modules/private/websites/tools/tools/default.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   adminer = pkgs.callPackage ./adminer.nix {
   4     inherit (pkgs.webapps) adminer;
   5   };
   6   ympd = pkgs.callPackage ./ympd.nix {
   7     env = config.myEnv.tools.ympd;
   8   };
   9   ttrss = pkgs.callPackage ./ttrss.nix {
  10     inherit (pkgs.webapps) ttrss ttrss-plugins;
  11     env = config.myEnv.tools.ttrss;
  12   };
  13   kanboard = pkgs.callPackage ./kanboard.nix  {
  14     env = config.myEnv.tools.kanboard;
  15   };
  16   wallabag = pkgs.callPackage ./wallabag.nix {
  17     inherit (pkgs.webapps) wallabag;
  18     env = config.myEnv.tools.wallabag;
  19   };
  20   yourls = pkgs.callPackage ./yourls.nix {
  21     inherit (pkgs.webapps) yourls yourls-plugins;
  22     env = config.myEnv.tools.yourls;
  23   };
  24   rompr = pkgs.callPackage ./rompr.nix {
  25     inherit (pkgs.webapps) rompr;
  26     env = config.myEnv.tools.rompr;
  27   };
  28   shaarli = pkgs.callPackage ./shaarli.nix {
  29     env = config.myEnv.tools.shaarli;
  30   };
  31   dokuwiki = pkgs.callPackage ./dokuwiki.nix {
  32     inherit (pkgs.webapps) dokuwiki dokuwiki-plugins;
  33   };
  34   ldap = pkgs.callPackage ./ldap.nix {
  35     inherit (pkgs.webapps) phpldapadmin;
  36     env = config.myEnv.tools.phpldapadmin;
  37   };
  38   grocy = pkgs.callPackage ./grocy.nix {
  39     inherit (pkgs.webapps) grocy;
  40   };
  41
  42   cfg = config.myServices.websites.tools.tools;
  43 in {
  44   options.myServices.websites.tools.tools = {
  45     enable = lib.mkEnableOption "enable tools website";
  46   };
  47
  48   config = lib.mkIf cfg.enable {
  49     secrets.keys =
  50       kanboard.keys
  51       ++ ldap.keys
  52       ++ shaarli.keys
  53       ++ ttrss.keys
  54       ++ wallabag.keys
  55       ++ yourls.keys;
  56
  57     services.duplyBackup.profiles = {
  58       dokuwiki = dokuwiki.backups;
  59       grocy = grocy.backups;
  60       kanboard = kanboard.backups;
  61       rompr = rompr.backups;
  62       shaarli = shaarli.backups;
  63       ttrss = ttrss.backups;
  64       wallabag = wallabag.backups;
  65     };
  66
  67     services.websites.env.tools.modules =
  68       [ "proxy_fcgi" ]
  69       ++ adminer.apache.modules
  70       ++ ympd.apache.modules
  71       ++ ttrss.apache.modules
  72       ++ wallabag.apache.modules
  73       ++ yourls.apache.modules
  74       ++ rompr.apache.modules
  75       ++ shaarli.apache.modules
  76       ++ dokuwiki.apache.modules
  77       ++ ldap.apache.modules
  78       ++ kanboard.apache.modules;
  79
  80     services.websites.env.integration.vhostConfs.devtools = {
  81       certName     = "integration";
  82       certMainHost = "devtools.immae.eu";
  83       addToCerts   = true;
  84       hosts        = [ "devtools.immae.eu" ];
  85       root         = "/var/lib/ftp/devtools.immae.eu";
  86       extraConfig  = [
  87         ''
  88           Timeout 600
  89           ProxyTimeout 600
  90           <Directory "/var/lib/ftp/devtools.immae.eu">
  91             DirectoryIndex index.php index.htm index.html
  92             AllowOverride all
  93             Require all granted
  94             <FilesMatch "\.php$">
  95               SetHandler "proxy:unix:/var/run/phpfpm/devtools.sock|fcgi://localhost"
  96             </FilesMatch>
  97           </Directory>
  98           ''
  99       ];
 100     };
 101
 102     services.websites.env.tools.vhostConfs.tools = {
 103       certName    = "eldiron";
 104       addToCerts  = true;
 105       hosts       = ["tools.immae.eu" ];
 106       root        = "/var/lib/ftp/tools.immae.eu";
 107       extraConfig = [
 108         ''
 109           RedirectMatch 301 ^/vpn(.*)$         https://vpn.immae.eu$1
 110           RedirectMatch 301 ^/roundcube(.*)$   https://mail.immae.eu/roundcube$1
 111           RedirectMatch 301 ^/jappix(.*)$      https://im.immae.fr/converse
 112
 113           <Directory "/var/lib/ftp/tools.immae.eu">
 114             DirectoryIndex index.php index.htm index.html
 115             AllowOverride all
 116             Require all granted
 117             <FilesMatch "\.php$">
 118               SetHandler "proxy:unix:/var/run/phpfpm/tools.sock|fcgi://localhost"
 119             </FilesMatch>
 120           </Directory>
 121           ''
 122         adminer.apache.vhostConf
 123         ympd.apache.vhostConf
 124         ttrss.apache.vhostConf
 125         wallabag.apache.vhostConf
 126         yourls.apache.vhostConf
 127         rompr.apache.vhostConf
 128         shaarli.apache.vhostConf
 129         dokuwiki.apache.vhostConf
 130         ldap.apache.vhostConf
 131         kanboard.apache.vhostConf
 132         grocy.apache.vhostConf
 133       ];
 134     };
 135
 136     services.websites.env.tools.vhostConfs.outils = {
 137       certName   = "eldiron";
 138       addToCerts = true;
 139       hosts      = [ "outils.immae.eu" ];
 140       root       = null;
 141       extraConfig = [
 142         ''
 143         RedirectMatch 301 ^/mediagoblin(.*)$ https://mgoblin.immae.eu$1
 144
 145         RedirectMatch 301 ^/ether(.*)$       https://ether.immae.eu$1
 146
 147         RedirectMatch 301 ^/nextcloud(.*)$   https://cloud.immae.eu$1
 148         RedirectMatch 301 ^/owncloud(.*)$    https://cloud.immae.eu$1
 149
 150         RedirectMatch 301 ^/carddavmate(.*)$ https://dav.immae.eu/infcloud$1
 151         RedirectMatch 301 ^/caldavzap(.*)$   https://dav.immae.eu/infcloud$1
 152         RedirectMatch 301 ^/caldav.php(.*)$  https://dav.immae.eu/caldav.php$1
 153         RedirectMatch 301 ^/davical(.*)$     https://dav.immae.eu/davical$1
 154
 155         RedirectMatch 301 ^/taskweb(.*)$     https://task.immae.eu/taskweb$1
 156
 157         RedirectMatch 301 ^/roundcube(.*)$   https://mail.immae.eu/roundcube$1
 158
 159         RedirectMatch 301 ^/jappix(.*)$      https://im.immae.fr/converse
 160
 161         RedirectMatch 301 ^/vpn(.*)$         https://vpn.immae.eu$1
 162
 163         RedirectMatch 301 ^/(.*)$            https://tools.immae.eu/$1
 164         ''
 165       ];
 166     };
 167
 168     systemd.services = {
 169       phpfpm-dokuwiki = {
 170         after = lib.mkAfter dokuwiki.phpFpm.serviceDeps;
 171         wants = dokuwiki.phpFpm.serviceDeps;
 172       };
 173       phpfpm-kanboard = {
 174         after = lib.mkAfter kanboard.phpFpm.serviceDeps;
 175         wants = kanboard.phpFpm.serviceDeps;
 176       };
 177       phpfpm-ldap = {
 178         after = lib.mkAfter ldap.phpFpm.serviceDeps;
 179         wants = ldap.phpFpm.serviceDeps;
 180       };
 181       phpfpm-shaarli = {
 182         after = lib.mkAfter shaarli.phpFpm.serviceDeps;
 183         wants = shaarli.phpFpm.serviceDeps;
 184       };
 185       phpfpm-ttrss = {
 186         after = lib.mkAfter ttrss.phpFpm.serviceDeps;
 187         wants = ttrss.phpFpm.serviceDeps;
 188       };
 189       phpfpm-wallabag = {
 190         after = lib.mkAfter wallabag.phpFpm.serviceDeps;
 191         wants = wallabag.phpFpm.serviceDeps;
 192         preStart = lib.mkAfter wallabag.phpFpm.preStart;
 193       };
 194       phpfpm-yourls = {
 195         after = lib.mkAfter yourls.phpFpm.serviceDeps;
 196         wants = yourls.phpFpm.serviceDeps;
 197       };
 198       ympd = {
 199         description = "Standalone MPD Web GUI written in C";
 200         wantedBy = [ "multi-user.target" ];
 201         script = ''
 202           export MPD_PASSWORD=$(cat /var/secrets/mpd)
 203           ${pkgs.ympd}/bin/ympd --host ${ympd.config.host} --port ${toString ympd.config.port} --webport ${ympd.config.webPort} --user nobody
 204           '';
 205       };
 206       tt-rss = {
 207         description = "Tiny Tiny RSS feeds update daemon";
 208         serviceConfig = {
 209           User = "wwwrun";
 210           ExecStart = "${pkgs.php}/bin/php ${ttrss.webRoot}/update.php --daemon";
 211           StandardOutput = "syslog";
 212           StandardError = "syslog";
 213           PermissionsStartOnly = true;
 214         };
 215
 216         wantedBy = [ "multi-user.target" ];
 217         requires = ["postgresql.service"];
 218         after = ["network.target" "postgresql.service"];
 219       };
 220     };
 221
 222     services.filesWatcher.ympd = {
 223       restart = true;
 224       paths = [ "/var/secrets/mpd" ];
 225     };
 226
 227     services.phpfpm.pools = {
 228       tools = {
 229         listen = "/var/run/phpfpm/tools.sock";
 230         extraConfig = ''
 231           user = wwwrun
 232           group = wwwrun
 233           listen.owner = wwwrun
 234           listen.group = wwwrun
 235           pm = dynamic
 236           pm.max_children = 60
 237           pm.start_servers = 2
 238           pm.min_spare_servers = 1
 239           pm.max_spare_servers = 10
 240
 241           ; Needed to avoid clashes in browser cookies (same domain)
 242           php_value[session.name] = ToolsPHPSESSID
 243           php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/tools.immae.eu:/tmp"
 244           '';
 245       };
 246       devtools = {
 247         listen = "/var/run/phpfpm/devtools.sock";
 248         extraConfig = ''
 249           user = wwwrun
 250           group = wwwrun
 251           listen.owner = wwwrun
 252           listen.group = wwwrun
 253           pm = dynamic
 254           pm.max_children = 60
 255           pm.start_servers = 2
 256           pm.min_spare_servers = 1
 257           pm.max_spare_servers = 10
 258
 259           php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp"
 260           '';
 261         phpOptions = config.services.phpfpm.phpOptions + ''
 262           extension=${pkgs.php}/lib/php/extensions/mysqli.so
 263           extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
 264           extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
 265           zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
 266           '';
 267       };
 268       adminer = {
 269         listen = adminer.phpFpm.socket;
 270         extraConfig = adminer.phpFpm.pool;
 271       };
 272       ttrss = {
 273         listen = ttrss.phpFpm.socket;
 274         extraConfig = ttrss.phpFpm.pool;
 275       };
 276       wallabag = {
 277         listen = wallabag.phpFpm.socket;
 278         extraConfig = wallabag.phpFpm.pool;
 279       };
 280       yourls = {
 281         listen = yourls.phpFpm.socket;
 282         extraConfig = yourls.phpFpm.pool;
 283       };
 284       rompr = {
 285         listen = rompr.phpFpm.socket;
 286         extraConfig = rompr.phpFpm.pool;
 287       };
 288       shaarli = {
 289         listen = shaarli.phpFpm.socket;
 290         extraConfig = shaarli.phpFpm.pool;
 291       };
 292       dokuwiki = {
 293         listen = dokuwiki.phpFpm.socket;
 294         extraConfig = dokuwiki.phpFpm.pool;
 295       };
 296       ldap = {
 297         listen = ldap.phpFpm.socket;
 298         extraConfig = ldap.phpFpm.pool;
 299       };
 300       kanboard = {
 301         listen = kanboard.phpFpm.socket;
 302         extraConfig = kanboard.phpFpm.pool;
 303       };
 304       grocy = {
 305         listen = grocy.phpFpm.socket;
 306         extraConfig = grocy.phpFpm.pool;
 307       };
 308     };
 309
 310     system.activationScripts = {
 311       adminer = adminer.activationScript;
 312       grocy = grocy.activationScript;
 313       ttrss = ttrss.activationScript;
 314       wallabag = wallabag.activationScript;
 315       yourls = yourls.activationScript;
 316       rompr = rompr.activationScript;
 317       shaarli = shaarli.activationScript;
 318       dokuwiki = dokuwiki.activationScript;
 319       kanboard = kanboard.activationScript;
 320       ldap = ldap.activationScript;
 321     };
 322
 323     myServices.websites.webappDirs = {
 324       _adminer = adminer.webRoot;
 325       "${dokuwiki.apache.webappName}" = dokuwiki.webRoot;
 326       "${ldap.apache.webappName}" = "${ldap.webRoot}/htdocs";
 327       "${rompr.apache.webappName}" = rompr.webRoot;
 328       "${shaarli.apache.webappName}" = shaarli.webRoot;
 329       "${ttrss.apache.webappName}" = ttrss.webRoot;
 330       "${wallabag.apache.webappName}" = wallabag.webRoot;
 331       "${yourls.apache.webappName}" = yourls.webRoot;
 332       "${kanboard.apache.webappName}" = kanboard.webRoot;
 333       "${grocy.apache.webappName}" = grocy.webRoot;
 334     };
 335
 336     services.websites.env.tools.watchPaths = [
 337       "/var/secrets/webapps/tools-shaarli"
 338     ];
 339     services.filesWatcher.phpfpm-wallabag = {
 340       restart = true;
 341       paths = [ "/var/secrets/webapps/tools-wallabag" ];
 342     };
 343   };
 344 }
 345