nixops/modules/websites/default.nix

   1 { lib, pkgs, config, mylibs, myconfig, ... }:
   2 let
   3   cfg = config.services.myWebsites;
   4   makeService = name: cfg: let
   5     toVhost = vhostConf: {
   6       enableSSL = true;
   7       sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
   8       sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
   9       sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem";
  10       logFormat = "combinedVhost";
  11       listen = [
  12         { ip = cfg.ip;  port = 443; }
  13       ];
  14       hostName = builtins.head vhostConf.hosts;
  15       serverAliases = builtins.tail vhostConf.hosts or [];
  16       documentRoot = vhostConf.root;
  17       extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
  18     };
  19     nosslVhost = {
  20       listen = [ { ip = cfg.ip; port = 80; } ];
  21       hostName = "nossl.immae.eu";
  22       enableSSL = false;
  23       logFormat = "combinedVhost";
  24       documentRoot = ../../www;
  25       extraConfig = ''
  26         <Directory ${../../www}>
  27           DirectoryIndex nossl.html
  28           AllowOverride None
  29           Require all granted
  30
  31           RewriteEngine on
  32           RewriteRule ^/(.+)   /   [L]
  33         </Directory>
  34         '';
  35     };
  36     redirectVhost = { # Should go last, catchall http -> https redirect
  37       listen = [ { ip = cfg.ip; port = 80; } ];
  38       hostName = "redirectSSL";
  39       serverAliases = [ "*" ];
  40       enableSSL = false;
  41       logFormat = "combinedVhost";
  42       documentRoot = "/var/lib/acme/acme-challenge";
  43       extraConfig = ''
  44         RewriteEngine on
  45         RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
  46         RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
  47         # To redirect in specific "VirtualHost *:80", do
  48         #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
  49         # rather than rewrite
  50       '';
  51     };
  52     fallbackVhost = toVhost { # Should go first, default choice
  53       certName    = "eldiron";
  54       hosts       = ["eldiron.immae.eu" ];
  55       root        = ../../www;
  56       extraConfig = [ "DirectoryIndex index.htm" ];
  57     };
  58   in rec {
  59     enable = true;
  60     listen = [
  61       { ip = cfg.ip;  port = 443; }
  62     ];
  63     stateDir = "/run/httpd_${name}";
  64     logPerVirtualHost = true;
  65     multiProcessingModule = "worker";
  66     adminAddr = "httpd@immae.eu";
  67     logFormat = "combinedVhost";
  68     extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
  69     extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
  70     virtualHosts = [ fallbackVhost ]
  71       ++ lib.optionals (name == "tools") [ nosslVhost ]
  72       ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
  73       ++ [ redirectVhost ];
  74   };
  75   makeServiceOptions = name: ip: {
  76     enable = lib.mkEnableOption "enable websites in ${name}";
  77     ip = lib.mkOption {
  78       type = lib.types.string;
  79       default = ip;
  80       description = "${name} ip to listen to";
  81     };
  82     modules = lib.mkOption {
  83       type = lib.types.listOf (lib.types.str);
  84       default = [];
  85     };
  86     extraConfig = lib.mkOption {
  87       type = lib.types.listOf (lib.types.lines);
  88       default = [];
  89     };
  90     vhostConfs = lib.mkOption {
  91       type = lib.types.attrsOf (lib.types.submodule {
  92         options = {
  93           certName = lib.mkOption { type = lib.types.string; };
  94           hosts    = lib.mkOption { type = lib.types.listOf lib.types.string; };
  95           root     = lib.mkOption { type = lib.types.nullOr lib.types.path; };
  96           extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
  97         };
  98       });
  99     };
 100   };
 101   makeModules = cfg: pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
 102   makeExtraConfig = cfg: (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
 103 in
 104 {
 105   imports = [
 106     ./chloe
 107     ./ludivine
 108     ./aten
 109     ./piedsjaloux
 110     ./connexionswing
 111     ./tellesflorian
 112     ./emilia
 113     ./capitaines
 114     ./ftp/jerome.nix
 115     ./ftp/nassime.nix
 116     ./ftp/florian.nix
 117     ./ftp/denisejerome.nix
 118     ./ftp/immae.nix
 119     ./ftp/release.nix
 120     ./ftp/temp.nix
 121     ./tools/db
 122     ./tools/tools
 123     ./tools/dav
 124     ./tools/cloud
 125     ./tools/git
 126     ./tools/mastodon
 127     ./tools/mediagoblin
 128     ./tools/diaspora
 129     ./tools/ether
 130     # built using:
 131     # sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
 132     # Removed allGranted
 133     # And removed users / groups
 134     ./apache/httpd_prod.nix
 135     ./apache/httpd_inte.nix
 136     # except for this one for users/groups
 137     ./apache/httpd_tools.nix
 138     # Adapted from base phpfpm
 139     ./phpfpm
 140   ];
 141
 142   options.services.myWebsites = {
 143     production = makeServiceOptions "production" myconfig.ips.production;
 144     integration = makeServiceOptions "integration" myconfig.ips.integration;
 145     tools = makeServiceOptions "tools" myconfig.ips.main;
 146
 147     apacheConfig = lib.mkOption {
 148       type = lib.types.attrsOf (lib.types.submodule {
 149         options = {
 150           modules = lib.mkOption {
 151             type = lib.types.listOf (lib.types.str);
 152             default = [];
 153           };
 154           extraConfig = lib.mkOption {
 155             type = lib.types.nullOr lib.types.lines;
 156             default = null;
 157           };
 158         };
 159       });
 160       default = {};
 161       description = "Extra global config";
 162     };
 163
 164   };
 165
 166   config = {
 167     networking = {
 168       firewall = {
 169         enable = true;
 170         allowedTCPPorts = [ 80 443 ];
 171       };
 172       interfaces."eth0".ipv4.addresses = [
 173         # 176.9.151.89 declared in nixops -> infra / tools
 174         { address = myconfig.ips.production; prefixLength = 32; }
 175         { address = myconfig.ips.integration; prefixLength = 32; }
 176       ];
 177     };
 178
 179     nixpkgs.config.packageOverrides = oldpkgs: rec {
 180       php = php72;
 181       php72 = (oldpkgs.php72.override {
 182         mysql.connector-c = pkgs.mariadb;
 183         config.php.mysqlnd = false;
 184         config.php.mysqli = false;
 185       }).overrideAttrs(old: rec {
 186         # Didn't manage to build with mysqli + mysql_config connector
 187         configureFlags = old.configureFlags ++ [
 188           "--with-mysqli=shared,mysqlnd"
 189           ];
 190         # preConfigure = (old.preConfigure or "") + ''
 191         #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
 192         #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
 193         #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
 194         #   '';
 195       });
 196       phpPackages = oldpkgs.php72Packages.override { inherit php; };
 197       composerEnv = import ./commons/composer-env.nix {
 198         inherit (pkgs) stdenv writeTextFile fetchurl php unzip;
 199       };
 200     };
 201
 202     services.myWebsites.tools.databases.enable = true;
 203     services.myWebsites.tools.tools.enable = true;
 204     services.myWebsites.tools.dav.enable = true;
 205     services.myWebsites.tools.cloud.enable = true;
 206     services.myWebsites.tools.git.enable = true;
 207     services.myWebsites.tools.mastodon.enable = true;
 208     services.myWebsites.tools.mediagoblin.enable = true;
 209     services.myWebsites.tools.diaspora.enable = true;
 210     services.myWebsites.tools.etherpad-lite.enable = true;
 211
 212     services.myWebsites.Chloe.production.enable = cfg.production.enable;
 213     services.myWebsites.Ludivine.production.enable = cfg.production.enable;
 214     services.myWebsites.Aten.production.enable = cfg.production.enable;
 215     services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
 216     services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
 217     services.myWebsites.Jerome.production.enable = cfg.production.enable;
 218     services.myWebsites.Nassime.production.enable = cfg.production.enable;
 219     services.myWebsites.Florian.production.enable = cfg.production.enable;
 220     services.myWebsites.DeniseJerome.production.enable = cfg.production.enable;
 221     services.myWebsites.Emilia.production.enable = cfg.production.enable;
 222     services.myWebsites.Capitaines.production.enable = cfg.production.enable;
 223     services.myWebsites.Immae.production.enable = cfg.production.enable;
 224     services.myWebsites.Release.production.enable = cfg.production.enable;
 225     services.myWebsites.Temp.production.enable = cfg.production.enable;
 226
 227     services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
 228     services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
 229     services.myWebsites.Aten.integration.enable = cfg.integration.enable;
 230     services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
 231     services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
 232     services.myWebsites.TellesFlorian.integration.enable = true;
 233     services.myWebsites.Florian.integration.enable = true;
 234
 235     services.myWebsites.apacheConfig = {
 236       gzip = {
 237         modules = [ "deflate" "filter" ];
 238         extraConfig = ''
 239           AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
 240         '';
 241       };
 242       macros = {
 243         modules = [ "macro" ];
 244       };
 245       stats = {
 246         extraConfig = ''
 247           <Macro Stats %{domain}>
 248             Alias /awstats /var/lib/goaccess/%{domain}
 249             <Directory /var/lib/goaccess/%{domain}>
 250               DirectoryIndex index.html
 251               AllowOverride None
 252               Require all granted
 253             </Directory>
 254             <Location /awstats>
 255               Use LDAPConnect
 256               Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
 257             </Location>
 258           </Macro>
 259         '';
 260       };
 261       ldap = {
 262         modules = [ "ldap" "authnz_ldap" ];
 263         extraConfig = ''
 264           <IfModule ldap_module>
 265             LDAPSharedCacheSize 500000
 266             LDAPCacheEntries 1024
 267             LDAPCacheTTL 600
 268             LDAPOpCacheEntries 1024
 269             LDAPOpCacheTTL 600
 270           </IfModule>
 271
 272           <Macro LDAPConnect>
 273             <IfModule authnz_ldap_module>
 274               AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 275               AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 276               AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
 277               AuthType             Basic
 278               AuthName             "Authentification requise (Acces LDAP)"
 279               AuthBasicProvider    ldap
 280             </IfModule>
 281           </Macro>
 282         '';
 283       };
 284       global = {
 285         extraConfig = ''
 286           ErrorDocument 500 /maintenance_immae.html
 287           ErrorDocument 501 /maintenance_immae.html
 288           ErrorDocument 502 /maintenance_immae.html
 289           ErrorDocument 503 /maintenance_immae.html
 290           ErrorDocument 504 /maintenance_immae.html
 291           Alias /maintenance_immae.html ${../../www}/maintenance_immae.html
 292           ProxyPass /maintenance_immae.html !
 293
 294           AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${../../www}/googleb6d69446ff4ca3e5.html
 295           <Directory ${../../www}>
 296             AllowOverride None
 297             Require all granted
 298           </Directory>
 299         '';
 300       };
 301       apaxy = {
 302         extraConfig = ''
 303           <Macro Apaxy %{folder} %{ignored}>
 304             Alias /theme ${./apache/theme}
 305             <Directory ${./apache/theme}>
 306               Options -Indexes
 307               AllowOverride None
 308               Require all granted
 309             </Directory>
 310
 311             # mod_autoindex
 312             <Directory %{folder}>
 313               Options Indexes
 314               AllowOverride None
 315               Require all granted
 316
 317               # Inspired from Apaxy by @adamwhitcroft
 318
 319               IndexOptions +Charset=UTF-8 +FancyIndexing +IgnoreCase +FoldersFirst +XHTML +HTMLTable +SuppressRules +SuppressDescription +NameWidth=* +IconsAreLinks +ShowForbidden
 320
 321               IndexHeadInsert "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />"
 322
 323               IndexIgnoreReset ON
 324               IndexIgnore /theme .htaccess %{ignored}
 325
 326               AddIcon /theme/icons/blank.png ^^BLANKICON^^
 327               AddIcon /theme/icons/folder.png ^^DIRECTORY^^
 328               AddIcon /theme/icons/folder-home.png ..
 329
 330               AddIconByType (TXT,/theme/icons/text.png) text/*
 331               AddIconByType (IMG,/theme/icons/image.png) image/*
 332               AddIconByType (SND,/theme/icons/audio.png) audio/*
 333               AddIconByType (VID,/theme/icons/video.png) video/*
 334
 335               AddIcon /theme/icons/archive.png .7z .bz2 .cab .gz .tar
 336               AddIcon /theme/icons/audio.png .aac .aif .aifc .aiff .ape .au .flac .iff .m4a .mid .mp3 .mpa .ra .wav .wma .f4a .f4b .oga .ogg .xm .it .s3m .mod
 337               AddIcon /theme/icons/bin.png .bin .hex
 338               AddIcon /theme/icons/bmp.png .bmp
 339               AddIcon /theme/icons/c.png .c
 340               AddIcon /theme/icons/calc.png .xlsx .xlsm .xltx .xltm .xlam .xlr .xls .csv
 341               AddIcon /theme/icons/cd.png .iso
 342               AddIcon /theme/icons/cpp.png .cpp
 343               AddIcon /theme/icons/css.png .css .sass .scss
 344               AddIcon /theme/icons/deb.png .deb
 345               AddIcon /theme/icons/doc.png .doc .docx .docm .dot .dotx .dotm .log .msg .odt .pages .rtf .tex .wpd .wps
 346               AddIcon /theme/icons/draw.png .svg .svgz
 347               AddIcon /theme/icons/eps.png .ai .eps
 348               AddIcon /theme/icons/exe.png .exe
 349               AddIcon /theme/icons/gif.png .gif
 350               AddIcon /theme/icons/h.png .h
 351               AddIcon /theme/icons/html.png .html .xhtml .shtml .htm .URL .url
 352               AddIcon /theme/icons/ico.png .ico
 353               AddIcon /theme/icons/java.png .jar
 354               AddIcon /theme/icons/jpg.png .jpg .jpeg .jpe
 355               AddIcon /theme/icons/js.png .js .json
 356               AddIcon /theme/icons/markdown.png .md
 357               AddIcon /theme/icons/package.png .pkg .dmg
 358               AddIcon /theme/icons/pdf.png .pdf
 359               AddIcon /theme/icons/php.png .php .phtml
 360               AddIcon /theme/icons/playlist.png .m3u .m3u8 .pls .pls8
 361               AddIcon /theme/icons/png.png .png
 362               AddIcon /theme/icons/ps.png .ps
 363               AddIcon /theme/icons/psd.png .psd
 364               AddIcon /theme/icons/py.png .py
 365               AddIcon /theme/icons/rar.png .rar
 366               AddIcon /theme/icons/rb.png .rb
 367               AddIcon /theme/icons/rpm.png .rpm
 368               AddIcon /theme/icons/rss.png .rss
 369               AddIcon /theme/icons/script.png .bat .cmd .sh
 370               AddIcon /theme/icons/sql.png .sql
 371               AddIcon /theme/icons/tiff.png .tiff .tif
 372               AddIcon /theme/icons/text.png .txt .nfo
 373               AddIcon /theme/icons/video.png .asf .asx .avi .flv .mkv .mov .mp4 .mpg .rm .srt .swf .vob .wmv .m4v .f4v .f4p .ogv
 374               AddIcon /theme/icons/xml.png .xml
 375               AddIcon /theme/icons/zip.png .zip
 376               DefaultIcon /theme/icons/default.png
 377
 378               HeaderName /theme/header.html
 379               ReadmeName /theme/footer.html
 380               IndexStyleSheet /theme/style.css
 381             </Directory>
 382           </Macro>
 383         '';
 384       };
 385       http2 = {
 386         modules = [ "http2" ];
 387         extraConfig = ''
 388           Protocols h2 http/1.1
 389         '';
 390       };
 391       customLog = {
 392         extraConfig = ''
 393           LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
 394         '';
 395       };
 396     };
 397
 398     system.activationScripts = {
 399       httpd = ''
 400         install -d -m 0755 /var/lib/acme/acme-challenge
 401         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 402         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
 403         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
 404         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
 405         '';
 406     };
 407
 408     services.myPhpfpm = {
 409       phpPackage = pkgs.php;
 410       phpOptions = ''
 411         session.save_path = "/var/lib/php/sessions"
 412         post_max_size = 20M
 413         session.gc_maxlifetime = 60*60*24*15
 414         session.cache_expire = 60*24*30
 415         '';
 416       extraConfig = ''
 417         log_level = notice
 418         '';
 419     };
 420
 421     services.httpdProd = makeService "production" config.services.myWebsites.production;
 422     services.myWebsites.production.modules = makeModules cfg;
 423     services.myWebsites.production.extraConfig = makeExtraConfig cfg;
 424
 425     services.httpdInte = makeService "integration" config.services.myWebsites.integration;
 426     services.myWebsites.integration.modules = makeModules cfg;
 427     services.myWebsites.integration.extraConfig = makeExtraConfig cfg;
 428
 429     services.httpdTools = makeService "tools" config.services.myWebsites.tools;
 430     services.myWebsites.tools.modules = makeModules cfg;
 431     services.myWebsites.tools.extraConfig = makeExtraConfig cfg ++
 432     [ ''
 433         RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 434         RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 435         RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 436         RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 437         RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 438         RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 439       ''
 440       ]
 441     ;
 442   };
 443 }