nixops/modules/websites/default.nix

   1 { lib, pkgs, config,  myconfig, ... }:
   2 let
   3   cfg = config.services.myWebsites;
   4   www_root = "/run/current-system/webapps/_www";
   5   theme_root = "/run/current-system/webapps/_theme";
   6   apacheConfig = {
   7     gzip = {
   8       modules = [ "deflate" "filter" ];
   9       extraConfig = ''
  10         AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
  11       '';
  12     };
  13     macros = {
  14       modules = [ "macro" ];
  15     };
  16     stats = {
  17       extraConfig = ''
  18         <Macro Stats %{domain}>
  19           Alias /webstats ${config.services.webstats.dataDir}/%{domain}
  20           <Directory ${config.services.webstats.dataDir}/%{domain}>
  21             DirectoryIndex index.html
  22             AllowOverride None
  23             Require all granted
  24           </Directory>
  25           <Location /webstats>
  26             Use LDAPConnect
  27             Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
  28           </Location>
  29         </Macro>
  30       '';
  31     };
  32     ldap = {
  33       modules = [ "ldap" "authnz_ldap" ];
  34       extraConfig = ''
  35         <IfModule ldap_module>
  36           LDAPSharedCacheSize 500000
  37           LDAPCacheEntries 1024
  38           LDAPCacheTTL 600
  39           LDAPOpCacheEntries 1024
  40           LDAPOpCacheTTL 600
  41         </IfModule>
  42
  43         Include /var/secrets/apache-ldap
  44       '';
  45     };
  46     global = {
  47       extraConfig = (pkgs.webapps.apache-default.override { inherit www_root;}).apacheConfig;
  48     };
  49     apaxy = {
  50       extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
  51     };
  52     http2 = {
  53       modules = [ "http2" ];
  54       extraConfig = ''
  55         Protocols h2 http/1.1
  56       '';
  57     };
  58     customLog = {
  59       extraConfig = ''
  60         LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
  61       '';
  62     };
  63   };
  64   makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
  65   makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
  66 in
  67 {
  68   imports = [
  69     ./chloe
  70     ./ludivine
  71     ./aten
  72     ./piedsjaloux
  73     ./connexionswing
  74     ./tellesflorian
  75     ./emilia
  76     ./capitaines
  77     ./ftp/jerome.nix
  78     ./ftp/nassime.nix
  79     ./ftp/florian.nix
  80     ./ftp/denisejerome.nix
  81     ./ftp/leila.nix
  82     ./ftp/papa.nix
  83     ./ftp/immae.nix
  84     ./ftp/release.nix
  85     ./ftp/temp.nix
  86     ./tools/db.nix
  87     ./tools/tools
  88     ./tools/dav
  89     ./tools/cloud.nix
  90     ./tools/git
  91     ./tools/mastodon.nix
  92     ./tools/mediagoblin.nix
  93     ./tools/diaspora.nix
  94     ./tools/ether.nix
  95     ./tools/peertube.nix
  96     # Adapted from base phpfpm
  97     ./phpfpm
  98   ];
  99
 100   config = {
 101     users.users.wwwrun.extraGroups = [ "keys" ];
 102     networking.firewall.allowedTCPPorts = [ 80 443 ];
 103
 104     nixpkgs.overlays = [ (self: super: rec {
 105       #openssl = self.openssl_1_1;
 106       php = php72;
 107       php72 = (super.php72.override {
 108         mysql.connector-c = self.mariadb;
 109         config.php.mysqlnd = false;
 110         config.php.mysqli = false;
 111       }).overrideAttrs(old: rec {
 112         # Didn't manage to build with mysqli + mysql_config connector
 113         configureFlags = old.configureFlags ++ [
 114           "--with-mysqli=shared,mysqlnd"
 115           ];
 116         # preConfigure = (old.preConfigure or "") + ''
 117         #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
 118         #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
 119         #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
 120         #   '';
 121       });
 122       phpPackages = super.php72Packages.override { inherit php; };
 123     }) ];
 124
 125     services.myWebsites.tools.databases.enable = true;
 126     services.myWebsites.tools.tools.enable = true;
 127     services.myWebsites.tools.dav.enable = true;
 128     services.myWebsites.tools.cloud.enable = true;
 129     services.myWebsites.tools.git.enable = true;
 130     services.myWebsites.tools.mastodon.enable = true;
 131     services.myWebsites.tools.mediagoblin.enable = true;
 132     services.myWebsites.tools.diaspora.enable = true;
 133     services.myWebsites.tools.etherpad-lite.enable = true;
 134     services.myWebsites.tools.peertube.enable = true;
 135
 136     services.myWebsites.Chloe.production.enable = true;
 137     services.myWebsites.Ludivine.production.enable = true;
 138     services.myWebsites.Aten.production.enable = true;
 139     services.myWebsites.PiedsJaloux.production.enable = true;
 140     services.myWebsites.Connexionswing.production.enable = true;
 141     services.myWebsites.Jerome.production.enable = true;
 142     services.myWebsites.Nassime.production.enable = true;
 143     services.myWebsites.Florian.production.enable = true;
 144     services.myWebsites.Leila.production.enable = true;
 145     services.myWebsites.Papa.production.enable = true;
 146     services.myWebsites.DeniseJerome.production.enable = true;
 147     services.myWebsites.Emilia.production.enable = true;
 148     services.myWebsites.Capitaines.production.enable = true;
 149     services.myWebsites.Immae.production.enable = true;
 150     services.myWebsites.Release.production.enable = true;
 151     services.myWebsites.Temp.production.enable = true;
 152
 153     services.myWebsites.Chloe.integration.enable = true;
 154     services.myWebsites.Ludivine.integration.enable = true;
 155     services.myWebsites.Aten.integration.enable = true;
 156     services.myWebsites.PiedsJaloux.integration.enable = true;
 157     services.myWebsites.Connexionswing.integration.enable = true;
 158     services.myWebsites.TellesFlorian.integration.enable = true;
 159     services.myWebsites.Florian.integration.enable = true;
 160
 161     secrets.keys = [{
 162       dest = "apache-ldap";
 163       user = "wwwrun";
 164       group = "wwwrun";
 165       permissions = "0400";
 166       text = ''
 167         <Macro LDAPConnect>
 168           <IfModule authnz_ldap_module>
 169             AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 170             AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 171             AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
 172             AuthType             Basic
 173             AuthName             "Authentification requise (Acces LDAP)"
 174             AuthBasicProvider    ldap
 175           </IfModule>
 176         </Macro>
 177         '';
 178     }];
 179
 180     system.activationScripts = {
 181       httpd = ''
 182         install -d -m 0755 /var/lib/acme/acme-challenge
 183         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 184         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
 185         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/tmp/adminer
 186         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
 187         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
 188         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/phpldapadmin
 189         '';
 190     };
 191
 192     system.extraSystemBuilderCmds = let
 193       adminer = pkgs.callPackage ./commons/adminer.nix {};
 194     in ''
 195       mkdir -p $out/webapps
 196       ln -s ${pkgs.webapps.apache-default.www} $out/webapps/_www
 197       ln -s ${pkgs.webapps.apache-theme.theme} $out/webapps/_theme
 198       ln -s ${adminer.webRoot} $out/webapps/${adminer.apache.webappName}
 199       '';
 200
 201     services.myPhpfpm = {
 202       phpPackage = pkgs.php;
 203       phpOptions = ''
 204         session.save_path = "/var/lib/php/sessions"
 205         post_max_size = 20M
 206         ; 15 days (seconds)
 207         session.gc_maxlifetime = 1296000
 208         ; 30 days (minutes)
 209         session.cache_expire = 43200
 210         '';
 211       extraConfig = ''
 212         log_level = notice
 213         '';
 214     };
 215
 216     services.websites.production = {
 217       enable = true;
 218       adminAddr = "httpd@immae.eu";
 219       httpdName = "Prod";
 220       ips =
 221         let ips = myconfig.env.servers.eldiron.ips.production;
 222         in [ips.ip4] ++ (ips.ip6 or []);
 223       modules = makeModules;
 224       extraConfig = makeExtraConfig;
 225       fallbackVhost = {
 226         certName    = "eldiron";
 227         hosts       = ["eldiron.immae.eu" ];
 228         root        = www_root;
 229         extraConfig = [ "DirectoryIndex index.htm" ];
 230       };
 231     };
 232
 233     services.websites.integration = {
 234       enable = true;
 235       adminAddr = "httpd@immae.eu";
 236       httpdName = "Inte";
 237       ips =
 238         let ips = myconfig.env.servers.eldiron.ips.integration;
 239         in [ips.ip4] ++ (ips.ip6 or []);
 240       modules = makeModules;
 241       extraConfig = makeExtraConfig;
 242       fallbackVhost = {
 243         certName    = "eldiron";
 244         hosts       = ["eldiron.immae.eu" ];
 245         root        = www_root;
 246         extraConfig = [ "DirectoryIndex index.htm" ];
 247       };
 248     };
 249
 250     services.websites.tools = {
 251       enable = true;
 252       adminAddr = "httpd@immae.eu";
 253       httpdName = "Tools";
 254       ips =
 255         let ips = myconfig.env.servers.eldiron.ips.main;
 256         in [ips.ip4] ++ (ips.ip6 or []);
 257       modules = makeModules;
 258       extraConfig = makeExtraConfig ++
 259         [ ''
 260             RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 261             RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 262             RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 263             RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 264             RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 265             RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 266           ''
 267           ];
 268       nosslVhost = {
 269         enable = true;
 270         host = "nossl.immae.eu";
 271       };
 272       fallbackVhost = {
 273         certName    = "eldiron";
 274         hosts       = ["eldiron.immae.eu" ];
 275         root        = www_root;
 276         extraConfig = [ "DirectoryIndex index.htm" ];
 277       };
 278     };
 279   };
 280 }