modules/private/websites/tools/tools/default.nix

   1 { lib, pkgs, config, ... }:
   2 let
   3   adminer = pkgs.callPackage ./adminer.nix {
   4     inherit (pkgs.webapps) adminer;
   5   };
   6   ympd = pkgs.callPackage ./ympd.nix {
   7     env = config.myEnv.tools.ympd;
   8   };
   9   ttrss = pkgs.callPackage ./ttrss.nix {
  10     inherit (pkgs.webapps) ttrss ttrss-plugins;
  11     env = config.myEnv.tools.ttrss;
  12   };
  13   kanboard = pkgs.callPackage ./kanboard.nix  {
  14     env = config.myEnv.tools.kanboard;
  15   };
  16   wallabag = pkgs.callPackage ./wallabag.nix {
  17     inherit (pkgs.webapps) wallabag;
  18     env = config.myEnv.tools.wallabag;
  19   };
  20   yourls = pkgs.callPackage ./yourls.nix {
  21     inherit (pkgs.webapps) yourls yourls-plugins;
  22     env = config.myEnv.tools.yourls;
  23   };
  24   rompr = pkgs.callPackage ./rompr.nix {
  25     inherit (pkgs.webapps) rompr;
  26     env = config.myEnv.tools.rompr;
  27   };
  28   shaarli = pkgs.callPackage ./shaarli.nix {
  29     env = config.myEnv.tools.shaarli;
  30   };
  31   dokuwiki = pkgs.callPackage ./dokuwiki.nix {
  32     inherit (pkgs.webapps) dokuwiki dokuwiki-plugins;
  33   };
  34   ldap = pkgs.callPackage ./ldap.nix {
  35     inherit (pkgs.webapps) phpldapadmin;
  36     env = config.myEnv.tools.phpldapadmin;
  37   };
  38
  39   cfg = config.myServices.websites.tools.tools;
  40 in {
  41   options.myServices.websites.tools.tools = {
  42     enable = lib.mkEnableOption "enable tools website";
  43   };
  44
  45   config = lib.mkIf cfg.enable {
  46     secrets.keys =
  47       kanboard.keys
  48       ++ ldap.keys
  49       ++ shaarli.keys
  50       ++ ttrss.keys
  51       ++ wallabag.keys
  52       ++ yourls.keys;
  53
  54     services.duplyBackup.profiles = {
  55       dokuwiki = dokuwiki.backups;
  56       kanboard = kanboard.backups;
  57       rompr = rompr.backups;
  58       shaarli = shaarli.backups;
  59       ttrss = ttrss.backups;
  60       wallabag = wallabag.backups;
  61     };
  62
  63     services.websites.env.tools.modules =
  64       [ "proxy_fcgi" ]
  65       ++ adminer.apache.modules
  66       ++ ympd.apache.modules
  67       ++ ttrss.apache.modules
  68       ++ wallabag.apache.modules
  69       ++ yourls.apache.modules
  70       ++ rompr.apache.modules
  71       ++ shaarli.apache.modules
  72       ++ dokuwiki.apache.modules
  73       ++ ldap.apache.modules
  74       ++ kanboard.apache.modules;
  75
  76     services.websites.env.integration.vhostConfs.devtools = {
  77       certName     = "integration";
  78       certMainHost = "devtools.immae.eu";
  79       addToCerts   = true;
  80       hosts        = [ "devtools.immae.eu" ];
  81       root         = "/var/lib/ftp/devtools.immae.eu";
  82       extraConfig  = [
  83         ''
  84           Timeout 600
  85           ProxyTimeout 600
  86           <Directory "/var/lib/ftp/devtools.immae.eu">
  87             DirectoryIndex index.php index.htm index.html
  88             AllowOverride all
  89             Require all granted
  90             <FilesMatch "\.php$">
  91               SetHandler "proxy:unix:/var/run/phpfpm/devtools.sock|fcgi://localhost"
  92             </FilesMatch>
  93           </Directory>
  94           ''
  95       ];
  96     };
  97
  98     services.websites.env.tools.vhostConfs.tools = {
  99       certName    = "eldiron";
 100       addToCerts  = true;
 101       hosts       = ["tools.immae.eu" ];
 102       root        = "/var/lib/ftp/tools.immae.eu";
 103       extraConfig = [
 104         ''
 105           RedirectMatch 301 ^/vpn(.*)$         https://vpn.immae.eu$1
 106           RedirectMatch 301 ^/roundcube(.*)$   https://mail.immae.eu/roundcube$1
 107           RedirectMatch 301 ^/jappix(.*)$      https://im.immae.fr/converse
 108
 109           <Directory "/var/lib/ftp/tools.immae.eu">
 110             DirectoryIndex index.php index.htm index.html
 111             AllowOverride all
 112             Require all granted
 113             <FilesMatch "\.php$">
 114               SetHandler "proxy:unix:/var/run/phpfpm/tools.sock|fcgi://localhost"
 115             </FilesMatch>
 116           </Directory>
 117           ''
 118         adminer.apache.vhostConf
 119         ympd.apache.vhostConf
 120         ttrss.apache.vhostConf
 121         wallabag.apache.vhostConf
 122         yourls.apache.vhostConf
 123         rompr.apache.vhostConf
 124         shaarli.apache.vhostConf
 125         dokuwiki.apache.vhostConf
 126         ldap.apache.vhostConf
 127         kanboard.apache.vhostConf
 128       ];
 129     };
 130
 131     services.websites.env.tools.vhostConfs.outils = {
 132       certName   = "eldiron";
 133       addToCerts = true;
 134       hosts      = [ "outils.immae.eu" ];
 135       root       = null;
 136       extraConfig = [
 137         ''
 138         RedirectMatch 301 ^/mediagoblin(.*)$ https://mgoblin.immae.eu$1
 139
 140         RedirectMatch 301 ^/ether(.*)$       https://ether.immae.eu$1
 141
 142         RedirectMatch 301 ^/nextcloud(.*)$   https://cloud.immae.eu$1
 143         RedirectMatch 301 ^/owncloud(.*)$    https://cloud.immae.eu$1
 144
 145         RedirectMatch 301 ^/carddavmate(.*)$ https://dav.immae.eu/infcloud$1
 146         RedirectMatch 301 ^/caldavzap(.*)$   https://dav.immae.eu/infcloud$1
 147         RedirectMatch 301 ^/caldav.php(.*)$  https://dav.immae.eu/caldav.php$1
 148         RedirectMatch 301 ^/davical(.*)$     https://dav.immae.eu/davical$1
 149
 150         RedirectMatch 301 ^/taskweb(.*)$     https://task.immae.eu/taskweb$1
 151
 152         RedirectMatch 301 ^/roundcube(.*)$   https://mail.immae.eu/roundcube$1
 153
 154         RedirectMatch 301 ^/jappix(.*)$      https://im.immae.fr/converse
 155
 156         RedirectMatch 301 ^/vpn(.*)$         https://vpn.immae.eu$1
 157
 158         RedirectMatch 301 ^/(.*)$            https://tools.immae.eu/$1
 159         ''
 160       ];
 161     };
 162
 163     systemd.services = {
 164       phpfpm-dokuwiki = {
 165         after = lib.mkAfter dokuwiki.phpFpm.serviceDeps;
 166         wants = dokuwiki.phpFpm.serviceDeps;
 167       };
 168       phpfpm-kanboard = {
 169         after = lib.mkAfter kanboard.phpFpm.serviceDeps;
 170         wants = kanboard.phpFpm.serviceDeps;
 171       };
 172       phpfpm-ldap = {
 173         after = lib.mkAfter ldap.phpFpm.serviceDeps;
 174         wants = ldap.phpFpm.serviceDeps;
 175       };
 176       phpfpm-shaarli = {
 177         after = lib.mkAfter shaarli.phpFpm.serviceDeps;
 178         wants = shaarli.phpFpm.serviceDeps;
 179       };
 180       phpfpm-ttrss = {
 181         after = lib.mkAfter ttrss.phpFpm.serviceDeps;
 182         wants = ttrss.phpFpm.serviceDeps;
 183       };
 184       phpfpm-wallabag = {
 185         after = lib.mkAfter wallabag.phpFpm.serviceDeps;
 186         wants = wallabag.phpFpm.serviceDeps;
 187         preStart = lib.mkAfter wallabag.phpFpm.preStart;
 188       };
 189       phpfpm-yourls = {
 190         after = lib.mkAfter yourls.phpFpm.serviceDeps;
 191         wants = yourls.phpFpm.serviceDeps;
 192       };
 193       ympd = {
 194         description = "Standalone MPD Web GUI written in C";
 195         wantedBy = [ "multi-user.target" ];
 196         script = ''
 197           export MPD_PASSWORD=$(cat /var/secrets/mpd)
 198           ${pkgs.ympd}/bin/ympd --host ${ympd.config.host} --port ${toString ympd.config.port} --webport ${ympd.config.webPort} --user nobody
 199           '';
 200       };
 201       tt-rss = {
 202         description = "Tiny Tiny RSS feeds update daemon";
 203         serviceConfig = {
 204           User = "wwwrun";
 205           ExecStart = "${pkgs.php}/bin/php ${ttrss.webRoot}/update.php --daemon";
 206           StandardOutput = "syslog";
 207           StandardError = "syslog";
 208           PermissionsStartOnly = true;
 209         };
 210
 211         wantedBy = [ "multi-user.target" ];
 212         requires = ["postgresql.service"];
 213         after = ["network.target" "postgresql.service"];
 214       };
 215     };
 216
 217     services.filesWatcher.ympd = {
 218       restart = true;
 219       paths = [ "/var/secrets/mpd" ];
 220     };
 221
 222     services.phpfpm.pools.devtools = {
 223       listen = "/var/run/phpfpm/devtools.sock";
 224       extraConfig = ''
 225         user = wwwrun
 226         group = wwwrun
 227         listen.owner = wwwrun
 228         listen.group = wwwrun
 229         pm = dynamic
 230         pm.max_children = 60
 231         pm.start_servers = 2
 232         pm.min_spare_servers = 1
 233         pm.max_spare_servers = 10
 234
 235         php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp"
 236         '';
 237       phpOptions = config.services.phpfpm.phpOptions + ''
 238         extension=${pkgs.php}/lib/php/extensions/mysqli.so
 239         extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
 240         extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
 241         zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
 242         '';
 243     };
 244
 245     services.phpfpm.poolConfigs = {
 246       adminer = adminer.phpFpm.pool;
 247       ttrss = ttrss.phpFpm.pool;
 248       wallabag = wallabag.phpFpm.pool;
 249       yourls = yourls.phpFpm.pool;
 250       rompr = rompr.phpFpm.pool;
 251       shaarli = shaarli.phpFpm.pool;
 252       dokuwiki = dokuwiki.phpFpm.pool;
 253       ldap = ldap.phpFpm.pool;
 254       kanboard = kanboard.phpFpm.pool;
 255       tools = ''
 256         listen = /var/run/phpfpm/tools.sock
 257         user = wwwrun
 258         group = wwwrun
 259         listen.owner = wwwrun
 260         listen.group = wwwrun
 261         pm = dynamic
 262         pm.max_children = 60
 263         pm.start_servers = 2
 264         pm.min_spare_servers = 1
 265         pm.max_spare_servers = 10
 266
 267         ; Needed to avoid clashes in browser cookies (same domain)
 268         php_value[session.name] = ToolsPHPSESSID
 269         php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/tools.immae.eu:/tmp"
 270         '';
 271     };
 272
 273     system.activationScripts = {
 274       adminer = adminer.activationScript;
 275       ttrss = ttrss.activationScript;
 276       wallabag = wallabag.activationScript;
 277       yourls = yourls.activationScript;
 278       rompr = rompr.activationScript;
 279       shaarli = shaarli.activationScript;
 280       dokuwiki = dokuwiki.activationScript;
 281       kanboard = kanboard.activationScript;
 282       ldap = ldap.activationScript;
 283     };
 284
 285     myServices.websites.webappDirs = {
 286       _adminer = adminer.webRoot;
 287       "${dokuwiki.apache.webappName}" = dokuwiki.webRoot;
 288       "${ldap.apache.webappName}" = "${ldap.webRoot}/htdocs";
 289       "${rompr.apache.webappName}" = rompr.webRoot;
 290       "${shaarli.apache.webappName}" = shaarli.webRoot;
 291       "${ttrss.apache.webappName}" = ttrss.webRoot;
 292       "${wallabag.apache.webappName}" = wallabag.webRoot;
 293       "${yourls.apache.webappName}" = yourls.webRoot;
 294       "${kanboard.apache.webappName}" = kanboard.webRoot;
 295     };
 296
 297     services.websites.env.tools.watchPaths = [
 298       "/var/secrets/webapps/tools-shaarli"
 299     ];
 300     services.filesWatcher.phpfpm-wallabag = {
 301       restart = true;
 302       paths = [ "/var/secrets/webapps/tools-wallabag" ];
 303     };
 304   };
 305 }
 306