nixops/modules/websites/default.nix

   1 { lib, pkgs, config, mylibs, myconfig, ... }:
   2 let
   3   cfg = config.services.myWebsites;
   4   www_root = "/run/current-system/webapps/_www";
   5   theme_root = "/run/current-system/webapps/_theme";
   6   makeService = name: cfg: let
   7     toVhost = vhostConf: {
   8       enableSSL = true;
   9       sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
  10       sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
  11       sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem";
  12       logFormat = "combinedVhost";
  13       listen = map (ip: { inherit ip; port = 443; }) cfg.ips;
  14       hostName = builtins.head vhostConf.hosts;
  15       serverAliases = builtins.tail vhostConf.hosts or [];
  16       documentRoot = vhostConf.root;
  17       extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
  18     };
  19     nosslVhost = {
  20       listen = map (ip: { inherit ip; port = 80; }) cfg.ips;
  21       hostName = "nossl.immae.eu";
  22       enableSSL = false;
  23       logFormat = "combinedVhost";
  24       documentRoot = www_root;
  25       extraConfig = ''
  26         <Directory ${www_root}>
  27           DirectoryIndex nossl.html
  28           AllowOverride None
  29           Require all granted
  30
  31           RewriteEngine on
  32           RewriteRule ^/(.+)   /   [L]
  33         </Directory>
  34         '';
  35     };
  36     redirectVhost = { # Should go last, catchall http -> https redirect
  37       listen = map (ip: { inherit ip; port = 80; }) cfg.ips;
  38       hostName = "redirectSSL";
  39       serverAliases = [ "*" ];
  40       enableSSL = false;
  41       logFormat = "combinedVhost";
  42       documentRoot = "/var/lib/acme/acme-challenge";
  43       extraConfig = ''
  44         RewriteEngine on
  45         RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
  46         RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
  47         # To redirect in specific "VirtualHost *:80", do
  48         #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
  49         # rather than rewrite
  50       '';
  51     };
  52     fallbackVhost = toVhost { # Should go first, default choice
  53       certName    = "eldiron";
  54       hosts       = ["eldiron.immae.eu" ];
  55       root        = www_root;
  56       extraConfig = [ "DirectoryIndex index.htm" ];
  57     };
  58   in rec {
  59     enable = true;
  60     listen = map (ip: { inherit ip; port = 443; }) cfg.ips;
  61     stateDir = "/run/httpd_${name}";
  62     logPerVirtualHost = true;
  63     multiProcessingModule = "worker";
  64     adminAddr = "httpd@immae.eu";
  65     logFormat = "combinedVhost";
  66     extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
  67     extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
  68     virtualHosts = [ fallbackVhost ]
  69       ++ lib.optionals (name == "tools") [ nosslVhost ]
  70       ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
  71       ++ [ redirectVhost ];
  72   };
  73   makeServiceOptions = name: {
  74     enable = lib.mkEnableOption "enable websites in ${name}";
  75     ips = lib.mkOption {
  76       type = lib.types.listOf lib.types.string;
  77       default = let
  78         ips = myconfig.env.servers.eldiron.ips.${name};
  79       in
  80         [ips.ip4] ++ (ips.ip6 or []);
  81       description = "${name} ips to listen to";
  82     };
  83     modules = lib.mkOption {
  84       type = lib.types.listOf (lib.types.str);
  85       default = [];
  86     };
  87     extraConfig = lib.mkOption {
  88       type = lib.types.listOf (lib.types.lines);
  89       default = [];
  90     };
  91     vhostConfs = lib.mkOption {
  92       type = lib.types.attrsOf (lib.types.submodule {
  93         options = {
  94           certName = lib.mkOption { type = lib.types.string; };
  95           hosts    = lib.mkOption { type = lib.types.listOf lib.types.string; };
  96           root     = lib.mkOption { type = lib.types.nullOr lib.types.path; };
  97           extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
  98         };
  99       });
 100     };
 101   };
 102   makeModules = cfg: pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
 103   makeExtraConfig = cfg: (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
 104 in
 105 {
 106   imports = [
 107     ./chloe
 108     ./ludivine
 109     ./aten
 110     ./piedsjaloux
 111     ./connexionswing
 112     ./tellesflorian
 113     ./emilia
 114     ./capitaines
 115     ./ftp/jerome.nix
 116     ./ftp/nassime.nix
 117     ./ftp/florian.nix
 118     ./ftp/denisejerome.nix
 119     ./ftp/immae.nix
 120     ./ftp/release.nix
 121     ./ftp/temp.nix
 122     ./tools/db
 123     ./tools/tools
 124     ./tools/dav
 125     ./tools/cloud
 126     ./tools/git
 127     ./tools/mastodon
 128     ./tools/mediagoblin
 129     ./tools/diaspora
 130     ./tools/ether
 131     ./tools/peertube
 132     # built using:
 133     # sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
 134     # Removed allGranted
 135     # And removed users / groups
 136     ./apache/httpd_prod.nix
 137     ./apache/httpd_inte.nix
 138     # except for this one for users/groups
 139     ./apache/httpd_tools.nix
 140     # Adapted from base phpfpm
 141     ./phpfpm
 142   ];
 143
 144   options.services.myWebsites = {
 145     production = makeServiceOptions "production";
 146     integration = makeServiceOptions "integration";
 147     tools = makeServiceOptions "main";
 148
 149     apacheConfig = lib.mkOption {
 150       type = lib.types.attrsOf (lib.types.submodule {
 151         options = {
 152           modules = lib.mkOption {
 153             type = lib.types.listOf (lib.types.str);
 154             default = [];
 155           };
 156           extraConfig = lib.mkOption {
 157             type = lib.types.nullOr lib.types.lines;
 158             default = null;
 159           };
 160         };
 161       });
 162       default = {};
 163       description = "Extra global config";
 164     };
 165
 166   };
 167
 168   config = {
 169     networking.firewall.allowedTCPPorts = [ 80 443 ];
 170
 171     nixpkgs.overlays = [ (self: super: rec {
 172       php = php72;
 173       php72 = (super.php72.override {
 174         mysql.connector-c = self.mariadb;
 175         config.php.mysqlnd = false;
 176         config.php.mysqli = false;
 177       }).overrideAttrs(old: rec {
 178         # Didn't manage to build with mysqli + mysql_config connector
 179         configureFlags = old.configureFlags ++ [
 180           "--with-mysqli=shared,mysqlnd"
 181           ];
 182         # preConfigure = (old.preConfigure or "") + ''
 183         #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
 184         #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
 185         #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
 186         #   '';
 187       });
 188       phpPackages = super.php72Packages.override { inherit php; };
 189       composerEnv = import ./commons/composer-env.nix {
 190         inherit (self) stdenv writeTextFile fetchurl php unzip;
 191       };
 192     }) ];
 193
 194     services.myWebsites.tools.databases.enable = true;
 195     services.myWebsites.tools.tools.enable = true;
 196     services.myWebsites.tools.dav.enable = true;
 197     services.myWebsites.tools.cloud.enable = true;
 198     services.myWebsites.tools.git.enable = true;
 199     services.myWebsites.tools.mastodon.enable = true;
 200     services.myWebsites.tools.mediagoblin.enable = true;
 201     services.myWebsites.tools.diaspora.enable = true;
 202     services.myWebsites.tools.etherpad-lite.enable = true;
 203     services.myWebsites.tools.peertube.enable = true;
 204
 205     services.myWebsites.Chloe.production.enable = cfg.production.enable;
 206     services.myWebsites.Ludivine.production.enable = cfg.production.enable;
 207     services.myWebsites.Aten.production.enable = cfg.production.enable;
 208     services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
 209     services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
 210     services.myWebsites.Jerome.production.enable = cfg.production.enable;
 211     services.myWebsites.Nassime.production.enable = cfg.production.enable;
 212     services.myWebsites.Florian.production.enable = cfg.production.enable;
 213     services.myWebsites.DeniseJerome.production.enable = cfg.production.enable;
 214     services.myWebsites.Emilia.production.enable = cfg.production.enable;
 215     services.myWebsites.Capitaines.production.enable = cfg.production.enable;
 216     services.myWebsites.Immae.production.enable = cfg.production.enable;
 217     services.myWebsites.Release.production.enable = cfg.production.enable;
 218     services.myWebsites.Temp.production.enable = cfg.production.enable;
 219
 220     services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
 221     services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
 222     services.myWebsites.Aten.integration.enable = cfg.integration.enable;
 223     services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
 224     services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
 225     services.myWebsites.TellesFlorian.integration.enable = true;
 226     services.myWebsites.Florian.integration.enable = true;
 227
 228     services.myWebsites.apacheConfig = {
 229       gzip = {
 230         modules = [ "deflate" "filter" ];
 231         extraConfig = ''
 232           AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
 233         '';
 234       };
 235       macros = {
 236         modules = [ "macro" ];
 237       };
 238       stats = {
 239         extraConfig = ''
 240           <Macro Stats %{domain}>
 241             Alias /awstats /var/lib/goaccess/%{domain}
 242             <Directory /var/lib/goaccess/%{domain}>
 243               DirectoryIndex index.html
 244               AllowOverride None
 245               Require all granted
 246             </Directory>
 247             <Location /awstats>
 248               Use LDAPConnect
 249               Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
 250             </Location>
 251           </Macro>
 252         '';
 253       };
 254       ldap = {
 255         modules = [ "ldap" "authnz_ldap" ];
 256         extraConfig = ''
 257           <IfModule ldap_module>
 258             LDAPSharedCacheSize 500000
 259             LDAPCacheEntries 1024
 260             LDAPCacheTTL 600
 261             LDAPOpCacheEntries 1024
 262             LDAPOpCacheTTL 600
 263           </IfModule>
 264
 265           <Macro LDAPConnect>
 266             <IfModule authnz_ldap_module>
 267               AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 268               AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 269               AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
 270               AuthType             Basic
 271               AuthName             "Authentification requise (Acces LDAP)"
 272               AuthBasicProvider    ldap
 273             </IfModule>
 274           </Macro>
 275         '';
 276       };
 277       global = {
 278         extraConfig = ''
 279           ErrorDocument 500 /maintenance_immae.html
 280           ErrorDocument 501 /maintenance_immae.html
 281           ErrorDocument 502 /maintenance_immae.html
 282           ErrorDocument 503 /maintenance_immae.html
 283           ErrorDocument 504 /maintenance_immae.html
 284           Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
 285           ProxyPass /maintenance_immae.html !
 286
 287           AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
 288           <Directory ${www_root}>
 289             AllowOverride None
 290             Require all granted
 291           </Directory>
 292         '';
 293       };
 294       apaxy = {
 295         extraConfig = ''
 296           <Macro Apaxy %{folder} %{ignored}>
 297             Alias /theme ${theme_root}
 298             <Directory ${theme_root}>
 299               Options -Indexes
 300               AllowOverride None
 301               Require all granted
 302             </Directory>
 303
 304             # mod_autoindex
 305             <Directory %{folder}>
 306               Options Indexes
 307               AllowOverride None
 308               Require all granted
 309
 310               # Inspired from Apaxy by @adamwhitcroft
 311
 312               IndexOptions +Charset=UTF-8 +FancyIndexing +IgnoreCase +FoldersFirst +XHTML +HTMLTable +SuppressRules +SuppressDescription +NameWidth=* +IconsAreLinks +ShowForbidden
 313
 314               IndexHeadInsert "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />"
 315
 316               IndexIgnoreReset ON
 317               IndexIgnore /theme .htaccess %{ignored}
 318
 319               AddIcon /theme/icons/blank.png ^^BLANKICON^^
 320               AddIcon /theme/icons/folder.png ^^DIRECTORY^^
 321               AddIcon /theme/icons/folder-home.png ..
 322
 323               AddIconByType (TXT,/theme/icons/text.png) text/*
 324               AddIconByType (IMG,/theme/icons/image.png) image/*
 325               AddIconByType (SND,/theme/icons/audio.png) audio/*
 326               AddIconByType (VID,/theme/icons/video.png) video/*
 327
 328               AddIcon /theme/icons/archive.png .7z .bz2 .cab .gz .tar
 329               AddIcon /theme/icons/audio.png .aac .aif .aifc .aiff .ape .au .flac .iff .m4a .mid .mp3 .mpa .ra .wav .wma .f4a .f4b .oga .ogg .xm .it .s3m .mod
 330               AddIcon /theme/icons/bin.png .bin .hex
 331               AddIcon /theme/icons/bmp.png .bmp
 332               AddIcon /theme/icons/c.png .c
 333               AddIcon /theme/icons/calc.png .xlsx .xlsm .xltx .xltm .xlam .xlr .xls .csv
 334               AddIcon /theme/icons/cd.png .iso
 335               AddIcon /theme/icons/cpp.png .cpp
 336               AddIcon /theme/icons/css.png .css .sass .scss
 337               AddIcon /theme/icons/deb.png .deb
 338               AddIcon /theme/icons/doc.png .doc .docx .docm .dot .dotx .dotm .log .msg .odt .pages .rtf .tex .wpd .wps
 339               AddIcon /theme/icons/draw.png .svg .svgz
 340               AddIcon /theme/icons/eps.png .ai .eps
 341               AddIcon /theme/icons/exe.png .exe
 342               AddIcon /theme/icons/gif.png .gif
 343               AddIcon /theme/icons/h.png .h
 344               AddIcon /theme/icons/html.png .html .xhtml .shtml .htm .URL .url
 345               AddIcon /theme/icons/ico.png .ico
 346               AddIcon /theme/icons/java.png .jar
 347               AddIcon /theme/icons/jpg.png .jpg .jpeg .jpe
 348               AddIcon /theme/icons/js.png .js .json
 349               AddIcon /theme/icons/markdown.png .md
 350               AddIcon /theme/icons/package.png .pkg .dmg
 351               AddIcon /theme/icons/pdf.png .pdf
 352               AddIcon /theme/icons/php.png .php .phtml
 353               AddIcon /theme/icons/playlist.png .m3u .m3u8 .pls .pls8
 354               AddIcon /theme/icons/png.png .png
 355               AddIcon /theme/icons/ps.png .ps
 356               AddIcon /theme/icons/psd.png .psd
 357               AddIcon /theme/icons/py.png .py
 358               AddIcon /theme/icons/rar.png .rar
 359               AddIcon /theme/icons/rb.png .rb
 360               AddIcon /theme/icons/rpm.png .rpm
 361               AddIcon /theme/icons/rss.png .rss
 362               AddIcon /theme/icons/script.png .bat .cmd .sh
 363               AddIcon /theme/icons/sql.png .sql
 364               AddIcon /theme/icons/tiff.png .tiff .tif
 365               AddIcon /theme/icons/text.png .txt .nfo
 366               AddIcon /theme/icons/video.png .asf .asx .avi .flv .mkv .mov .mp4 .mpg .rm .srt .swf .vob .wmv .m4v .f4v .f4p .ogv
 367               AddIcon /theme/icons/xml.png .xml
 368               AddIcon /theme/icons/zip.png .zip
 369               DefaultIcon /theme/icons/default.png
 370
 371               HeaderName /theme/header.html
 372               ReadmeName /theme/footer.html
 373               IndexStyleSheet /theme/style.css
 374             </Directory>
 375           </Macro>
 376         '';
 377       };
 378       http2 = {
 379         modules = [ "http2" ];
 380         extraConfig = ''
 381           Protocols h2 http/1.1
 382         '';
 383       };
 384       customLog = {
 385         extraConfig = ''
 386           LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
 387         '';
 388       };
 389     };
 390
 391     system.activationScripts = {
 392       httpd = ''
 393         install -d -m 0755 /var/lib/acme/acme-challenge
 394         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 395         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
 396         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
 397         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
 398         '';
 399     };
 400
 401     system.extraSystemBuilderCmds = let
 402       adminer = pkgs.callPackage ./commons/adminer.nix {};
 403     in ''
 404       mkdir -p $out/webapps
 405       ln -s ${../../www} $out/webapps/_www
 406       ln -s ${./apache/theme} $out/webapps/_theme
 407       ln -s ${adminer.webRoot} $out/webapps/${adminer.apache.webappName}
 408       '';
 409
 410     services.myPhpfpm = {
 411       phpPackage = pkgs.php;
 412       phpOptions = ''
 413         session.save_path = "/var/lib/php/sessions"
 414         post_max_size = 20M
 415         session.gc_maxlifetime = 60*60*24*15
 416         session.cache_expire = 60*24*30
 417         '';
 418       extraConfig = ''
 419         log_level = notice
 420         '';
 421     };
 422
 423     services.httpdProd = makeService "production" config.services.myWebsites.production;
 424     services.myWebsites.production.modules = makeModules cfg;
 425     services.myWebsites.production.extraConfig = makeExtraConfig cfg;
 426
 427     services.httpdInte = makeService "integration" config.services.myWebsites.integration;
 428     services.myWebsites.integration.modules = makeModules cfg;
 429     services.myWebsites.integration.extraConfig = makeExtraConfig cfg;
 430
 431     services.httpdTools = makeService "tools" config.services.myWebsites.tools;
 432     services.myWebsites.tools.modules = makeModules cfg;
 433     services.myWebsites.tools.extraConfig = makeExtraConfig cfg ++
 434     [ ''
 435         RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 436         RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 437         RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 438         RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 439         RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 440         RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 441       ''
 442       ]
 443     ;
 444   };
 445 }