systems/eldiron/websites/immae/production.nix

   1 { lib, pkgs, config,  ... }:
   2 let
   3   cfg = config.myServices.websites.immae.production;
   4   varDir = "/var/lib/buildbot/outputs/immae/blog";
   5   historyDir = "/var/lib/buildbot/outputs/immae/history";
   6   docsDir = "/var/lib/buildbot/outputs/immae/docs/";
   7   patchesDir = "/var/lib/buildbot/outputs/immae/patches/";
   8 in {
   9   options.myServices.websites.immae.production.enable = lib.mkEnableOption "enable Immae's website";
  10
  11   config = lib.mkIf cfg.enable {
  12     myServices.dns.zones."immae.eu".subdomains = with config.myServices.dns.helpers;
  13       {
  14         www = ips servers.eldiron.ips.production;
  15         matrix.CNAME = [ "immae.element.io." ];
  16       };
  17     services.webstats.sites = [ { name = "www.immae.eu"; } ];
  18
  19     security.acme.certs.immae.domain = "www.immae.eu";
  20     security.acme.certs.immae.extraDomainNames = [ "immae.eu" ];
  21     services.websites.env.production.bindMounts."${varDir}" = {};
  22     services.websites.env.production.bindMounts."${docsDir}" = {};
  23     services.websites.env.production.bindMounts."${patchesDir}" = {};
  24     services.websites.env.production.bindMounts."${historyDir}" = {};
  25     services.websites.env.production.vhostConfs.immae_production = {
  26       certName     = "immae";
  27       hosts        = [ "www.immae.eu" "immae.eu" ];
  28       root         = varDir;
  29       extraConfig  = [
  30         ''
  31         Use Stats www.immae.eu
  32         Header always set Strict-Transport-Security "max-age=31536000"
  33
  34         <LocationMatch /.well-known/(webfinger|host-meta)>
  35           Header always set Referrer-Policy "strict-origin-when-cross-origin"
  36           RequestHeader set X-Forwarded-Proto "https"
  37
  38           RewriteRule ^(.*)$ https://mastodon.immae.eu%{REQUEST_URI} [QSA,L]
  39         </LocationMatch>
  40
  41         RewriteEngine On
  42         RewriteCond "%{REQUEST_URI}" "!^/.well-known/(webfinger|host-meta)"
  43         RewriteCond "%{HTTP_HOST}" "!^www\.immae\.eu$" [NC]
  44         RewriteRule ^(.+)$ https://www.immae.eu$1 [R=302,L]
  45
  46         <Directory ${varDir}>
  47           DirectoryIndex index.htm index.html
  48           Options Indexes FollowSymLinks MultiViews Includes
  49           AllowOverride All
  50           Require all granted
  51         </Directory>
  52
  53         Alias /.well-known/matrix ${./matrix}
  54         <Directory ${./matrix}>
  55           Options Indexes FollowSymLinks MultiViews Includes
  56           AllowOverride None
  57           Require all granted
  58           Header always set Access-Control-Allow-Origin "*"
  59         </Directory>
  60
  61         Alias /patches ${patchesDir}
  62         <Directory ${patchesDir}>
  63           DirectoryIndex index.htm index.html
  64           Options Indexes FollowSymLinks MultiViews Includes
  65           AllowOverride All
  66           Require all granted
  67         </Directory>
  68
  69         Alias /docs ${docsDir}
  70         <Directory ${docsDir}>
  71           DirectoryIndex index.htm index.html
  72           Options Indexes FollowSymLinks MultiViews Includes
  73           AllowOverride All
  74           Require all granted
  75         </Directory>
  76
  77         Alias /eurl ${./sarl}
  78         Alias /eurl ${./sarl}
  79         <Directory ${./sarl}>
  80           DirectoryIndex index.htm index.html
  81           Options Indexes FollowSymLinks MultiViews Includes
  82           AllowOverride None
  83           Require all granted
  84         </Directory>
  85
  86         Alias /history ${historyDir}
  87         <Directory ${historyDir}>
  88           DirectoryIndex index.html
  89           AllowOverride None
  90           Require all granted
  91         </Directory>
  92
  93         Alias /.well-known/chatonsinfos ${config.myServices.chatonsProperties.propertiesPath}
  94         <Directory ${config.myServices.chatonsProperties.propertiesPath}>
  95           Options Indexes FollowSymLinks MultiViews Includes
  96           AllowOverride None
  97           Require all granted
  98         </Directory>
  99         ''
 100       ];
 101     };
 102
 103     myServices.monitoring.fromMasterActivatedPlugins = [ "http" ];
 104     myServices.monitoring.fromMasterObjects.service = [
 105       {
 106         service_description = "blog website is running on immae.eu";
 107         host_name = config.hostEnv.fqdn;
 108         use = "external-web-service";
 109         check_command = ["check_https" "www.immae.eu" "/blog/" "egrep -ri TODO /etc"];
 110
 111         servicegroups = "webstatus-websites";
 112         _webstatus_name = "Immae’s Blog";
 113         _webstatus_url = "https://www.immae.eu/blog";
 114       }
 115     ];
 116   };
 117 }