systems/eldiron/websites/default.nix

   1 { lib, pkgs, config, mypackages-lib, ... }:
   2 let
   3   www_root = ./_www;
   4   theme_root = (mypackages-lib.apache-theme {}).theme;
   5   apacheConfig = {
   6     shutdownconfig = {
   7       # Only give 5 seconds to workers to finish their work
   8       extraConfig = ''
   9         GracefulShutdownTimeout 5
  10       '';
  11     };
  12     cache = {
  13       # This setting permits to ignore time-based cache for files in the
  14       # nix store:
  15       # If a client requires an If-Modified-Since from timestamp 1, then
  16       # this header is removed, and if the response contains a
  17       # too old Last-Modified tag, then it is removed too
  18       extraConfig = ''
  19         <If "%{HTTP:If-Modified-Since} =~ /01 Jan 1970 00:00:01/" >
  20           RequestHeader unset If-Modified-Since
  21         </If>
  22         Header unset Last-Modified "expr=%{LAST_MODIFIED} < 19991231235959"
  23       '';
  24     };
  25     gzip = {
  26       modules = [ "deflate" "filter" ];
  27       extraConfig = ''
  28         AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
  29       '';
  30     };
  31     macros = {
  32       modules = [ "macro" ];
  33     };
  34     stats = {
  35       extraConfig = ''
  36         <Macro Stats %{domain}>
  37           Alias /webstats ${config.services.webstats.dataDir}/%{domain}
  38           <Directory ${config.services.webstats.dataDir}/%{domain}>
  39             DirectoryIndex index.html
  40             AllowOverride None
  41             Require all granted
  42           </Directory>
  43           <Location /webstats>
  44             Use LDAPConnect
  45             Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
  46           </Location>
  47         </Macro>
  48       '';
  49     };
  50     ldap = {
  51       modules = [ "ldap" "authnz_ldap" ];
  52       extraConfig = ''
  53         <IfModule ldap_module>
  54           LDAPSharedCacheSize 500000
  55           LDAPCacheEntries 1024
  56           LDAPCacheTTL 600
  57           LDAPOpCacheEntries 1024
  58           LDAPOpCacheTTL 600
  59         </IfModule>
  60
  61         Include ${config.secrets.fullPaths."apache-ldap"}
  62       '';
  63     };
  64     global = {
  65       extraConfig = ''
  66         ErrorDocument 500 /maintenance_immae.html
  67         ErrorDocument 501 /maintenance_immae.html
  68         ErrorDocument 502 /maintenance_immae.html
  69         ErrorDocument 503 /maintenance_immae.html
  70         ErrorDocument 504 /maintenance_immae.html
  71         Alias /maintenance_immae.html ${www_root}/maintenance_immae.html
  72         ProxyPass /maintenance_immae.html !
  73
  74         AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html
  75         <Directory ${www_root}>
  76           AllowOverride None
  77           Require all granted
  78         </Directory>
  79       '';
  80     };
  81     mail-autoconfig = {
  82       extraConfig = let
  83         autoconfig = pkgs.writeTextDir "config-v1.1.xml" ''
  84           <?xml version="1.0"?>
  85           <clientConfig version="1.1">
  86             <emailProvider id="mail.immae.eu">
  87               <domain>mail.immae.eu</domain>
  88               <domain>%EMAILDOMAIN%</domain>
  89               <displayName>Immae E-mail</displayName>
  90               <displayShortName>Immae E-mail</displayShortName>
  91
  92               <incomingServer type="imap">
  93                 <hostname>imap.immae.eu</hostname>
  94                 <port>143</port>
  95                 <socketType>STARTTLS</socketType>
  96                 <username>%EMAILADDRESS%</username>
  97                 <authentication>password-cleartext</authentication>
  98               </incomingServer>
  99
 100               <incomingServer type="imap">
 101                 <hostname>imap.immae.eu</hostname>
 102                 <port>993</port>
 103                 <socketType>SSL</socketType>
 104                 <username>%EMAILADDRESS%</username>
 105                 <authentication>password-cleartext</authentication>
 106               </incomingServer>
 107
 108               <incomingServer type="pop3">
 109                 <hostname>pop.immae.eu</hostname>
 110                 <port>110</port>
 111                 <socketType>STARTTLS</socketType>
 112                 <username>%EMAILADDRESS%</username>
 113                 <authentication>password-cleartext</authentication>
 114               </incomingServer>
 115
 116               <incomingServer type="pop3">
 117                 <hostname>pop.immae.eu</hostname>
 118                 <port>995</port>
 119                 <socketType>SSL</socketType>
 120                 <username>%EMAILADDRESS%</username>
 121                 <authentication>password-cleartext</authentication>
 122               </incomingServer>
 123
 124               <outgoingServer type="smtp">
 125                 <hostname>smtp.immae.eu</hostname>
 126                 <port>587</port>
 127                 <socketType>STARTTLS</socketType>
 128                 <username>%EMAILADDRESS%</username>
 129                 <authentication>password-cleartext</authentication>
 130               </outgoingServer>
 131
 132               <outgoingServer type="smtp">
 133                 <hostname>smtp.immae.eu</hostname>
 134                 <port>465</port>
 135                 <socketType>SSL</socketType>
 136                 <username>%EMAILADDRESS%</username>
 137                 <authentication>password-cleartext</authentication>
 138               </outgoingServer>
 139             </emailProvider>
 140           </clientConfig>
 141         '';
 142       in ''
 143         Alias /.well-known/autoconfig/mail "${autoconfig}"
 144         <Directory ${autoconfig}>
 145           AllowOverride None
 146           Require all granted
 147         </Directory>
 148       '';
 149     };
 150     apaxy = {
 151       extraConfig = (mypackages-lib.apache-theme { inherit theme_root; }).apacheConfig;
 152     };
 153     http2 = {
 154       modules = [ "http2" ];
 155       extraConfig = ''
 156         Protocols h2 http/1.1
 157       '';
 158     };
 159     customLog = {
 160       extraConfig = ''
 161         LogFormat "%{Host}i:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
 162       '';
 163     };
 164   };
 165   makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
 166   makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
 167   moomin = let
 168     lines = lib.splitString "\n" (lib.fileContents ./moomin.txt);
 169     pad = width: str: let
 170         padWidth = width - lib.stringLength str;
 171         padding = lib.concatStrings (lib.genList (lib.const "0") padWidth);
 172       in lib.optionalString (padWidth > 0) padding + str;
 173   in
 174     lib.imap0 (i: e: ''Header always set "X-Moomin-${pad 2 (builtins.toString i)}" "${e}"'') lines;
 175 in
 176 {
 177   imports = [
 178     ./immae/production.nix
 179     ./immae/release.nix
 180
 181     # Tools
 182     ./assets
 183     ./cloud
 184     ./cloud/farm.nix
 185     ./cryptpad
 186     ./cryptpad/farm.nix
 187     ./commento
 188     ./dav
 189     ./vpn
 190     ./db
 191     ./diaspora
 192     ./ether
 193     ./git
 194     ./im
 195     ./mastodon
 196     ./mgoblin
 197     ./peertube
 198     ./performance
 199     ./tools
 200     ./mail
 201     ./stats
 202     ./visio
 203     ./kanboard/farm.nix
 204
 205     # Games
 206     ./games/codenames
 207     ./games/terraforming-mars
 208   ];
 209
 210   options.myServices.websites.enable = lib.mkEnableOption "enable websites";
 211
 212   config = lib.mkIf config.myServices.websites.enable {
 213     myServices.dns.zones."immae.eu".subdomains = with config.myServices.dns.helpers;
 214       {
 215         games = ips servers.eldiron.ips.main;
 216         nossl = ips servers.eldiron.ips.main;
 217       };
 218
 219     myServices.chatonsProperties.hostings.web = {
 220       file.datetime = "2022-08-22T01:30:00";
 221       hosting = {
 222         name = "Hébergement Web";
 223         description = "Service d'hébergement web avec php/mysql/postgresql";
 224         website = "https://www.immae.eu";
 225         status.level = "OK";
 226         status.description = "OK";
 227         registration.load = "OPEN";
 228         install.type = "PACKAGE";
 229       };
 230       software = {
 231         name = "Apache Httpd";
 232         website = "https://httpd.apache.org/";
 233         license.url = "https://www.apache.org/licenses/";
 234         license.name = "Apache License Version 2";
 235         version = pkgs.apacheHttpd.version;
 236         source.url = "https://httpd.apache.org/download.cgi";
 237         modules = "openssh,pure-ftpd";
 238       };
 239     };
 240     users.users.wwwrun.extraGroups = [ "keys" ];
 241     networking.firewall.allowedTCPPorts = [ 80 443 ];
 242
 243     secrets.keys."apache-ldap" = {
 244       user = "wwwrun";
 245       group = "wwwrun";
 246       permissions = "0400";
 247       text = ''
 248         <Macro LDAPConnect>
 249           <IfModule authnz_ldap_module>
 250             AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 251             AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 252             AuthLDAPBindPassword "${config.myEnv.httpd.ldap.password}"
 253             AuthType             Basic
 254             AuthName             "Authentification requise (Acces LDAP)"
 255             AuthBasicProvider    ldap
 256           </IfModule>
 257         </Macro>
 258         '';
 259     };
 260
 261     system.activationScripts = {
 262       httpd = ''
 263         install -d -m 0755 /var/lib/acme/acme-challenges
 264         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 265         '';
 266     };
 267
 268     services.phpfpm = {
 269       phpOptions = ''
 270         session.save_path = "/var/lib/php/sessions"
 271         post_max_size = 20M
 272         ; 15 days (seconds)
 273         session.gc_maxlifetime = 1296000
 274         ; 30 days (minutes)
 275         session.cache_expire = 43200
 276         '';
 277       settings = {
 278         log_level = "notice";
 279       };
 280     };
 281
 282     services.websites.env.production = {
 283       enable = true;
 284       moduleType = "container";
 285       adminAddr = "httpd@immae.eu";
 286       bindMounts."/var/lib/ftp" = {};
 287       # FIXME: Bind directly the needed files
 288       bindMounts."/var/secrets" = {};
 289       bindMounts."/var/lib/goaccess" = {};
 290       bindMounts."/var/lib/acme" = {};
 291       bindMounts."/run/phpfpm" = {};
 292       ips =
 293         let ips = config.myEnv.servers.eldiron.ips.production;
 294         in (ips.ip4 or []) ++ (ips.ip6 or []);
 295       modules = makeModules;
 296       extraConfig = makeExtraConfig;
 297       fallbackVhost = {
 298         certName    = "eldiron";
 299         hosts       = ["eldiron.immae.eu" ];
 300         root        = www_root;
 301         extraConfig = [ "DirectoryIndex index.htm" ];
 302       };
 303     };
 304
 305     services.websites.env.integration = {
 306       enable = true;
 307       moduleType = "container";
 308       adminAddr = "httpd@immae.eu";
 309       bindMounts."/var/lib/ftp" = {};
 310       bindMounts."/var/secrets" = {};
 311       bindMounts."/var/lib/goaccess" = {};
 312       bindMounts."/var/lib/acme" = {};
 313       bindMounts."/run/phpfpm" = {};
 314       ips =
 315         let ips = config.myEnv.servers.eldiron.ips.integration;
 316         in (ips.ip4 or []) ++ (ips.ip6 or []);
 317       modules = makeModules;
 318       extraConfig = makeExtraConfig ++ moomin;
 319       fallbackVhost = {
 320         certName    = "integration";
 321         hosts       = ["eldiron.immae.eu" ];
 322         root        = www_root;
 323         extraConfig = [ "DirectoryIndex index.htm" ];
 324       };
 325       watchPaths = [ config.secrets.fullPaths."apache-ldap" ];
 326     };
 327
 328     services.websites.env.tools = {
 329       enable = true;
 330       moduleType = "main";
 331       adminAddr = "httpd@immae.eu";
 332       ips =
 333         let ips = config.myEnv.servers.eldiron.ips.main;
 334         in (ips.ip4 or []) ++ (ips.ip6 or []);
 335       modules = makeModules;
 336       extraConfig = makeExtraConfig ++
 337         [ ''
 338             RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 339             RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 340             RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 341             RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 342             RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 343             RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 344           ''
 345           ];
 346       nosslVhost = {
 347         enable = true;
 348         host = "nossl.immae.eu";
 349         root = ./nossl;
 350       };
 351       fallbackVhost = {
 352         certName    = "eldiron";
 353         hosts       = ["eldiron.immae.eu" ];
 354         root        = www_root;
 355         extraConfig = [ "DirectoryIndex index.htm" ];
 356       };
 357       watchPaths = [ config.secrets.fullPaths."apache-ldap" ];
 358     };
 359
 360     myServices.websites = {
 361       immae = {
 362         production.enable = true;
 363         release.enable = true;
 364       };
 365
 366       tools.assets.enable = true;
 367       tools.cloud.enable = true;
 368       tools.commento.enable = true;
 369       tools.cryptpad.enable = true;
 370       tools.dav.enable = true;
 371       tools.db.enable = true;
 372       tools.diaspora.enable = true;
 373       tools.etherpad-lite.enable = true;
 374       tools.git.enable = true;
 375       tools.mastodon.enable = true;
 376       tools.mediagoblin.enable = true;
 377       tools.peertube.enable = true;
 378       tools.performance.enable = true;
 379       tools.tools.enable = true;
 380       tools.email.enable = true;
 381       tools.stats.enable = false;
 382       tools.visio.enable = true;
 383
 384       games.codenames.enable = true;
 385       games.terraforming-mars.enable = true;
 386     };
 387   };
 388 }