Move httpd service to module

[perso/Immae/Config/Nix.git] / virtual / modules / websites / default.nix

diff --git a/virtual/modules/websites/default.nix b/virtual/modules/websites/default.nix
index a9e62a56ebb1851a4d87f4dbdb192e1de8d14ba1..b027b81c6671042d86db28ad0397a0e473723e10 100644 (file)
--- a/virtual/modules/websites/default.nix
+++ b/virtual/modules/websites/default.nix
@@ -1,5 +1,8 @@
 { lib, pkgs, config, mylibs, myconfig, ... }:
 let
+  mypkgs = pkgs.callPackage ../../packages.nix {
+    inherit (mylibs) checkEnv fetchedGit fetchedGithub;
+  };
   cfg = config.services.myWebsites;
   makeService = name: cfg: let
     toVhost = vhostConf: {
@@ -16,6 +19,28 @@ let
       documentRoot = vhostConf.root;
       extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
     };
+    redirectVhost = { # Should go last, catchall http -> https redirect
+      listen = [ { ip = cfg.ip; port = 80; } ];
+      hostName = "redirectSSL";
+      serverAliases = [ "*" ];
+      enableSSL = false;
+      logFormat = "combinedVhost";
+      documentRoot = "/var/lib/acme/acme-challenge";
+      extraConfig = ''
+        RewriteEngine on
+        RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
+        RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
+        # To redirect in specific "VirtualHost *:80", do
+        #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
+        # rather than rewrite
+      '';
+    };
+    fallbackVhost = toVhost { # Should go first, default choice
+      certName    = "eldiron";
+      hosts       = ["eldiron.immae.eu" ];
+      root        = ../../www;
+      extraConfig = [ "DirectoryIndex index.htm" ];
+    };
   in rec {
     enable = true;
     listen = [
@@ -28,7 +53,9 @@ let
     logFormat = "combinedVhost";
     extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
     extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
-    virtualHosts = pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs;
+    virtualHosts = [ fallbackVhost ]
+      ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
+      ++ [ redirectVhost ];
   };
   makeServiceOptions = name: ip: {
     enable = lib.mkEnableOption "enable websites in ${name}";
@@ -74,6 +101,7 @@ in
   options.services.myWebsites = {
     production = makeServiceOptions "production" myconfig.ips.production;
     integration = makeServiceOptions "integration" myconfig.ips.integration;
+    tools = makeServiceOptions "tools" myconfig.ips.main;
 
     apacheConfig = lib.mkOption {
       type = lib.types.attrsOf (lib.types.submodule {
@@ -208,5 +236,65 @@ in
     services.httpdInte = makeService "integration" config.services.myWebsites.integration;
     services.myWebsites.integration.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
     services.myWebsites.integration.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
+
+    services.httpd = makeService "tools" config.services.myWebsites.tools;
+    services.myWebsites.tools.modules =
+      mypkgs.adminer.apache.modules ++
+      mypkgs.nextcloud.apache.modules ++
+      mypkgs.ympd.apache.modules ++
+      mypkgs.mantisbt.apache.modules ++
+      mypkgs.ttrss.apache.modules ++
+      mypkgs.roundcubemail.apache.modules ++
+      pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
+    services.myWebsites.tools.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
+    # FIXME: move them all to separate modules
+    services.myWebsites.tools.vhostConfs.eldiron = {
+      certName    = "eldiron";
+      hosts       = ["eldiron.immae.eu" ];
+      root        = ../../www;
+      extraConfig = [ "DirectoryIndex index.htm" ];
+    };
+    services.myWebsites.tools.vhostConfs.db-1 = {
+      certName    = "eldiron";
+      hosts       = ["db-1.immae.eu" ];
+      root        = null;
+      extraConfig = [ mypkgs.adminer.apache.vhostConf ];
+    };
+    services.myWebsites.tools.vhostConfs.tools = {
+      certName    = "eldiron";
+      hosts       = ["tools.immae.eu" ];
+      root        = null;
+      extraConfig = [
+        mypkgs.adminer.apache.vhostConf
+        mypkgs.ympd.apache.vhostConf
+        mypkgs.ttrss.apache.vhostConf
+        mypkgs.roundcubemail.apache.vhostConf
+      ];
+    };
+    services.myWebsites.tools.vhostConfs.dav = {
+      certName    = "eldiron";
+      hosts       = ["dav.immae.eu" ];
+      root        = null;
+      extraConfig = [
+        mypkgs.infcloud.apache.vhostConf
+        mypkgs.davical.apache.vhostConf
+      ];
+    };
+    services.myWebsites.tools.vhostConfs.cloud = {
+      certName    = "eldiron";
+      hosts       = ["cloud.immae.eu" ];
+      root        = mypkgs.nextcloud.webRoot;
+      extraConfig = [
+        mypkgs.nextcloud.apache.vhostConf
+      ];
+    };
+    services.myWebsites.tools.vhostConfs.git.extraConfig = [
+      mypkgs.mantisbt.apache.vhostConf
+      ''
+        RewriteEngine on
+        RewriteCond %{REQUEST_URI}       ^/releases
+        RewriteRule /releases(.*)        https://release.immae.eu$1 [P,L]
+        ''
+    ];
   };
 }