modules/private/websites/tools/tools/default.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   adminer = pkgs.callPackage ./adminer.nix {
   4     inherit (pkgs.webapps) adminer;
   5   };
   6   ympd = pkgs.callPackage ./ympd.nix {
   7     env = config.myEnv.tools.ympd;
   8   };
   9   ttrss = pkgs.callPackage ./ttrss.nix {
  10     inherit (pkgs.webapps) ttrss ttrss-plugins;
  11     env = config.myEnv.tools.ttrss;
  12   };
  13   kanboard = pkgs.callPackage ./kanboard.nix  {
  14     env = config.myEnv.tools.kanboard;
  15   };
  16   wallabag = pkgs.callPackage ./wallabag.nix {
  17     inherit (pkgs.webapps) wallabag;
  18     env = config.myEnv.tools.wallabag;
  19   };
  20   yourls = pkgs.callPackage ./yourls.nix {
  21     inherit (pkgs.webapps) yourls yourls-plugins;
  22     env = config.myEnv.tools.yourls;
  23   };
  24   rompr = pkgs.callPackage ./rompr.nix {
  25     inherit (pkgs.webapps) rompr;
  26     env = config.myEnv.tools.rompr;
  27   };
  28   shaarli = pkgs.callPackage ./shaarli.nix {
  29     env = config.myEnv.tools.shaarli;
  30   };
  31   dokuwiki = pkgs.callPackage ./dokuwiki.nix {
  32     inherit (pkgs.webapps) dokuwiki dokuwiki-plugins;
  33   };
  34   ldap = pkgs.callPackage ./ldap.nix {
  35     inherit (pkgs.webapps) phpldapadmin;
  36     env = config.myEnv.tools.phpldapadmin;
  37   };
  38   grocy = pkgs.callPackage ./grocy.nix {
  39     inherit (pkgs.webapps) grocy;
  40   };
  41   phpbb = pkgs.callPackage ./phpbb.nix {
  42     phpbb = (pkgs.webapps.phpbb.withLangs (l: [ l.fr ])).withExts (e: [
  43       e.alfredoramos.markdown e.davidiq.mailinglist e.dmzx.mchat
  44       e.empteintesduweb.monitoranswers e.lr94.autosubscribe
  45       e.phpbbmodders.adduser ]);
  46   };
  47   webhooks = pkgs.callPackage ./webhooks.nix {
  48     env = config.myEnv.tools.webhooks;
  49   };
  50
  51   landing = pkgs.callPackage ./landing.nix {};
  52
  53   cfg = config.myServices.websites.tools.tools;
  54   pcfg = config.services.phpfpm.pools;
  55 in {
  56   options.myServices.websites.tools.tools = {
  57     enable = lib.mkEnableOption "enable tools website";
  58   };
  59
  60   config = lib.mkIf cfg.enable {
  61     secrets.keys =
  62       kanboard.keys
  63       ++ ldap.keys
  64       ++ shaarli.keys
  65       ++ ttrss.keys
  66       ++ wallabag.keys
  67       ++ yourls.keys
  68       ++ webhooks.keys;
  69
  70     services.duplyBackup.profiles = {
  71       dokuwiki = dokuwiki.backups;
  72       grocy = grocy.backups;
  73       kanboard = kanboard.backups;
  74       rompr = rompr.backups;
  75       shaarli = shaarli.backups;
  76       ttrss = ttrss.backups;
  77       wallabag = wallabag.backups;
  78       phpbb = phpbb.backups;
  79     };
  80
  81     services.websites.env.tools.modules =
  82       [ "proxy_fcgi" ]
  83       ++ adminer.apache.modules
  84       ++ ympd.apache.modules
  85       ++ ttrss.apache.modules
  86       ++ wallabag.apache.modules
  87       ++ yourls.apache.modules
  88       ++ rompr.apache.modules
  89       ++ shaarli.apache.modules
  90       ++ dokuwiki.apache.modules
  91       ++ phpbb.apache.modules
  92       ++ ldap.apache.modules
  93       ++ kanboard.apache.modules;
  94
  95     services.websites.env.integration.vhostConfs.devtools = {
  96       certName     = "integration";
  97       certMainHost = "devtools.immae.eu";
  98       addToCerts   = true;
  99       hosts        = [ "devtools.immae.eu" ];
 100       root         = "/var/lib/ftp/devtools.immae.eu";
 101       extraConfig  = [
 102         ''
 103           Timeout 600
 104           ProxyTimeout 600
 105           <Directory "/var/lib/ftp/devtools.immae.eu">
 106             DirectoryIndex index.php index.htm index.html
 107             AllowOverride all
 108             Require all granted
 109             <FilesMatch "\.php$">
 110               SetHandler "proxy:unix:${pcfg.devtools.socket}|fcgi://localhost"
 111             </FilesMatch>
 112           </Directory>
 113           ''
 114       ];
 115     };
 116
 117     services.websites.env.tools.vhostConfs.tools = {
 118       certName    = "eldiron";
 119       addToCerts  = true;
 120       hosts       = ["tools.immae.eu" ];
 121       root        = landing;
 122       extraConfig = [
 123         ''
 124           RedirectMatch 301 ^/vpn(.*)$         https://vpn.immae.eu$1
 125           RedirectMatch 301 ^/roundcube(.*)$   https://mail.immae.eu/roundcube$1
 126           RedirectMatch 301 ^/jappix(.*)$      https://im.immae.fr/converse
 127
 128           <Directory "${landing}">
 129             DirectoryIndex index.html
 130             AllowOverride None
 131             Require all granted
 132
 133             <FilesMatch "\.php$">
 134               SetHandler "proxy:unix:${pcfg.tools.socket}|fcgi://localhost"
 135             </FilesMatch>
 136           </Directory>
 137           ''
 138         (adminer.apache.vhostConf pcfg.adminer.socket)
 139         ympd.apache.vhostConf
 140         (ttrss.apache.vhostConf pcfg.ttrss.socket)
 141         (wallabag.apache.vhostConf pcfg.wallabag.socket)
 142         (yourls.apache.vhostConf pcfg.yourls.socket)
 143         (rompr.apache.vhostConf pcfg.rompr.socket)
 144         (shaarli.apache.vhostConf pcfg.shaarli.socket)
 145         (dokuwiki.apache.vhostConf pcfg.dokuwiki.socket)
 146         (ldap.apache.vhostConf pcfg.ldap.socket)
 147         (kanboard.apache.vhostConf pcfg.kanboard.socket)
 148         (grocy.apache.vhostConf pcfg.grocy.socket)
 149         (phpbb.apache.vhostConf pcfg.phpbb.socket)
 150         ''
 151           Alias /paste /var/lib/fiche
 152           <Directory "/var/lib/fiche">
 153             DirectoryIndex index.txt index.html
 154             AllowOverride None
 155             Require all granted
 156             Options -Indexes
 157           </Directory>
 158
 159           Alias /BIP39 /var/lib/buildbot/outputs/bip39
 160           <Directory "/var/lib/buildbot/outputs/bip39">
 161             DirectoryIndex index.html
 162             AllowOverride None
 163             Require all granted
 164           </Directory>
 165
 166           Alias /webhooks ${config.secrets.location}/webapps/webhooks
 167           <Directory "${config.secrets.location}/webapps/webhooks">
 168             Options -Indexes
 169             Require all granted
 170             AllowOverride None
 171             <FilesMatch "\.php$">
 172               SetHandler "proxy:unix:${pcfg.tools.socket}|fcgi://localhost"
 173             </FilesMatch>
 174           </Directory>
 175         ''
 176       ];
 177     };
 178
 179     services.websites.env.tools.vhostConfs.outils = {
 180       certName   = "eldiron";
 181       addToCerts = true;
 182       hosts      = [ "outils.immae.eu" ];
 183       root       = null;
 184       extraConfig = [
 185         ''
 186         RedirectMatch 301 ^/mediagoblin(.*)$ https://mgoblin.immae.eu$1
 187
 188         RedirectMatch 301 ^/ether(.*)$       https://ether.immae.eu$1
 189
 190         RedirectMatch 301 ^/nextcloud(.*)$   https://cloud.immae.eu$1
 191         RedirectMatch 301 ^/owncloud(.*)$    https://cloud.immae.eu$1
 192
 193         RedirectMatch 301 ^/carddavmate(.*)$ https://dav.immae.eu/infcloud$1
 194         RedirectMatch 301 ^/caldavzap(.*)$   https://dav.immae.eu/infcloud$1
 195         RedirectMatch 301 ^/caldav.php(.*)$  https://dav.immae.eu/caldav.php$1
 196         RedirectMatch 301 ^/davical(.*)$     https://dav.immae.eu/davical$1
 197
 198         RedirectMatch 301 ^/taskweb(.*)$     https://task.immae.eu/taskweb$1
 199
 200         RedirectMatch 301 ^/roundcube(.*)$   https://mail.immae.eu/roundcube$1
 201
 202         RedirectMatch 301 ^/jappix(.*)$      https://im.immae.fr/converse
 203
 204         RedirectMatch 301 ^/vpn(.*)$         https://vpn.immae.eu$1
 205
 206         RedirectMatch 301 ^/(.*)$            https://tools.immae.eu/$1
 207         ''
 208       ];
 209     };
 210
 211     systemd.services = {
 212       phpfpm-dokuwiki = {
 213         after = lib.mkAfter dokuwiki.phpFpm.serviceDeps;
 214         wants = dokuwiki.phpFpm.serviceDeps;
 215       };
 216       phpfpm-phpbb = {
 217         after = lib.mkAfter phpbb.phpFpm.serviceDeps;
 218         wants = phpbb.phpFpm.serviceDeps;
 219       };
 220       phpfpm-kanboard = {
 221         after = lib.mkAfter kanboard.phpFpm.serviceDeps;
 222         wants = kanboard.phpFpm.serviceDeps;
 223       };
 224       phpfpm-ldap = {
 225         after = lib.mkAfter ldap.phpFpm.serviceDeps;
 226         wants = ldap.phpFpm.serviceDeps;
 227       };
 228       phpfpm-shaarli = {
 229         after = lib.mkAfter shaarli.phpFpm.serviceDeps;
 230         wants = shaarli.phpFpm.serviceDeps;
 231       };
 232       phpfpm-ttrss = {
 233         after = lib.mkAfter ttrss.phpFpm.serviceDeps;
 234         wants = ttrss.phpFpm.serviceDeps;
 235       };
 236       phpfpm-wallabag = {
 237         after = lib.mkAfter wallabag.phpFpm.serviceDeps;
 238         wants = wallabag.phpFpm.serviceDeps;
 239         preStart = lib.mkAfter wallabag.phpFpm.preStart;
 240       };
 241       phpfpm-yourls = {
 242         after = lib.mkAfter yourls.phpFpm.serviceDeps;
 243         wants = yourls.phpFpm.serviceDeps;
 244       };
 245       ympd = {
 246         description = "Standalone MPD Web GUI written in C";
 247         wantedBy = [ "multi-user.target" ];
 248         script = ''
 249           export MPD_PASSWORD=$(cat /var/secrets/mpd)
 250           ${pkgs.ympd}/bin/ympd --host ${ympd.config.host} --port ${toString ympd.config.port} --webport ${ympd.config.webPort} --user nobody
 251           '';
 252       };
 253       tt-rss = {
 254         description = "Tiny Tiny RSS feeds update daemon";
 255         serviceConfig = {
 256           User = "wwwrun";
 257           ExecStart = "${pkgs.php}/bin/php ${ttrss.webRoot}/update.php --daemon";
 258           StandardOutput = "syslog";
 259           StandardError = "syslog";
 260           PermissionsStartOnly = true;
 261         };
 262
 263         wantedBy = [ "multi-user.target" ];
 264         requires = ["postgresql.service"];
 265         after = ["network.target" "postgresql.service"];
 266       };
 267     };
 268
 269     services.filesWatcher.ympd = {
 270       restart = true;
 271       paths = [ "/var/secrets/mpd" ];
 272     };
 273
 274     services.phpfpm.pools = {
 275       tools = {
 276         user = "wwwrun";
 277         group = "wwwrun";
 278         settings = {
 279           "listen.owner" = "wwwrun";
 280           "listen.group" = "wwwrun";
 281           "pm" = "dynamic";
 282           "pm.max_children" = "60";
 283           "pm.start_servers" = "2";
 284           "pm.min_spare_servers" = "1";
 285           "pm.max_spare_servers" = "10";
 286
 287           # Needed to avoid clashes in browser cookies (same domain)
 288           "php_value[session.name]" = "ToolsPHPSESSID";
 289           "php_admin_value[open_basedir]" = builtins.concatStringsSep ":" [
 290             "/run/wrappers/bin/sendmail" landing "/tmp"
 291             "${config.secrets.location}/webapps/webhooks"
 292           ];
 293         };
 294         phpEnv = {
 295           CONTACT_EMAIL = config.myEnv.tools.contact;
 296         };
 297       };
 298       devtools = {
 299         user = "wwwrun";
 300         group = "wwwrun";
 301         settings = {
 302           "listen.owner" = "wwwrun";
 303           "listen.group" = "wwwrun";
 304           "pm" = "dynamic";
 305           "pm.max_children" = "60";
 306           "pm.start_servers" = "2";
 307           "pm.min_spare_servers" = "1";
 308           "pm.max_spare_servers" = "10";
 309
 310           "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp";
 311         };
 312         phpOptions = config.services.phpfpm.phpOptions + ''
 313           extension=${pkgs.php}/lib/php/extensions/mysqli.so
 314           extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
 315           extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
 316           zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
 317           '';
 318       };
 319       adminer = adminer.phpFpm;
 320       ttrss = {
 321         user = "wwwrun";
 322         group = "wwwrun";
 323         settings = ttrss.phpFpm.pool;
 324       };
 325       wallabag = {
 326         user = "wwwrun";
 327         group = "wwwrun";
 328         settings = wallabag.phpFpm.pool;
 329       };
 330       yourls = {
 331         user = "wwwrun";
 332         group = "wwwrun";
 333         settings = yourls.phpFpm.pool;
 334       };
 335       rompr = {
 336         user = "wwwrun";
 337         group = "wwwrun";
 338         settings = rompr.phpFpm.pool;
 339       };
 340       shaarli = {
 341         user = "wwwrun";
 342         group = "wwwrun";
 343         settings = shaarli.phpFpm.pool;
 344       };
 345       dokuwiki = {
 346         user = "wwwrun";
 347         group = "wwwrun";
 348         settings = dokuwiki.phpFpm.pool;
 349       };
 350       phpbb = {
 351         user = "wwwrun";
 352         group = "wwwrun";
 353         settings = phpbb.phpFpm.pool;
 354       };
 355       ldap = {
 356         user = "wwwrun";
 357         group = "wwwrun";
 358         settings = ldap.phpFpm.pool;
 359         phpPackage = pkgs.php72;
 360       };
 361       kanboard = {
 362         user = "wwwrun";
 363         group = "wwwrun";
 364         settings = kanboard.phpFpm.pool;
 365       };
 366       grocy = {
 367         user = "wwwrun";
 368         group = "wwwrun";
 369         settings = grocy.phpFpm.pool;
 370       };
 371     };
 372
 373     system.activationScripts = {
 374       adminer = adminer.activationScript;
 375       grocy = grocy.activationScript;
 376       ttrss = ttrss.activationScript;
 377       wallabag = wallabag.activationScript;
 378       yourls = yourls.activationScript;
 379       rompr = rompr.activationScript;
 380       shaarli = shaarli.activationScript;
 381       dokuwiki = dokuwiki.activationScript;
 382       phpbb = phpbb.activationScript;
 383       kanboard = kanboard.activationScript;
 384       ldap = ldap.activationScript;
 385     };
 386
 387     services.websites.webappDirs = {
 388       _adminer = adminer.webRoot;
 389       "${dokuwiki.apache.webappName}" = dokuwiki.webRoot;
 390       "${phpbb.apache.webappName}" = phpbb.webRoot;
 391       "${ldap.apache.webappName}" = "${ldap.webRoot}/htdocs";
 392       "${rompr.apache.webappName}" = rompr.webRoot;
 393       "${shaarli.apache.webappName}" = shaarli.webRoot;
 394       "${ttrss.apache.webappName}" = ttrss.webRoot;
 395       "${wallabag.apache.webappName}" = wallabag.webRoot;
 396       "${yourls.apache.webappName}" = yourls.webRoot;
 397       "${kanboard.apache.webappName}" = kanboard.webRoot;
 398       "${grocy.apache.webappName}" = grocy.webRoot;
 399     };
 400
 401     services.websites.env.tools.watchPaths = [
 402       "/var/secrets/webapps/tools-shaarli"
 403     ];
 404     services.filesWatcher.phpfpm-wallabag = {
 405       restart = true;
 406       paths = [ "/var/secrets/webapps/tools-wallabag" ];
 407     };
 408
 409     services.fiche = {
 410       enable = true;
 411       port = config.myEnv.ports.fiche;
 412       domain = "tools.immae.eu/paste";
 413       https = true;
 414     };
 415   };
 416 }
 417