X-Git-Url: https://git.immae.eu/?p=perso%2FImmae%2FConfig%2FNix.git;a=blobdiff_plain;f=nixops%2Fmodules%2Fwebsites%2Fdefault.nix;h=927243b2e31cb31da62d594528db42690ff3db67;hp=4c9c7fe5ee5993ab7c0da650333c45cf769d3303;hb=b7d2d4e3da7da83bc7f133acaa216375890592b1;hpb=f759f52e50c1099724c0a172cbebfdcb0823a25f diff --git a/nixops/modules/websites/default.nix b/nixops/modules/websites/default.nix index 4c9c7fe..927243b 100644 --- a/nixops/modules/websites/default.nix +++ b/nixops/modules/websites/default.nix @@ -1,23 +1,40 @@ { lib, pkgs, config, mylibs, myconfig, ... }: let cfg = config.services.myWebsites; + www_root = "/run/current-system/webapps/_www"; + theme_root = "/run/current-system/webapps/_theme"; makeService = name: cfg: let toVhost = vhostConf: { enableSSL = true; sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem"; sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem"; - sslServerChain = "/var/lib/acme/${vhostConf.certName}/fullchain.pem"; + sslServerChain = "/var/lib/acme/${vhostConf.certName}/chain.pem"; logFormat = "combinedVhost"; - listen = [ - { ip = cfg.ip; port = 443; } - ]; + listen = map (ip: { inherit ip; port = 443; }) cfg.ips; hostName = builtins.head vhostConf.hosts; serverAliases = builtins.tail vhostConf.hosts or []; documentRoot = vhostConf.root; extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig; }; + nosslVhost = { + listen = map (ip: { inherit ip; port = 80; }) cfg.ips; + hostName = "nossl.immae.eu"; + enableSSL = false; + logFormat = "combinedVhost"; + documentRoot = www_root; + extraConfig = '' + + DirectoryIndex nossl.html + AllowOverride None + Require all granted + + RewriteEngine on + RewriteRule ^/(.+) / [L] + + ''; + }; redirectVhost = { # Should go last, catchall http -> https redirect - listen = [ { ip = cfg.ip; port = 80; } ]; + listen = map (ip: { inherit ip; port = 80; }) cfg.ips; hostName = "redirectSSL"; serverAliases = [ "*" ]; enableSSL = false; @@ -35,14 +52,12 @@ let fallbackVhost = toVhost { # Should go first, default choice certName = "eldiron"; hosts = ["eldiron.immae.eu" ]; - root = ../../www; + root = www_root; extraConfig = [ "DirectoryIndex index.htm" ]; }; in rec { enable = true; - listen = [ - { ip = cfg.ip; port = 443; } - ]; + listen = map (ip: { inherit ip; port = 443; }) cfg.ips; stateDir = "/run/httpd_${name}"; logPerVirtualHost = true; multiProcessingModule = "worker"; @@ -51,15 +66,19 @@ let extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules); extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig; virtualHosts = [ fallbackVhost ] + ++ lib.optionals (name == "tools") [ nosslVhost ] ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs) ++ [ redirectVhost ]; }; - makeServiceOptions = name: ip: { + makeServiceOptions = name: { enable = lib.mkEnableOption "enable websites in ${name}"; - ip = lib.mkOption { - type = lib.types.string; - default = ip; - description = "${name} ip to listen to"; + ips = lib.mkOption { + type = lib.types.listOf lib.types.string; + default = let + ips = myconfig.env.servers.eldiron.ips.${name}; + in + [ips.ip4] ++ (ips.ip6 or []); + description = "${name} ips to listen to"; }; modules = lib.mkOption { type = lib.types.listOf (lib.types.str); @@ -97,7 +116,10 @@ in ./ftp/nassime.nix ./ftp/florian.nix ./ftp/denisejerome.nix + ./ftp/leila.nix ./ftp/immae.nix + ./ftp/release.nix + ./ftp/temp.nix ./tools/db ./tools/tools ./tools/dav @@ -107,6 +129,7 @@ in ./tools/mediagoblin ./tools/diaspora ./tools/ether + ./tools/peertube # built using: # sed -e "s/services\.httpd/services\.httpdProd/g" .nix-defexpr/channels/nixpkgs/nixos/modules/services/web-servers/apache-httpd/default.nix # Removed allGranted @@ -120,9 +143,9 @@ in ]; options.services.myWebsites = { - production = makeServiceOptions "production" myconfig.ips.production; - integration = makeServiceOptions "integration" myconfig.ips.integration; - tools = makeServiceOptions "tools" myconfig.ips.main; + production = makeServiceOptions "production"; + integration = makeServiceOptions "integration"; + tools = makeServiceOptions "main"; apacheConfig = lib.mkOption { type = lib.types.attrsOf (lib.types.submodule { @@ -144,22 +167,14 @@ in }; config = { - networking = { - firewall = { - enable = true; - allowedTCPPorts = [ 80 443 ]; - }; - interfaces."eth0".ipv4.addresses = [ - # 176.9.151.89 declared in nixops -> infra / tools - { address = myconfig.ips.production; prefixLength = 32; } - { address = myconfig.ips.integration; prefixLength = 32; } - ]; - }; + users.users.wwwrun.extraGroups = [ "keys" ]; + networking.firewall.allowedTCPPorts = [ 80 443 ]; - nixpkgs.config.packageOverrides = oldpkgs: rec { + nixpkgs.overlays = [ (self: super: rec { + #openssl = self.openssl_1_1; php = php72; - php72 = (oldpkgs.php72.override { - mysql.connector-c = pkgs.mariadb; + php72 = (super.php72.override { + mysql.connector-c = self.mariadb; config.php.mysqlnd = false; config.php.mysqli = false; }).overrideAttrs(old: rec { @@ -173,11 +188,11 @@ in # ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c # ''; }); - phpPackages = oldpkgs.php72Packages.override { inherit php; }; + phpPackages = super.php72Packages.override { inherit php; }; composerEnv = import ./commons/composer-env.nix { - inherit (pkgs) stdenv writeTextFile fetchurl php unzip; + inherit (self) stdenv writeTextFile fetchurl php unzip; }; - }; + }) ]; services.myWebsites.tools.databases.enable = true; services.myWebsites.tools.tools.enable = true; @@ -188,6 +203,7 @@ in services.myWebsites.tools.mediagoblin.enable = true; services.myWebsites.tools.diaspora.enable = true; services.myWebsites.tools.etherpad-lite.enable = true; + services.myWebsites.tools.peertube.enable = true; services.myWebsites.Chloe.production.enable = cfg.production.enable; services.myWebsites.Ludivine.production.enable = cfg.production.enable; @@ -197,10 +213,13 @@ in services.myWebsites.Jerome.production.enable = cfg.production.enable; services.myWebsites.Nassime.production.enable = cfg.production.enable; services.myWebsites.Florian.production.enable = cfg.production.enable; + services.myWebsites.Leila.production.enable = cfg.production.enable; services.myWebsites.DeniseJerome.production.enable = cfg.production.enable; services.myWebsites.Emilia.production.enable = cfg.production.enable; services.myWebsites.Capitaines.production.enable = cfg.production.enable; services.myWebsites.Immae.production.enable = cfg.production.enable; + services.myWebsites.Release.production.enable = cfg.production.enable; + services.myWebsites.Temp.production.enable = cfg.production.enable; services.myWebsites.Chloe.integration.enable = cfg.integration.enable; services.myWebsites.Ludivine.integration.enable = cfg.integration.enable; @@ -210,6 +229,24 @@ in services.myWebsites.TellesFlorian.integration.enable = true; services.myWebsites.Florian.integration.enable = true; + deployment.keys.apache-ldap = { + user = "wwwrun"; + group = "wwwrun"; + permissions = "0400"; + text = '' + + + AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS + AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu + AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}" + AuthType Basic + AuthName "Authentification requise (Acces LDAP)" + AuthBasicProvider ldap + + + ''; + }; + services.myWebsites.apacheConfig = { gzip = { modules = [ "deflate" "filter" ]; @@ -220,28 +257,8 @@ in macros = { modules = [ "macro" ]; }; - ldap = { - modules = [ "ldap" "authnz_ldap" ]; + stats = { extraConfig = '' - - LDAPSharedCacheSize 500000 - LDAPCacheEntries 1024 - LDAPCacheTTL 600 - LDAPOpCacheEntries 1024 - LDAPOpCacheTTL 600 - - - - - AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS - AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu - AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}" - AuthType Basic - AuthName "Authentification requise (Acces LDAP)" - AuthBasicProvider ldap - - - Alias /awstats /var/lib/goaccess/%{domain} @@ -254,16 +271,121 @@ in Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu + ''; + }; + ldap = { + modules = [ "ldap" "authnz_ldap" ]; + extraConfig = '' + + LDAPSharedCacheSize 500000 + LDAPCacheEntries 1024 + LDAPCacheTTL 600 + LDAPOpCacheEntries 1024 + LDAPOpCacheTTL 600 + + Include /run/keys/apache-ldap + ''; + }; + global = { + extraConfig = '' ErrorDocument 500 /maintenance_immae.html ErrorDocument 501 /maintenance_immae.html ErrorDocument 502 /maintenance_immae.html ErrorDocument 503 /maintenance_immae.html ErrorDocument 504 /maintenance_immae.html - Alias /maintenance_immae.html ${../../www}/maintenance_immae.html + Alias /maintenance_immae.html ${www_root}/maintenance_immae.html ProxyPass /maintenance_immae.html ! - AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${../../www}/googleb6d69446ff4ca3e5.html + AliasMatch "(.*)/googleb6d69446ff4ca3e5.html" ${www_root}/googleb6d69446ff4ca3e5.html + + AllowOverride None + Require all granted + + ''; + }; + apaxy = { + extraConfig = '' + + Alias /theme ${theme_root} + + Options -Indexes + AllowOverride None + Require all granted + + + # mod_autoindex + + Options Indexes + AllowOverride None + Require all granted + + # Inspired from Apaxy by @adamwhitcroft + + IndexOptions +Charset=UTF-8 +FancyIndexing +IgnoreCase +FoldersFirst +XHTML +HTMLTable +SuppressRules +SuppressDescription +NameWidth=* +IconsAreLinks +ShowForbidden + + IndexHeadInsert "" + + IndexIgnoreReset ON + IndexIgnore /theme .htaccess %{ignored} + + AddIcon /theme/icons/blank.png ^^BLANKICON^^ + AddIcon /theme/icons/folder.png ^^DIRECTORY^^ + AddIcon /theme/icons/folder-home.png .. + + AddIconByType (TXT,/theme/icons/text.png) text/* + AddIconByType (IMG,/theme/icons/image.png) image/* + AddIconByType (SND,/theme/icons/audio.png) audio/* + AddIconByType (VID,/theme/icons/video.png) video/* + + AddIcon /theme/icons/archive.png .7z .bz2 .cab .gz .tar + AddIcon /theme/icons/audio.png .aac .aif .aifc .aiff .ape .au .flac .iff .m4a .mid .mp3 .mpa .ra .wav .wma .f4a .f4b .oga .ogg .xm .it .s3m .mod + AddIcon /theme/icons/bin.png .bin .hex + AddIcon /theme/icons/bmp.png .bmp + AddIcon /theme/icons/c.png .c + AddIcon /theme/icons/calc.png .xlsx .xlsm .xltx .xltm .xlam .xlr .xls .csv + AddIcon /theme/icons/cd.png .iso + AddIcon /theme/icons/cpp.png .cpp + AddIcon /theme/icons/css.png .css .sass .scss + AddIcon /theme/icons/deb.png .deb + AddIcon /theme/icons/doc.png .doc .docx .docm .dot .dotx .dotm .log .msg .odt .pages .rtf .tex .wpd .wps + AddIcon /theme/icons/draw.png .svg .svgz + AddIcon /theme/icons/eps.png .ai .eps + AddIcon /theme/icons/exe.png .exe + AddIcon /theme/icons/gif.png .gif + AddIcon /theme/icons/h.png .h + AddIcon /theme/icons/html.png .html .xhtml .shtml .htm .URL .url + AddIcon /theme/icons/ico.png .ico + AddIcon /theme/icons/java.png .jar + AddIcon /theme/icons/jpg.png .jpg .jpeg .jpe + AddIcon /theme/icons/js.png .js .json + AddIcon /theme/icons/markdown.png .md + AddIcon /theme/icons/package.png .pkg .dmg + AddIcon /theme/icons/pdf.png .pdf + AddIcon /theme/icons/php.png .php .phtml + AddIcon /theme/icons/playlist.png .m3u .m3u8 .pls .pls8 + AddIcon /theme/icons/png.png .png + AddIcon /theme/icons/ps.png .ps + AddIcon /theme/icons/psd.png .psd + AddIcon /theme/icons/py.png .py + AddIcon /theme/icons/rar.png .rar + AddIcon /theme/icons/rb.png .rb + AddIcon /theme/icons/rpm.png .rpm + AddIcon /theme/icons/rss.png .rss + AddIcon /theme/icons/script.png .bat .cmd .sh + AddIcon /theme/icons/sql.png .sql + AddIcon /theme/icons/tiff.png .tiff .tif + AddIcon /theme/icons/text.png .txt .nfo + AddIcon /theme/icons/video.png .asf .asx .avi .flv .mkv .mov .mp4 .mpg .rm .srt .swf .vob .wmv .m4v .f4v .f4p .ogv + AddIcon /theme/icons/xml.png .xml + AddIcon /theme/icons/zip.png .zip + DefaultIcon /theme/icons/default.png + + HeaderName /theme/header.html + ReadmeName /theme/footer.html + IndexStyleSheet /theme/style.css + + ''; }; http2 = { @@ -284,17 +406,31 @@ in install -d -m 0755 /var/lib/acme/acme-challenge install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer + install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/tmp/adminer install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical + install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/phpldapadmin ''; }; + system.extraSystemBuilderCmds = let + adminer = pkgs.callPackage ./commons/adminer.nix {}; + in '' + mkdir -p $out/webapps + ln -s ${../../www} $out/webapps/_www + ln -s ${./apache/theme} $out/webapps/_theme + ln -s ${adminer.webRoot} $out/webapps/${adminer.apache.webappName} + ''; + services.myPhpfpm = { phpPackage = pkgs.php; phpOptions = '' session.save_path = "/var/lib/php/sessions" - session.gc_maxlifetime = 60*60*24*15 - session.cache_expire = 60*24*30 + post_max_size = 20M + ; 15 days (seconds) + session.gc_maxlifetime = 1296000 + ; 30 days (minutes) + session.cache_expire = 43200 ''; extraConfig = '' log_level = notice