nixops/modules/websites/default.nix

   1 { lib, pkgs, config, mylibs, myconfig, ... }:
   2 let
   3   cfg = config.services.myWebsites;
   4   www_root = "/run/current-system/webapps/_www";
   5   theme_root = "/run/current-system/webapps/_theme";
   6   makeService = name: cfg: let
   7     toVhost = vhostConf: {
   8       enableSSL = true;
   9       sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
  10       sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
  11       sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem";
  12       logFormat = "combinedVhost";
  13       listen = map (ip: { inherit ip; port = 443; }) cfg.ips;
  14       hostName = builtins.head vhostConf.hosts;
  15       serverAliases = builtins.tail vhostConf.hosts or [];
  16       documentRoot = vhostConf.root;
  17       extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
  18     };
  19     nosslVhost = {
  20       listen = map (ip: { inherit ip; port = 80; }) cfg.ips;
  21       hostName = "nossl.immae.eu";
  22       enableSSL = false;
  23       logFormat = "combinedVhost";
  24       documentRoot = www_root;
  25       extraConfig = ''
  26         <Directory ${www_root}>
  27           DirectoryIndex nossl.html
  28           AllowOverride None
  29           Require all granted
  30
  31           RewriteEngine on
  32           RewriteRule ^/(.+)   /   [L]
  33         </Directory>
  34         '';
  35     };
  36     redirectVhost = { # Should go last, catchall http -> https redirect
  37       listen = map (ip: { inherit ip; port = 80; }) cfg.ips;
  38       hostName = "redirectSSL";
  39       serverAliases = [ "*" ];
  40       enableSSL = false;
  41       logFormat = "combinedVhost";
  42       documentRoot = "/var/lib/acme/acme-challenge";
  43       extraConfig = ''
  44         RewriteEngine on
  45         RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
  46         RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
  47         # To redirect in specific "VirtualHost *:80", do
  48         #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
  49         # rather than rewrite
  50       '';
  51     };
  52     fallbackVhost = toVhost { # Should go first, default choice
  53       certName    = "eldiron";
  54       hosts       = ["eldiron.immae.eu" ];
  55       root        = www_root;
  56       extraConfig = [ "DirectoryIndex index.htm" ];
  57     };
  58   in rec {
  59     enable = true;
  60     listen = map (ip: { inherit ip; port = 443; }) cfg.ips;
  61     stateDir = "/run/httpd_${name}";
  62     logPerVirtualHost = true;
  63     multiProcessingModule = "worker";
  64     adminAddr = "httpd@immae.eu";
  65     logFormat = "combinedVhost";
  66     extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
  67     extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
  68     virtualHosts = [ fallbackVhost ]
  69       ++ lib.optionals (name == "tools") [ nosslVhost ]
  70       ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
  71       ++ [ redirectVhost ];
  72   };
  73   makeServiceOptions = name: {
  74     enable = lib.mkEnableOption "enable websites in ${name}";
  75     ips = lib.mkOption {
  76       type = lib.types.listOf lib.types.string;
  77       default = let
  78         ips = myconfig.env.servers.eldiron.ips.${name};
  79       in
  80         [ips.ip4] ++ (ips.ip6 or []);
  81       description = "${name} ips to listen to";
  82     };
  83     modules = lib.mkOption {
  84       type = lib.types.listOf (lib.types.str);
  85       default = [];
  86     };
  87     extraConfig = lib.mkOption {
  88       type = lib.types.listOf (lib.types.lines);
  89       default = [];
  90     };
  91     vhostConfs = lib.mkOption {
  92       type = lib.types.attrsOf (lib.types.submodule {
  93         options = {
  94           certName = lib.mkOption { type = lib.types.string; };
  95           hosts    = lib.mkOption { type = lib.types.listOf lib.types.string; };
  96           root     = lib.mkOption { type = lib.types.nullOr lib.types.path; };
  97           extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
  98         };
  99       });
 100     };
 101   };
 102   makeModules = cfg: pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
 103   makeExtraConfig = cfg: (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
 104 in
 105 {
 106   imports = [
 107     ./chloe
 108     ./ludivine
 109     ./aten
 110     ./piedsjaloux
 111     ./connexionswing
 112     ./tellesflorian
 113     ./emilia
 114     ./capitaines
 115     ./ftp/jerome.nix
 116     ./ftp/nassime.nix
 117     ./ftp/florian.nix
 118     ./ftp/denisejerome.nix
 119     ./ftp/leila.nix
 120     ./ftp/immae.nix
 121     ./ftp/release.nix
 122     ./ftp/temp.nix
 123     ./tools/db
 124     ./tools/tools
 125     ./tools/dav
 126     ./tools/cloud
 127     ./tools/git
 128     ./tools/mastodon
 129     ./tools/mediagoblin
 130     ./tools/diaspora
 131     ./tools/ether
 132     ./tools/peertube
 133     # built using:
 134     # sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
 135     # Removed allGranted
 136     # And removed users / groups
 137     ./apache/httpd_prod.nix
 138     ./apache/httpd_inte.nix
 139     # except for this one for users/groups
 140     ./apache/httpd_tools.nix
 141     # Adapted from base phpfpm
 142     ./phpfpm
 143   ];
 144
 145   options.services.myWebsites = {
 146     production = makeServiceOptions "production";
 147     integration = makeServiceOptions "integration";
 148     tools = makeServiceOptions "main";
 149
 150     apacheConfig = lib.mkOption {
 151       type = lib.types.attrsOf (lib.types.submodule {
 152         options = {
 153           modules = lib.mkOption {
 154             type = lib.types.listOf (lib.types.str);
 155             default = [];
 156           };
 157           extraConfig = lib.mkOption {
 158             type = lib.types.nullOr lib.types.lines;
 159             default = null;
 160           };
 161         };
 162       });
 163       default = {};
 164       description = "Extra global config";
 165     };
 166
 167   };
 168
 169   config = {
 170     networking.firewall.allowedTCPPorts = [ 80 443 ];
 171
 172     nixpkgs.overlays = [ (self: super: rec {
 173       php = php72;
 174       php72 = (super.php72.override {
 175         mysql.connector-c = self.mariadb;
 176         config.php.mysqlnd = false;
 177         config.php.mysqli = false;
 178       }).overrideAttrs(old: rec {
 179         # Didn't manage to build with mysqli + mysql_config connector
 180         configureFlags = old.configureFlags ++ [
 181           "--with-mysqli=shared,mysqlnd"
 182           ];
 183         # preConfigure = (old.preConfigure or "") + ''
 184         #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
 185         #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
 186         #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
 187         #   '';
 188       });
 189       phpPackages = super.php72Packages.override { inherit php; };
 190       composerEnv = import ./commons/composer-env.nix {
 191         inherit (self) stdenv writeTextFile fetchurl php unzip;
 192       };
 193     }) ];
 194
 195     services.myWebsites.tools.databases.enable = true;
 196     services.myWebsites.tools.tools.enable = true;
 197     services.myWebsites.tools.dav.enable = true;
 198     services.myWebsites.tools.cloud.enable = true;
 199     services.myWebsites.tools.git.enable = true;
 200     services.myWebsites.tools.mastodon.enable = true;
 201     services.myWebsites.tools.mediagoblin.enable = true;
 202     services.myWebsites.tools.diaspora.enable = true;
 203     services.myWebsites.tools.etherpad-lite.enable = true;
 204     services.myWebsites.tools.peertube.enable = true;
 205
 206     services.myWebsites.Chloe.production.enable = cfg.production.enable;
 207     services.myWebsites.Ludivine.production.enable = cfg.production.enable;
 208     services.myWebsites.Aten.production.enable = cfg.production.enable;
 209     services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
 210     services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
 211     services.myWebsites.Jerome.production.enable = cfg.production.enable;
 212     services.myWebsites.Nassime.production.enable = cfg.production.enable;
 213     services.myWebsites.Florian.production.enable = cfg.production.enable;
 214     services.myWebsites.Leila.production.enable = cfg.production.enable;
 215     services.myWebsites.DeniseJerome.production.enable = cfg.production.enable;
 216     services.myWebsites.Emilia.production.enable = cfg.production.enable;
 217     services.myWebsites.Capitaines.production.enable = cfg.production.enable;
 218     services.myWebsites.Immae.production.enable = cfg.production.enable;
 219     services.myWebsites.Release.production.enable = cfg.production.enable;
 220     services.myWebsites.Temp.production.enable = cfg.production.enable;
 221
 222     services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
 223     services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
 224     services.myWebsites.Aten.integration.enable = cfg.integration.enable;
 225     services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
 226     services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
 227     services.myWebsites.TellesFlorian.integration.enable = true;
 228     services.myWebsites.Florian.integration.enable = true;
 229
 230     services.myWebsites.apacheConfig = {
 231       gzip = {
 232         modules = [ "deflate" "filter" ];
 233         extraConfig = ''
 234           AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
 235         '';
 236       };
 237       macros = {
 238         modules = [ "macro" ];
 239       };
 240       stats = {
 241         extraConfig = ''
 242           <Macro Stats %{domain}>
 243             Alias /awstats /var/lib/goaccess/%{domain}
 244             <Directory /var/lib/goaccess/%{domain}>
 245               DirectoryIndex index.html
 246               AllowOverride None
 247               Require all granted
 248             </Directory>
 249             <Location /awstats>
 250               Use LDAPConnect
 251               Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
 252             </Location>
 253           </Macro>
 254         '';
 255       };
 256       ldap = {
 257         modules = [ "ldap" "authnz_ldap" ];
 258         extraConfig = ''
 259           <IfModule ldap_module>
 260             LDAPSharedCacheSize 500000
 261             LDAPCacheEntries 1024
 262             LDAPCacheTTL 600
 263             LDAPOpCacheEntries 1024
 264             LDAPOpCacheTTL 600
 265           </IfModule>
 266
 267           <Macro LDAPConnect>
 268             <IfModule authnz_ldap_module>
 269               AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 270               AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 271               AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
 272               AuthType             Basic
 273               AuthName             "Authentification requise (Acces LDAP)"
 274               AuthBasicProvider    ldap
 275             </IfModule>
 276           </Macro>
 277         '';
 278       };
 279       global = {
 280         extraConfig = ''
 281           ErrorDocument 500 /maintenance_immae.html
 282           ErrorDocument 501 /maintenance_immae.html
 283           ErrorDocument 502 /maintenance_immae.html
 284           ErrorDocument 503 /maintenance_immae.html
 285           ErrorDocument 504 /maintenance_immae.html
 286           Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
 287           ProxyPass /maintenance_immae.html !
 288
 289           AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
 290           <Directory ${www_root}>
 291             AllowOverride None
 292             Require all granted
 293           </Directory>
 294         '';
 295       };
 296       apaxy = {
 297         extraConfig = ''
 298           <Macro Apaxy %{folder} %{ignored}>
 299             Alias /theme ${theme_root}
 300             <Directory ${theme_root}>
 301               Options -Indexes
 302               AllowOverride None
 303               Require all granted
 304             </Directory>
 305
 306             # mod_autoindex
 307             <Directory %{folder}>
 308               Options Indexes
 309               AllowOverride None
 310               Require all granted
 311
 312               # Inspired from Apaxy by @adamwhitcroft
 313
 314               IndexOptions +Charset=UTF-8 +FancyIndexing +IgnoreCase +FoldersFirst +XHTML +HTMLTable +SuppressRules +SuppressDescription +NameWidth=* +IconsAreLinks +ShowForbidden
 315
 316               IndexHeadInsert "<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\" />"
 317
 318               IndexIgnoreReset ON
 319               IndexIgnore /theme .htaccess %{ignored}
 320
 321               AddIcon /theme/icons/blank.png ^^BLANKICON^^
 322               AddIcon /theme/icons/folder.png ^^DIRECTORY^^
 323               AddIcon /theme/icons/folder-home.png ..
 324
 325               AddIconByType (TXT,/theme/icons/text.png) text/*
 326               AddIconByType (IMG,/theme/icons/image.png) image/*
 327               AddIconByType (SND,/theme/icons/audio.png) audio/*
 328               AddIconByType (VID,/theme/icons/video.png) video/*
 329
 330               AddIcon /theme/icons/archive.png .7z .bz2 .cab .gz .tar
 331               AddIcon /theme/icons/audio.png .aac .aif .aifc .aiff .ape .au .flac .iff .m4a .mid .mp3 .mpa .ra .wav .wma .f4a .f4b .oga .ogg .xm .it .s3m .mod
 332               AddIcon /theme/icons/bin.png .bin .hex
 333               AddIcon /theme/icons/bmp.png .bmp
 334               AddIcon /theme/icons/c.png .c
 335               AddIcon /theme/icons/calc.png .xlsx .xlsm .xltx .xltm .xlam .xlr .xls .csv
 336               AddIcon /theme/icons/cd.png .iso
 337               AddIcon /theme/icons/cpp.png .cpp
 338               AddIcon /theme/icons/css.png .css .sass .scss
 339               AddIcon /theme/icons/deb.png .deb
 340               AddIcon /theme/icons/doc.png .doc .docx .docm .dot .dotx .dotm .log .msg .odt .pages .rtf .tex .wpd .wps
 341               AddIcon /theme/icons/draw.png .svg .svgz
 342               AddIcon /theme/icons/eps.png .ai .eps
 343               AddIcon /theme/icons/exe.png .exe
 344               AddIcon /theme/icons/gif.png .gif
 345               AddIcon /theme/icons/h.png .h
 346               AddIcon /theme/icons/html.png .html .xhtml .shtml .htm .URL .url
 347               AddIcon /theme/icons/ico.png .ico
 348               AddIcon /theme/icons/java.png .jar
 349               AddIcon /theme/icons/jpg.png .jpg .jpeg .jpe
 350               AddIcon /theme/icons/js.png .js .json
 351               AddIcon /theme/icons/markdown.png .md
 352               AddIcon /theme/icons/package.png .pkg .dmg
 353               AddIcon /theme/icons/pdf.png .pdf
 354               AddIcon /theme/icons/php.png .php .phtml
 355               AddIcon /theme/icons/playlist.png .m3u .m3u8 .pls .pls8
 356               AddIcon /theme/icons/png.png .png
 357               AddIcon /theme/icons/ps.png .ps
 358               AddIcon /theme/icons/psd.png .psd
 359               AddIcon /theme/icons/py.png .py
 360               AddIcon /theme/icons/rar.png .rar
 361               AddIcon /theme/icons/rb.png .rb
 362               AddIcon /theme/icons/rpm.png .rpm
 363               AddIcon /theme/icons/rss.png .rss
 364               AddIcon /theme/icons/script.png .bat .cmd .sh
 365               AddIcon /theme/icons/sql.png .sql
 366               AddIcon /theme/icons/tiff.png .tiff .tif
 367               AddIcon /theme/icons/text.png .txt .nfo
 368               AddIcon /theme/icons/video.png .asf .asx .avi .flv .mkv .mov .mp4 .mpg .rm .srt .swf .vob .wmv .m4v .f4v .f4p .ogv
 369               AddIcon /theme/icons/xml.png .xml
 370               AddIcon /theme/icons/zip.png .zip
 371               DefaultIcon /theme/icons/default.png
 372
 373               HeaderName /theme/header.html
 374               ReadmeName /theme/footer.html
 375               IndexStyleSheet /theme/style.css
 376             </Directory>
 377           </Macro>
 378         '';
 379       };
 380       http2 = {
 381         modules = [ "http2" ];
 382         extraConfig = ''
 383           Protocols h2 http/1.1
 384         '';
 385       };
 386       customLog = {
 387         extraConfig = ''
 388           LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
 389         '';
 390       };
 391     };
 392
 393     system.activationScripts = {
 394       httpd = ''
 395         install -d -m 0755 /var/lib/acme/acme-challenge
 396         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 397         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
 398         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
 399         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
 400         '';
 401     };
 402
 403     system.extraSystemBuilderCmds = let
 404       adminer = pkgs.callPackage ./commons/adminer.nix {};
 405     in ''
 406       mkdir -p $out/webapps
 407       ln -s ${../../www} $out/webapps/_www
 408       ln -s ${./apache/theme} $out/webapps/_theme
 409       ln -s ${adminer.webRoot} $out/webapps/${adminer.apache.webappName}
 410       '';
 411
 412     services.myPhpfpm = {
 413       phpPackage = pkgs.php;
 414       phpOptions = ''
 415         session.save_path = "/var/lib/php/sessions"
 416         post_max_size = 20M
 417         session.gc_maxlifetime = 60*60*24*15
 418         session.cache_expire = 60*24*30
 419         '';
 420       extraConfig = ''
 421         log_level = notice
 422         '';
 423     };
 424
 425     services.httpdProd = makeService "production" config.services.myWebsites.production;
 426     services.myWebsites.production.modules = makeModules cfg;
 427     services.myWebsites.production.extraConfig = makeExtraConfig cfg;
 428
 429     services.httpdInte = makeService "integration" config.services.myWebsites.integration;
 430     services.myWebsites.integration.modules = makeModules cfg;
 431     services.myWebsites.integration.extraConfig = makeExtraConfig cfg;
 432
 433     services.httpdTools = makeService "tools" config.services.myWebsites.tools;
 434     services.myWebsites.tools.modules = makeModules cfg;
 435     services.myWebsites.tools.extraConfig = makeExtraConfig cfg ++
 436     [ ''
 437         RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 438         RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 439         RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 440         RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 441         RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 442         RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 443       ''
 444       ]
 445     ;
 446   };
 447 }