virtual/eldiron.nix

   1 {
   2   network = {
   3     description = "Immae's network";
   4     enableRollback = true;
   5   };
   6
   7   eldiron = { config, pkgs, ... }:
   8     let mypkgs = import ./packages.nix;
   9         mylibs = import ../libs.nix;
  10     in
  11   {
  12     networking = {
  13       firewall = {
  14         enable = true;
  15         allowedTCPPorts = [ 22 80 443 3306 5432 9418 ];
  16       };
  17     };
  18
  19     deployment = {
  20       targetEnv = "hetzner";
  21       hetzner = {
  22         #robotUser = "defined in HETZNER_ROBOT_USER";
  23         #robotPass = "defined in HETZNER_ROBOT_PASS";
  24         mainIPv4 = "176.9.151.89";
  25         partitions = ''
  26           clearpart --all --initlabel --drives=sda,sdb
  27
  28           part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
  29           part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
  30
  31           part raid.1 --grow --ondisk=sda
  32           part raid.2 --grow --ondisk=sdb
  33
  34           raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  35         '';
  36       };
  37     };
  38
  39     environment.systemPackages = let
  40       # FIXME: move it to nextcloud
  41       occ = pkgs.writeScriptBin "nextcloud-occ" ''
  42         #! ${pkgs.stdenv.shell}
  43         cd ${mypkgs.nextcloud.webRoot}
  44         NEXTCLOUD_CONFIG_DIR="${mypkgs.nextcloud.webRoot}/config" \
  45           exec \
  46           ${config.services.phpfpm.phpPackage}/bin/php \
  47           -c ${config.services.phpfpm.phpPackage}/etc/php.ini \
  48           occ $*
  49         '';
  50     in [
  51       pkgs.telnet
  52       pkgs.vim
  53       occ
  54     ];
  55
  56     security.acme.certs = {
  57       "eldiron" = {
  58         webroot = "/var/lib/acme/acme-challenge";
  59         email = "ismael@bouya.org";
  60         domain = "eldiron.immae.eu";
  61         plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
  62         postRun = ''
  63           systemctl reload httpd.service
  64         '';
  65         extraDomains = {
  66           "db-1.immae.eu" = null;
  67           "tools.immae.eu" = null;
  68           "connexionswing.immae.eu" = null;
  69           "sandetludo.immae.eu" = null;
  70           "cloud.immae.eu" = null;
  71         };
  72       };
  73       # "connexionswing" = {
  74       #   webroot = "/var/lib/acme/acme-challenge";
  75       #   email = "ismael@bouya.org";
  76       #   domain = "connexionswing.com";
  77       #   plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
  78       #   postRun = ''
  79       #     systemctl reload httpd.service
  80       #   '';
  81       #   extraDomains = {
  82       #     "www.connexionswing.com" = null;
  83       #     "sandetludo.com" = null;
  84       #     "www.sandetludo.com" = null;
  85       #   };
  86       # };
  87     };
  88
  89     services.openssh.extraConfig = ''
  90       AuthorizedKeysCommand     /etc/ssh/ldap_authorized_keys
  91       AuthorizedKeysCommandUser nobody
  92       '';
  93
  94     users.users.wwwrun.extraGroups = [ "gitolite" ];
  95
  96     users.users.gitolite.packages = let
  97       python-packages = python-packages: with python-packages; [
  98         simplejson
  99         urllib3
 100       ];
 101     in
 102       [
 103         (pkgs.python3.withPackages python-packages)
 104       ];
 105     # FIXME: after initial install, need to
 106     # (1) copy rc file (adjust gitolite_ldap_groups.sh)
 107     # (2) (mark old readonly and) sync repos except gitolite-admin
 108     #     rsync -av --exclude=gitolite-admin.git old:/var/lib/gitolite/repositories /var/lib/gitolite/
 109     #     chown -R gitolite:gitolite /var/lib/gitolite
 110     # (3) push force the gitolite-admin to new location (from external point)
 111     #     Don't use an existing key, it will take precedence over
 112     #     gitolite-admin
 113     # (4) su -u gitolite gitolite setup
 114     services.gitolite = {
 115       enable = true;
 116       # FIXME: key from ./ssh
 117       adminPubkey = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDXqRbiHw7QoHADNIEuo4nUT9fSOIEBMdJZH0bkQAxXyJFyCM1IMz0pxsHV0wu9tdkkr36bPEUj2aV5bkYLBN6nxcV2Y49X8bjOSCPfx3n6Own1h+NeZVBj4ZByrFmqCbTxUJIZ2bZKcWOFncML39VmWdsVhNjg0X4NBBehqXRIKr2gt3E/ESAxTYJFm0BnU0baciw9cN0bsRGqvFgf5h2P48CIAfwhVcGmPQnnAwabnosYQzRWxR0OygH5Kd8mePh6FheIRIigfXsDO8f/jdxwut8buvNIf3m5EBr3tUbTsvM+eV3M5vKGt7sk8T64DVtepTSdOOWtp+47ktsnHOMh immae@immae.eu";
 118     };
 119
 120     services.ympd = mypkgs.ympd.config // { enable = true; };
 121
 122     services.phpfpm = {
 123       # /!\ phppackage is used in nextcloud configuation
 124       phpOptions = ''
 125         ; For nextcloud
 126         extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
 127         ; For nextcloud
 128         extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
 129         '';
 130       extraConfig = ''
 131         log_level = notice
 132         '';
 133       poolConfigs = {
 134         adminer = mypkgs.adminer.phpFpm.pool;
 135         connexionswing_dev = mypkgs.connexionswing_dev.phpFpm.pool;
 136         connexionswing_prod = mypkgs.connexionswing_prod.phpFpm.pool;
 137         nextcloud = mypkgs.nextcloud.phpFpm.pool;
 138         mantisbt = mypkgs.mantisbt.phpFpm.pool;
 139       };
 140     };
 141
 142     system.activationScripts = {
 143       connexionswing_dev  = mypkgs.connexionswing_dev.activationScript;
 144       connexionswing_prod = mypkgs.connexionswing_prod.activationScript;
 145       nextcloud = mypkgs.nextcloud.activationScript;
 146       httpd = ''
 147         install -d -m 0755 /var/lib/acme/acme-challenge
 148         '';
 149       redis = ''
 150         mkdir -p /run/redis
 151         chown redis /run/redis
 152         '';
 153       gitolite =
 154         assert mylibs.checkEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
 155         let
 156         gitolite_ldap_groups = mylibs.wrap {
 157           name = "gitolite_ldap_groups.sh";
 158           file = ./packages/gitolite_ldap_groups.sh;
 159           vars = {
 160             LDAP_PASS = builtins.getEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
 161           };
 162           paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.coreutils ];
 163         };
 164       in {
 165         deps = [ "users" ];
 166         text = ''
 167           if [ -d /var/lib/gitolite ]; then
 168             ln -sf ${gitolite_ldap_groups} /var/lib/gitolite/gitolite_ldap_groups.sh
 169             chmod g+rx /var/lib/gitolite
 170           fi
 171           if [ -f /var/lib/gitolite/projects.list ]; then
 172             chmod g+r /var/lib/gitolite/projects.list
 173           fi
 174         '';
 175       };
 176     };
 177
 178     environment.etc."ssh/ldap_authorized_keys" = let
 179       ldap_authorized_keys =
 180         assert mylibs.checkEnv "NIXOPS_SSHD_LDAP_PASSWORD";
 181         mylibs.wrap {
 182           name = "ldap_authorized_keys";
 183           file = ./ldap_authorized_keys.sh;
 184           vars = {
 185             LDAP_PASS = builtins.getEnv "NIXOPS_SSHD_LDAP_PASSWORD";
 186             GITOLITE_SHELL = "${pkgs.gitolite}/bin/gitolite-shell";
 187             ECHO = "${pkgs.coreutils}/bin/echo";
 188           };
 189           paths = [ pkgs.openldap pkgs.stdenv.shellPackage pkgs.gnugrep pkgs.gnused pkgs.coreutils ];
 190         };
 191     in {
 192       enable = true;
 193       mode = "0755";
 194       user = "root";
 195       source = ldap_authorized_keys;
 196     };
 197
 198     services.gitDaemon = {
 199       enable = true;
 200       user = "gitolite";
 201       group = "gitolite";
 202       basePath = "${mypkgs.git.web.varDir}/repositories";
 203     };
 204
 205     services.httpd = let
 206       withSSL = domain: {
 207         enableSSL = true;
 208         sslServerCert = "/var/lib/acme/${domain}/cert.pem";
 209         sslServerKey = "/var/lib/acme/${domain}/key.pem";
 210         sslServerChain = "/var/lib/acme/${domain}/fullchain.pem";
 211       };
 212       apacheConfig = {
 213         gzip = {
 214           modules = [ "deflate" "filter" ];
 215           extraConfig = ''
 216             AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
 217           '';
 218         };
 219         ldap = {
 220           modules = [ "ldap" "authnz_ldap" ];
 221           extraConfig = assert mylibs.checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; ''
 222             <IfModule ldap_module>
 223               LDAPSharedCacheSize 500000
 224               LDAPCacheEntries 1024
 225               LDAPCacheTTL 600
 226               LDAPOpCacheEntries 1024
 227               LDAPOpCacheTTL 600
 228             </IfModule>
 229
 230             <Macro LDAPConnect>
 231               <IfModule authnz_ldap_module>
 232                 AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu
 233                 AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 234                 AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
 235                 AuthType             Basic
 236                 AuthName             "Authentification requise (Acces LDAP)"
 237                 AuthBasicProvider    ldap
 238               </IfModule>
 239             </Macro>
 240           '';
 241         };
 242       };
 243     in rec {
 244       enable = true;
 245       logPerVirtualHost = true;
 246       multiProcessingModule = "worker";
 247       adminAddr = "httpd@immae.eu";
 248       # FIXME: http2
 249       # FIXME: voir les autres modules:
 250       #    authz_core_module
 251       #    reqtimeout_module
 252       #    http2_module
 253       #    version_module
 254       #    proxy_connect_module
 255       #    proxy_ftp_module
 256       #    proxy_scgi_module
 257       #    proxy_ajp_module
 258       #    proxy_balancer_module
 259       #    proxy_express_module
 260       #    lbmethod_byrequests_module
 261       #    lbmethod_bytraffic_module
 262       #    lbmethod_bybusyness_module
 263       #    lbmethod_heartbeat_module
 264
 265       extraModules = pkgs.lib.lists.unique (
 266         mypkgs.adminer.apache.modules ++
 267         mypkgs.nextcloud.apache.modules ++
 268         mypkgs.connexionswing_dev.apache.modules ++
 269         mypkgs.connexionswing_prod.apache.modules ++
 270         mypkgs.ympd.apache.modules ++
 271         mypkgs.git.web.apache.modules ++
 272         mypkgs.mantisbt.apache.modules ++
 273         pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules) apacheConfig) ++
 274         [ "macro" ]);
 275       extraConfig = builtins.concatStringsSep "\n"
 276         (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig) apacheConfig);
 277       virtualHosts = [
 278         (withSSL "eldiron" // {
 279           listen = [ { ip = "*"; port = 443; } ];
 280           hostName = "eldiron.immae.eu";
 281           documentRoot = ./www;
 282           extraConfig = ''
 283             DirectoryIndex index.htm
 284             '';
 285         })
 286         (withSSL "eldiron" // {
 287           listen = [ { ip = "*"; port = 443; } ];
 288           hostName = "db-1.immae.eu";
 289           documentRoot = null;
 290           extraConfig = builtins.concatStringsSep "\n" [
 291             mypkgs.adminer.apache.vhostConf
 292           ];
 293         })
 294         (withSSL "eldiron" // {
 295           listen = [ { ip = "*"; port = 443; } ];
 296           hostName = "tools.immae.eu";
 297           documentRoot = null;
 298           extraConfig = builtins.concatStringsSep "\n" [
 299             mypkgs.adminer.apache.vhostConf
 300             mypkgs.ympd.apache.vhostConf
 301           ];
 302         })
 303         (withSSL "eldiron" // {
 304           listen = [ { ip = "*"; port = 443; } ];
 305           hostName = "connexionswing.immae.eu";
 306           serverAliases = [ "sandetludo.immae.eu" ];
 307           documentRoot = mypkgs.connexionswing_dev.webRoot;
 308           extraConfig = builtins.concatStringsSep "\n" [
 309             mypkgs.connexionswing_dev.apache.vhostConf
 310           ];
 311         })
 312         (withSSL "eldiron" // {
 313           listen = [ { ip = "*"; port = 443; } ];
 314           hostName = "cloud.immae.eu";
 315           documentRoot = mypkgs.nextcloud.webRoot;
 316           extraConfig = builtins.concatStringsSep "\n" [
 317             mypkgs.nextcloud.apache.vhostConf
 318           ];
 319         })
 320         (withSSL "eldiron" // {
 321           listen = [ { ip = "*"; port = 443; } ];
 322           hostName = "git.immae.eu";
 323           documentRoot = mypkgs.git.web.webRoot;
 324           extraConfig = builtins.concatStringsSep "\n" [
 325             mypkgs.git.web.apache.vhostConf
 326             mypkgs.mantisbt.apache.vhostConf
 327           ] + ''
 328             RewriteEngine on
 329             RewriteCond %{REQUEST_URI}       ^/releases
 330             RewriteRule /releases(.*)        https://release.immae.eu$1 [P,L]
 331             '';
 332         })
 333         { # Should go last, default fallback
 334           listen = [ { ip = "*"; port = 80; } ];
 335           hostName = "redirectSSL";
 336           serverAliases = [ "*" ];
 337           enableSSL = false;
 338           documentRoot = "/var/lib/acme/acme-challenge";
 339           extraConfig = ''
 340             RewriteEngine on
 341             RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
 342             RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
 343             # To redirect in specific "VirtualHost *:80", do
 344             #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
 345             # rather than rewrite
 346             '';
 347         }
 348         ];
 349     };
 350
 351     security.pam.services = let
 352       pam_ldap = pkgs.pam_ldap;
 353       pam_ldap_mysql = assert mylibs.checkEnv "NIXOPS_MYSQL_PAM_PASSWORD";
 354               pkgs.writeText "mysql.conf" ''
 355         host ldap.immae.eu
 356         base dc=immae,dc=eu
 357         binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 358         bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
 359         pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 360         '';
 361     in [
 362       {
 363         name = "mysql";
 364         text = ''
 365           # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
 366           auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 367           account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 368           '';
 369       }
 370     ];
 371
 372     # FIXME: backup
 373     services.redis = rec {
 374       enable = true;
 375       bind = "127.0.0.1";
 376       unixSocket = "/run/redis/redis.sock";
 377       extraConfig = ''
 378         unixsocketperm 777
 379         maxclients 1024
 380         '';
 381     };
 382
 383     # FIXME: initial sync
 384     # FIXME: backup
 385     # FIXME: restart after pam
 386     # FIXME: pam access doesn’t work (because of php module)
 387     # FIXME: ssl
 388     services.mysql = rec {
 389       enable = true;
 390       package = pkgs.mariadb.overrideAttrs(old: rec {
 391         cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
 392         buildInputs = old.buildInputs ++ [ pkgs.pam ];
 393       });
 394     };
 395
 396     # FIXME: initial sync
 397     # FIXME: backup
 398     # FIXME: ssl
 399     services.postgresql = rec {
 400       enable = true;
 401       package = pkgs.postgresql100.overrideAttrs(old: rec {
 402         passthru = old.passthru // { psqlSchema = "11.0"; };
 403         name = "postgresql-11.1";
 404         src = pkgs.fetchurl {
 405           url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
 406           sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
 407         };
 408       });
 409       enableTCPIP = true;
 410       extraConfig = ''
 411         max_connections = 100
 412         wal_level = logical
 413         shared_buffers = 128MB
 414         max_wal_size = 1GB
 415         min_wal_size = 80MB
 416         log_timezone = 'Europe/Paris'
 417         datestyle = 'iso, mdy'
 418         timezone = 'Europe/Paris'
 419         lc_messages = 'en_US.UTF-8'
 420         lc_monetary = 'en_US.UTF-8'
 421         lc_numeric = 'en_US.UTF-8'
 422         lc_time = 'en_US.UTF-8'
 423         default_text_search_config = 'pg_catalog.english'
 424         # ssl = on
 425         # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem'
 426         # ssl_key_file = '/var/lib/acme/eldiron/key.pem'
 427         '';
 428       authentication = ''
 429         local   all     postgres                                ident
 430         local   all     all                                     md5
 431         host    all     all             samehost                md5
 432         host    all     all             178.33.252.96/32        md5
 433         host    all     all             188.165.209.148/32      md5
 434         #host   all     all             all                     pam
 435       '';
 436     };
 437   };
 438 }