virtual/eldiron.nix

   1 {
   2   network = {
   3     description = "Immae's network";
   4     enableRollback = true;
   5   };
   6
   7   eldiron = { config, pkgs, ... }:
   8     let mypkgs = import ./packages.nix;
   9         mylibs = import ../libs.nix;
  10     in
  11   {
  12     networking = {
  13       firewall = {
  14         enable = true;
  15         allowedTCPPorts = [ 22 80 443 3306 5432 ];
  16       };
  17     };
  18
  19     deployment = {
  20       targetEnv = "hetzner";
  21       hetzner = {
  22         #robotUser = "defined in HETZNER_ROBOT_USER";
  23         #robotPass = "defined in HETZNER_ROBOT_PASS";
  24         mainIPv4 = "176.9.151.89";
  25         partitions = ''
  26           clearpart --all --initlabel --drives=sda,sdb
  27
  28           part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
  29           part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
  30
  31           part raid.1 --grow --ondisk=sda
  32           part raid.2 --grow --ondisk=sdb
  33
  34           raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  35         '';
  36       };
  37     };
  38
  39     environment.systemPackages = [
  40       pkgs.telnet
  41       pkgs.vim
  42     ];
  43
  44     security.acme.certs = {
  45       "eldiron" = {
  46         webroot = "/var/lib/acme/acme-challenge";
  47         email = "ismael@bouya.org";
  48         domain = "eldiron.immae.eu";
  49         plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
  50         postRun = ''
  51           systemctl reload httpd.service
  52         '';
  53         extraDomains = {
  54           "db-1.immae.eu" = null;
  55           "tools.immae.eu" = null;
  56           "connexionswing.immae.eu" = null;
  57           "sandetludo.immae.eu" = null;
  58         };
  59       };
  60       # "connexionswing" = {
  61       #   webroot = "/var/lib/acme/acme-challenge";
  62       #   email = "ismael@bouya.org";
  63       #   domain = "connexionswing.com";
  64       #   plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
  65       #   postRun = ''
  66       #     systemctl reload httpd.service
  67       #   '';
  68       #   extraDomains = {
  69       #     "www.connexionswing.com" = null;
  70       #     "sandetludo.com" = null;
  71       #     "www.sandetludo.com" = null;
  72       #   };
  73       # };
  74     };
  75
  76     services.ympd = mypkgs.ympd.config // { enable = true; };
  77
  78     services.phpfpm = {
  79       extraConfig = ''
  80         log_level = notice
  81         '';
  82       poolConfigs = {
  83         adminer = mypkgs.adminer.phpFpm.pool;
  84         connexionswing_dev = mypkgs.connexionswing_dev.phpFpm.pool;
  85         connexionswing_prod = mypkgs.connexionswing_prod.phpFpm.pool;
  86       };
  87     };
  88
  89     system.activationScripts = {
  90       connexionswing_dev  = mypkgs.connexionswing_dev.activationScript;
  91       connexionswing_prod = mypkgs.connexionswing_prod.activationScript;
  92       httpd = ''
  93         install -d -m 0755 /var/lib/acme/acme-challenge
  94         '';
  95       redis = ''
  96         mkdir -p /run/redis
  97         chown redis /run/redis
  98         '';
  99     };
 100
 101     services.httpd = let
 102       withSSL = domain: {
 103         enableSSL = true;
 104         sslServerCert = "/var/lib/acme/${domain}/cert.pem";
 105         sslServerKey = "/var/lib/acme/${domain}/key.pem";
 106         sslServerChain = "/var/lib/acme/${domain}/fullchain.pem";
 107       };
 108       apacheConfig = {
 109         gzip = {
 110           modules = [ "deflate" "filter" ];
 111           extraConfig = ''
 112             AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
 113           '';
 114         };
 115         ldap = {
 116           modules = [ "ldap" "authnz_ldap" ];
 117           extraConfig = assert mylibs.checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; ''
 118             <IfModule ldap_module>
 119               LDAPSharedCacheSize 500000
 120               LDAPCacheEntries 1024
 121               LDAPCacheTTL 600
 122               LDAPOpCacheEntries 1024
 123               LDAPOpCacheTTL 600
 124             </IfModule>
 125
 126             <Macro LDAPConnect>
 127               <IfModule authnz_ldap_module>
 128                 AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu
 129                 AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 130                 AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
 131                 AuthType             Basic
 132                 AuthName             "Authentification requise (Acces LDAP)"
 133                 AuthBasicProvider    ldap
 134               </IfModule>
 135             </Macro>
 136           '';
 137         };
 138       };
 139     in rec {
 140       enable = true;
 141       logPerVirtualHost = true;
 142       multiProcessingModule = "worker";
 143       adminAddr = "httpd@immae.eu";
 144       # FIXME: http2
 145       # FIXME: voir les autres modules:
 146       #    authz_core_module
 147       #    reqtimeout_module
 148       #    http2_module
 149       #    version_module
 150       #    proxy_connect_module
 151       #    proxy_ftp_module
 152       #    proxy_scgi_module
 153       #    proxy_ajp_module
 154       #    proxy_balancer_module
 155       #    proxy_express_module
 156       #    lbmethod_byrequests_module
 157       #    lbmethod_bytraffic_module
 158       #    lbmethod_bybusyness_module
 159       #    lbmethod_heartbeat_module
 160
 161       extraModules = pkgs.lib.lists.unique (
 162         mypkgs.adminer.apache.modules ++
 163         mypkgs.connexionswing_dev.apache.modules ++
 164         mypkgs.connexionswing_prod.apache.modules ++
 165         mypkgs.ympd.apache.modules ++
 166         pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules) apacheConfig) ++
 167         [ "macro" ]);
 168       extraConfig = builtins.concatStringsSep "\n"
 169         (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig) apacheConfig);
 170       virtualHosts = [
 171         (withSSL "eldiron" // {
 172           listen = [ { ip = "*"; port = 443; } ];
 173           hostName = "eldiron.immae.eu";
 174           documentRoot = ./www;
 175           extraConfig = ''
 176             DirectoryIndex index.htm
 177             '';
 178         })
 179         (withSSL "eldiron" // {
 180           listen = [ { ip = "*"; port = 443; } ];
 181           hostName = "db-1.immae.eu";
 182           documentRoot = null;
 183           extraConfig = builtins.concatStringsSep "\n" [
 184             mypkgs.adminer.apache.vhostConf
 185           ];
 186         })
 187         (withSSL "eldiron" // {
 188           listen = [ { ip = "*"; port = 443; } ];
 189           hostName = "tools.immae.eu";
 190           documentRoot = null;
 191           extraConfig = builtins.concatStringsSep "\n" [
 192             mypkgs.adminer.apache.vhostConf
 193             mypkgs.ympd.apache.vhostConf
 194           ];
 195         })
 196         (withSSL "eldiron" // {
 197           listen = [ { ip = "*"; port = 443; } ];
 198           hostName = "connexionswing.immae.eu";
 199           serverAliases = [ "sandetludo.immae.eu" ];
 200           documentRoot = mypkgs.connexionswing_dev.webRoot;
 201           extraConfig = builtins.concatStringsSep "\n" [
 202             mypkgs.connexionswing_dev.apache.vhostConf
 203           ];
 204         })
 205         { # Should go last, default fallback
 206           listen = [ { ip = "*"; port = 80; } ];
 207           hostName = "redirectSSL";
 208           serverAliases = [ "*" ];
 209           enableSSL = false;
 210           documentRoot = "/var/lib/acme/acme-challenge";
 211           extraConfig = ''
 212             RewriteEngine on
 213             RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
 214             RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
 215             # To redirect in specific "VirtualHost *:80", do
 216             #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
 217             # rather than rewrite
 218             '';
 219         }
 220         ];
 221     };
 222
 223     security.pam.services = let
 224       pam_ldap = pkgs.pam_ldap;
 225       pam_ldap_mysql = assert mylibs.checkEnv "NIXOPS_MYSQL_PAM_PASSWORD";
 226               pkgs.writeText "mysql.conf" ''
 227         host ldap.immae.eu
 228         base dc=immae,dc=eu
 229         binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 230         bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
 231         pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 232         '';
 233     in [
 234       {
 235         name = "mysql";
 236         text = ''
 237           # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
 238           auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 239           account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 240           '';
 241       }
 242     ];
 243
 244     # FIXME: backup
 245     services.redis = rec {
 246       enable = true;
 247       bind = "127.0.0.1";
 248       unixSocket = "/run/redis/redis.sock";
 249       extraConfig = ''
 250         unixsocketperm 777
 251         maxclients 1024
 252         '';
 253     };
 254
 255     # FIXME: initial sync
 256     # FIXME: backup
 257     # FIXME: restart after pam
 258     # FIXME: pam access doesn’t work (because of php module)
 259     # FIXME: ssl
 260     services.mysql = rec {
 261       enable = true;
 262       package = pkgs.mariadb.overrideAttrs(old: rec {
 263         cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
 264         buildInputs = old.buildInputs ++ [ pkgs.pam ];
 265       });
 266     };
 267
 268     # FIXME: initial sync
 269     # FIXME: backup
 270     # FIXME: ssl
 271     services.postgresql = rec {
 272       enable = true;
 273       package = pkgs.postgresql100.overrideAttrs(old: rec {
 274         passthru = old.passthru // { psqlSchema = "11.0"; };
 275         name = "postgresql-11.1";
 276         src = pkgs.fetchurl {
 277           url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
 278           sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
 279         };
 280       });
 281       enableTCPIP = true;
 282       extraConfig = ''
 283         max_connections = 100
 284         wal_level = logical
 285         shared_buffers = 128MB
 286         max_wal_size = 1GB
 287         min_wal_size = 80MB
 288         log_timezone = 'Europe/Paris'
 289         datestyle = 'iso, mdy'
 290         timezone = 'Europe/Paris'
 291         lc_messages = 'en_US.UTF-8'
 292         lc_monetary = 'en_US.UTF-8'
 293         lc_numeric = 'en_US.UTF-8'
 294         lc_time = 'en_US.UTF-8'
 295         default_text_search_config = 'pg_catalog.english'
 296         # ssl = on
 297         # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem'
 298         # ssl_key_file = '/var/lib/acme/eldiron/key.pem'
 299         '';
 300       authentication = ''
 301         local   all     postgres                                ident
 302         local   all     all                                     md5
 303         host    all     all             178.33.252.96/32        md5
 304         host    all     all             188.165.209.148/32      md5
 305         #host   all     all             all                     pam
 306       '';
 307     };
 308   };
 309 }