Add CSP reports

[perso/Immae/Config/Nix.git] / modules / private / websites / tools / tools / default.nix

diff --git a/modules/private/websites/tools/tools/default.nix b/modules/private/websites/tools/tools/default.nix
index 0cb7a1062ebc7520320d2b37b8a569b2dfd9f8bf..93d11222785fd860c64dcd7320d1221f35f7b6d8 100644 (file)
--- a/modules/private/websites/tools/tools/default.nix
+++ b/modules/private/websites/tools/tools/default.nix
@@ -9,12 +9,17 @@ let
   ttrss = pkgs.callPackage ./ttrss.nix {
     inherit (pkgs.webapps) ttrss ttrss-plugins;
     env = config.myEnv.tools.ttrss;
+    php = pkgs.php72;
   };
   kanboard = pkgs.callPackage ./kanboard.nix  {
     env = config.myEnv.tools.kanboard;
   };
   wallabag = pkgs.callPackage ./wallabag.nix {
-    inherit (pkgs.webapps) wallabag;
+    wallabag = pkgs.webapps.wallabag.override {
+      composerEnv = pkgs.composerEnv.override {
+        php = pkgs.php73.withExtensions(e: pkgs.php73.enabledExtensions ++ [e.tidy]);
+      };
+    };
     env = config.myEnv.tools.wallabag;
   };
   yourls = pkgs.callPackage ./yourls.nix {
@@ -36,7 +41,7 @@ let
     env = config.myEnv.tools.phpldapadmin;
   };
   grocy = pkgs.callPackage ./grocy.nix {
-    inherit (pkgs.webapps) grocy;
+    grocy = pkgs.webapps.grocy.override { composerEnv = pkgs.composerEnv.override { php = pkgs.php72; }; };
   };
   phpbb = pkgs.callPackage ./phpbb.nix {
     phpbb = (pkgs.webapps.phpbb.withLangs (l: [ l.fr ])).withExts (e: [
@@ -47,6 +52,9 @@ let
   webhooks = pkgs.callPackage ./webhooks.nix {
     env = config.myEnv.tools.webhooks;
   };
+  dmarc-reports = pkgs.callPackage ./dmarc_reports.nix {
+    env = config.myEnv.tools.dmarc_reports;
+  };
 
   landing = pkgs.callPackage ./landing.nix {};
 
@@ -65,6 +73,7 @@ in {
       ++ ttrss.keys
       ++ wallabag.keys
       ++ yourls.keys
+      ++ dmarc-reports.keys
       ++ webhooks.keys;
 
     services.duplyBackup.profiles = {
@@ -88,6 +97,7 @@ in {
       ++ rompr.apache.modules
       ++ shaarli.apache.modules
       ++ dokuwiki.apache.modules
+      ++ dmarc-reports.apache.modules
       ++ phpbb.apache.modules
       ++ ldap.apache.modules
       ++ kanboard.apache.modules;
@@ -102,6 +112,7 @@ in {
         ''
           Timeout 600
           ProxyTimeout 600
+          Header always set Content-Security-Policy-Report-Only "${config.myEnv.tools.csp_reports.policies.inline}"
           <Directory "/var/lib/ftp/devtools.immae.eu">
             DirectoryIndex index.php index.htm index.html
             AllowOverride all
@@ -147,6 +158,7 @@ in {
         (kanboard.apache.vhostConf pcfg.kanboard.socket)
         (grocy.apache.vhostConf pcfg.grocy.socket)
         (phpbb.apache.vhostConf pcfg.phpbb.socket)
+        (dmarc-reports.apache.vhostConf pcfg.dmarc-reports.socket)
         ''
           Alias /paste /var/lib/fiche
           <Directory "/var/lib/fiche">
@@ -156,8 +168,8 @@ in {
             Options -Indexes
           </Directory>
 
-          Alias /BIP39 /var/lib/buildbot/outputs/bip39
-          <Directory "/var/lib/buildbot/outputs/bip39">
+          Alias /BIP39 /var/lib/buildbot/outputs/immae/bip39
+          <Directory "/var/lib/buildbot/outputs/immae/bip39">
             DirectoryIndex index.html
             AllowOverride None
             Require all granted
@@ -254,7 +266,7 @@ in {
         description = "Tiny Tiny RSS feeds update daemon";
         serviceConfig = {
           User = "wwwrun";
-          ExecStart = "${pkgs.php}/bin/php ${ttrss.webRoot}/update.php --daemon";
+          ExecStart = "${pkgs.php72}/bin/php ${ttrss.webRoot}/update.php --daemon";
           StandardOutput = "syslog";
           StandardError = "syslog";
           PermissionsStartOnly = true;
@@ -293,7 +305,10 @@ in {
         };
         phpEnv = {
           CONTACT_EMAIL = config.myEnv.tools.contact;
+          CSP_REPORT_URI = with config.myEnv.tools.csp_reports.postgresql;
+            "\"host=${socket} dbname=${database} user=${user} password=${password}\"";
         };
+        phpPackage = pkgs.php72;
       };
       devtools = {
         user = "wwwrun";
@@ -309,48 +324,57 @@ in {
 
           "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp";
         };
-        phpOptions = config.services.phpfpm.phpOptions + ''
-          extension=${pkgs.php}/lib/php/extensions/mysqli.so
-          extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
-          extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
-          zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
-          '';
+        phpPackage = pkgs.php72.withExtensions(e: pkgs.php72.enabledExtensions ++ [e.mysqli e.redis e.apcu e.opcache ]);
       };
       adminer = adminer.phpFpm;
       ttrss = {
         user = "wwwrun";
         group = "wwwrun";
         settings = ttrss.phpFpm.pool;
+        phpPackage = pkgs.php72;
       };
       wallabag = {
         user = "wwwrun";
         group = "wwwrun";
         settings = wallabag.phpFpm.pool;
+        phpPackage = pkgs.php73.withExtensions(e: pkgs.php73.enabledExtensions ++ [e.tidy]);
       };
       yourls = {
         user = "wwwrun";
         group = "wwwrun";
         settings = yourls.phpFpm.pool;
+        phpPackage = pkgs.php72;
       };
       rompr = {
         user = "wwwrun";
         group = "wwwrun";
         settings = rompr.phpFpm.pool;
+        phpPackage = pkgs.php72;
       };
       shaarli = {
         user = "wwwrun";
         group = "wwwrun";
         settings = shaarli.phpFpm.pool;
+        phpPackage = pkgs.php72;
+      };
+      dmarc-reports = {
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = dmarc-reports.phpFpm.pool;
+        phpEnv = dmarc-reports.phpFpm.phpEnv;
+        phpPackage = pkgs.php72;
       };
       dokuwiki = {
         user = "wwwrun";
         group = "wwwrun";
         settings = dokuwiki.phpFpm.pool;
+        phpPackage = pkgs.php72;
       };
       phpbb = {
         user = "wwwrun";
         group = "wwwrun";
         settings = phpbb.phpFpm.pool;
+        phpPackage = pkgs.php72;
       };
       ldap = {
         user = "wwwrun";
@@ -362,11 +386,13 @@ in {
         user = "wwwrun";
         group = "wwwrun";
         settings = kanboard.phpFpm.pool;
+        phpPackage = pkgs.php72;
       };
       grocy = {
         user = "wwwrun";
         group = "wwwrun";
         settings = grocy.phpFpm.pool;
+        phpPackage = pkgs.php72;
       };
     };
 
@@ -386,6 +412,7 @@ in {
 
     services.websites.webappDirs = {
       _adminer = adminer.webRoot;
+      "${dmarc-reports.apache.webappName}" = dmarc-reports.webRoot;
       "${dokuwiki.apache.webappName}" = dokuwiki.webRoot;
       "${phpbb.apache.webappName}" = phpbb.webRoot;
       "${ldap.apache.webappName}" = "${ldap.webRoot}/htdocs";