virtual/eldiron.nix

   1 {
   2   network = {
   3     description = "Immae's network";
   4     enableRollback = true;
   5   };
   6
   7   eldiron = { config, pkgs, ... }:
   8     let mypkgs = import ./packages.nix;
   9         mylibs = import ../libs.nix;
  10     in
  11   {
  12     networking = {
  13       firewall = {
  14         enable = true;
  15         allowedTCPPorts = [ 22 80 443 3306 5432 ];
  16       };
  17     };
  18
  19     deployment = {
  20       targetEnv = "hetzner";
  21       hetzner = {
  22         #robotUser = "defined in HETZNER_ROBOT_USER";
  23         #robotPass = "defined in HETZNER_ROBOT_PASS";
  24         mainIPv4 = "176.9.151.89";
  25         partitions = ''
  26           clearpart --all --initlabel --drives=sda,sdb
  27
  28           part swap1 --recommended --label=swap1 --fstype=swap --ondisk=sda
  29           part swap2 --recommended --label=swap2 --fstype=swap --ondisk=sdb
  30
  31           part raid.1 --grow --ondisk=sda
  32           part raid.2 --grow --ondisk=sdb
  33
  34           raid / --level=1 --device=md0 --fstype=ext4 --label=root raid.1 raid.2
  35         '';
  36       };
  37     };
  38
  39     # FIXME: how to run it? currently set as timer
  40     security.acme.certs = {
  41       "eldiron" = {
  42         webroot = "/var/lib/acme/acme-challenge";
  43         email = "ismael@bouya.org";
  44         domain = "eldiron.immae.eu";
  45         plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
  46         postRun = ''
  47           "systemctl reload httpd.service"
  48         '';
  49         extraDomains = {
  50           "db-1.immae.eu" = null;
  51           "tools.immae.eu" = null;
  52         };
  53       };
  54     };
  55
  56     services.ympd = mypkgs.ympd.config // { enable = true; };
  57
  58     # FIXME: open_basedir
  59     services.phpfpm = {
  60       extraConfig = ''
  61         log_level = notice
  62         '';
  63       poolConfigs = {
  64         adminer = mypkgs.adminer.phpFpm.pool;
  65         www = ''
  66           listen = /var/run/phpfpm/www.sock
  67           user = wwwrun
  68           group = wwwrun
  69           listen.owner = wwwrun
  70           listen.group = wwwrun
  71           pm = ondemand
  72           pm.max_children = 5
  73           pm.process_idle_timeout = 60
  74           ;php_admin_flag[log_errors] = on
  75           php_admin_value[open_basedir] = "/var/www"
  76           '';
  77       };
  78     };
  79
  80     services.httpd = let
  81       withSSL = domain: {
  82         enableSSL = true;
  83         sslServerCert = "/var/lib/acme/${domain}/full.pem"; # FIXME: cert only?
  84         sslServerKey = "/var/lib/acme/${domain}/key.pem";
  85         sslServerChain = "/var/lib/acme/${domain}/fullchain.pem";
  86       };
  87     in rec {
  88       enable = true;
  89       logPerVirtualHost = true;
  90       multiProcessingModule = "worker";
  91       adminAddr = "httpd@immae.eu";
  92       # FIXME: http2
  93       extraModules = pkgs.lib.lists.unique (
  94         mypkgs.adminer.apache.modules ++
  95         [
  96           "macro"
  97           "ldap"
  98           "authnz_ldap"
  99         ]);
 100       extraConfig = assert mylibs.checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; ''
 101         <IfModule ldap_module>
 102           LDAPSharedCacheSize 500000
 103           LDAPCacheEntries 1024
 104           LDAPCacheTTL 600
 105           LDAPOpCacheEntries 1024
 106           LDAPOpCacheTTL 600
 107         </IfModule>
 108
 109         <Macro LDAPConnect>
 110           <IfModule authnz_ldap_module>
 111             AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu
 112             AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 113             AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
 114             AuthType             Basic
 115             AuthName             "Authentification requise (Acces LDAP)"
 116             AuthBasicProvider    ldap
 117           </IfModule>
 118         </Macro>
 119         '';
 120       virtualHosts = [
 121         (withSSL "eldiron" // {
 122           listen = [ { ip = "*"; port = 443; } ];
 123           hostName = "eldiron.immae.eu";
 124           # FIXME: directory needs to exist
 125           documentRoot = "/var/www";
 126         })
 127         (withSSL "eldiron" // {
 128           listen = [ { ip = "*"; port = 443; } ];
 129           hostName = "db-1.immae.eu";
 130           documentRoot = null;
 131           extraConfig = builtins.concatStringsSep "\n" [
 132             mypkgs.adminer.apache.vhostConf
 133           ];
 134         })
 135         (withSSL "eldiron" // {
 136           listen = [ { ip = "*"; port = 443; } ];
 137           hostName = "tools.immae.eu";
 138           documentRoot = null;
 139           extraConfig = builtins.concatStringsSep "\n" [
 140             mypkgs.adminer.apache.vhostConf
 141             mypkgs.ympd.apache.vhostConf
 142           ];
 143         })
 144         { # Should go last, default fallback
 145           listen = [ { ip = "*"; port = 80; } ];
 146           hostName = "redirectSSL";
 147           serverAliases = [ "*" ];
 148           enableSSL = false;
 149           # FIXME: directory needs to exist
 150           documentRoot = "/var/lib/acme/acme-challenge";
 151           extraConfig = ''
 152             RewriteEngine on
 153             RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
 154             RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
 155             # To redirect in specific "VirtualHost *:80", do
 156             #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
 157             # rather than rewrite
 158             '';
 159         }
 160         ];
 161     };
 162
 163     # FIXME: environment variables ?
 164     security.pam.services = let
 165       pam_ldap = pkgs.pam_ldap;
 166       pam_ldap_mysql = assert mylibs.checkEnv "NIXOPS_MYSQL_PAM_PASSWORD";
 167               pkgs.writeText "mysql.conf" ''
 168         host ldap.immae.eu
 169         base dc=immae,dc=eu
 170         binddn cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 171         bindpw ${builtins.getEnv "NIXOPS_MYSQL_PAM_PASSWORD"}
 172         pam_filter memberOf=cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
 173         '';
 174     in [
 175       {
 176         name = "mysql";
 177         text = ''
 178           # https://mariadb.com/kb/en/mariadb/pam-authentication-plugin/
 179           auth    required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 180           account required ${pam_ldap}/lib/security/pam_ldap.so config=${pam_ldap_mysql}
 181           '';
 182       }
 183     ];
 184
 185     # FIXME: initial sync
 186     # FIXME: backup
 187     # FIXME: restart after pam
 188     # FIXME: pam access doesn’t work (because of php module)
 189     # FIXME: ssl
 190     services.mysql = rec {
 191       enable = true;
 192       package = pkgs.mariadb.overrideAttrs(old: rec {
 193         cmakeFlags = old.cmakeFlags ++ [ "-DWITH_AUTHENTICATION_PAM=ON" ];
 194         buildInputs = old.buildInputs ++ [ pkgs.pam ];
 195       });
 196     };
 197
 198     # FIXME: initial sync
 199     # FIXME: backup
 200     # FIXME: ssl
 201     services.postgresql = rec {
 202       enable = true;
 203       package = pkgs.postgresql100.overrideAttrs(old: rec {
 204         passthru = old.passthru // { psqlSchema = "11.0"; };
 205         name = "postgresql-11.1";
 206         src = pkgs.fetchurl {
 207           url = "mirror://postgresql/source/v11.1/${name}.tar.bz2";
 208           sha256 = "026v0sicsh7avzi45waf8shcbhivyxmi7qgn9fd1x0vl520mx0ch";
 209         };
 210       });
 211       enableTCPIP = true;
 212       extraConfig = ''
 213         max_connections = 100
 214         wal_level = logical
 215         shared_buffers = 128MB
 216         max_wal_size = 1GB
 217         min_wal_size = 80MB
 218         log_timezone = 'Europe/Paris'
 219         datestyle = 'iso, mdy'
 220         timezone = 'Europe/Paris'
 221         lc_messages = 'en_US.UTF-8'
 222         lc_monetary = 'en_US.UTF-8'
 223         lc_numeric = 'en_US.UTF-8'
 224         lc_time = 'en_US.UTF-8'
 225         default_text_search_config = 'pg_catalog.english'
 226         # ssl = on
 227         # ssl_cert_file = '/var/lib/acme/eldiron/fullchain.pem'
 228         # ssl_key_file = '/var/lib/acme/eldiron/key.pem'
 229         '';
 230       authentication = ''
 231         local   all     postgres                                ident
 232         local   all     all                                     md5
 233         host    all     all             178.33.252.96/32        md5
 234         host    all     all             188.165.209.148/32      md5
 235         #host   all     all             all                     pam
 236       '';
 237     };
 238   };
 239 }