]> git.immae.eu Git - perso/Immae/Config/Nix.git/blob - nixops/modules/websites/tools/tools/default.nix
Pre-generate certificates with acme
[perso/Immae/Config/Nix.git] / nixops / modules / websites / tools / tools / default.nix
1 { lib, pkgs, config, myconfig, ... }:
2 let
3 adminer = pkgs.callPackage ../../commons/adminer.nix {};
4 ympd = pkgs.callPackage ./ympd.nix {
5 env = myconfig.env.tools.ympd;
6 };
7 ttrss = pkgs.callPackage ./ttrss.nix {
8 inherit (pkgs.webapps) ttrss ttrss-plugins;
9 env = myconfig.env.tools.ttrss;
10 };
11 roundcubemail = pkgs.callPackage ./roundcubemail.nix {
12 inherit (pkgs.webapps) roundcubemail roundcubemail-plugins roundcubemail-skins;
13 env = myconfig.env.tools.roundcubemail;
14 };
15 rainloop = pkgs.callPackage ./rainloop.nix {};
16 kanboard = pkgs.callPackage ./kanboard.nix {
17 env = myconfig.env.tools.kanboard;
18 };
19 wallabag = pkgs.callPackage ./wallabag.nix {
20 inherit (pkgs.webapps) wallabag;
21 env = myconfig.env.tools.wallabag;
22 };
23 yourls = pkgs.callPackage ./yourls.nix {
24 inherit (pkgs.webapps) yourls yourls-plugins;
25 env = myconfig.env.tools.yourls;
26 };
27 rompr = pkgs.callPackage ./rompr.nix {
28 inherit (pkgs.webapps) rompr;
29 env = myconfig.env.tools.rompr;
30 };
31 shaarli = pkgs.callPackage ./shaarli.nix {
32 env = myconfig.env.tools.shaarli;
33 };
34 dokuwiki = pkgs.callPackage ./dokuwiki.nix {
35 inherit (pkgs.webapps) dokuwiki dokuwiki-plugins;
36 };
37 ldap = pkgs.callPackage ./ldap.nix {
38 inherit (pkgs.webapps) phpldapadmin;
39 env = myconfig.env.tools.phpldapadmin;
40 };
41
42 cfg = config.services.myWebsites.tools.tools;
43 in {
44 options.services.myWebsites.tools.tools = {
45 enable = lib.mkEnableOption "enable tools website";
46 };
47
48 config = lib.mkIf cfg.enable {
49 security.acme.certs."eldiron".extraDomains."tools.immae.eu" = null;
50 security.acme.certs."eldiron".extraDomains."devtools.immae.eu" = null;
51
52 secrets.keys =
53 kanboard.keys
54 ++ ldap.keys
55 ++ roundcubemail.keys
56 ++ shaarli.keys
57 ++ ttrss.keys
58 ++ wallabag.keys
59 ++ yourls.keys;
60
61 services.myWebsites.integration.modules =
62 rainloop.apache.modules;
63
64 services.myWebsites.tools.modules =
65 [ "proxy_fcgi" ]
66 ++ adminer.apache.modules
67 ++ ympd.apache.modules
68 ++ ttrss.apache.modules
69 ++ roundcubemail.apache.modules
70 ++ wallabag.apache.modules
71 ++ yourls.apache.modules
72 ++ rompr.apache.modules
73 ++ shaarli.apache.modules
74 ++ dokuwiki.apache.modules
75 ++ ldap.apache.modules
76 ++ kanboard.apache.modules;
77
78 systemd.services.ympd = {
79 description = "Standalone MPD Web GUI written in C";
80 wantedBy = [ "multi-user.target" ];
81 script = ''
82 export MPD_PASSWORD=$(cat /var/secrets/mpd)
83 ${pkgs.ympd}/bin/ympd --host ${ympd.config.host} --port ${toString ympd.config.port} --webport ${ympd.config.webPort} --user nobody
84 '';
85 };
86
87 services.myWebsites.integration.vhostConfs.devtools = {
88 certName = "eldiron";
89 hosts = ["devtools.immae.eu" ];
90 root = "/var/lib/ftp/devtools.immae.eu";
91 extraConfig = [
92 ''
93 <Directory "/var/lib/ftp/devtools.immae.eu">
94 DirectoryIndex index.php index.htm index.html
95 AllowOverride all
96 Require all granted
97 <FilesMatch "\.php$">
98 SetHandler "proxy:unix:/var/run/phpfpm/devtools.sock|fcgi://localhost"
99 </FilesMatch>
100 </Directory>
101 ''
102 rainloop.apache.vhostConf
103 ];
104 };
105
106 services.myWebsites.tools.vhostConfs.tools = {
107 certName = "eldiron";
108 hosts = ["tools.immae.eu" ];
109 root = "/var/lib/ftp/tools.immae.eu";
110 extraConfig = [
111 ''
112 <Directory "/var/lib/ftp/tools.immae.eu">
113 DirectoryIndex index.php index.htm index.html
114 AllowOverride all
115 Require all granted
116 <FilesMatch "\.php$">
117 SetHandler "proxy:unix:/var/run/phpfpm/tools.sock|fcgi://localhost"
118 </FilesMatch>
119 </Directory>
120 ''
121 adminer.apache.vhostConf
122 ympd.apache.vhostConf
123 ttrss.apache.vhostConf
124 roundcubemail.apache.vhostConf
125 wallabag.apache.vhostConf
126 yourls.apache.vhostConf
127 rompr.apache.vhostConf
128 shaarli.apache.vhostConf
129 dokuwiki.apache.vhostConf
130 ldap.apache.vhostConf
131 kanboard.apache.vhostConf
132 ];
133 };
134
135 security.acme.certs."eldiron".extraDomains."outils.immae.eu" = null;
136 services.myWebsites.tools.vhostConfs.outils = {
137 certName = "eldiron";
138 hosts = [ "outils.immae.eu" ];
139 root = null;
140 extraConfig = [
141 ''
142 RedirectMatch 301 ^/mediagoblin(.*)$ https://mgoblin.immae.eu$1
143
144 RedirectMatch 301 ^/ether(.*)$ https://ether.immae.eu$1
145
146 RedirectMatch 301 ^/nextcloud(.*)$ https://cloud.immae.eu$1
147 RedirectMatch 301 ^/owncloud(.*)$ https://cloud.immae.eu$1
148
149 RedirectMatch 301 ^/carddavmate(.*)$ https://dav.immae.eu/infcloud$1
150 RedirectMatch 301 ^/caldavzap(.*)$ https://dav.immae.eu/infcloud$1
151 RedirectMatch 301 ^/caldav.php(.*)$ https://dav.immae.eu/caldav.php$1
152 RedirectMatch 301 ^/davical(.*)$ https://dav.immae.eu/davical$1
153
154 RedirectMatch 301 ^/taskweb(.*)$ https://task.immae.eu/taskweb$1
155
156 RedirectMatch 301 ^/(.*)$ https://tools.immae.eu/$1
157 ''
158 ];
159 };
160
161 services.myPhpfpm.serviceDependencies = {
162 dokuwiki = dokuwiki.phpFpm.serviceDeps;
163 kanboard = kanboard.phpFpm.serviceDeps;
164 ldap = ldap.phpFpm.serviceDeps;
165 rainloop = rainloop.phpFpm.serviceDeps;
166 roundcubemail = roundcubemail.phpFpm.serviceDeps;
167 shaarli = shaarli.phpFpm.serviceDeps;
168 ttrss = ttrss.phpFpm.serviceDeps;
169 wallabag = wallabag.phpFpm.serviceDeps;
170 yourls = yourls.phpFpm.serviceDeps;
171 };
172
173 services.myPhpfpm.poolPhpConfigs = {
174 devtools = ''
175 extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
176 extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
177 zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
178 '';
179 roundcubemail = roundcubemail.phpFpm.phpConfig;
180 };
181 services.myPhpfpm.preStart = {
182 wallabag = wallabag.phpFpm.preStart;
183 };
184 services.myPhpfpm.poolConfigs = {
185 adminer = adminer.phpFpm.pool;
186 ttrss = ttrss.phpFpm.pool;
187 roundcubemail = roundcubemail.phpFpm.pool;
188 wallabag = wallabag.phpFpm.pool;
189 yourls = yourls.phpFpm.pool;
190 rompr = rompr.phpFpm.pool;
191 shaarli = shaarli.phpFpm.pool;
192 dokuwiki = dokuwiki.phpFpm.pool;
193 ldap = ldap.phpFpm.pool;
194 rainloop = rainloop.phpFpm.pool;
195 kanboard = kanboard.phpFpm.pool;
196 devtools = ''
197 listen = /var/run/phpfpm/devtools.sock
198 user = wwwrun
199 group = wwwrun
200 listen.owner = wwwrun
201 listen.group = wwwrun
202 pm = dynamic
203 pm.max_children = 60
204 pm.start_servers = 2
205 pm.min_spare_servers = 1
206 pm.max_spare_servers = 10
207
208 php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp"
209 '';
210 tools = ''
211 listen = /var/run/phpfpm/tools.sock
212 user = wwwrun
213 group = wwwrun
214 listen.owner = wwwrun
215 listen.group = wwwrun
216 pm = dynamic
217 pm.max_children = 60
218 pm.start_servers = 2
219 pm.min_spare_servers = 1
220 pm.max_spare_servers = 10
221
222 ; Needed to avoid clashes in browser cookies (same domain)
223 php_value[session.name] = ToolsPHPSESSID
224 php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/tools.immae.eu:/tmp"
225 '';
226 };
227
228 system.activationScripts = {
229 ttrss = ttrss.activationScript;
230 roundcubemail = roundcubemail.activationScript;
231 wallabag = wallabag.activationScript;
232 yourls = yourls.activationScript;
233 rompr = rompr.activationScript;
234 shaarli = shaarli.activationScript;
235 dokuwiki = dokuwiki.activationScript;
236 rainloop = rainloop.activationScript;
237 kanboard = kanboard.activationScript;
238 };
239
240 system.extraSystemBuilderCmds = ''
241 mkdir -p $out/webapps
242 ln -s ${dokuwiki.webRoot} $out/webapps/${dokuwiki.apache.webappName}
243 ln -s ${ldap.webRoot}/htdocs $out/webapps/${ldap.apache.webappName}
244 ln -s ${rompr.webRoot} $out/webapps/${rompr.apache.webappName}
245 ln -s ${roundcubemail.webRoot} $out/webapps/${roundcubemail.apache.webappName}
246 ln -s ${shaarli.webRoot} $out/webapps/${shaarli.apache.webappName}
247 ln -s ${ttrss.webRoot} $out/webapps/${ttrss.apache.webappName}
248 ln -s ${wallabag.webRoot} $out/webapps/${wallabag.apache.webappName}
249 ln -s ${yourls.webRoot} $out/webapps/${yourls.apache.webappName}
250 ln -s ${rainloop.webRoot} $out/webapps/${rainloop.apache.webappName}
251 ln -s ${kanboard.webRoot} $out/webapps/${kanboard.apache.webappName}
252 '';
253
254 systemd.services.tt-rss = {
255 description = "Tiny Tiny RSS feeds update daemon";
256 serviceConfig = {
257 User = "wwwrun";
258 ExecStart = "${pkgs.php}/bin/php ${ttrss.webRoot}/update.php --daemon";
259 StandardOutput = "syslog";
260 StandardError = "syslog";
261 PermissionsStartOnly = true;
262 };
263
264 wantedBy = [ "multi-user.target" ];
265 requires = ["postgresql.service"];
266 after = ["network.target" "postgresql.service"];
267 };
268
269 };
270 }
271