virtual/eldiron.nix

   1 {
   2   network = {
   3     description = "Immae's network";
   4     enableRollback = true;
   5   };
   6
   7   eldiron = { config, pkgs, ... }:
   8     let mypkgs = import ./packages.nix;
   9     in
  10   {
  11     networking = {
  12       firewall = {
  13         enable = true;
  14         allowedTCPPorts = [ 22 80 443 3306 5432 ];
  15       };
  16     };
  17
  18     deployment = {
  19       targetEnv = "hetzner";
  20       hetzner = {
  21         #robotUser = "defined in HETZNER_ROBOT_USER";
  22         #robotPass = "defined in HETZNER_ROBOT_PASS";
  23         mainIPv4 = "176.9.151.89";
  24         partitions = ''
  25           clearpart --all --initlabel --drives=sda,sdb
  26
  27           part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
  28           part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
  29
  30           part raid.1 --grow --ondisk=sda
  31           part raid.2 --grow --ondisk=sdb
  32
  33           raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  34         '';
  35       };
  36     };
  37
  38     # FIXME: how to run it? currently set as timer
  39     security.acme.certs = {
  40       "eldiron" = {
  41         webroot = "/var/lib/acme/acme-challenge";
  42         email = "ismael@bouya.org";
  43         domain = "eldiron.immae.eu";
  44         extraDomains = {
  45           "db-1.immae.eu" = null;
  46         };
  47       };
  48     };
  49
  50     # FIXME: open_basedir
  51     services.phpfpm = {
  52       extraConfig = ''
  53         log_level = notice
  54         '';
  55       poolConfigs = {
  56         adminer = ''
  57           listen = /var/run/phpfpm/adminer.sock
  58           user = wwwrun
  59           group = wwwrun
  60           listen.owner = wwwrun
  61           listen.group = wwwrun
  62           pm = ondemand
  63           pm.max_children = 5
  64           pm.process_idle_timeout = 60
  65           ;php_admin_flag[log_errors] = on
  66           php_admin_value[open_basedir] = "${mypkgs.adminer}:/tmp"
  67           '';
  68         www = ''
  69           listen = /var/run/phpfpm/www.sock
  70           user = wwwrun
  71           group = wwwrun
  72           listen.owner = wwwrun
  73           listen.group = wwwrun
  74           pm = ondemand
  75           pm.max_children = 5
  76           pm.process_idle_timeout = 60
  77           ;php_admin_flag[log_errors] = on
  78           php_admin_value[open_basedir] = "/var/www"
  79           '';
  80       };
  81     };
  82
  83     services.httpd = let
  84       withSSL = domain: {
  85         enableSSL = true;
  86         sslServerCert = "/var/lib/acme/${domain}/full.pem"; # FIXME: cert only?
  87         sslServerKey = "/var/lib/acme/${domain}/key.pem";
  88         sslServerChain = "/var/lib/acme/${domain}/fullchain.pem";
  89       };
  90     in rec {
  91       enable = true;
  92       logPerVirtualHost = true;
  93       multiProcessingModule = "worker";
  94       adminAddr = "httpd@immae.eu";
  95       extraModules = [
  96         "proxy_fcgi" # for PHP
  97       ];
  98       virtualHosts = [
  99         (withSSL "eldiron" // {
 100           listen = [ { ip = "*"; port = 443; } ];
 101           hostName = "eldiron.immae.eu";
 102           # FIXME: directory needs to exist
 103           documentRoot = "/var/www";
 104         })
 105         (withSSL "eldiron" // {
 106           listen = [ { ip = "*"; port = 443; } ];
 107           hostName = "db-1.immae.eu";
 108           documentRoot = null;
 109           extraConfig = ''
 110             Alias /adminer ${mypkgs.adminer}
 111             <Directory ${mypkgs.adminer}>
 112               DirectoryIndex = index.php
 113               <FilesMatch "\.php$">
 114                 SetHandler "proxy:unix:/var/run/phpfpm/adminer.sock|fcgi://localhost"
 115               </FilesMatch>
 116             </Directory>
 117             '';
 118         })
 119         { # Should go last, default fallback
 120           listen = [ { ip = "*"; port = 80; } ];
 121           hostName = "redirectSSL";
 122           serverAliases = [ "*" ];
 123           enableSSL = false;
 124           # FIXME: directory needs to exist
 125           documentRoot = "/var/lib/acme/acme-challenge";
 126           extraConfig = ''
 127             RewriteEngine on
 128             RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
 129             RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
 130             # To redirect in specific "VirtualHost *:80", do
 131             #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
 132             # rather than rewrite
 133             '';
 134         }
 135         ];
 136     };
 137
 138     services.nginx = rec {
 139       enable = false;
 140       virtualHosts = {
 141         "_" = {
 142           serverName = "_";
 143           useACMEHost = "eldiron";
 144         };
 145         "eldiron.immae.eu" = {
 146           forceSSL = true;
 147           useACMEHost = "eldiron";
 148           locations."/" = {
 149             # FIXME: directory needs to exist
 150             root = "/var/www";
 151             extraConfig = ''
 152               include ${pkgs.nginx}/conf/fastcgi.conf;
 153               fastcgi_split_path_info ^(.+?\.php)(/.*)$;
 154               fastcgi_param HTTP_PROXY "";
 155               fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
 156               fastcgi_pass unix:/var/run/phpfpm/www.sock;
 157               fastcgi_index index.php;
 158               fastcgi_intercept_errors on;
 159               '';
 160           };
 161         };
 162         "db-1.immae.eu" = {
 163           forceSSL = true;
 164           useACMEHost = "eldiron";
 165           locations."/adminer" = {
 166             alias = mypkgs.adminer;
 167             index = "index.php";
 168             extraConfig = ''
 169               include ${pkgs.nginx}/conf/fastcgi.conf;
 170               fastcgi_split_path_info ^(.+?\.php)(/.*)$;
 171               fastcgi_param HTTP_PROXY "";
 172               fastcgi_param SCRIPT_FILENAME ${mypkgs.adminer}/index.php;
 173               fastcgi_pass unix:/var/run/phpfpm/adminer.sock;
 174               fastcgi_index index.php;
 175               fastcgi_intercept_errors on;
 176               '';
 177           };
 178         };
 179       };
 180     };
 181
 182     # FIXME: environment variables ?
 183     security.pam.services = let
 184       pam_ldap = pkgs.pam_ldap;
 185       pam_ldap_mysql = pkgs.writeText "mysql.conf" ''
 186         host ldap.immae.eu
 187         base dc=immae,dc=eu
 188         binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 189         bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
 190         pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 191         '';
 192     in [
 193       {
 194         name = "mysql";
 195         text = ''
 196           # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
 197           auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 198           account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 199           '';
 200       }
 201     ];
 202
 203     # FIXME: initial sync
 204     # FIXME: backup
 205     # FIXME: restart after pam
 206     # FIXME: pam access doesn’t work (because of php module)
 207     services.mysql = rec {
 208       enable = true;
 209       package = pkgs.mariadb.overrideAttrs(old: rec {
 210         cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
 211         buildInputs = old.buildInputs ++ [ pkgs.pam ];
 212       });
 213     };
 214
 215     # FIXME: initial sync
 216     # FIXME: backup
 217     services.postgresql = rec {
 218       enable = true;
 219       package = pkgs.postgresql100.overrideAttrs(old: rec {
 220         passthru = old.passthru // { psqlSchema = "11.0"; };
 221         name = "postgresql-11.1";
 222         src = pkgs.fetchurl {
 223           url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
 224           sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
 225         };
 226       });
 227       enableTCPIP = true;
 228       extraConfig = ''
 229         max_connections = 100
 230         wal_level = logical
 231         shared_buffers = 128MB
 232         max_wal_size = 1GB
 233         min_wal_size = 80MB
 234         log_timezone = 'Europe/Paris'
 235         datestyle = 'iso, mdy'
 236         timezone = 'Europe/Paris'
 237         lc_messages = 'en_US.UTF-8'
 238         lc_monetary = 'en_US.UTF-8'
 239         lc_numeric = 'en_US.UTF-8'
 240         lc_time = 'en_US.UTF-8'
 241         default_text_search_config = 'pg_catalog.english'
 242         # ssl = on
 243         # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem'
 244         # ssl_key_file = '/var/lib/acme/eldiron/key.pem'
 245         '';
 246       authentication = ''
 247         local   all     postgres                                ident
 248         local   all     all                                     md5
 249         host    all     all             178.33.252.96/32        md5
 250         host    all     all             188.165.209.148/32      md5
 251         #host   all     all             all                     pam
 252       '';
 253     };
 254   };
 255 }