virtual/modules/websites/default.nix

   1 { lib, pkgs, config, mylibs, myconfig, ... }:
   2 let
   3   mypkgs = pkgs.callPackage ../../packages.nix {
   4     inherit (mylibs) checkEnv fetchedGit fetchedGithub;
   5   };
   6   cfg = config.services.myWebsites;
   7   makeService = name: cfg: let
   8     toVhost = vhostConf: {
   9       enableSSL = true;
  10       sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
  11       sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
  12       sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem";
  13       logFormat = "combinedVhost";
  14       listen = [
  15         { ip = cfg.ip;  port = 443; }
  16       ];
  17       hostName = builtins.head vhostConf.hosts;
  18       serverAliases = builtins.tail vhostConf.hosts or [];
  19       documentRoot = vhostConf.root;
  20       extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
  21     };
  22     redirectVhost = { # Should go last, catchall http -> https redirect
  23       listen = [ { ip = cfg.ip; port = 80; } ];
  24       hostName = "redirectSSL";
  25       serverAliases = [ "*" ];
  26       enableSSL = false;
  27       logFormat = "combinedVhost";
  28       documentRoot = "/var/lib/acme/acme-challenge";
  29       extraConfig = ''
  30         RewriteEngine on
  31         RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
  32         RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
  33         # To redirect in specific "VirtualHost *:80", do
  34         #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
  35         # rather than rewrite
  36       '';
  37     };
  38     fallbackVhost = toVhost { # Should go first, default choice
  39       certName    = "eldiron";
  40       hosts       = ["eldiron.immae.eu" ];
  41       root        = ../../www;
  42       extraConfig = [ "DirectoryIndex index.htm" ];
  43     };
  44   in rec {
  45     enable = true;
  46     listen = [
  47       { ip = cfg.ip;  port = 443; }
  48     ];
  49     stateDir = "/run/httpd_${name}";
  50     logPerVirtualHost = true;
  51     multiProcessingModule = "worker";
  52     adminAddr = "httpd@immae.eu";
  53     logFormat = "combinedVhost";
  54     extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
  55     extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
  56     virtualHosts = [ fallbackVhost ]
  57       ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
  58       ++ [ redirectVhost ];
  59   };
  60   makeServiceOptions = name: ip: {
  61     enable = lib.mkEnableOption "enable websites in ${name}";
  62     ip = lib.mkOption {
  63       type = lib.types.string;
  64       default = ip;
  65       description = "${name} ip to listen to";
  66     };
  67     modules = lib.mkOption {
  68       type = lib.types.listOf (lib.types.str);
  69       default = [];
  70     };
  71     extraConfig = lib.mkOption {
  72       type = lib.types.listOf (lib.types.lines);
  73       default = [];
  74     };
  75     vhostConfs = lib.mkOption {
  76       type = lib.types.attrsOf (lib.types.submodule {
  77         options = {
  78           certName = lib.mkOption { type = lib.types.string; };
  79           hosts    = lib.mkOption { type = lib.types.listOf lib.types.string; };
  80           root     = lib.mkOption { type = lib.types.nullOr lib.types.path; };
  81           extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
  82         };
  83       });
  84     };
  85   };
  86 in
  87 {
  88   imports = [
  89     ./chloe
  90     ./ludivine
  91     ./aten
  92     ./piedsjaloux
  93     ./connexionswing
  94     ./tools/db
  95     ./tools/tools
  96     ./tools/dav
  97     ./tools/cloud
  98     ./tools/git
  99     # built using:
 100     # sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix
 101     # And removed users / groups
 102     ./apache/httpd_prod.nix
 103     ./apache/httpd_inte.nix
 104     # Adapted from base phpfpm
 105     ./phpfpm
 106   ];
 107
 108   options.services.myWebsites = {
 109     production = makeServiceOptions "production" myconfig.ips.production;
 110     integration = makeServiceOptions "integration" myconfig.ips.integration;
 111     tools = makeServiceOptions "tools" myconfig.ips.main;
 112
 113     apacheConfig = lib.mkOption {
 114       type = lib.types.attrsOf (lib.types.submodule {
 115         options = {
 116           modules = lib.mkOption {
 117             type = lib.types.listOf (lib.types.str);
 118             default = [];
 119           };
 120           extraConfig = lib.mkOption {
 121             type = lib.types.nullOr lib.types.lines;
 122             default = null;
 123           };
 124         };
 125       });
 126       default = {};
 127       description = "Extra global config";
 128     };
 129
 130   };
 131
 132   config = {
 133     networking = {
 134       firewall = {
 135         enable = true;
 136         allowedTCPPorts = [ 80 443 ];
 137       };
 138       interfaces."eth0".ipv4.addresses = [
 139         # 176.9.151.89 declared in nixops -> infra / tools
 140         { address = myconfig.ips.production; prefixLength = 32; }
 141         { address = myconfig.ips.integration; prefixLength = 32; }
 142       ];
 143     };
 144
 145     nixpkgs.config.packageOverrides = oldpkgs: rec {
 146       php = php72;
 147       php72 = (oldpkgs.php72.override {
 148         mysql.connector-c = pkgs.mariadb;
 149         config.php.mysqlnd = false;
 150         config.php.mysqli = false;
 151       }).overrideAttrs(old: rec {
 152         # Didn't manage to build with mysqli + mysql_config connector
 153         configureFlags = old.configureFlags ++ [
 154           "--with-mysqli=shared,mysqlnd"
 155           ];
 156         # preConfigure = (old.preConfigure or "") + ''
 157         #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
 158         #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
 159         #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
 160         #   '';
 161       });
 162       phpPackages = oldpkgs.php72Packages.override { inherit php; };
 163     };
 164
 165     services.myWebsites.tools.databases.enable = true;
 166     services.myWebsites.tools.tools.enable = true;
 167     services.myWebsites.tools.dav.enable = true;
 168     services.myWebsites.tools.cloud.enable = true;
 169     services.myWebsites.tools.git.enable = true;
 170
 171     services.myWebsites.Chloe.production.enable = cfg.production.enable;
 172     services.myWebsites.Ludivine.production.enable = cfg.production.enable;
 173     services.myWebsites.Aten.production.enable = cfg.production.enable;
 174     services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
 175     services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
 176
 177     services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
 178     services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
 179     services.myWebsites.Aten.integration.enable = cfg.integration.enable;
 180     services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
 181     services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
 182
 183     services.myWebsites.apacheConfig = {
 184       gzip = {
 185         modules = [ "deflate" "filter" ];
 186         extraConfig = ''
 187           AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
 188         '';
 189       };
 190       macros = {
 191         modules = [ "macro" ];
 192       };
 193       ldap = {
 194         modules = [ "ldap" "authnz_ldap" ];
 195         # FIXME: starttls
 196         extraConfig = assert mylibs.checkEnv "NIXOPS_HTTP_LDAP_PASSWORD"; ''
 197           <IfModule ldap_module>
 198             LDAPSharedCacheSize 500000
 199             LDAPCacheEntries 1024
 200             LDAPCacheTTL 600
 201             LDAPOpCacheEntries 1024
 202             LDAPOpCacheTTL 600
 203           </IfModule>
 204
 205           <Macro LDAPConnect>
 206             <IfModule authnz_ldap_module>
 207               AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
 208               AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
 209               AuthLDAPBindPassword "${builtins.getEnv "NIXOPS_HTTP_LDAP_PASSWORD"}"
 210               AuthType             Basic
 211               AuthName             "Authentification requise (Acces LDAP)"
 212               AuthBasicProvider    ldap
 213             </IfModule>
 214           </Macro>
 215
 216           <Macro Stats %{domain}>
 217             Alias /awstats /var/lib/goaccess/%{domain}
 218             <Directory /var/lib/goaccess/%{domain}>
 219               DirectoryIndex index.html
 220               AllowOverride None
 221               Require all granted
 222             </Directory>
 223             <Location /awstats>
 224               Use LDAPConnect
 225               Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
 226             </Location>
 227           </Macro>
 228         '';
 229       };
 230       http2 = {
 231         modules = [ "http2" ];
 232         extraConfig = ''
 233           Protocols h2 http/1.1
 234         '';
 235       };
 236       customLog = {
 237         extraConfig = ''
 238           LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
 239         '';
 240       };
 241     };
 242
 243     system.activationScripts = {
 244       httpd = ''
 245         install -d -m 0755 /var/lib/acme/acme-challenge
 246         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
 247         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
 248         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
 249         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
 250         '';
 251     };
 252
 253     services.myPhpfpm = {
 254       phpPackage = pkgs.php;
 255       phpOptions = ''
 256         session.save_path = "/var/lib/php/sessions"
 257         session.gc_maxlifetime = 60*60*24*15
 258         session.cache_expire = 60*24*30
 259         '';
 260       extraConfig = ''
 261         log_level = notice
 262         '';
 263     };
 264
 265     # FIXME: logrotate
 266     # FIXME: ipv6
 267     services.httpdProd = makeService "production" config.services.myWebsites.production;
 268     services.myWebsites.production.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
 269     services.myWebsites.production.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
 270
 271     services.httpdInte = makeService "integration" config.services.myWebsites.integration;
 272     services.myWebsites.integration.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
 273     services.myWebsites.integration.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
 274
 275     services.httpd = makeService "tools" config.services.myWebsites.tools;
 276     services.myWebsites.tools.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
 277     services.myWebsites.tools.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
 278   };
 279 }