cfg = config.services.myWebsites;
www_root = "/run/current-system/webapps/_www";
theme_root = "/run/current-system/webapps/_theme";
- makeService = name: cfg: let
- toVhost = vhostConf: {
- enableSSL = true;
- sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
- sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
- sslServerChain = "/var/lib/acme/${vhostConf.certName}/chain.pem";
- logFormat = "combinedVhost";
- listen = map (ip: { inherit ip; port = 443; }) cfg.ips;
- hostName = builtins.head vhostConf.hosts;
- serverAliases = builtins.tail vhostConf.hosts or [];
- documentRoot = vhostConf.root;
- extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
- };
- nosslVhost = {
- listen = map (ip: { inherit ip; port = 80; }) cfg.ips;
- hostName = "nossl.immae.eu";
- enableSSL = false;
- logFormat = "combinedVhost";
- documentRoot = www_root;
+ apacheConfig = {
+ gzip = {
+ modules = [ "deflate" "filter" ];
extraConfig = ''
- <Directory ${www_root}>
- DirectoryIndex nossl.html
- AllowOverride None
- Require all granted
-
- RewriteEngine on
- RewriteRule ^/(.+) / [L]
- </Directory>
- '';
+ AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
+ '';
+ };
+ macros = {
+ modules = [ "macro" ];
};
- redirectVhost = { # Should go last, catchall http -> https redirect
- listen = map (ip: { inherit ip; port = 80; }) cfg.ips;
- hostName = "redirectSSL";
- serverAliases = [ "*" ];
- enableSSL = false;
- logFormat = "combinedVhost";
- documentRoot = "/var/lib/acme/acme-challenge";
+ stats = {
extraConfig = ''
- RewriteEngine on
- RewriteCond "%{REQUEST_URI}" "!^/\.well-known"
- RewriteRule ^(.+) https://%{HTTP_HOST}$1 [R=301]
- # To redirect in specific "VirtualHost *:80", do
- # RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
- # rather than rewrite
+ <Macro Stats %{domain}>
+ Alias /webstats ${config.services.webstats.dataDir}/%{domain}
+ <Directory ${config.services.webstats.dataDir}/%{domain}>
+ DirectoryIndex index.html
+ AllowOverride None
+ Require all granted
+ </Directory>
+ <Location /webstats>
+ Use LDAPConnect
+ Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
+ </Location>
+ </Macro>
'';
};
- fallbackVhost = toVhost { # Should go first, default choice
- certName = "eldiron";
- hosts = ["eldiron.immae.eu" ];
- root = www_root;
- extraConfig = [ "DirectoryIndex index.htm" ];
+ ldap = {
+ modules = [ "ldap" "authnz_ldap" ];
+ extraConfig = ''
+ <IfModule ldap_module>
+ LDAPSharedCacheSize 500000
+ LDAPCacheEntries 1024
+ LDAPCacheTTL 600
+ LDAPOpCacheEntries 1024
+ LDAPOpCacheTTL 600
+ </IfModule>
+
+ Include /var/secrets/apache-ldap
+ '';
};
- in rec {
- enable = true;
- listen = map (ip: { inherit ip; port = 443; }) cfg.ips;
- stateDir = "/run/httpd_${name}";
- logPerVirtualHost = true;
- multiProcessingModule = "worker";
- adminAddr = "httpd@immae.eu";
- logFormat = "combinedVhost";
- extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
- extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
- virtualHosts = [ fallbackVhost ]
- ++ lib.optionals (name == "tools") [ nosslVhost ]
- ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
- ++ [ redirectVhost ];
- };
- makeServiceOptions = name: {
- enable = lib.mkEnableOption "enable websites in ${name}";
- ips = lib.mkOption {
- type = lib.types.listOf lib.types.string;
- default = let
- ips = myconfig.env.servers.eldiron.ips.${name};
- in
- [ips.ip4] ++ (ips.ip6 or []);
- description = "${name} ips to listen to";
+ global = {
+ extraConfig = (pkgs.webapps.apache-default.override { inherit www_root;}).apacheConfig;
};
- modules = lib.mkOption {
- type = lib.types.listOf (lib.types.str);
- default = [];
+ apaxy = {
+ extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
};
- extraConfig = lib.mkOption {
- type = lib.types.listOf (lib.types.lines);
- default = [];
+ http2 = {
+ modules = [ "http2" ];
+ extraConfig = ''
+ Protocols h2 http/1.1
+ '';
};
- vhostConfs = lib.mkOption {
- type = lib.types.attrsOf (lib.types.submodule {
- options = {
- certName = lib.mkOption { type = lib.types.string; };
- hosts = lib.mkOption { type = lib.types.listOf lib.types.string; };
- root = lib.mkOption { type = lib.types.nullOr lib.types.path; };
- extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
- };
- });
+ customLog = {
+ extraConfig = ''
+ LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
+ '';
};
};
- makeModules = cfg: pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
- makeExtraConfig = cfg: (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
+ makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
+ makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
in
{
imports = [
./phpfpm
];
- options.services.myWebsites = {
- production = makeServiceOptions "production";
- integration = makeServiceOptions "integration";
- tools = makeServiceOptions "main";
-
- apacheConfig = lib.mkOption {
- type = lib.types.attrsOf (lib.types.submodule {
- options = {
- modules = lib.mkOption {
- type = lib.types.listOf (lib.types.str);
- default = [];
- };
- extraConfig = lib.mkOption {
- type = lib.types.nullOr lib.types.lines;
- default = null;
- };
- };
- });
- default = {};
- description = "Extra global config";
- };
-
- };
-
config = {
users.users.wwwrun.extraGroups = [ "keys" ];
networking.firewall.allowedTCPPorts = [ 80 443 ];
services.myWebsites.tools.etherpad-lite.enable = true;
services.myWebsites.tools.peertube.enable = true;
- services.myWebsites.Chloe.production.enable = cfg.production.enable;
- services.myWebsites.Ludivine.production.enable = cfg.production.enable;
- services.myWebsites.Aten.production.enable = cfg.production.enable;
- services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
- services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
- services.myWebsites.Jerome.production.enable = cfg.production.enable;
- services.myWebsites.Nassime.production.enable = cfg.production.enable;
- services.myWebsites.Florian.production.enable = cfg.production.enable;
- services.myWebsites.Leila.production.enable = cfg.production.enable;
- services.myWebsites.Papa.production.enable = cfg.production.enable;
- services.myWebsites.DeniseJerome.production.enable = cfg.production.enable;
- services.myWebsites.Emilia.production.enable = cfg.production.enable;
- services.myWebsites.Capitaines.production.enable = cfg.production.enable;
- services.myWebsites.Immae.production.enable = cfg.production.enable;
- services.myWebsites.Release.production.enable = cfg.production.enable;
- services.myWebsites.Temp.production.enable = cfg.production.enable;
+ services.myWebsites.Chloe.production.enable = true;
+ services.myWebsites.Ludivine.production.enable = true;
+ services.myWebsites.Aten.production.enable = true;
+ services.myWebsites.PiedsJaloux.production.enable = true;
+ services.myWebsites.Connexionswing.production.enable = true;
+ services.myWebsites.Jerome.production.enable = true;
+ services.myWebsites.Nassime.production.enable = true;
+ services.myWebsites.Florian.production.enable = true;
+ services.myWebsites.Leila.production.enable = true;
+ services.myWebsites.Papa.production.enable = true;
+ services.myWebsites.DeniseJerome.production.enable = true;
+ services.myWebsites.Emilia.production.enable = true;
+ services.myWebsites.Capitaines.production.enable = true;
+ services.myWebsites.Immae.production.enable = true;
+ services.myWebsites.Release.production.enable = true;
+ services.myWebsites.Temp.production.enable = true;
- services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
- services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
- services.myWebsites.Aten.integration.enable = cfg.integration.enable;
- services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
- services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
+ services.myWebsites.Chloe.integration.enable = true;
+ services.myWebsites.Ludivine.integration.enable = true;
+ services.myWebsites.Aten.integration.enable = true;
+ services.myWebsites.PiedsJaloux.integration.enable = true;
+ services.myWebsites.Connexionswing.integration.enable = true;
services.myWebsites.TellesFlorian.integration.enable = true;
services.myWebsites.Florian.integration.enable = true;
'';
}];
- services.myWebsites.apacheConfig = {
- gzip = {
- modules = [ "deflate" "filter" ];
- extraConfig = ''
- AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
- '';
- };
- macros = {
- modules = [ "macro" ];
- };
- stats = {
- extraConfig = ''
- <Macro Stats %{domain}>
- Alias /webstats ${config.services.webstats.dataDir}/%{domain}
- <Directory ${config.services.webstats.dataDir}/%{domain}>
- DirectoryIndex index.html
- AllowOverride None
- Require all granted
- </Directory>
- <Location /webstats>
- Use LDAPConnect
- Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
- </Location>
- </Macro>
- '';
- };
- ldap = {
- modules = [ "ldap" "authnz_ldap" ];
- extraConfig = ''
- <IfModule ldap_module>
- LDAPSharedCacheSize 500000
- LDAPCacheEntries 1024
- LDAPCacheTTL 600
- LDAPOpCacheEntries 1024
- LDAPOpCacheTTL 600
- </IfModule>
-
- Include /var/secrets/apache-ldap
- '';
- };
- global = {
- extraConfig = (pkgs.webapps.apache-default.override { inherit www_root;}).apacheConfig;
- };
- apaxy = {
- extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
- };
- http2 = {
- modules = [ "http2" ];
- extraConfig = ''
- Protocols h2 http/1.1
- '';
- };
- customLog = {
- extraConfig = ''
- LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
- '';
- };
- };
-
system.activationScripts = {
httpd = ''
install -d -m 0755 /var/lib/acme/acme-challenge
'';
};
- services.httpdProd = makeService "production" config.services.myWebsites.production;
- services.myWebsites.production.modules = makeModules cfg;
- services.myWebsites.production.extraConfig = makeExtraConfig cfg;
+ services.websites.production = {
+ enable = true;
+ adminAddr = "httpd@immae.eu";
+ httpdName = "Prod";
+ ips =
+ let ips = myconfig.env.servers.eldiron.ips.production;
+ in [ips.ip4] ++ (ips.ip6 or []);
+ modules = makeModules;
+ extraConfig = makeExtraConfig;
+ fallbackVhost = {
+ certName = "eldiron";
+ hosts = ["eldiron.immae.eu" ];
+ root = www_root;
+ extraConfig = [ "DirectoryIndex index.htm" ];
+ };
+ };
- services.httpdInte = makeService "integration" config.services.myWebsites.integration;
- services.myWebsites.integration.modules = makeModules cfg;
- services.myWebsites.integration.extraConfig = makeExtraConfig cfg;
+ services.websites.integration = {
+ enable = true;
+ adminAddr = "httpd@immae.eu";
+ httpdName = "Inte";
+ ips =
+ let ips = myconfig.env.servers.eldiron.ips.integration;
+ in [ips.ip4] ++ (ips.ip6 or []);
+ modules = makeModules;
+ extraConfig = makeExtraConfig;
+ fallbackVhost = {
+ certName = "eldiron";
+ hosts = ["eldiron.immae.eu" ];
+ root = www_root;
+ extraConfig = [ "DirectoryIndex index.htm" ];
+ };
+ };
- services.httpdTools = makeService "tools" config.services.myWebsites.tools;
- services.myWebsites.tools.modules = makeModules cfg;
- services.myWebsites.tools.extraConfig = makeExtraConfig cfg ++
- [ ''
- RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
- RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
- RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
- RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
- RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
- RedirectMatch ^/CGU$ https://www.immae.eu/CGU
- ''
- ]
- ;
+ services.websites.tools = {
+ enable = true;
+ adminAddr = "httpd@immae.eu";
+ httpdName = "Tools";
+ ips =
+ let ips = myconfig.env.servers.eldiron.ips.main;
+ in [ips.ip4] ++ (ips.ip6 or []);
+ modules = makeModules;
+ extraConfig = makeExtraConfig ++
+ [ ''
+ RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
+ RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
+ RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
+ RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
+ RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
+ RedirectMatch ^/CGU$ https://www.immae.eu/CGU
+ ''
+ ];
+ nosslVhost = {
+ enable = true;
+ host = "nossl.immae.eu";
+ };
+ fallbackVhost = {
+ certName = "eldiron";
+ hosts = ["eldiron.immae.eu" ];
+ root = www_root;
+ extraConfig = [ "DirectoryIndex index.htm" ];
+ };
+ };
};
}
projects / perso / Immae / Config / Nix.git / blobdiff