nixops/modules/websites/default.nix

   1 { lib, pkgs, config,  myconfig, ... }:
   2 let
   3   cfg = config.services.myWebsites;
   4   www_root = "/run/current-system/webapps/_www";
   5   theme_root = "/run/current-system/webapps/_theme";
   6   makeService = name: cfg: let
   7     toVhost = vhostConf: {
   8       enableSSL = true;
   9       sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
  10       sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
  11       sslServerChain = "/var/lib/acme/${vhostConf.certName}/chain.pem";
  12       logFormat = "combinedVhost";
  13       listen = map (ip: { inherit ip; port = 443; }) cfg.ips;
  14       hostName = builtins.head vhostConf.hosts;
  15       serverAliases = builtins.tail vhostConf.hosts or [];
  16       documentRoot = vhostConf.root;
  17       extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
  18     };
  19     nosslVhost = {
  20       listen = map (ip: { inherit ip; port = 80; }) cfg.ips;
  21       hostName = "nossl.immae.eu";
  22       enableSSL = false;
  23       logFormat = "combinedVhost";
  24       documentRoot = www_root;
  25       extraConfig = ''
  26         <Directory ${www_root}>
  27           DirectoryIndex nossl.html
  28           AllowOverride None
  29           Require all granted
  30
  31           RewriteEngine on
  32           RewriteRule ^/(.+)   /   [L]
  33         </Directory>
  34         '';
  35     };
  36     redirectVhost = { # Should go last, catchall http -> https redirect
  37       listen = map (ip: { inherit ip; port = 80; }) cfg.ips;
  38       hostName = "redirectSSL";
  39       serverAliases = [ "*" ];
  40       enableSSL = false;
  41       logFormat = "combinedVhost";
  42       documentRoot = "/var/lib/acme/acme-challenge";
  43       extraConfig = ''
  44         RewriteEngine on
  45         RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
  46         RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
  47         # To redirect in specific "VirtualHost *:80", do
  48         #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
  49         # rather than rewrite
  50       '';
  51     };
  52     fallbackVhost = toVhost { # Should go first, default choice
  53       certName    = "eldiron";
  54       hosts       = ["eldiron.immae.eu" ];
  55       root        = www_root;
  56       extraConfig = [ "DirectoryIndex index.htm" ];
  57     };
  58   in rec {
  59     enable = true;
  60     listen = map (ip: { inherit ip; port = 443; }) cfg.ips;
  61     stateDir = "/run/httpd_${name}";
  62     logPerVirtualHost = true;
  63     multiProcessingModule = "worker";
  64     adminAddr = "httpd@immae.eu";
  65     logFormat = "combinedVhost";
  66     extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
  67     extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
  68     virtualHosts = [ fallbackVhost ]
  69       ++ lib.optionals (name == "tools") [ nosslVhost ]
  70       ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
  71       ++ [ redirectVhost ];
  72   };
  73   makeServiceOptions = name: {
  74     enable = lib.mkEnableOption "enable websites in ${name}";
  75     ips = lib.mkOption {
  76       type = lib.types.listOf lib.types.string;
  77       default = let
  78         ips = myconfig.env.servers.eldiron.ips.${name};
  79       in
  80         [ips.ip4] ++ (ips.ip6 or []);
  81       description = "${name} ips to listen to";
  82     };
  83     modules = lib.mkOption {
  84       type = lib.types.listOf (lib.types.str);
  85       default = [];
  86     };
  87     extraConfig = lib.mkOption {
  88       type = lib.types.listOf (lib.types.lines);
  89       default = [];
  90     };
  91     vhostConfs = lib.mkOption {
  92       type = lib.types.attrsOf (lib.types.submodule {
  93         options = {
  94           certName = lib.mkOption { type = lib.types.string; };
  95           hosts    = lib.mkOption { type = lib.types.listOf lib.types.string; };
  96           root     = lib.mkOption { type = lib.types.nullOr lib.types.path; };
  97           extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
  98         };
  99       });
 100     };
 101   };
 102   makeModules = cfg: pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
 103   makeExtraConfig = cfg: (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
 104 in
 105 {
 106   imports = [
 107     ./chloe
 108     ./ludivine
 109     ./aten
 110     ./piedsjaloux
 111     ./connexionswing
 112     ./tellesflorian
 113     ./emilia
 114     ./capitaines
 115     ./ftp/jerome.nix
 116     ./ftp/nassime.nix
 117     ./ftp/florian.nix
 118     ./ftp/denisejerome.nix
 119     ./ftp/leila.nix
 120     ./ftp/papa.nix
 121     ./ftp/immae.nix
 122     ./ftp/release.nix
 123     ./ftp/temp.nix
 124     ./tools/db.nix
 125     ./tools/tools
 126     ./tools/dav
 127     ./tools/cloud.nix
 128     ./tools/git
 129     ./tools/mastodon.nix
 130     ./tools/mediagoblin.nix
 131     ./tools/diaspora.nix
 132     ./tools/ether.nix
 133     ./tools/peertube.nix
 134     # Adapted from base phpfpm
 135     ./phpfpm
 136   ];
 137
 138   options.services.myWebsites = {
 139     production = makeServiceOptions "production";
 140     integration = makeServiceOptions "integration";
 141     tools = makeServiceOptions "main";
 142
 143     apacheConfig = lib.mkOption {
 144       type = lib.types.attrsOf (lib.types.submodule {
 145         options = {
 146           modules = lib.mkOption {
 147             type = lib.types.listOf (lib.types.str);
 148             default = [];
 149           };
 150           extraConfig = lib.mkOption {
 151             type = lib.types.nullOr lib.types.lines;
 152             default = null;
 153           };
 154         };
 155       });
 156       default = {};
 157       description = "Extra global config";
 158     };
 159
 160   };
 161
 162   config = {
 163     users.users.wwwrun.extraGroups = [ "keys" ];
 164     networking.firewall.allowedTCPPorts = [ 80 443 ];
 165
 166     nixpkgs.overlays = [ (self: super: rec {
 167       #openssl = self.openssl_1_1;
 168       php = php72;
 169       php72 = (super.php72.override {
 170         mysql.connector-c = self.mariadb;
 171         config.php.mysqlnd = false;
 172         config.php.mysqli = false;
 173       }).overrideAttrs(old: rec {
 174         # Didn't manage to build with mysqli + mysql_config connector
 175         configureFlags = old.configureFlags ++ [
 176           "--with-mysqli=shared,mysqlnd"
 177           ];
 178         # preConfigure = (old.preConfigure or "") + ''
 179         #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
 180         #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
 181         #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
 182         #   '';
 183       });
 184       phpPackages = super.php72Packages.override { inherit php; };
 185     }) ];
 186
 187     services.myWebsites.tools.databases.enable = true;
 188     services.myWebsites.tools.tools.enable = true;
 189     services.myWebsites.tools.dav.enable = true;
 190     services.myWebsites.tools.cloud.enable = true;
 191     services.myWebsites.tools.git.enable = true;
 192     services.myWebsites.tools.mastodon.enable = true;
 193     services.myWebsites.tools.mediagoblin.enable = true;
 194     services.myWebsites.tools.diaspora.enable = true;
 195     services.myWebsites.tools.etherpad-lite.enable = true;
 196     services.myWebsites.tools.peertube.enable = true;
 197
 198     services.myWebsites.Chloe.production.enable = cfg.production.enable;
 199     services.myWebsites.Ludivine.production.enable = cfg.production.enable;
 200     services.myWebsites.Aten.production.enable = cfg.production.enable;
 201     services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
 202     services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
 203     services.myWebsites.Jerome.production.enable = cfg.production.enable;
 204     services.myWebsites.Nassime.production.enable = cfg.production.enable;
 205     services.myWebsites.Florian.production.enable = cfg.production.enable;
 206     services.myWebsites.Leila.production.enable = cfg.production.enable;
 207     services.myWebsites.Papa.production.enable = cfg.production.enable;
 208     services.myWebsites.DeniseJerome.production.enable = cfg.production.enable;
 209     services.myWebsites.Emilia.production.enable = cfg.production.enable;
 210     services.myWebsites.Capitaines.production.enable = cfg.production.enable;
 211     services.myWebsites.Immae.production.enable = cfg.production.enable;
 212     services.myWebsites.Release.production.enable = cfg.production.enable;
 213     services.myWebsites.Temp.production.enable = cfg.production.enable;
 214
 215     services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
 216     services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
 217     services.myWebsites.Aten.integration.enable = cfg.integration.enable;
 218     services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
 219     services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
 220     services.myWebsites.TellesFlorian.integration.enable = true;
 221     services.myWebsites.Florian.integration.enable = true;
 222
 223     secrets.keys = [{
 224       dest = "apache-ldap";
 225       user = "wwwrun";
 226       group = "wwwrun";
 227       permissions = "0400";
 228       text = ''
 229         <Macro LDAPConnect>
 230           <IfModule authnz_ldap_module>
 231             AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 232             AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 233             AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
 234             AuthType             Basic
 235             AuthName             "Authentification requise (Acces LDAP)"
 236             AuthBasicProvider    ldap
 237           </IfModule>
 238         </Macro>
 239         '';
 240     }];
 241
 242     services.myWebsites.apacheConfig = {
 243       gzip = {
 244         modules = [ "deflate" "filter" ];
 245         extraConfig = ''
 246           AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
 247         '';
 248       };
 249       macros = {
 250         modules = [ "macro" ];
 251       };
 252       stats = {
 253         extraConfig = ''
 254           <Macro Stats %{domain}>
 255             Alias /webstats ${config.services.webstats.dataDir}/%{domain}
 256             <Directory ${config.services.webstats.dataDir}/%{domain}>
 257               DirectoryIndex index.html
 258               AllowOverride None
 259               Require all granted
 260             </Directory>
 261             <Location /webstats>
 262               Use LDAPConnect
 263               Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
 264             </Location>
 265           </Macro>
 266         '';
 267       };
 268       ldap = {
 269         modules = [ "ldap" "authnz_ldap" ];
 270         extraConfig = ''
 271           <IfModule ldap_module>
 272             LDAPSharedCacheSize 500000
 273             LDAPCacheEntries 1024
 274             LDAPCacheTTL 600
 275             LDAPOpCacheEntries 1024
 276             LDAPOpCacheTTL 600
 277           </IfModule>
 278
 279           Include /var/secrets/apache-ldap
 280         '';
 281       };
 282       global = {
 283         extraConfig = (pkgs.webapps.apache-default.override { inherit www_root;}).apacheConfig;
 284       };
 285       apaxy = {
 286         extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
 287       };
 288       http2 = {
 289         modules = [ "http2" ];
 290         extraConfig = ''
 291           Protocols h2 http/1.1
 292         '';
 293       };
 294       customLog = {
 295         extraConfig = ''
 296           LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
 297         '';
 298       };
 299     };
 300
 301     system.activationScripts = {
 302       httpd = ''
 303         install -d -m 0755 /var/lib/acme/acme-challenge
 304         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 305         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
 306         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/tmp/adminer
 307         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
 308         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
 309         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/phpldapadmin
 310         '';
 311     };
 312
 313     system.extraSystemBuilderCmds = let
 314       adminer = pkgs.callPackage ./commons/adminer.nix {};
 315     in ''
 316       mkdir -p $out/webapps
 317       ln -s ${pkgs.webapps.apache-default.www} $out/webapps/_www
 318       ln -s ${pkgs.webapps.apache-theme.theme} $out/webapps/_theme
 319       ln -s ${adminer.webRoot} $out/webapps/${adminer.apache.webappName}
 320       '';
 321
 322     services.myPhpfpm = {
 323       phpPackage = pkgs.php;
 324       phpOptions = ''
 325         session.save_path = "/var/lib/php/sessions"
 326         post_max_size = 20M
 327         ; 15 days (seconds)
 328         session.gc_maxlifetime = 1296000
 329         ; 30 days (minutes)
 330         session.cache_expire = 43200
 331         '';
 332       extraConfig = ''
 333         log_level = notice
 334         '';
 335     };
 336
 337     services.httpdProd = makeService "production" config.services.myWebsites.production;
 338     services.myWebsites.production.modules = makeModules cfg;
 339     services.myWebsites.production.extraConfig = makeExtraConfig cfg;
 340
 341     services.httpdInte = makeService "integration" config.services.myWebsites.integration;
 342     services.myWebsites.integration.modules = makeModules cfg;
 343     services.myWebsites.integration.extraConfig = makeExtraConfig cfg;
 344
 345     services.httpdTools = makeService "tools" config.services.myWebsites.tools;
 346     services.myWebsites.tools.modules = makeModules cfg;
 347     services.myWebsites.tools.extraConfig = makeExtraConfig cfg ++
 348     [ ''
 349         RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 350         RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 351         RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 352         RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 353         RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 354         RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 355       ''
 356       ]
 357     ;
 358   };
 359 }