nixops/modules/websites/default.nix

   1 { lib, pkgs, config,  myconfig, ... }:
   2 let
   3   cfg = config.services.myWebsites;
   4   www_root = "/run/current-system/webapps/_www";
   5   theme_root = "/run/current-system/webapps/_theme";
   6   makeService = name: cfg: let
   7     toVhost = vhostConf: {
   8       enableSSL = true;
   9       sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
  10       sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
  11       sslServerChain = "/var/lib/acme/${vhostConf.certName}/chain.pem";
  12       logFormat = "combinedVhost";
  13       listen = map (ip: { inherit ip; port = 443; }) cfg.ips;
  14       hostName = builtins.head vhostConf.hosts;
  15       serverAliases = builtins.tail vhostConf.hosts or [];
  16       documentRoot = vhostConf.root;
  17       extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
  18     };
  19     nosslVhost = {
  20       listen = map (ip: { inherit ip; port = 80; }) cfg.ips;
  21       hostName = "nossl.immae.eu";
  22       enableSSL = false;
  23       logFormat = "combinedVhost";
  24       documentRoot = www_root;
  25       extraConfig = ''
  26         <Directory ${www_root}>
  27           DirectoryIndex nossl.html
  28           AllowOverride None
  29           Require all granted
  30
  31           RewriteEngine on
  32           RewriteRule ^/(.+)   /   [L]
  33         </Directory>
  34         '';
  35     };
  36     redirectVhost = { # Should go last, catchall http -> https redirect
  37       listen = map (ip: { inherit ip; port = 80; }) cfg.ips;
  38       hostName = "redirectSSL";
  39       serverAliases = [ "*" ];
  40       enableSSL = false;
  41       logFormat = "combinedVhost";
  42       documentRoot = "/var/lib/acme/acme-challenge";
  43       extraConfig = ''
  44         RewriteEngine on
  45         RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
  46         RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
  47         # To redirect in specific "VirtualHost *:80", do
  48         #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
  49         # rather than rewrite
  50       '';
  51     };
  52     fallbackVhost = toVhost { # Should go first, default choice
  53       certName    = "eldiron";
  54       hosts       = ["eldiron.immae.eu" ];
  55       root        = www_root;
  56       extraConfig = [ "DirectoryIndex index.htm" ];
  57     };
  58   in rec {
  59     enable = true;
  60     listen = map (ip: { inherit ip; port = 443; }) cfg.ips;
  61     stateDir = "/run/httpd_${name}";
  62     logPerVirtualHost = true;
  63     multiProcessingModule = "worker";
  64     adminAddr = "httpd@immae.eu";
  65     logFormat = "combinedVhost";
  66     extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
  67     extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
  68     virtualHosts = [ fallbackVhost ]
  69       ++ lib.optionals (name == "tools") [ nosslVhost ]
  70       ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
  71       ++ [ redirectVhost ];
  72   };
  73   makeServiceOptions = name: {
  74     enable = lib.mkEnableOption "enable websites in ${name}";
  75     ips = lib.mkOption {
  76       type = lib.types.listOf lib.types.string;
  77       default = let
  78         ips = myconfig.env.servers.eldiron.ips.${name};
  79       in
  80         [ips.ip4] ++ (ips.ip6 or []);
  81       description = "${name} ips to listen to";
  82     };
  83     modules = lib.mkOption {
  84       type = lib.types.listOf (lib.types.str);
  85       default = [];
  86     };
  87     extraConfig = lib.mkOption {
  88       type = lib.types.listOf (lib.types.lines);
  89       default = [];
  90     };
  91     vhostConfs = lib.mkOption {
  92       type = lib.types.attrsOf (lib.types.submodule {
  93         options = {
  94           certName = lib.mkOption { type = lib.types.string; };
  95           hosts    = lib.mkOption { type = lib.types.listOf lib.types.string; };
  96           root     = lib.mkOption { type = lib.types.nullOr lib.types.path; };
  97           extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
  98         };
  99       });
 100     };
 101   };
 102   makeModules = cfg: pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
 103   makeExtraConfig = cfg: (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
 104 in
 105 {
 106   imports = [
 107     ./chloe
 108     ./ludivine
 109     ./aten
 110     ./piedsjaloux
 111     ./connexionswing
 112     ./tellesflorian
 113     ./emilia
 114     ./capitaines
 115     ./ftp/jerome.nix
 116     ./ftp/nassime.nix
 117     ./ftp/florian.nix
 118     ./ftp/denisejerome.nix
 119     ./ftp/leila.nix
 120     ./ftp/papa.nix
 121     ./ftp/immae.nix
 122     ./ftp/release.nix
 123     ./ftp/temp.nix
 124     ./tools/db.nix
 125     ./tools/tools
 126     ./tools/dav
 127     ./tools/cloud.nix
 128     ./tools/git
 129     ./tools/mastodon.nix
 130     ./tools/mediagoblin.nix
 131     ./tools/diaspora.nix
 132     ./tools/ether.nix
 133     ./tools/peertube.nix
 134     # built using:
 135     # sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
 136     # Removed allGranted
 137     # And removed users / groups
 138     ./apache/httpd_prod.nix
 139     ./apache/httpd_inte.nix
 140     # except for this one for users/groups
 141     ./apache/httpd_tools.nix
 142     # Adapted from base phpfpm
 143     ./phpfpm
 144   ];
 145
 146   options.services.myWebsites = {
 147     production = makeServiceOptions "production";
 148     integration = makeServiceOptions "integration";
 149     tools = makeServiceOptions "main";
 150
 151     apacheConfig = lib.mkOption {
 152       type = lib.types.attrsOf (lib.types.submodule {
 153         options = {
 154           modules = lib.mkOption {
 155             type = lib.types.listOf (lib.types.str);
 156             default = [];
 157           };
 158           extraConfig = lib.mkOption {
 159             type = lib.types.nullOr lib.types.lines;
 160             default = null;
 161           };
 162         };
 163       });
 164       default = {};
 165       description = "Extra global config";
 166     };
 167
 168   };
 169
 170   config = {
 171     users.users.wwwrun.extraGroups = [ "keys" ];
 172     networking.firewall.allowedTCPPorts = [ 80 443 ];
 173
 174     nixpkgs.overlays = [ (self: super: rec {
 175       #openssl = self.openssl_1_1;
 176       php = php72;
 177       php72 = (super.php72.override {
 178         mysql.connector-c = self.mariadb;
 179         config.php.mysqlnd = false;
 180         config.php.mysqli = false;
 181       }).overrideAttrs(old: rec {
 182         # Didn't manage to build with mysqli + mysql_config connector
 183         configureFlags = old.configureFlags ++ [
 184           "--with-mysqli=shared,mysqlnd"
 185           ];
 186         # preConfigure = (old.preConfigure or "") + ''
 187         #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
 188         #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
 189         #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
 190         #   '';
 191       });
 192       phpPackages = super.php72Packages.override { inherit php; };
 193     }) ];
 194
 195     services.myWebsites.tools.databases.enable = true;
 196     services.myWebsites.tools.tools.enable = true;
 197     services.myWebsites.tools.dav.enable = true;
 198     services.myWebsites.tools.cloud.enable = true;
 199     services.myWebsites.tools.git.enable = true;
 200     services.myWebsites.tools.mastodon.enable = true;
 201     services.myWebsites.tools.mediagoblin.enable = true;
 202     services.myWebsites.tools.diaspora.enable = true;
 203     services.myWebsites.tools.etherpad-lite.enable = true;
 204     services.myWebsites.tools.peertube.enable = true;
 205
 206     services.myWebsites.Chloe.production.enable = cfg.production.enable;
 207     services.myWebsites.Ludivine.production.enable = cfg.production.enable;
 208     services.myWebsites.Aten.production.enable = cfg.production.enable;
 209     services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
 210     services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
 211     services.myWebsites.Jerome.production.enable = cfg.production.enable;
 212     services.myWebsites.Nassime.production.enable = cfg.production.enable;
 213     services.myWebsites.Florian.production.enable = cfg.production.enable;
 214     services.myWebsites.Leila.production.enable = cfg.production.enable;
 215     services.myWebsites.Papa.production.enable = cfg.production.enable;
 216     services.myWebsites.DeniseJerome.production.enable = cfg.production.enable;
 217     services.myWebsites.Emilia.production.enable = cfg.production.enable;
 218     services.myWebsites.Capitaines.production.enable = cfg.production.enable;
 219     services.myWebsites.Immae.production.enable = cfg.production.enable;
 220     services.myWebsites.Release.production.enable = cfg.production.enable;
 221     services.myWebsites.Temp.production.enable = cfg.production.enable;
 222
 223     services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
 224     services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
 225     services.myWebsites.Aten.integration.enable = cfg.integration.enable;
 226     services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
 227     services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
 228     services.myWebsites.TellesFlorian.integration.enable = true;
 229     services.myWebsites.Florian.integration.enable = true;
 230
 231     secrets.keys = [{
 232       dest = "apache-ldap";
 233       user = "wwwrun";
 234       group = "wwwrun";
 235       permissions = "0400";
 236       text = ''
 237         <Macro LDAPConnect>
 238           <IfModule authnz_ldap_module>
 239             AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 240             AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 241             AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
 242             AuthType             Basic
 243             AuthName             "Authentification requise (Acces LDAP)"
 244             AuthBasicProvider    ldap
 245           </IfModule>
 246         </Macro>
 247         '';
 248     }];
 249
 250     services.myWebsites.apacheConfig = {
 251       gzip = {
 252         modules = [ "deflate" "filter" ];
 253         extraConfig = ''
 254           AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
 255         '';
 256       };
 257       macros = {
 258         modules = [ "macro" ];
 259       };
 260       stats = {
 261         extraConfig = ''
 262           <Macro Stats %{domain}>
 263             Alias /webstats ${config.services.webstats.dataDir}/%{domain}
 264             <Directory ${config.services.webstats.dataDir}/%{domain}>
 265               DirectoryIndex index.html
 266               AllowOverride None
 267               Require all granted
 268             </Directory>
 269             <Location /webstats>
 270               Use LDAPConnect
 271               Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
 272             </Location>
 273           </Macro>
 274         '';
 275       };
 276       ldap = {
 277         modules = [ "ldap" "authnz_ldap" ];
 278         extraConfig = ''
 279           <IfModule ldap_module>
 280             LDAPSharedCacheSize 500000
 281             LDAPCacheEntries 1024
 282             LDAPCacheTTL 600
 283             LDAPOpCacheEntries 1024
 284             LDAPOpCacheTTL 600
 285           </IfModule>
 286
 287           Include /var/secrets/apache-ldap
 288         '';
 289       };
 290       global = {
 291         extraConfig = ''
 292           ErrorDocument 500 /maintenance_immae.html
 293           ErrorDocument 501 /maintenance_immae.html
 294           ErrorDocument 502 /maintenance_immae.html
 295           ErrorDocument 503 /maintenance_immae.html
 296           ErrorDocument 504 /maintenance_immae.html
 297           Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
 298           ProxyPass /maintenance_immae.html !
 299
 300           AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
 301           <Directory ${www_root}>
 302             AllowOverride None
 303             Require all granted
 304           </Directory>
 305         '';
 306       };
 307       apaxy = {
 308         extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
 309       };
 310       http2 = {
 311         modules = [ "http2" ];
 312         extraConfig = ''
 313           Protocols h2 http/1.1
 314         '';
 315       };
 316       customLog = {
 317         extraConfig = ''
 318           LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
 319         '';
 320       };
 321     };
 322
 323     system.activationScripts = {
 324       httpd = ''
 325         install -d -m 0755 /var/lib/acme/acme-challenge
 326         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 327         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
 328         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/tmp/adminer
 329         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
 330         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
 331         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/phpldapadmin
 332         '';
 333     };
 334
 335     system.extraSystemBuilderCmds = let
 336       adminer = pkgs.callPackage ./commons/adminer.nix {};
 337     in ''
 338       mkdir -p $out/webapps
 339       ln -s ${../../www} $out/webapps/_www
 340       ln -s ${pkgs.webapps.apache-theme.theme} $out/webapps/_theme
 341       ln -s ${adminer.webRoot} $out/webapps/${adminer.apache.webappName}
 342       '';
 343
 344     services.myPhpfpm = {
 345       phpPackage = pkgs.php;
 346       phpOptions = ''
 347         session.save_path = "/var/lib/php/sessions"
 348         post_max_size = 20M
 349         ; 15 days (seconds)
 350         session.gc_maxlifetime = 1296000
 351         ; 30 days (minutes)
 352         session.cache_expire = 43200
 353         '';
 354       extraConfig = ''
 355         log_level = notice
 356         '';
 357     };
 358
 359     services.httpdProd = makeService "production" config.services.myWebsites.production;
 360     services.myWebsites.production.modules = makeModules cfg;
 361     services.myWebsites.production.extraConfig = makeExtraConfig cfg;
 362
 363     services.httpdInte = makeService "integration" config.services.myWebsites.integration;
 364     services.myWebsites.integration.modules = makeModules cfg;
 365     services.myWebsites.integration.extraConfig = makeExtraConfig cfg;
 366
 367     services.httpdTools = makeService "tools" config.services.myWebsites.tools;
 368     services.myWebsites.tools.modules = makeModules cfg;
 369     services.myWebsites.tools.extraConfig = makeExtraConfig cfg ++
 370     [ ''
 371         RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 372         RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 373         RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 374         RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 375         RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 376         RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 377       ''
 378       ]
 379     ;
 380   };
 381 }