nixops/modules/websites/default.nix

   1 { lib, pkgs, config, mylibs, myconfig, ... }:
   2 let
   3   cfg = config.services.myWebsites;
   4   www_root = "/run/current-system/webapps/_www";
   5   theme_root = "/run/current-system/webapps/_theme";
   6   makeService = name: cfg: let
   7     toVhost = vhostConf: {
   8       enableSSL = true;
   9       sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
  10       sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
  11       sslServerChain = "/var/lib/acme/${vhostConf.certName}/chain.pem";
  12       logFormat = "combinedVhost";
  13       listen = map (ip: { inherit ip; port = 443; }) cfg.ips;
  14       hostName = builtins.head vhostConf.hosts;
  15       serverAliases = builtins.tail vhostConf.hosts or [];
  16       documentRoot = vhostConf.root;
  17       extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
  18     };
  19     nosslVhost = {
  20       listen = map (ip: { inherit ip; port = 80; }) cfg.ips;
  21       hostName = "nossl.immae.eu";
  22       enableSSL = false;
  23       logFormat = "combinedVhost";
  24       documentRoot = www_root;
  25       extraConfig = ''
  26         <Directory ${www_root}>
  27           DirectoryIndex nossl.html
  28           AllowOverride None
  29           Require all granted
  30
  31           RewriteEngine on
  32           RewriteRule ^/(.+)   /   [L]
  33         </Directory>
  34         '';
  35     };
  36     redirectVhost = { # Should go last, catchall http -> https redirect
  37       listen = map (ip: { inherit ip; port = 80; }) cfg.ips;
  38       hostName = "redirectSSL";
  39       serverAliases = [ "*" ];
  40       enableSSL = false;
  41       logFormat = "combinedVhost";
  42       documentRoot = "/var/lib/acme/acme-challenge";
  43       extraConfig = ''
  44         RewriteEngine on
  45         RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
  46         RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
  47         # To redirect in specific "VirtualHost *:80", do
  48         #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
  49         # rather than rewrite
  50       '';
  51     };
  52     fallbackVhost = toVhost { # Should go first, default choice
  53       certName    = "eldiron";
  54       hosts       = ["eldiron.immae.eu" ];
  55       root        = www_root;
  56       extraConfig = [ "DirectoryIndex index.htm" ];
  57     };
  58   in rec {
  59     enable = true;
  60     listen = map (ip: { inherit ip; port = 443; }) cfg.ips;
  61     stateDir = "/run/httpd_${name}";
  62     logPerVirtualHost = true;
  63     multiProcessingModule = "worker";
  64     adminAddr = "httpd@immae.eu";
  65     logFormat = "combinedVhost";
  66     extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
  67     extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
  68     virtualHosts = [ fallbackVhost ]
  69       ++ lib.optionals (name == "tools") [ nosslVhost ]
  70       ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
  71       ++ [ redirectVhost ];
  72   };
  73   makeServiceOptions = name: {
  74     enable = lib.mkEnableOption "enable websites in ${name}";
  75     ips = lib.mkOption {
  76       type = lib.types.listOf lib.types.string;
  77       default = let
  78         ips = myconfig.env.servers.eldiron.ips.${name};
  79       in
  80         [ips.ip4] ++ (ips.ip6 or []);
  81       description = "${name} ips to listen to";
  82     };
  83     modules = lib.mkOption {
  84       type = lib.types.listOf (lib.types.str);
  85       default = [];
  86     };
  87     extraConfig = lib.mkOption {
  88       type = lib.types.listOf (lib.types.lines);
  89       default = [];
  90     };
  91     vhostConfs = lib.mkOption {
  92       type = lib.types.attrsOf (lib.types.submodule {
  93         options = {
  94           certName = lib.mkOption { type = lib.types.string; };
  95           hosts    = lib.mkOption { type = lib.types.listOf lib.types.string; };
  96           root     = lib.mkOption { type = lib.types.nullOr lib.types.path; };
  97           extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
  98         };
  99       });
 100     };
 101   };
 102   makeModules = cfg: pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
 103   makeExtraConfig = cfg: (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
 104 in
 105 {
 106   imports = [
 107     ./chloe
 108     ./ludivine
 109     ./aten
 110     ./piedsjaloux
 111     ./connexionswing
 112     ./tellesflorian
 113     ./emilia
 114     ./capitaines
 115     ./ftp/jerome.nix
 116     ./ftp/nassime.nix
 117     ./ftp/florian.nix
 118     ./ftp/denisejerome.nix
 119     ./ftp/leila.nix
 120     ./ftp/papa.nix
 121     ./ftp/immae.nix
 122     ./ftp/release.nix
 123     ./ftp/temp.nix
 124     ./tools/db
 125     ./tools/tools
 126     ./tools/dav
 127     ./tools/cloud
 128     ./tools/git
 129     ./tools/mastodon
 130     ./tools/mediagoblin
 131     ./tools/diaspora
 132     ./tools/ether
 133     ./tools/peertube
 134     # built using:
 135     # sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
 136     # Removed allGranted
 137     # And removed users / groups
 138     ./apache/httpd_prod.nix
 139     ./apache/httpd_inte.nix
 140     # except for this one for users/groups
 141     ./apache/httpd_tools.nix
 142     # Adapted from base phpfpm
 143     ./phpfpm
 144   ];
 145
 146   options.services.myWebsites = {
 147     production = makeServiceOptions "production";
 148     integration = makeServiceOptions "integration";
 149     tools = makeServiceOptions "main";
 150
 151     apacheConfig = lib.mkOption {
 152       type = lib.types.attrsOf (lib.types.submodule {
 153         options = {
 154           modules = lib.mkOption {
 155             type = lib.types.listOf (lib.types.str);
 156             default = [];
 157           };
 158           extraConfig = lib.mkOption {
 159             type = lib.types.nullOr lib.types.lines;
 160             default = null;
 161           };
 162         };
 163       });
 164       default = {};
 165       description = "Extra global config";
 166     };
 167
 168   };
 169
 170   config = {
 171     users.users.wwwrun.extraGroups = [ "keys" ];
 172     networking.firewall.allowedTCPPorts = [ 80 443 ];
 173
 174     nixpkgs.overlays = [ (self: super: rec {
 175       #openssl = self.openssl_1_1;
 176       php = php72;
 177       php72 = (super.php72.override {
 178         mysql.connector-c = self.mariadb;
 179         config.php.mysqlnd = false;
 180         config.php.mysqli = false;
 181       }).overrideAttrs(old: rec {
 182         # Didn't manage to build with mysqli + mysql_config connector
 183         configureFlags = old.configureFlags ++ [
 184           "--with-mysqli=shared,mysqlnd"
 185           ];
 186         # preConfigure = (old.preConfigure or "") + ''
 187         #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
 188         #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
 189         #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
 190         #   '';
 191       });
 192       phpPackages = super.php72Packages.override { inherit php; };
 193       composerEnv = import ./commons/composer-env.nix {
 194         inherit (self) stdenv writeTextFile fetchurl php unzip;
 195       };
 196     }) ];
 197
 198     services.myWebsites.tools.databases.enable = true;
 199     services.myWebsites.tools.tools.enable = true;
 200     services.myWebsites.tools.dav.enable = true;
 201     services.myWebsites.tools.cloud.enable = true;
 202     services.myWebsites.tools.git.enable = true;
 203     services.myWebsites.tools.mastodon.enable = true;
 204     services.myWebsites.tools.mediagoblin.enable = true;
 205     services.myWebsites.tools.diaspora.enable = true;
 206     services.myWebsites.tools.etherpad-lite.enable = true;
 207     services.myWebsites.tools.peertube.enable = true;
 208
 209     services.myWebsites.Chloe.production.enable = cfg.production.enable;
 210     services.myWebsites.Ludivine.production.enable = cfg.production.enable;
 211     services.myWebsites.Aten.production.enable = cfg.production.enable;
 212     services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
 213     services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
 214     services.myWebsites.Jerome.production.enable = cfg.production.enable;
 215     services.myWebsites.Nassime.production.enable = cfg.production.enable;
 216     services.myWebsites.Florian.production.enable = cfg.production.enable;
 217     services.myWebsites.Leila.production.enable = cfg.production.enable;
 218     services.myWebsites.Papa.production.enable = cfg.production.enable;
 219     services.myWebsites.DeniseJerome.production.enable = cfg.production.enable;
 220     services.myWebsites.Emilia.production.enable = cfg.production.enable;
 221     services.myWebsites.Capitaines.production.enable = cfg.production.enable;
 222     services.myWebsites.Immae.production.enable = cfg.production.enable;
 223     services.myWebsites.Release.production.enable = cfg.production.enable;
 224     services.myWebsites.Temp.production.enable = cfg.production.enable;
 225
 226     services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
 227     services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
 228     services.myWebsites.Aten.integration.enable = cfg.integration.enable;
 229     services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
 230     services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
 231     services.myWebsites.TellesFlorian.integration.enable = true;
 232     services.myWebsites.Florian.integration.enable = true;
 233
 234     mySecrets.keys = [{
 235       dest = "apache-ldap";
 236       user = "wwwrun";
 237       group = "wwwrun";
 238       permissions = "0400";
 239       text = ''
 240         <Macro LDAPConnect>
 241           <IfModule authnz_ldap_module>
 242             AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 243             AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 244             AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
 245             AuthType             Basic
 246             AuthName             "Authentification requise (Acces LDAP)"
 247             AuthBasicProvider    ldap
 248           </IfModule>
 249         </Macro>
 250         '';
 251     }];
 252
 253     services.myWebsites.apacheConfig = {
 254       gzip = {
 255         modules = [ "deflate" "filter" ];
 256         extraConfig = ''
 257           AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
 258         '';
 259       };
 260       macros = {
 261         modules = [ "macro" ];
 262       };
 263       stats = {
 264         extraConfig = ''
 265           <Macro Stats %{domain}>
 266             Alias /awstats /var/lib/goaccess/%{domain}
 267             <Directory /var/lib/goaccess/%{domain}>
 268               DirectoryIndex index.html
 269               AllowOverride None
 270               Require all granted
 271             </Directory>
 272             <Location /awstats>
 273               Use LDAPConnect
 274               Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
 275             </Location>
 276           </Macro>
 277         '';
 278       };
 279       ldap = {
 280         modules = [ "ldap" "authnz_ldap" ];
 281         extraConfig = ''
 282           <IfModule ldap_module>
 283             LDAPSharedCacheSize 500000
 284             LDAPCacheEntries 1024
 285             LDAPCacheTTL 600
 286             LDAPOpCacheEntries 1024
 287             LDAPOpCacheTTL 600
 288           </IfModule>
 289
 290           Include /var/secrets/apache-ldap
 291         '';
 292       };
 293       global = {
 294         extraConfig = ''
 295           ErrorDocument 500 /maintenance_immae.html
 296           ErrorDocument 501 /maintenance_immae.html
 297           ErrorDocument 502 /maintenance_immae.html
 298           ErrorDocument 503 /maintenance_immae.html
 299           ErrorDocument 504 /maintenance_immae.html
 300           Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
 301           ProxyPass /maintenance_immae.html !
 302
 303           AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
 304           <Directory ${www_root}>
 305             AllowOverride None
 306             Require all granted
 307           </Directory>
 308         '';
 309       };
 310       apaxy = {
 311         extraConfig = ''
 312           <Macro Apaxy %{folder} %{ignored}>
 313             Alias /theme ${theme_root}
 314             <Directory ${theme_root}>
 315               Options -Indexes
 316               AllowOverride None
 317               Require all granted
 318             </Directory>
 319
 320             # mod_autoindex
 321             <Directory %{folder}>
 322               Options Indexes
 323               AllowOverride None
 324               Require all granted
 325
 326               # Inspired from Apaxy by @adamwhitcroft
 327
 328               IndexOptions +Charset=UTF-8 +FancyIndexing +IgnoreCase +FoldersFirst +XHTML +HTMLTable +SuppressRules +SuppressDescription +NameWidth=* +IconsAreLinks +ShowForbidden
 329
 330               IndexHeadInsert "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />"
 331
 332               IndexIgnoreReset ON
 333               IndexIgnore /theme .htaccess %{ignored}
 334
 335               AddIcon /theme/icons/blank.png ^^BLANKICON^^
 336               AddIcon /theme/icons/folder.png ^^DIRECTORY^^
 337               AddIcon /theme/icons/folder-home.png ..
 338
 339               AddIconByType (TXT,/theme/icons/text.png) text/*
 340               AddIconByType (IMG,/theme/icons/image.png) image/*
 341               AddIconByType (SND,/theme/icons/audio.png) audio/*
 342               AddIconByType (VID,/theme/icons/video.png) video/*
 343
 344               AddIcon /theme/icons/archive.png .7z .bz2 .cab .gz .tar
 345               AddIcon /theme/icons/audio.png .aac .aif .aifc .aiff .ape .au .flac .iff .m4a .mid .mp3 .mpa .ra .wav .wma .f4a .f4b .oga .ogg .xm .it .s3m .mod
 346               AddIcon /theme/icons/bin.png .bin .hex
 347               AddIcon /theme/icons/bmp.png .bmp
 348               AddIcon /theme/icons/c.png .c
 349               AddIcon /theme/icons/calc.png .xlsx .xlsm .xltx .xltm .xlam .xlr .xls .csv
 350               AddIcon /theme/icons/cd.png .iso
 351               AddIcon /theme/icons/cpp.png .cpp
 352               AddIcon /theme/icons/css.png .css .sass .scss
 353               AddIcon /theme/icons/deb.png .deb
 354               AddIcon /theme/icons/doc.png .doc .docx .docm .dot .dotx .dotm .log .msg .odt .pages .rtf .tex .wpd .wps
 355               AddIcon /theme/icons/draw.png .svg .svgz
 356               AddIcon /theme/icons/eps.png .ai .eps
 357               AddIcon /theme/icons/exe.png .exe
 358               AddIcon /theme/icons/gif.png .gif
 359               AddIcon /theme/icons/h.png .h
 360               AddIcon /theme/icons/html.png .html .xhtml .shtml .htm .URL .url
 361               AddIcon /theme/icons/ico.png .ico
 362               AddIcon /theme/icons/java.png .jar
 363               AddIcon /theme/icons/jpg.png .jpg .jpeg .jpe
 364               AddIcon /theme/icons/js.png .js .json
 365               AddIcon /theme/icons/markdown.png .md
 366               AddIcon /theme/icons/package.png .pkg .dmg
 367               AddIcon /theme/icons/pdf.png .pdf
 368               AddIcon /theme/icons/php.png .php .phtml
 369               AddIcon /theme/icons/playlist.png .m3u .m3u8 .pls .pls8
 370               AddIcon /theme/icons/png.png .png
 371               AddIcon /theme/icons/ps.png .ps
 372               AddIcon /theme/icons/psd.png .psd
 373               AddIcon /theme/icons/py.png .py
 374               AddIcon /theme/icons/rar.png .rar
 375               AddIcon /theme/icons/rb.png .rb
 376               AddIcon /theme/icons/rpm.png .rpm
 377               AddIcon /theme/icons/rss.png .rss
 378               AddIcon /theme/icons/script.png .bat .cmd .sh
 379               AddIcon /theme/icons/sql.png .sql
 380               AddIcon /theme/icons/tiff.png .tiff .tif
 381               AddIcon /theme/icons/text.png .txt .nfo
 382               AddIcon /theme/icons/video.png .asf .asx .avi .flv .mkv .mov .mp4 .mpg .rm .srt .swf .vob .wmv .m4v .f4v .f4p .ogv
 383               AddIcon /theme/icons/xml.png .xml
 384               AddIcon /theme/icons/zip.png .zip
 385               DefaultIcon /theme/icons/default.png
 386
 387               HeaderName /theme/header.html
 388               ReadmeName /theme/footer.html
 389               IndexStyleSheet /theme/style.css
 390             </Directory>
 391           </Macro>
 392         '';
 393       };
 394       http2 = {
 395         modules = [ "http2" ];
 396         extraConfig = ''
 397           Protocols h2 http/1.1
 398         '';
 399       };
 400       customLog = {
 401         extraConfig = ''
 402           LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
 403         '';
 404       };
 405     };
 406
 407     system.activationScripts = {
 408       httpd = ''
 409         install -d -m 0755 /var/lib/acme/acme-challenge
 410         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 411         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
 412         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/tmp/adminer
 413         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
 414         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
 415         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/phpldapadmin
 416         '';
 417     };
 418
 419     system.extraSystemBuilderCmds = let
 420       adminer = pkgs.callPackage ./commons/adminer.nix {};
 421     in ''
 422       mkdir -p $out/webapps
 423       ln -s ${../../www} $out/webapps/_www
 424       ln -s ${./apache/theme} $out/webapps/_theme
 425       ln -s ${adminer.webRoot} $out/webapps/${adminer.apache.webappName}
 426       '';
 427
 428     services.myPhpfpm = {
 429       phpPackage = pkgs.php;
 430       phpOptions = ''
 431         session.save_path = "/var/lib/php/sessions"
 432         post_max_size = 20M
 433         ; 15 days (seconds)
 434         session.gc_maxlifetime = 1296000
 435         ; 30 days (minutes)
 436         session.cache_expire = 43200
 437         '';
 438       extraConfig = ''
 439         log_level = notice
 440         '';
 441     };
 442
 443     services.httpdProd = makeService "production" config.services.myWebsites.production;
 444     services.myWebsites.production.modules = makeModules cfg;
 445     services.myWebsites.production.extraConfig = makeExtraConfig cfg;
 446
 447     services.httpdInte = makeService "integration" config.services.myWebsites.integration;
 448     services.myWebsites.integration.modules = makeModules cfg;
 449     services.myWebsites.integration.extraConfig = makeExtraConfig cfg;
 450
 451     services.httpdTools = makeService "tools" config.services.myWebsites.tools;
 452     services.myWebsites.tools.modules = makeModules cfg;
 453     services.myWebsites.tools.extraConfig = makeExtraConfig cfg ++
 454     [ ''
 455         RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 456         RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 457         RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 458         RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 459         RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 460         RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 461       ''
 462       ]
 463     ;
 464   };
 465 }