Add certificate creation and handling to websites

[perso/Immae/Config/Nix.git] / nixops / modules / websites / tools / ether.nix

diff --git a/nixops/modules/websites/tools/ether.nix b/nixops/modules/websites/tools/ether.nix
index 3efa363a969a61610903d98953019fc93cbd747d..8c9bbb181390021536716bb7c3a8650fcefc8d42 100644 (file)
--- a/nixops/modules/websites/tools/ether.nix
+++ b/nixops/modules/websites/tools/ether.nix
@@ -1,10 +1,11 @@
-{ lib, pkgs, config, myconfig, mylibs, ... }:
+{ lib, pkgs, config, myconfig,  ... }:
 let
   env = myconfig.env.tools.etherpad-lite;
   cfg = config.services.myWebsites.tools.etherpad-lite;
   # Make sure we’re not rebuilding whole libreoffice just because of a
   # dependency
   libreoffice = (import <nixpkgs> { overlays = []; }).libreoffice-fresh;
+  ecfg = config.services.etherpad-lite;
 in {
   options.services.myWebsites.tools.etherpad-lite = {
     enable = lib.mkEnableOption "enable etherpad's website";
@@ -30,8 +31,8 @@ in {
             "title": "Etherpad",
             "favicon": "favicon.ico",
 
-            "ip": "127.0.0.1",
-            "port" : ${env.listenPort},
+            "ip": "",
+            "port" : "${ecfg.sockets.node}",
             "showSettingsInAdminPage" : false,
             "dbType" : "postgres",
             "dbSettings" : {
@@ -132,12 +133,12 @@ in {
 
     systemd.services.etherpad-lite.serviceConfig.SupplementaryGroups = "keys";
 
-    services.myWebsites.tools.modules = [
+    services.websites.tools.modules = [
       "headers" "proxy" "proxy_http" "proxy_wstunnel"
     ];
-    security.acme.certs."eldiron".extraDomains."ether.immae.eu" = null;
-    services.myWebsites.tools.vhostConfs.etherpad-lite = {
+    services.websites.tools.vhostConfs.etherpad-lite = {
       certName    = "eldiron";
+      addToCerts  = true;
       hosts       = [ "ether.immae.eu" ];
       root        = null;
       extraConfig = [ ''
@@ -154,14 +155,14 @@ in {
 
         RewriteCond %{REQUEST_URI}  ^/socket.io            [NC]
         RewriteCond %{QUERY_STRING} transport=websocket    [NC]
-        RewriteRule /(.*)           ws://localhost:${env.listenPort}/$1 [P,L]
+        RewriteRule /(.*)           unix://${ecfg.sockets.node}|ws://ether.immae.eu/$1 [P,NE,QSA,L]
 
         <IfModule mod_proxy.c>
           ProxyVia On
           ProxyRequests Off
           ProxyPreserveHost On
-          ProxyPass         / http://localhost:${env.listenPort}/
-          ProxyPassReverse  / http://localhost:${env.listenPort}/
+          ProxyPass         / unix://${ecfg.sockets.node}|http://ether.immae.eu/
+          ProxyPassReverse  / unix://${ecfg.sockets.node}|http://ether.immae.eu/
           <Proxy *>
             Options FollowSymLinks MultiViews
             AllowOverride None