Move websites/tools to modules

1 files changed, 250 insertions, 24 deletions

diff --git a/modules/private/websites/default.nix b/modules/private/websites/default.nix
index 80d902e..8b02977 100644
--- a/modules/private/websites/default.nix
+++ b/modules/private/websites/default.nix
@@ -1,39 +1,265 @@
-{ ... }:
+{ lib, pkgs, config, myconfig, ... }:
+let
+  www_root = "/run/current-system/webapps/_www";
+  theme_root = "/run/current-system/webapps/_theme";
+  apacheConfig = {
+    gzip = {
+      modules = [ "deflate" "filter" ];
+      extraConfig = ''
+        AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
+      '';
+    };
+    macros = {
+      modules = [ "macro" ];
+    };
+    stats = {
+      extraConfig = ''
+        <Macro Stats %{domain}>
+          Alias /webstats ${config.services.webstats.dataDir}/%{domain}
+          <Directory ${config.services.webstats.dataDir}/%{domain}>
+            DirectoryIndex index.html
+            AllowOverride None
+            Require all granted
+          </Directory>
+          <Location /webstats>
+            Use LDAPConnect
+            Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
+          </Location>
+        </Macro>
+      '';
+    };
+    ldap = {
+      modules = [ "ldap" "authnz_ldap" ];
+      extraConfig = ''
+        <IfModule ldap_module>
+          LDAPSharedCacheSize 500000
+          LDAPCacheEntries 1024
+          LDAPCacheTTL 600
+          LDAPOpCacheEntries 1024
+          LDAPOpCacheTTL 600
+        </IfModule>
+
+        Include /var/secrets/apache-ldap
+      '';
+    };
+    global = {
+      extraConfig = (pkgs.webapps.apache-default.override { inherit www_root;}).apacheConfig;
+    };
+    apaxy = {
+      extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
+    };
+    http2 = {
+      modules = [ "http2" ];
+      extraConfig = ''
+        Protocols h2 http/1.1
+      '';
+    };
+    customLog = {
+      extraConfig = ''
+        LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
+      '';
+    };
+  };
+  makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
+  makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
+in
 {
-  config.myServices.websites.aten.integration.enable = true;
-  config.myServices.websites.aten.production.enable = true;
+  options.myServices.websites.webappDirs = lib.mkOption {
+    type = lib.types.attrsOf lib.types.path;
+    description = ''
+      Webapp paths to create in /run/current-system/webapps
+      '';
+    default = {};
+  };
+
+  config = {
+    users.users.wwwrun.extraGroups = [ "keys" ];
+    networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+    nixpkgs.overlays = [ (self: super: rec {
+      #openssl = self.openssl_1_1;
+      php = php72;
+      php72 = (super.php72.override {
+        mysql.connector-c = self.mariadb;
+        config.php.mysqlnd = false;
+        config.php.mysqli = false;
+      }).overrideAttrs(old: rec {
+        # Didn't manage to build with mysqli + mysql_config connector
+        configureFlags = old.configureFlags ++ [
+          "--with-mysqli=shared,mysqlnd"
+          ];
+        # preConfigure = (old.preConfigure or "") + ''
+        #   export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
+        #   sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
+        #     ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
+        #   '';
+      });
+      phpPackages = super.php72Packages.override { inherit php; };
+    }) ];
+
+    secrets.keys = [{
+      dest = "apache-ldap";
+      user = "wwwrun";
+      group = "wwwrun";
+      permissions = "0400";
+      text = ''
+        <Macro LDAPConnect>
+          <IfModule authnz_ldap_module>
+            AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
+            AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
+            AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
+            AuthType             Basic
+            AuthName             "Authentification requise (Acces LDAP)"
+            AuthBasicProvider    ldap
+          </IfModule>
+        </Macro>
+        '';
+    }];
+
+    system.activationScripts = {
+      httpd = ''
+        install -d -m 0755 ${config.security.acme.directory}/acme-challenge
+        install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
+        '';
+    };
+
+    services.phpfpm = {
+      phpPackage = pkgs.php;
+      phpOptions = ''
+        session.save_path = "/var/lib/php/sessions"
+        post_max_size = 20M
+        ; 15 days (seconds)
+        session.gc_maxlifetime = 1296000
+        ; 30 days (minutes)
+        session.cache_expire = 43200
+        '';
+      extraConfig = ''
+        log_level = notice
+        '';
+    };
+
+    services.websites.production = {
+      enable = true;
+      adminAddr = "httpd@immae.eu";
+      httpdName = "Prod";
+      ips =
+        let ips = myconfig.env.servers.eldiron.ips.production;
+        in [ips.ip4] ++ (ips.ip6 or []);
+      modules = makeModules;
+      extraConfig = makeExtraConfig;
+      fallbackVhost = {
+        certName    = "eldiron";
+        hosts       = ["eldiron.immae.eu" ];
+        root        = www_root;
+        extraConfig = [ "DirectoryIndex index.htm" ];
+      };
+    };
+
+    services.websites.integration = {
+      enable = true;
+      adminAddr = "httpd@immae.eu";
+      httpdName = "Inte";
+      ips =
+        let ips = myconfig.env.servers.eldiron.ips.integration;
+        in [ips.ip4] ++ (ips.ip6 or []);
+      modules = makeModules;
+      extraConfig = makeExtraConfig;
+      fallbackVhost = {
+        certName    = "eldiron";
+        hosts       = ["eldiron.immae.eu" ];
+        root        = www_root;
+        extraConfig = [ "DirectoryIndex index.htm" ];
+      };
+    };
+
+    services.websites.tools = {
+      enable = true;
+      adminAddr = "httpd@immae.eu";
+      httpdName = "Tools";
+      ips =
+        let ips = myconfig.env.servers.eldiron.ips.main;
+        in [ips.ip4] ++ (ips.ip6 or []);
+      modules = makeModules;
+      extraConfig = makeExtraConfig ++
+        [ ''
+            RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
+            RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
+            RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
+            RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
+            RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
+            RedirectMatch ^/CGU$ https://www.immae.eu/CGU
+          ''
+          ];
+      nosslVhost = {
+        enable = true;
+        host = "nossl.immae.eu";
+      };
+      fallbackVhost = {
+        certName    = "eldiron";
+        hosts       = ["eldiron.immae.eu" ];
+        root        = www_root;
+        extraConfig = [ "DirectoryIndex index.htm" ];
+      };
+    };
+
+    system.extraSystemBuilderCmds = lib.mkIf (builtins.length (builtins.attrValues config.myServices.websites.webappDirs) > 0) ''
+    mkdir -p $out/webapps
+    ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList (name: path: "ln -s ${path} $out/webapps/${name}") config.myServices.websites.webappDirs)}
+    '';
+
+    myServices.websites = {
+      webappDirs = {
+        _www = pkgs.webapps.apache-default.www;
+        _theme = pkgs.webapps.apache-theme.theme;
+      };
+
+      aten.integration.enable = true;
+      aten.production.enable = true;
+
+      capitaines.production.enable = true;
 
-  config.myServices.websites.capitaines.production.enable = true;
+      chloe.integration.enable = true;
+      chloe.production.enable = true;
 
-  config.myServices.websites.chloe.integration.enable = true;
-  config.myServices.websites.chloe.production.enable = true;
+      connexionswing.integration.enable = true;
+      connexionswing.production.enable = true;
 
-  config.myServices.websites.connexionswing.integration.enable = true;
-  config.myServices.websites.connexionswing.production.enable = true;
+      denisejerome.production.enable = true;
 
-  config.myServices.websites.denisejerome.production.enable = true;
+      emilia.production.enable = true;
 
-  config.myServices.websites.emilia.production.enable = true;
+      florian.app.enable = true;
+      florian.integration.enable = true;
+      florian.production.enable = true;
 
-  config.myServices.websites.florian.app.enable = true;
-  config.myServices.websites.florian.integration.enable = true;
-  config.myServices.websites.florian.production.enable = true;
+      immae.production.enable = true;
+      immae.release.enable = true;
+      immae.temp.enable = true;
 
-  config.myServices.websites.immae.production.enable = true;
-  config.myServices.websites.immae.release.enable = true;
-  config.myServices.websites.immae.temp.enable = true;
+      leila.production.enable = true;
 
-  config.myServices.websites.leila.production.enable = true;
+      ludivinecassal.integration.enable = true;
+      ludivinecassal.production.enable = true;
 
-  config.myServices.websites.ludivinecassal.integration.enable = true;
-  config.myServices.websites.ludivinecassal.production.enable = true;
+      nassime.production.enable = true;
 
-  config.myServices.websites.nassime.production.enable = true;
+      naturaloutil.production.enable = true;
 
-  config.myServices.websites.naturaloutil.production.enable = true;
+      papa.surveillance.enable = true;
 
-  config.myServices.websites.papa.surveillance.enable = true;
+      piedsjaloux.integration.enable = true;
+      piedsjaloux.production.enable = true;
 
-  config.myServices.websites.piedsjaloux.integration.enable = true;
-  config.myServices.websites.piedsjaloux.production.enable = true;
+      tools.cloud.enable = true;
+      tools.dav.enable = true;
+      tools.db.enable = true;
+      tools.diaspora.enable = true;
+      tools.etherpad-lite.enable = true;
+      tools.git.enable = true;
+      tools.mastodon.enable = true;
+      tools.mediagoblin.enable = true;
+      tools.peertube.enable = true;
+      tools.tools.enable = true;
+    };
+  };
 }