systems/eldiron/websites/immae/production.nix

   1 { lib, pkgs, config,  ... }:
   2 let
   3   cfg = config.myServices.websites.immae.production;
   4   varDir = "/var/lib/buildbot/outputs/immae/blog";
   5   historyDir = "/var/lib/buildbot/outputs/immae/history";
   6   docsDir = "/var/lib/buildbot/outputs/immae/docs/";
   7   patchesDir = "/var/lib/buildbot/outputs/immae/patches/";
   8 in {
   9   options.myServices.websites.immae.production.enable = lib.mkEnableOption "enable Immae's website";
  10
  11   config = lib.mkIf cfg.enable {
  12     myServices.dns.zones."immae.eu".subdomains = with config.myServices.dns.helpers;
  13       {
  14         www = ips servers.eldiron.ips.production;
  15         matrix.CNAME = [ "immae.element.io." ];
  16       };
  17     services.webstats.sites = [ { name = "www.immae.eu"; } ];
  18
  19     security.acme.certs.immae.domain = "www.immae.eu";
  20     security.acme.certs.immae.extraDomainNames = [ "immae.eu" ];
  21     services.websites.env.production.bindMounts."${varDir}" = {};
  22     services.websites.env.production.bindMounts."${docsDir}" = {};
  23     services.websites.env.production.bindMounts."${patchesDir}" = {};
  24     services.websites.env.production.bindMounts."${historyDir}" = {};
  25     services.websites.env.production.vhostConfs.immae_production = {
  26       certName     = "immae";
  27       hosts        = [ "www.immae.eu" "immae.eu" ];
  28       root         = varDir;
  29       extraConfig  = [
  30         ''
  31         Use Stats www.immae.eu
  32         Header always set Strict-Transport-Security "max-age=31536000"
  33
  34         <LocationMatch /.well-known/(webfinger|host-meta)>
  35           Header always set Referrer-Policy "strict-origin-when-cross-origin"
  36           RequestHeader set X-Forwarded-Proto "https"
  37
  38           RewriteRule ^(.*)$ https://mastodon.immae.eu%{REQUEST_URI} [QSA,L]
  39         </LocationMatch>
  40
  41         RewriteEngine On
  42         RewriteCond "%{REQUEST_URI}" "!^/.well-known/(webfinger|host-meta)"
  43         RewriteCond "%{HTTP_HOST}" "!^www\.immae\.eu$" [NC]
  44         RewriteRule ^(.+)$ https://www.immae.eu$1 [R=302,L]
  45
  46         <Directory ${varDir}>
  47           DirectoryIndex index.htm index.html
  48           Options Indexes FollowSymLinks MultiViews Includes
  49           AllowOverride All
  50           Require all granted
  51         </Directory>
  52
  53         Alias /.well-known/matrix ${./matrix}
  54         <Directory ${./matrix}>
  55           Options Indexes FollowSymLinks MultiViews Includes
  56           AllowOverride None
  57           Require all granted
  58           Header always set Access-Control-Allow-Origin "*"
  59           Header always set Cache-Control "max-age=3600, public"
  60         </Directory>
  61
  62         Alias /patches ${patchesDir}
  63         <Directory ${patchesDir}>
  64           DirectoryIndex index.htm index.html
  65           Options Indexes FollowSymLinks MultiViews Includes
  66           AllowOverride All
  67           Require all granted
  68         </Directory>
  69
  70         Alias /docs ${docsDir}
  71         <Directory ${docsDir}>
  72           DirectoryIndex index.htm index.html
  73           Options Indexes FollowSymLinks MultiViews Includes
  74           AllowOverride All
  75           Require all granted
  76         </Directory>
  77
  78         Alias /eurl ${./sarl}
  79         Alias /eurl ${./sarl}
  80         <Directory ${./sarl}>
  81           DirectoryIndex index.htm index.html
  82           Options Indexes FollowSymLinks MultiViews Includes
  83           AllowOverride None
  84           Require all granted
  85         </Directory>
  86
  87         Alias /history ${historyDir}
  88         <Directory ${historyDir}>
  89           DirectoryIndex index.html
  90           AllowOverride None
  91           Require all granted
  92         </Directory>
  93
  94         Alias /.well-known/chatonsinfos ${config.myServices.chatonsProperties.propertiesPath}
  95         <Directory ${config.myServices.chatonsProperties.propertiesPath}>
  96           Options Indexes FollowSymLinks MultiViews Includes
  97           AllowOverride None
  98           Require all granted
  99         </Directory>
 100         ''
 101       ];
 102     };
 103
 104     myServices.monitoring.fromMasterActivatedPlugins = [ "http" ];
 105     myServices.monitoring.fromMasterObjects.service = [
 106       {
 107         service_description = "blog website is running on immae.eu";
 108         host_name = config.hostEnv.fqdn;
 109         use = "external-web-service";
 110         check_command = ["check_https" "www.immae.eu" "/blog/" "egrep -ri TODO /etc"];
 111
 112         servicegroups = "webstatus-websites";
 113         _webstatus_name = "Immae’s Blog";
 114         _webstatus_url = "https://www.immae.eu/blog";
 115       }
 116     ];
 117   };
 118 }