virtual/eldiron.nix

   1 {
   2   network = {
   3     description = "Immae's network";
   4     enableRollback = true;
   5   };
   6
   7   eldiron = { config, pkgs, ... }:
   8     let mypkgs = import ./packages.nix;
   9         mylibs = import ../libs.nix;
  10     in
  11   {
  12     networking = {
  13       firewall = {
  14         enable = true;
  15         allowedTCPPorts = [ 22 80 443 3306 5432 ];
  16       };
  17     };
  18
  19     deployment = {
  20       targetEnv = "hetzner";
  21       hetzner = {
  22         #robotUser = "defined in HETZNER_ROBOT_USER";
  23         #robotPass = "defined in HETZNER_ROBOT_PASS";
  24         mainIPv4 = "176.9.151.89";
  25         partitions = ''
  26           clearpart --all --initlabel --drives=sda,sdb
  27
  28           part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
  29           part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
  30
  31           part raid.1 --grow --ondisk=sda
  32           part raid.2 --grow --ondisk=sdb
  33
  34           raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  35         '';
  36       };
  37     };
  38
  39     environment.systemPackages = let
  40       # FIXME: move it to nextcloud
  41       occ = pkgs.writeScriptBin "nextcloud-occ" ''
  42         #! ${pkgs.stdenv.shell}
  43         cd ${mypkgs.nextcloud.webRoot}
  44         NEXTCLOUD_CONFIG_DIR="${mypkgs.nextcloud.webRoot}/config" \
  45           exec \
  46           ${config.services.phpfpm.phpPackage}/bin/php \
  47           -c ${config.services.phpfpm.phpPackage}/etc/php.ini \
  48           occ $*
  49         '';
  50     in [
  51       pkgs.telnet
  52       pkgs.vim
  53       occ
  54     ];
  55
  56     security.acme.certs = {
  57       "eldiron" = {
  58         webroot = "/var/lib/acme/acme-challenge";
  59         email = "ismael@bouya.org";
  60         domain = "eldiron.immae.eu";
  61         plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
  62         postRun = ''
  63           systemctl reload httpd.service
  64         '';
  65         extraDomains = {
  66           "db-1.immae.eu" = null;
  67           "tools.immae.eu" = null;
  68           "connexionswing.immae.eu" = null;
  69           "sandetludo.immae.eu" = null;
  70           "cloud.immae.eu" = null;
  71         };
  72       };
  73       # "connexionswing" = {
  74       #   webroot = "/var/lib/acme/acme-challenge";
  75       #   email = "ismael@bouya.org";
  76       #   domain = "connexionswing.com";
  77       #   plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
  78       #   postRun = ''
  79       #     systemctl reload httpd.service
  80       #   '';
  81       #   extraDomains = {
  82       #     "www.connexionswing.com" = null;
  83       #     "sandetludo.com" = null;
  84       #     "www.sandetludo.com" = null;
  85       #   };
  86       # };
  87     };
  88
  89     services.ympd = mypkgs.ympd.config // { enable = true; };
  90
  91     services.phpfpm = {
  92       # /!\ phppackage is used in nextcloud configuation
  93       phpOptions = ''
  94         ; For nextcloud
  95         extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
  96         ; For nextcloud
  97         extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
  98         '';
  99       extraConfig = ''
 100         log_level = notice
 101         '';
 102       poolConfigs = {
 103         adminer = mypkgs.adminer.phpFpm.pool;
 104         connexionswing_dev = mypkgs.connexionswing_dev.phpFpm.pool;
 105         connexionswing_prod = mypkgs.connexionswing_prod.phpFpm.pool;
 106         nextcloud = mypkgs.nextcloud.phpFpm.pool;
 107       };
 108     };
 109
 110     system.activationScripts = {
 111       connexionswing_dev  = mypkgs.connexionswing_dev.activationScript;
 112       connexionswing_prod = mypkgs.connexionswing_prod.activationScript;
 113       nextcloud = mypkgs.nextcloud.activationScript;
 114       httpd = ''
 115         install -d -m 0755 /var/lib/acme/acme-challenge
 116         '';
 117       redis = ''
 118         mkdir -p /run/redis
 119         chown redis /run/redis
 120         '';
 121     };
 122
 123     services.httpd = let
 124       withSSL = domain: {
 125         enableSSL = true;
 126         sslServerCert = "/var/lib/acme/${domain}/cert.pem";
 127         sslServerKey = "/var/lib/acme/${domain}/key.pem";
 128         sslServerChain = "/var/lib/acme/${domain}/fullchain.pem";
 129       };
 130       apacheConfig = {
 131         gzip = {
 132           modules = [ "deflate" "filter" ];
 133           extraConfig = ''
 134             AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
 135           '';
 136         };
 137         ldap = {
 138           modules = [ "ldap" "authnz_ldap" ];
 139           extraConfig = assert mylibs.checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; ''
 140             <IfModule ldap_module>
 141               LDAPSharedCacheSize 500000
 142               LDAPCacheEntries 1024
 143               LDAPCacheTTL 600
 144               LDAPOpCacheEntries 1024
 145               LDAPOpCacheTTL 600
 146             </IfModule>
 147
 148             <Macro LDAPConnect>
 149               <IfModule authnz_ldap_module>
 150                 AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu
 151                 AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 152                 AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
 153                 AuthType             Basic
 154                 AuthName             "Authentification requise (Acces LDAP)"
 155                 AuthBasicProvider    ldap
 156               </IfModule>
 157             </Macro>
 158           '';
 159         };
 160       };
 161     in rec {
 162       enable = true;
 163       logPerVirtualHost = true;
 164       multiProcessingModule = "worker";
 165       adminAddr = "httpd@immae.eu";
 166       # FIXME: http2
 167       # FIXME: voir les autres modules:
 168       #    authz_core_module
 169       #    reqtimeout_module
 170       #    http2_module
 171       #    version_module
 172       #    proxy_connect_module
 173       #    proxy_ftp_module
 174       #    proxy_scgi_module
 175       #    proxy_ajp_module
 176       #    proxy_balancer_module
 177       #    proxy_express_module
 178       #    lbmethod_byrequests_module
 179       #    lbmethod_bytraffic_module
 180       #    lbmethod_bybusyness_module
 181       #    lbmethod_heartbeat_module
 182
 183       extraModules = pkgs.lib.lists.unique (
 184         mypkgs.adminer.apache.modules ++
 185         mypkgs.nextcloud.apache.modules ++
 186         mypkgs.connexionswing_dev.apache.modules ++
 187         mypkgs.connexionswing_prod.apache.modules ++
 188         mypkgs.ympd.apache.modules ++
 189         pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules) apacheConfig) ++
 190         [ "macro" ]);
 191       extraConfig = builtins.concatStringsSep "\n"
 192         (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig) apacheConfig);
 193       virtualHosts = [
 194         (withSSL "eldiron" // {
 195           listen = [ { ip = "*"; port = 443; } ];
 196           hostName = "eldiron.immae.eu";
 197           documentRoot = ./www;
 198           extraConfig = ''
 199             DirectoryIndex index.htm
 200             '';
 201         })
 202         (withSSL "eldiron" // {
 203           listen = [ { ip = "*"; port = 443; } ];
 204           hostName = "db-1.immae.eu";
 205           documentRoot = null;
 206           extraConfig = builtins.concatStringsSep "\n" [
 207             mypkgs.adminer.apache.vhostConf
 208           ];
 209         })
 210         (withSSL "eldiron" // {
 211           listen = [ { ip = "*"; port = 443; } ];
 212           hostName = "tools.immae.eu";
 213           documentRoot = null;
 214           extraConfig = builtins.concatStringsSep "\n" [
 215             mypkgs.adminer.apache.vhostConf
 216             mypkgs.ympd.apache.vhostConf
 217           ];
 218         })
 219         (withSSL "eldiron" // {
 220           listen = [ { ip = "*"; port = 443; } ];
 221           hostName = "connexionswing.immae.eu";
 222           serverAliases = [ "sandetludo.immae.eu" ];
 223           documentRoot = mypkgs.connexionswing_dev.webRoot;
 224           extraConfig = builtins.concatStringsSep "\n" [
 225             mypkgs.connexionswing_dev.apache.vhostConf
 226           ];
 227         })
 228         (withSSL "eldiron" // {
 229           listen = [ { ip = "*"; port = 443; } ];
 230           hostName = "cloud.immae.eu";
 231           documentRoot = mypkgs.nextcloud.webRoot;
 232           extraConfig = builtins.concatStringsSep "\n" [
 233             mypkgs.nextcloud.apache.vhostConf
 234           ];
 235         })
 236         { # Should go last, default fallback
 237           listen = [ { ip = "*"; port = 80; } ];
 238           hostName = "redirectSSL";
 239           serverAliases = [ "*" ];
 240           enableSSL = false;
 241           documentRoot = "/var/lib/acme/acme-challenge";
 242           extraConfig = ''
 243             RewriteEngine on
 244             RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
 245             RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
 246             # To redirect in specific "VirtualHost *:80", do
 247             #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
 248             # rather than rewrite
 249             '';
 250         }
 251         ];
 252     };
 253
 254     security.pam.services = let
 255       pam_ldap = pkgs.pam_ldap;
 256       pam_ldap_mysql = assert mylibs.checkEnv "NIXOPS_MYSQL_PAM_PASSWORD";
 257               pkgs.writeText "mysql.conf" ''
 258         host ldap.immae.eu
 259         base dc=immae,dc=eu
 260         binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 261         bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
 262         pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 263         '';
 264     in [
 265       {
 266         name = "mysql";
 267         text = ''
 268           # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
 269           auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 270           account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 271           '';
 272       }
 273     ];
 274
 275     # FIXME: backup
 276     services.redis = rec {
 277       enable = true;
 278       bind = "127.0.0.1";
 279       unixSocket = "/run/redis/redis.sock";
 280       extraConfig = ''
 281         unixsocketperm 777
 282         maxclients 1024
 283         '';
 284     };
 285
 286     # FIXME: initial sync
 287     # FIXME: backup
 288     # FIXME: restart after pam
 289     # FIXME: pam access doesn’t work (because of php module)
 290     # FIXME: ssl
 291     services.mysql = rec {
 292       enable = true;
 293       package = pkgs.mariadb.overrideAttrs(old: rec {
 294         cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
 295         buildInputs = old.buildInputs ++ [ pkgs.pam ];
 296       });
 297     };
 298
 299     # FIXME: initial sync
 300     # FIXME: backup
 301     # FIXME: ssl
 302     services.postgresql = rec {
 303       enable = true;
 304       package = pkgs.postgresql100.overrideAttrs(old: rec {
 305         passthru = old.passthru // { psqlSchema = "11.0"; };
 306         name = "postgresql-11.1";
 307         src = pkgs.fetchurl {
 308           url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
 309           sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
 310         };
 311       });
 312       enableTCPIP = true;
 313       extraConfig = ''
 314         max_connections = 100
 315         wal_level = logical
 316         shared_buffers = 128MB
 317         max_wal_size = 1GB
 318         min_wal_size = 80MB
 319         log_timezone = 'Europe/Paris'
 320         datestyle = 'iso, mdy'
 321         timezone = 'Europe/Paris'
 322         lc_messages = 'en_US.UTF-8'
 323         lc_monetary = 'en_US.UTF-8'
 324         lc_numeric = 'en_US.UTF-8'
 325         lc_time = 'en_US.UTF-8'
 326         default_text_search_config = 'pg_catalog.english'
 327         # ssl = on
 328         # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem'
 329         # ssl_key_file = '/var/lib/acme/eldiron/key.pem'
 330         '';
 331       authentication = ''
 332         local   all     postgres                                ident
 333         local   all     all                                     md5
 334         host    all     all             178.33.252.96/32        md5
 335         host    all     all             188.165.209.148/32      md5
 336         #host   all     all             all                     pam
 337       '';
 338     };
 339   };
 340 }