mkIf config.myServices.websites.enable {
  84     services.duplyBackup.profiles.php = {
  85       rootDir = "/var/lib/php";
  86     };
  87     users.users.wwwrun.extraGroups = [ "keys" ];
  88     networking.firewall.allowedTCPPorts = [ 80 443 ];
  89
  90     nixpkgs.overlays = [ (self: super: rec {
  91       #openssl = self.openssl_1_1;
  92       php = php72;
  93       php72 = (super.php72.override {
  94         config.php.mysqlnd = true;
  95         config.php.mysqli = false;
  96         config.php.mhash = true; # Is it needed?
  97       }).overrideAttrs(old: rec {
  98         # Didn't manage to build with mysqli + mysql_config connector
  99         configureFlags = old.configureFlags ++ [
 100           "--with-mysqli=shared,mysqlnd"
 101           ];
 102         # preConfigure = (old.preConfigure or "") + ''
 103         #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
 104         #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
 105         #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
 106         #   '';
 107       });
 108       phpPackages = super.php72Packages.override { inherit php; };
 109     }) ];
 110
 111     secrets.keys = [{
 112       dest = "apache-ldap";
 113       user = "wwwrun";
 114       group = "wwwrun";
 115       permissions = "0400";
 116       text = ''
 117         <Macro LDAPConnect>
 118           <IfModule authnz_ldap_module>
 119             AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 120             AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 121             AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
 122             AuthType             Basic
 123             AuthName             "Authentification requise (Acces LDAP)"
 124             AuthBasicProvider    ldap
 125           </IfModule>
 126         </Macro>
 127         '';
 128     }];
 129
 130     system.activationScripts = {
 131       httpd = ''
 132         install -d -m 0755 /var/lib/acme/acme-challenges
 133         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 134         '';
 135     };
 136
 137     services.phpfpm = {
 138       phpPackage = pkgs.php;
 139       phpOptions = ''
 140         session.save_path = "/var/lib/php/sessions"
 141         post_max_size = 20M
 142         ; 15 days (seconds)
 143         session.gc_maxlifetime = 1296000
 144         ; 30 days (minutes)
 145         session.cache_expire = 43200
 146         '';
 147       settings = {
 148         log_level = "notice";
 149       };
 150     };
 151
 152     services.filesWatcher.httpdProd.paths = [ "/var/secrets/apache-ldap" ];
 153     services.filesWatcher.httpdInte.paths = [ "/var/secrets/apache-ldap" ];
 154     services.filesWatcher.httpdTools.paths = [ "/var/secrets/apache-ldap" ];
 155
 156     services.websites.env.production = {
 157       enable = true;
 158       adminAddr = "httpd@immae.eu";
 159       httpdName = "Prod";
 160       ips =
 161         let ips = config.myEnv.servers.eldiron.ips.production;
 162         in [ips.ip4] ++ (ips.ip6 or []);
 163       modules = makeModules;
 164       extraConfig = makeExtraConfig;
 165       fallbackVhost = {
 166         certName    = "eldiron";
 167         hosts       = ["eldiron.immae.eu" ];
 168         root        = www_root;
 169         extraConfig = [ "DirectoryIndex index.htm" ];
 170       };
 171     };
 172
 173     services.websites.env.integration = {
 174       enable = true;
 175       adminAddr = "httpd@immae.eu";
 176       httpdName = "Inte";
 177       ips =
 178         let ips = config.myEnv.servers.eldiron.ips.integration;
 179         in [ips.ip4] ++ (ips.ip6 or []);
 180       modules = makeModules;
 181       extraConfig = makeExtraConfig;
 182       fallbackVhost = {
 183         certName    = "eldiron";
 184         hosts       = ["eldiron.immae.eu" ];
 185         root        = www_root;
 186         extraConfig = [ "DirectoryIndex index.htm" ];
 187       };
 188     };
 189
 190     services.websites.env.tools = {
 191       enable = true;
 192       adminAddr = "httpd@immae.eu";
 193       httpdName = "Tools";
 194       ips =
 195         let ips = config.myEnv.servers.eldiron.ips.main;
 196         in [ips.ip4] ++ (ips.ip6 or []);
 197       modules = makeModules;
 198       extraConfig = makeExtraConfig ++
 199         [ ''
 200             RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 201             RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 202             RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 203             RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 204             RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 205             RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 206           ''
 207           ];
 208       nosslVhost = {
 209         enable = true;
 210         host = "nossl.immae.eu";
 211       };
 212       fallbackVhost = {
 213         certName    = "eldiron";
 214         hosts       = ["eldiron.immae.eu" ];
 215         root        = www_root;
 216         extraConfig = [ "DirectoryIndex index.htm" ];
 217       };
 218     };
 219
 220     services.websites.webappDirs = {
 221       _www = ./_www;
 222       _theme = pkgs.webapps.apache-theme.theme;
 223     };
 224     myServices.websites = {
 225       capitaines.landing_pages.enable = true;
 226
 227       chloe = {
 228         integration.enable = true;
 229         production.enable = true;
 230       };
 231
 232       connexionswing = {
 233         integration.enable = true;
 234         production.enable = true;
 235       };
 236
 237       denise = {
 238         evariste.enable = true;
 239         denisejerome.enable = true;
 240       };
 241
 242       emilia.moodle.enable = true;
 243
 244       florian = {
 245         app.enable = true;
 246         integration.enable = true;
 247         production.enable = true;
 248       };
 249
 250       immae = {
 251         production.enable = true;
 252         release.enable = true;
 253         temp.enable = true;
 254       };
 255
 256       isabelle = {
 257         aten_integration.enable = true;
 258         aten_production.enable = true;
 259         iridologie.enable = true;
 260       };
 261
 262       jerome.naturaloutil.enable = true;
 263
 264       leila.production.enable = true;
 265
 266       ludivine = {
 267         integration.enable = true;
 268         production.enable = true;
 269       };
 270
 271       nassime.production.enable = true;
 272
 273       nathanael.villon.enable = true;
 274
 275       papa = {
 276         surveillance.enable = true;
 277         maison_bbc.enable = true;
 278       };
 279
 280       piedsjaloux = {
 281         integration.enable = true;
 282         production.enable = true;
 283       };
 284
 285       richie.production.enable = true;
 286
 287       syden.peertube.enable = true;
 288
 289       telio_tortay.production.enable = true;
 290
 291       tools.cloud.enable = true;
 292       tools.dav.enable = true;
 293       tools.db.enable = true;
 294       tools.diaspora.enable = true;
 295       tools.etherpad-lite.enable = true;
 296       tools.git.enable = true;
 297       tools.mastodon.enable = true;
 298       tools.mediagoblin.enable = true;
 299       tools.peertube.enable = true;
 300       tools.tools.enable = true;
 301       tools.email.enable = true;
 302
 303       games.codenames.enable = true;
 304     };
 305   };
 306 }