virtual/eldiron.nix

   1 {
   2   network = {
   3     description = "Immae's network";
   4     enableRollback = true;
   5   };
   6
   7   eldiron = { config, pkgs, ... }:
   8     let mypkgs = import ./packages.nix;
   9     in
  10   {
  11     networking = {
  12       firewall = {
  13         enable = true;
  14         allowedTCPPorts = [ 22 80 443 3306 5432 ];
  15       };
  16     };
  17
  18     deployment = {
  19       targetEnv = "hetzner";
  20       hetzner = {
  21         #robotUser = "defined in HETZNER_ROBOT_USER";
  22         #robotPass = "defined in HETZNER_ROBOT_PASS";
  23         mainIPv4 = "176.9.151.89";
  24         partitions = ''
  25           clearpart --all --initlabel --drives=sda,sdb
  26
  27           part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
  28           part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
  29
  30           part raid.1 --grow --ondisk=sda
  31           part raid.2 --grow --ondisk=sdb
  32
  33           raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  34         '';
  35       };
  36     };
  37
  38     # FIXME: how to run it? currently set as timer
  39     security.acme.certs = {
  40       "eldiron" = {
  41         webroot = "/var/lib/acme/acme-challenge";
  42         email = "ismael@bouya.org";
  43         domain = "eldiron.immae.eu";
  44         plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
  45         postRun = ''
  46           "systemctl reload httpd.service"
  47         '';
  48         extraDomains = {
  49           "db-1.immae.eu" = null;
  50           "tools.immae.eu" = null;
  51         };
  52       };
  53     };
  54
  55     services.ympd = mypkgs.ympd.config // { enable = true; };
  56
  57     # FIXME: open_basedir
  58     services.phpfpm = {
  59       extraConfig = ''
  60         log_level = notice
  61         '';
  62       poolConfigs = {
  63         adminer = mypkgs.adminer.phpFpm.pool;
  64         www = ''
  65           listen = /var/run/phpfpm/www.sock
  66           user = wwwrun
  67           group = wwwrun
  68           listen.owner = wwwrun
  69           listen.group = wwwrun
  70           pm = ondemand
  71           pm.max_children = 5
  72           pm.process_idle_timeout = 60
  73           ;php_admin_flag[log_errors] = on
  74           php_admin_value[open_basedir] = "/var/www"
  75           '';
  76       };
  77     };
  78
  79     services.httpd = let
  80       withSSL = domain: {
  81         enableSSL = true;
  82         sslServerCert = "/var/lib/acme/${domain}/full.pem"; # FIXME: cert only?
  83         sslServerKey = "/var/lib/acme/${domain}/key.pem";
  84         sslServerChain = "/var/lib/acme/${domain}/fullchain.pem";
  85       };
  86     in rec {
  87       enable = true;
  88       logPerVirtualHost = true;
  89       multiProcessingModule = "worker";
  90       adminAddr = "httpd@immae.eu";
  91       # FIXME: http2
  92       extraModules = pkgs.lib.lists.unique (
  93         mypkgs.adminer.apache.modules ++
  94         [
  95           "macro"
  96           "ldap"
  97           "authnz_ldap"
  98         ]);
  99       extraConfig = ''
 100         <IfModule ldap_module>
 101           LDAPSharedCacheSize 500000
 102           LDAPCacheEntries 1024
 103           LDAPCacheTTL 600
 104           LDAPOpCacheEntries 1024
 105           LDAPOpCacheTTL 600
 106         </IfModule>
 107
 108         <Macro LDAPConnect>
 109           <IfModule authnz_ldap_module>
 110             AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu
 111             AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 112             AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
 113             AuthType             Basic
 114             AuthName             "Authentification requise (Acces LDAP)"
 115             AuthBasicProvider    ldap
 116           </IfModule>
 117         </Macro>
 118         '';
 119       virtualHosts = [
 120         (withSSL "eldiron" // {
 121           listen = [ { ip = "*"; port = 443; } ];
 122           hostName = "eldiron.immae.eu";
 123           # FIXME: directory needs to exist
 124           documentRoot = "/var/www";
 125         })
 126         (withSSL "eldiron" // {
 127           listen = [ { ip = "*"; port = 443; } ];
 128           hostName = "db-1.immae.eu";
 129           documentRoot = null;
 130           extraConfig = builtins.concatStringsSep "\n" [
 131             mypkgs.adminer.apache.vhostConf
 132           ];
 133         })
 134         (withSSL "eldiron" // {
 135           listen = [ { ip = "*"; port = 443; } ];
 136           hostName = "tools.immae.eu";
 137           documentRoot = null;
 138           extraConfig = builtins.concatStringsSep "\n" [
 139             mypkgs.adminer.apache.vhostConf
 140             mypkgs.ympd.apache.vhostConf
 141           ];
 142         })
 143         { # Should go last, default fallback
 144           listen = [ { ip = "*"; port = 80; } ];
 145           hostName = "redirectSSL";
 146           serverAliases = [ "*" ];
 147           enableSSL = false;
 148           # FIXME: directory needs to exist
 149           documentRoot = "/var/lib/acme/acme-challenge";
 150           extraConfig = ''
 151             RewriteEngine on
 152             RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
 153             RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
 154             # To redirect in specific "VirtualHost *:80", do
 155             #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
 156             # rather than rewrite
 157             '';
 158         }
 159         ];
 160     };
 161
 162     # FIXME: environment variables ?
 163     security.pam.services = let
 164       pam_ldap = pkgs.pam_ldap;
 165       pam_ldap_mysql = pkgs.writeText "mysql.conf" ''
 166         host ldap.immae.eu
 167         base dc=immae,dc=eu
 168         binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 169         bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
 170         pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 171         '';
 172     in [
 173       {
 174         name = "mysql";
 175         text = ''
 176           # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
 177           auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 178           account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 179           '';
 180       }
 181     ];
 182
 183     # FIXME: initial sync
 184     # FIXME: backup
 185     # FIXME: restart after pam
 186     # FIXME: pam access doesn’t work (because of php module)
 187     # FIXME: ssl
 188     services.mysql = rec {
 189       enable = true;
 190       package = pkgs.mariadb.overrideAttrs(old: rec {
 191         cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
 192         buildInputs = old.buildInputs ++ [ pkgs.pam ];
 193       });
 194     };
 195
 196     # FIXME: initial sync
 197     # FIXME: backup
 198     # FIXME: ssl
 199     services.postgresql = rec {
 200       enable = true;
 201       package = pkgs.postgresql100.overrideAttrs(old: rec {
 202         passthru = old.passthru // { psqlSchema = "11.0"; };
 203         name = "postgresql-11.1";
 204         src = pkgs.fetchurl {
 205           url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
 206           sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
 207         };
 208       });
 209       enableTCPIP = true;
 210       extraConfig = ''
 211         max_connections = 100
 212         wal_level = logical
 213         shared_buffers = 128MB
 214         max_wal_size = 1GB
 215         min_wal_size = 80MB
 216         log_timezone = 'Europe/Paris'
 217         datestyle = 'iso, mdy'
 218         timezone = 'Europe/Paris'
 219         lc_messages = 'en_US.UTF-8'
 220         lc_monetary = 'en_US.UTF-8'
 221         lc_numeric = 'en_US.UTF-8'
 222         lc_time = 'en_US.UTF-8'
 223         default_text_search_config = 'pg_catalog.english'
 224         # ssl = on
 225         # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem'
 226         # ssl_key_file = '/var/lib/acme/eldiron/key.pem'
 227         '';
 228       authentication = ''
 229         local   all     postgres                                ident
 230         local   all     all                                     md5
 231         host    all     all             178.33.252.96/32        md5
 232         host    all     all             188.165.209.148/32      md5
 233         #host   all     all             all                     pam
 234       '';
 235     };
 236   };
 237 }