virtual/modules/websites/default.nix

   1 { lib, pkgs, config, mylibs, myconfig, ... }:
   2 let
   3   mypkgs = pkgs.callPackage ../../packages.nix {
   4     inherit (mylibs) checkEnv fetchedGit fetchedGithub;
   5   };
   6   cfg = config.services.myWebsites;
   7   makeService = name: cfg: let
   8     toVhost = vhostConf: {
   9       enableSSL = true;
  10       sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
  11       sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
  12       sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem";
  13       logFormat = "combinedVhost";
  14       listen = [
  15         { ip = cfg.ip;  port = 443; }
  16       ];
  17       hostName = builtins.head vhostConf.hosts;
  18       serverAliases = builtins.tail vhostConf.hosts or [];
  19       documentRoot = vhostConf.root;
  20       extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
  21     };
  22     redirectVhost = { # Should go last, catchall http -> https redirect
  23       listen = [ { ip = cfg.ip; port = 80; } ];
  24       hostName = "redirectSSL";
  25       serverAliases = [ "*" ];
  26       enableSSL = false;
  27       logFormat = "combinedVhost";
  28       documentRoot = "/var/lib/acme/acme-challenge";
  29       extraConfig = ''
  30         RewriteEngine on
  31         RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
  32         RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
  33         # To redirect in specific "VirtualHost *:80", do
  34         #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
  35         # rather than rewrite
  36       '';
  37     };
  38     fallbackVhost = toVhost { # Should go first, default choice
  39       certName    = "eldiron";
  40       hosts       = ["eldiron.immae.eu" ];
  41       root        = ../../www;
  42       extraConfig = [ "DirectoryIndex index.htm" ];
  43     };
  44   in rec {
  45     enable = true;
  46     listen = [
  47       { ip = cfg.ip;  port = 443; }
  48     ];
  49     stateDir = "/run/httpd_${name}";
  50     logPerVirtualHost = true;
  51     multiProcessingModule = "worker";
  52     adminAddr = "httpd@immae.eu";
  53     logFormat = "combinedVhost";
  54     extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
  55     extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
  56     virtualHosts = [ fallbackVhost ]
  57       ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
  58       ++ [ redirectVhost ];
  59   };
  60   makeServiceOptions = name: ip: {
  61     enable = lib.mkEnableOption "enable websites in ${name}";
  62     ip = lib.mkOption {
  63       type = lib.types.string;
  64       default = ip;
  65       description = "${name} ip to listen to";
  66     };
  67     modules = lib.mkOption {
  68       type = lib.types.listOf (lib.types.str);
  69       default = [];
  70     };
  71     extraConfig = lib.mkOption {
  72       type = lib.types.listOf (lib.types.lines);
  73       default = [];
  74     };
  75     vhostConfs = lib.mkOption {
  76       type = lib.types.attrsOf (lib.types.submodule {
  77         options = {
  78           certName = lib.mkOption { type = lib.types.string; };
  79           hosts    = lib.mkOption { type = lib.types.listOf lib.types.string; };
  80           root     = lib.mkOption { type = lib.types.nullOr lib.types.path; };
  81           extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
  82         };
  83       });
  84     };
  85   };
  86 in
  87 {
  88   imports = [
  89     ./chloe
  90     ./ludivine
  91     ./aten
  92     ./piedsjaloux
  93     ./connexionswing
  94     ./tellesflorian
  95     ./tools/db
  96     ./tools/tools
  97     ./tools/dav
  98     ./tools/cloud
  99     ./tools/git
 100     ./tools/mastodon
 101     ./tools/mediagoblin
 102     # built using:
 103     # sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
 104     # Removed allGranted
 105     # And removed users / groups
 106     ./apache/httpd_prod.nix
 107     ./apache/httpd_inte.nix
 108     # except for this one for users/groups
 109     ./apache/httpd_tools.nix
 110     # Adapted from base phpfpm
 111     ./phpfpm
 112   ];
 113
 114   options.services.myWebsites = {
 115     production = makeServiceOptions "production" myconfig.ips.production;
 116     integration = makeServiceOptions "integration" myconfig.ips.integration;
 117     tools = makeServiceOptions "tools" myconfig.ips.main;
 118
 119     apacheConfig = lib.mkOption {
 120       type = lib.types.attrsOf (lib.types.submodule {
 121         options = {
 122           modules = lib.mkOption {
 123             type = lib.types.listOf (lib.types.str);
 124             default = [];
 125           };
 126           extraConfig = lib.mkOption {
 127             type = lib.types.nullOr lib.types.lines;
 128             default = null;
 129           };
 130         };
 131       });
 132       default = {};
 133       description = "Extra global config";
 134     };
 135
 136   };
 137
 138   config = {
 139     networking = {
 140       firewall = {
 141         enable = true;
 142         allowedTCPPorts = [ 80 443 ];
 143       };
 144       interfaces."eth0".ipv4.addresses = [
 145         # 176.9.151.89 declared in nixops -> infra / tools
 146         { address = myconfig.ips.production; prefixLength = 32; }
 147         { address = myconfig.ips.integration; prefixLength = 32; }
 148       ];
 149     };
 150
 151     nixpkgs.config.packageOverrides = oldpkgs: rec {
 152       php = php72;
 153       php72 = (oldpkgs.php72.override {
 154         mysql.connector-c = pkgs.mariadb;
 155         config.php.mysqlnd = false;
 156         config.php.mysqli = false;
 157       }).overrideAttrs(old: rec {
 158         # Didn't manage to build with mysqli + mysql_config connector
 159         configureFlags = old.configureFlags ++ [
 160           "--with-mysqli=shared,mysqlnd"
 161           ];
 162         # preConfigure = (old.preConfigure or "") + ''
 163         #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
 164         #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
 165         #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
 166         #   '';
 167       });
 168       phpPackages = oldpkgs.php72Packages.override { inherit php; };
 169     };
 170
 171     services.myWebsites.tools.databases.enable = true;
 172     services.myWebsites.tools.tools.enable = true;
 173     services.myWebsites.tools.dav.enable = true;
 174     services.myWebsites.tools.cloud.enable = true;
 175     services.myWebsites.tools.git.enable = true;
 176     services.myWebsites.tools.mastodon.enable = true;
 177     services.myWebsites.tools.mediagoblin.enable = true;
 178
 179     services.myWebsites.Chloe.production.enable = cfg.production.enable;
 180     services.myWebsites.Ludivine.production.enable = cfg.production.enable;
 181     services.myWebsites.Aten.production.enable = cfg.production.enable;
 182     services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
 183     services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
 184
 185     services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
 186     services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
 187     services.myWebsites.Aten.integration.enable = cfg.integration.enable;
 188     services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
 189     services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
 190     services.myWebsites.TellesFlorian.integration.enable = true;
 191
 192     services.myWebsites.apacheConfig = {
 193       gzip = {
 194         modules = [ "deflate" "filter" ];
 195         extraConfig = ''
 196           AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
 197         '';
 198       };
 199       macros = {
 200         modules = [ "macro" ];
 201       };
 202       ldap = {
 203         modules = [ "ldap" "authnz_ldap" ];
 204         # FIXME: starttls
 205         extraConfig = assert mylibs.checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; ''
 206           <IfModule ldap_module>
 207             LDAPSharedCacheSize 500000
 208             LDAPCacheEntries 1024
 209             LDAPCacheTTL 600
 210             LDAPOpCacheEntries 1024
 211             LDAPOpCacheTTL 600
 212           </IfModule>
 213
 214           <Macro LDAPConnect>
 215             <IfModule authnz_ldap_module>
 216               AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 217               AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 218               AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
 219               AuthType             Basic
 220               AuthName             "Authentification requise (Acces LDAP)"
 221               AuthBasicProvider    ldap
 222             </IfModule>
 223           </Macro>
 224
 225           <Macro Stats %{domain}>
 226             Alias /awstats /var/lib/goaccess/%{domain}
 227             <Directory /var/lib/goaccess/%{domain}>
 228               DirectoryIndex index.html
 229               AllowOverride None
 230               Require all granted
 231             </Directory>
 232             <Location /awstats>
 233               Use LDAPConnect
 234               Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
 235             </Location>
 236           </Macro>
 237
 238           ErrorDocument 500 /maintenance_immae.html
 239           ErrorDocument 501 /maintenance_immae.html
 240           ErrorDocument 502 /maintenance_immae.html
 241           ErrorDocument 503 /maintenance_immae.html
 242           ErrorDocument 504 /maintenance_immae.html
 243           Alias /maintenance_immae.html ${../../www}/maintenance_immae.html
 244           ProxyPass /maintenance_immae.html !
 245
 246           AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${../../www}/googleb6d69446ff4ca3e5.html
 247         '';
 248       };
 249       http2 = {
 250         modules = [ "http2" ];
 251         extraConfig = ''
 252           Protocols h2 http/1.1
 253         '';
 254       };
 255       customLog = {
 256         extraConfig = ''
 257           LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
 258         '';
 259       };
 260     };
 261
 262     system.activationScripts = {
 263       httpd = ''
 264         install -d -m 0755 /var/lib/acme/acme-challenge
 265         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 266         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
 267         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
 268         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
 269         '';
 270     };
 271
 272     services.myPhpfpm = {
 273       phpPackage = pkgs.php;
 274       phpOptions = ''
 275         session.save_path = "/var/lib/php/sessions"
 276         session.gc_maxlifetime = 60*60*24*15
 277         session.cache_expire = 60*24*30
 278         '';
 279       extraConfig = ''
 280         log_level = notice
 281         '';
 282     };
 283
 284     # FIXME: logrotate
 285     # FIXME: ipv6
 286     services.httpdProd = makeService "production" config.services.myWebsites.production;
 287     services.myWebsites.production.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
 288     services.myWebsites.production.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
 289
 290     services.httpdInte = makeService "integration" config.services.myWebsites.integration;
 291     services.myWebsites.integration.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
 292     services.myWebsites.integration.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
 293
 294     services.httpdTools = makeService "tools" config.services.myWebsites.tools;
 295     services.myWebsites.tools.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
 296     services.myWebsites.tools.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig)) ++
 297     [ ''
 298         RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
 299         RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 300         RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
 301         RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
 302         RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
 303         RedirectMatch ^/CGU$ https://www.immae.eu/CGU
 304       ''
 305       ]
 306     ;
 307   };
 308 }