nixops/modules/websites/default.nix

   1 { lib, pkgs, config,  myconfig, ... }:
   2 let
   3   cfg = config.services.myWebsites;
   4   www_root = "/run/current-system/webapps/_www";
   5   theme_root = "/run/current-system/webapps/_theme";
   6   apacheConfig = {
   7     gzip = {
   8       modules = [ "deflate" "filter" ];
   9       extraConfig = ''
  10         AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
  11       '';
  12     };
  13     macros = {
  14       modules = [ "macro" ];
  15     };
  16     stats = {
  17       extraConfig = ''
  18         <Macro Stats %{domain}>
  19           Alias /webstats ${config.services.webstats.dataDir}/%{domain}
  20           <Directory ${config.services.webstats.dataDir}/%{domain}>
  21             DirectoryIndex index.html
  22             AllowOverride None
  23             Require all granted
  24           </Directory>
  25           <Location /webstats>
  26             Use LDAPConnect
  27             Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
  28           </Location>
  29         </Macro>
  30       '';
  31     };
  32     ldap = {
  33       modules = [ "ldap" "authnz_ldap" ];
  34       extraConfig = ''
  35         <IfModule ldap_module>
  36           LDAPSharedCacheSize 500000
  37           LDAPCacheEntries 1024
  38           LDAPCacheTTL 600
  39           LDAPOpCacheEntries 1024
  40           LDAPOpCacheTTL 600
  41         </IfModule>
  42
  43         Include /var/secrets/apache-ldap
  44       '';
  45     };
  46     global = {
  47       extraConfig = (pkgs.webapps.apache-default.override { inherit www_root;}).apacheConfig;
  48     };
  49     apaxy = {
  50       extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
  51     };
  52     http2 = {
  53       modules = [ "http2" ];
  54       extraConfig = ''
  55         Protocols h2 http/1.1
  56       '';
  57     };
  58     customLog = {
  59       extraConfig = ''
  60         LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
  61       '';
  62     };
  63   };
  64   makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
  65   makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
  66 in
  67 {
  68   imports = [
  69     ./tools/db.nix
  70     ./tools/tools
  71     ./tools/dav
  72     ./tools/cloud.nix
  73     ./tools/git
  74     ./tools/mastodon.nix
  75     ./tools/mediagoblin.nix
  76     ./tools/diaspora.nix
  77     ./tools/ether.nix
  78     ./tools/peertube.nix
  79     # Adapted from base phpfpm
  80     ./phpfpm
  81   ];
  82
  83   config = {
  84     users.users.wwwrun.extraGroups = [ "keys" ];
  85     networking.firewall.allowedTCPPorts = [ 80 443 ];
  86
  87     nixpkgs.overlays = [ (self: super: rec {
  88       #openssl = self.openssl_1_1;
  89       php = php72;
  90       php72 = (super.php72.override {
  91         mysql.connector-c = self.mariadb;
  92         config.php.mysqlnd = false;
  93         config.php.mysqli = false;
  94       }).overrideAttrs(old: rec {
  95         # Didn't manage to build with mysqli + mysql_config connector
  96         configureFlags = old.configureFlags ++ [
  97           "--with-mysqli=shared,mysqlnd"
  98           ];
  99         # preConfigure = (old.preConfigure or "") + ''
 100         #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
 101         #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
 102         #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
 103         #   '';
 104       });
 105       phpPackages = super.php72Packages.override { inherit php; };
 106     }) ];
 107
 108     services.myWebsites.tools.databases.enable = true;
 109     services.myWebsites.tools.tools.enable = true;
 110     services.myWebsites.tools.dav.enable = true;
 111     services.myWebsites.tools.cloud.enable = true;
 112     services.myWebsites.tools.git.enable = true;
 113     services.myWebsites.tools.mastodon.enable = true;
 114     services.myWebsites.tools.mediagoblin.enable = true;
 115     services.myWebsites.tools.diaspora.enable = true;
 116     services.myWebsites.tools.etherpad-lite.enable = true;
 117     services.myWebsites.tools.peertube.enable = true;
 118
 119     secrets.keys = [{
 120       dest = "apache-ldap";
 121       user = "wwwrun";
 122       group = "wwwrun";
 123       permissions = "0400";
 124       text = ''
 125         <Macro LDAPConnect>
 126           <IfModule authnz_ldap_module>
 127             AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 128             AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 129             AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
 130             AuthType             Basic
 131             AuthName             "Authentification requise (Acces LDAP)"
 132             AuthBasicProvider    ldap
 133           </IfModule>
 134         </Macro>
 135         '';
 136     }];
 137
 138     system.activationScripts = {
 139       httpd = ''
 140         install -d -m 0755 ${config.security.acme.directory}/acme-challenge
 141         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 142         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
 143         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/tmp/adminer
 144         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
 145         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
 146         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/phpldapadmin
 147         '';
 148     };
 149
 150     system.extraSystemBuilderCmds = let
 151       adminer = pkgs.callPackage ./commons/adminer.nix {};
 152     in ''
 153       mkdir -p $out/webapps
 154       ln -s ${pkgs.webapps.apache-default.www} $out/webapps/_www
 155       ln -s ${pkgs.webapps.apache-theme.theme} $out/webapps/_theme
 156       ln -s ${adminer.webRoot} $out/webapps/${adminer.apache.webappName}
 157       '';
 158
 159     services.myPhpfpm = {
 160       phpPackage = pkgs.php;
 161       phpOptions = ''
 162         session.save_path = "/var/lib/php/sessions"
 163         post_max_size = 20M
 164         ; 15 days (seconds)
 165         session.gc_maxlifetime = 1296000
 166         ; 30 days (minutes)
 167         session.cache_expire = 43200
 168         '';
 169       extraConfig = ''
 170         log_level = notice
 171         '';
 172     };
 173
 174     services.websites.production = {
 175       enable = true;
 176       adminAddr = "httpd@immae.eu";
 177       httpdName = "Prod";
 178       ips =
 179         let ips = myconfig.env.servers.eldiron.ips.production;
 180         in [ips.ip4] ++ (ips.ip6 or []);
 181       modules = makeModules;
 182       extraConfig = makeExtraConfig;
 183       fallbackVhost = {
 184         certName    = "eldiron";
 185         hosts       = ["eldiron.immae.eu" ];
 186         root        = www_root;
 187         extraConfig = [ "DirectoryIndex index.htm" ];
 188       };
 189     };
 190
 191     services.websites.integration = {
 192       enable = true;
 193       adminAddr = "httpd@immae.eu";
 194       httpdName = "Inte";
 195       ips =
 196         let ips = myconfig.env.servers.eldiron.ips.integration;
 197         in [ips.ip4] ++ (ips.ip6 or []);
 198       modules = makeModules;
 199       extraConfig = makeExtraConfig;
 200       fallbackVhost = {
 201         certName    = "eldiron";
 202         hosts       = ["eldiron.immae.eu" ];
 203         root        = www_root;
 204         extraConfig = [ "DirectoryIndex index.htm" ];
 205       };
 206     };
 207
 208     services.websites.tools = {
 209       enable = true;
 210       adminAddr = "httpd@immae.eu";
 211       httpdName = "Tools";
 212       ips =
 213         let ips = myconfig.env.servers.eldiron.ips.main;
 214         in [ips.ip4] ++ (ips.ip6 or []);
 215       modules = makeModules;
 216       extraConfig = makeExtraConfig ++
 217         [ ''
 218             RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 219             RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 220             RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 221             RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 222             RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 223             RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 224           ''
 225           ];
 226       nosslVhost = {
 227         enable = true;
 228         host = "nossl.immae.eu";
 229       };
 230       fallbackVhost = {
 231         certName    = "eldiron";
 232         hosts       = ["eldiron.immae.eu" ];
 233         root        = www_root;
 234         extraConfig = [ "DirectoryIndex index.htm" ];
 235       };
 236     };
 237   };
 238 }