virtual/eldiron.nix

   1 {
   2   network = {
   3     description = "Immae's network";
   4     enableRollback = true;
   5   };
   6
   7   eldiron = { config, pkgs, mylibs, myconfig, ... }:
   8     with mylibs;
   9     let
  10         mypkgs = pkgs.callPackage ./packages.nix {
  11           inherit checkEnv fetchedGit fetchedGitPrivate fetchedGithub;
  12         };
  13     in
  14   {
  15     _module.args = {
  16       mylibs = import ../libs.nix;
  17       myconfig = {
  18         ips = {
  19           main = "176.9.151.89";
  20           production = "176.9.151.154";
  21           integration = "176.9.151.155";
  22         };
  23       };
  24     };
  25
  26     imports = [
  27       ./modules/certificates.nix
  28       ./modules/gitolite.nix
  29       ./modules/gitweb.nix
  30       ./modules/databases.nix
  31       ./modules/websites.nix
  32     ];
  33     services.myGitolite.enable = true;
  34     services.myGitweb.enable = true;
  35     services.myDatabases.enable = true;
  36     services.myWebsites.production.enable = true;
  37     services.myWebsites.integration.enable = true;
  38
  39     nixpkgs.config.packageOverrides = oldpkgs: rec {
  40       goaccess = oldpkgs.goaccess.overrideAttrs(old: rec {
  41         name = "goaccess-${version}";
  42         version = "1.3";
  43         src = pkgs.fetchurl {
  44           url = "https://tar.goaccess.io/${name}.tar.gz";
  45           sha256 = "16vv3pj7pbraq173wlxa89jjsd279004j4kgzlrsk1dz4if5qxwc";
  46         };
  47         configureFlags = old.configureFlags ++ [ "--enable-tcb=btree" ];
  48         buildInputs = old.buildInputs ++ [ pkgs.tokyocabinet pkgs.bzip2 ];
  49       });
  50     };
  51
  52     networking = {
  53       firewall = {
  54         enable = true;
  55         allowedTCPPorts = [ 22 80 443 9418 ];
  56       };
  57       interfaces."eth0".ipv4.addresses = [
  58         # 176.9.151.89 declared in nixops -> infra / tools
  59         { address = myconfig.ips.production; prefixLength = 32; }
  60         { address = myconfig.ips.integration; prefixLength = 32; }
  61       ];
  62     };
  63
  64     deployment = {
  65       targetEnv = "hetzner";
  66       hetzner = {
  67         #robotUser = "defined in HETZNER_ROBOT_USER";
  68         #robotPass = "defined in HETZNER_ROBOT_PASS";
  69         mainIPv4 = myconfig.ips.main;
  70         partitions = ''
  71           clearpart --all --initlabel --drives=sda,sdb
  72
  73           part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
  74           part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
  75
  76           part raid.1 --grow --ondisk=sda
  77           part raid.2 --grow --ondisk=sdb
  78
  79           raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  80         '';
  81       };
  82     };
  83
  84     environment.systemPackages = let
  85       # FIXME: move it to nextcloud
  86       occ = pkgs.writeScriptBin "nextcloud-occ" ''
  87         #! ${pkgs.stdenv.shell}
  88         cd ${mypkgs.nextcloud.webRoot}
  89         NEXTCLOUD_CONFIG_DIR="${mypkgs.nextcloud.webRoot}/config" \
  90           exec \
  91           ${config.services.phpfpm.phpPackage}/bin/php \
  92           -c ${config.services.phpfpm.phpPackage}/etc/php.ini \
  93           occ $*
  94         '';
  95     in [
  96       pkgs.telnet
  97       pkgs.htop
  98       pkgs.vim
  99       pkgs.goaccess
 100       occ
 101     ];
 102
 103     security.acme.certs."eldiron".extraDomains = {
 104       "db-1.immae.eu" = null;
 105       "tools.immae.eu" = null;
 106       "cloud.immae.eu" = null;
 107       "dav.immae.eu" = null;
 108     };
 109
 110     services.openssh.extraConfig = ''
 111       AuthorizedKeysCommand     /etc/ssh/ldap_authorized_keys
 112       AuthorizedKeysCommandUser nobody
 113       '';
 114
 115     services.ympd = mypkgs.ympd.config // { enable = false; };
 116
 117     services.phpfpm = {
 118       # FIXME: move session files to separate dirs
 119       # /!\ phppackage is used in nextcloud configuation
 120       phpOptions = ''
 121         session.save_path = "/var/lib/php/sessions"
 122         session.gc_maxlifetime = 60*60*24*15
 123         session.cache_expire = 60*24*30
 124         ; For nextcloud
 125         extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
 126         ; For nextcloud
 127         extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
 128         ; For nextcloud
 129         zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
 130         '';
 131       extraConfig = ''
 132         log_level = notice
 133         '';
 134       poolConfigs = {
 135         adminer = mypkgs.adminer.phpFpm.pool;
 136         nextcloud = mypkgs.nextcloud.phpFpm.pool;
 137         mantisbt = mypkgs.mantisbt.phpFpm.pool;
 138         ttrss = mypkgs.ttrss.phpFpm.pool;
 139         roundcubemail = mypkgs.roundcubemail.phpFpm.pool;
 140         davical = mypkgs.davical.phpFpm.pool;
 141       };
 142     };
 143
 144     system.activationScripts = {
 145       nextcloud = mypkgs.nextcloud.activationScript;
 146       ttrss = mypkgs.ttrss.activationScript;
 147       roundcubemail = mypkgs.roundcubemail.activationScript;
 148       httpd = ''
 149         install -d -m 0755 /var/lib/acme/acme-challenge
 150         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 151         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
 152         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
 153         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
 154         '';
 155       # FIXME: initial sync
 156       goaccess = ''
 157         mkdir -p /var/lib/goaccess
 158         mkdir -p /var/lib/goaccess/aten.pro
 159         mkdir -p /var/lib/goaccess/ludivinecassal.com
 160         mkdir -p /var/lib/goaccess/piedsjaloux.fr
 161         mkdir -p /var/lib/goaccess/osteopathe-cc.fr
 162         mkdir -p /var/lib/goaccess/connexionswing.com
 163         '';
 164     };
 165
 166     environment.etc."ssh/ldap_authorized_keys" = let
 167       ldap_authorized_keys =
 168         assert checkEnv "NIXOPS_SSHD_LDAP_PASSWORD";
 169         wrap {
 170           name = "ldap_authorized_keys";
 171           file = ./ldap_authorized_keys.sh;
 172           vars = {
 173             LDAP_PASS = builtins.getEnv "NIXOPS_SSHD_LDAP_PASSWORD";
 174             GITOLITE_SHELL = "${pkgs.gitolite}/bin/gitolite-shell";
 175             ECHO = "${pkgs.coreutils}/bin/echo";
 176           };
 177           paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ];
 178         };
 179     in {
 180       enable = true;
 181       mode = "0755";
 182       user = "root";
 183       source = ldap_authorized_keys;
 184     };
 185
 186     services.gitDaemon = {
 187       enable = true;
 188       user = "gitolite";
 189       group = "gitolite";
 190       basePath = "${mypkgs.git.web.varDir}/repositories";
 191     };
 192
 193     # FIXME: logrotate
 194     services.httpd = let
 195       withConf = domain: {
 196         enableSSL = true;
 197         sslServerCert = "/var/lib/acme/${domain}/cert.pem";
 198         sslServerKey = "/var/lib/acme/${domain}/key.pem";
 199         sslServerChain = "/var/lib/acme/${domain}/fullchain.pem";
 200         logFormat = "combinedVhost";
 201         listen = [
 202           { ip = "176.9.151.89";  port = 443; }
 203         ];
 204       };
 205       apacheConfig = config.services.myWebsites.apacheConfig;
 206     in rec {
 207       enable = true;
 208       logPerVirtualHost = true;
 209       multiProcessingModule = "worker";
 210       adminAddr = "httpd@immae.eu";
 211       logFormat = "combinedVhost";
 212       extraModules = pkgs.lib.lists.unique (
 213         mypkgs.adminer.apache.modules ++
 214         mypkgs.nextcloud.apache.modules ++
 215         mypkgs.ympd.apache.modules ++
 216         mypkgs.git.web.apache.modules ++
 217         mypkgs.mantisbt.apache.modules ++
 218         mypkgs.ttrss.apache.modules ++
 219         mypkgs.roundcubemail.apache.modules ++
 220         pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig));
 221       extraConfig = builtins.concatStringsSep "\n"
 222         (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
 223       virtualHosts = [
 224         (withConf "eldiron" // {
 225           hostName = "eldiron.immae.eu";
 226           documentRoot = ./www;
 227           extraConfig = ''
 228             DirectoryIndex index.htm
 229             '';
 230         })
 231         (withConf "eldiron" // {
 232           hostName = "db-1.immae.eu";
 233           documentRoot = null;
 234           extraConfig = builtins.concatStringsSep "\n" [
 235             mypkgs.adminer.apache.vhostConf
 236           ];
 237         })
 238         (withConf "eldiron" // {
 239           hostName = "tools.immae.eu";
 240           documentRoot = null;
 241           extraConfig = builtins.concatStringsSep "\n" [
 242             mypkgs.adminer.apache.vhostConf
 243             mypkgs.ympd.apache.vhostConf
 244             mypkgs.ttrss.apache.vhostConf
 245             mypkgs.roundcubemail.apache.vhostConf
 246           ];
 247         })
 248         (withConf "eldiron" // {
 249           hostName = "dav.immae.eu";
 250           documentRoot = null;
 251           extraConfig = builtins.concatStringsSep "\n" [
 252             mypkgs.infcloud.apache.vhostConf
 253             mypkgs.davical.apache.vhostConf
 254           ];
 255         })
 256         (withConf "connexionswing" // {
 257           hostName = "connexionswing.com";
 258           serverAliases = [ "sandetludo.com" "www.connexionswing.com" "www.sandetludo.com" ];
 259           documentRoot = mypkgs.connexionswing_prod.webRoot;
 260           extraConfig = builtins.concatStringsSep "\n" [
 261             mypkgs.connexionswing_prod.apache.vhostConf
 262           ];
 263         })
 264         (withConf "ludivinecassal" // {
 265           hostName = "ludivinecassal.com";
 266           serverAliases = [ "www.ludivinecassal.com" ];
 267           documentRoot = mypkgs.ludivinecassal_prod.webRoot;
 268           extraConfig = builtins.concatStringsSep "\n" [
 269             mypkgs.ludivinecassal_prod.apache.vhostConf
 270           ];
 271         })
 272         (withConf "piedsjaloux" // {
 273           hostName = "piedsjaloux.fr";
 274           serverAliases = [ "www.piedsjaloux.fr" ];
 275           documentRoot = mypkgs.piedsjaloux_prod.webRoot;
 276           extraConfig = builtins.concatStringsSep "\n" [
 277             mypkgs.piedsjaloux_prod.apache.vhostConf
 278           ];
 279         })
 280         (withConf "chloe" // {
 281           hostName = "osteopathe-cc.fr";
 282           serverAliases = [ "www.osteopathe-cc.fr" ];
 283           documentRoot = mypkgs.chloe_prod.webRoot;
 284           extraConfig = builtins.concatStringsSep "\n" [
 285             mypkgs.chloe_prod.apache.vhostConf
 286           ];
 287         })
 288         (withConf "aten" // {
 289           hostName = "aten.pro";
 290           serverAliases = [ "www.aten.pro" ];
 291           documentRoot = mypkgs.aten_prod.webRoot;
 292           extraConfig = builtins.concatStringsSep "\n" [
 293             mypkgs.aten_prod.apache.vhostConf
 294           ];
 295         })
 296         (withConf "eldiron" // {
 297           hostName = "cloud.immae.eu";
 298           documentRoot = mypkgs.nextcloud.webRoot;
 299           extraConfig = builtins.concatStringsSep "\n" [
 300             mypkgs.nextcloud.apache.vhostConf
 301           ];
 302         })
 303         (withConf "eldiron" // {
 304           hostName = "git.immae.eu";
 305           documentRoot = mypkgs.git.web.webRoot;
 306           extraConfig = builtins.concatStringsSep "\n" [
 307             mypkgs.git.web.apache.vhostConf
 308             mypkgs.mantisbt.apache.vhostConf
 309           ] + ''
 310             RewriteEngine on
 311             RewriteCond %{REQUEST_URI}       ^/releases
 312             RewriteRule /releases(.*)        https://release.immae.eu$1 [P,L]
 313             '';
 314         })
 315         { # Should go last, default fallback
 316           listen = [ { ip = "*"; port = 80; } ];
 317           hostName = "redirectSSL";
 318           serverAliases = [ "*" ];
 319           enableSSL = false;
 320           logFormat = "combinedVhost";
 321           documentRoot = "/var/lib/acme/acme-challenge";
 322           extraConfig = ''
 323             RewriteEngine on
 324             RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
 325             RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
 326             # To redirect in specific "VirtualHost *:80", do
 327             #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
 328             # rather than rewrite
 329             '';
 330         }
 331       ];
 332     };
 333
 334     services.cron = {
 335       enable = true;
 336       systemCronJobs = let
 337         stats = domain: conf: let
 338           d = pkgs.writeScriptBin "stats-${domain}" ''
 339             #!${pkgs.stdenv.shell}
 340             set -e
 341             shopt -s nullglob
 342             date_regex=$(LC_ALL=C date -d yesterday +'%d\/%b\/%Y')
 343             TMPFILE=$(mktemp)
 344             trap "rm -f $TMPFILE" EXIT
 345
 346             cat /var/log/httpd/access_log-${domain} | sed -n "/\\[$date_regex/ p" > $TMPFILE
 347             for i in /var/log/httpd/access_log-${domain}*.gz; do
 348               zcat "$i" | sed -n "/\\[$date_regex/ p" >> $TMPFILE
 349             done
 350             goaccess $TMPFILE --no-progress -o /var/lib/goaccess/${domain}/index.html -p ${conf}
 351             '';
 352           in "${d}/bin/stats-${domain}";
 353       # FIXME: running several goaccess simultaneously seems to be
 354       # bugged?
 355       in [
 356         "5 0 * * * root ${stats "aten.pro" ./packages/aten_goaccess.conf}"
 357         "6 0 * * * root ${stats "ludivinecassal.com" ./packages/ludivinecassal_goaccess.conf}"
 358         "7 0 * * * root ${stats "piedsjaloux.fr" ./packages/piedsjaloux_goaccess.conf}"
 359         "8 0 * * * root ${stats "osteopathe-cc.fr" ./packages/chloe_goaccess.conf}"
 360         "9 0 * * * root ${stats "connexionswing.com" ./packages/connexionswing_goaccess.conf}"
 361         ];
 362     };
 363
 364     systemd.services.tt-rss = {
 365       description = "Tiny Tiny RSS feeds update daemon";
 366       serviceConfig = {
 367         User = "wwwrun";
 368         ExecStart = "${pkgs.php}/bin/php ${mypkgs.ttrss.webRoot}/update.php --daemon";
 369         StandardOutput = "syslog";
 370         StandardError = "syslog";
 371         PermissionsStartOnly = true;
 372       };
 373
 374       wantedBy = [ "multi-user.target" ];
 375       requires = ["postgresql.service"];
 376       after = ["network.target" "postgresql.service"];
 377     };
 378   };
 379 }