Fix the SSL state for databases connections

Whenever possible, we use a socket connexion (all postgresql
connections, and a few mysql ones)

When remote (only mysql), we require SSL in the users database (cannot
be enforced globally)

Also, put pam configurations in a correct state

Fixes https://git.immae.eu/mantisbt/view.php?id=89
Fixes https://git.immae.eu/mantisbt/view.php?id=90
Fixes https://git.immae.eu/mantisbt/view.php?id=88

12 files changed, 44 insertions, 25 deletions

diff --git a/nixops/modules/websites/chloe/chloe.nix b/nixops/modules/websites/chloe/chloe.nix
index 355cca7..9752db6 100644
--- a/nixops/modules/websites/chloe/chloe.nix
+++ b/nixops/modules/websites/chloe/chloe.nix
@@ -23,7 +23,8 @@ let
         env[SPIP_LDAP_SEARCH_DN] = "${config.ldap.dn}"
         env[SPIP_LDAP_SEARCH_PW] = "${config.ldap.password}"
         env[SPIP_LDAP_SEARCH] = "${config.ldap.search}"
-        env[SPIP_MYSQL_HOST] = "db-1.immae.eu"
+        env[SPIP_MYSQL_HOST] = "${config.mysql.host}"
+        env[SPIP_MYSQL_PORT] = "${config.mysql.port}"
         env[SPIP_MYSQL_DB] = "${config.mysql.name}"
         env[SPIP_MYSQL_USER] = "${config.mysql.user}"
         env[SPIP_MYSQL_PASSWORD] = "${config.mysql.password}"
diff --git a/nixops/modules/websites/chloe/chloe_config_dev/connect.php b/nixops/modules/websites/chloe/chloe_config_dev/connect.php
index 2e4439f..18b0933 100644
--- a/nixops/modules/websites/chloe/chloe_config_dev/connect.php
+++ b/nixops/modules/websites/chloe/chloe_config_dev/connect.php
@@ -2,5 +2,14 @@
 if (!defined("_ECRIRE_INC_VERSION")) return;
 define('_MYSQL_SET_SQL_MODE',true);
 $GLOBALS['spip_connect_version'] = 0.7;
-spip_connect_db(getenv("SPIP_MYSQL_HOST"),'',getenv("SPIP_MYSQL_USER"),getenv("SPIP_MYSQL_PASSWORD"),getenv("SPIP_MYSQL_DB"),'mysql', 'spip','ldap.php');
+spip_connect_db(
+  getenv("SPIP_MYSQL_HOST"),
+  getenv("SPIP_MYSQL_PORT"),
+  getenv("SPIP_MYSQL_USER"),
+  getenv("SPIP_MYSQL_PASSWORD"),
+  getenv("SPIP_MYSQL_DB"),
+  'mysql',
+  'spip',
+  'ldap.php'
+);
 ?>
diff --git a/nixops/modules/websites/chloe/chloe_config_prod/connect.php b/nixops/modules/websites/chloe/chloe_config_prod/connect.php
index 2e4439f..18b0933 100644
--- a/nixops/modules/websites/chloe/chloe_config_prod/connect.php
+++ b/nixops/modules/websites/chloe/chloe_config_prod/connect.php
@@ -2,5 +2,14 @@
 if (!defined("_ECRIRE_INC_VERSION")) return;
 define('_MYSQL_SET_SQL_MODE',true);
 $GLOBALS['spip_connect_version'] = 0.7;
-spip_connect_db(getenv("SPIP_MYSQL_HOST"),'',getenv("SPIP_MYSQL_USER"),getenv("SPIP_MYSQL_PASSWORD"),getenv("SPIP_MYSQL_DB"),'mysql', 'spip','ldap.php');
+spip_connect_db(
+  getenv("SPIP_MYSQL_HOST"),
+  getenv("SPIP_MYSQL_PORT"),
+  getenv("SPIP_MYSQL_USER"),
+  getenv("SPIP_MYSQL_PASSWORD"),
+  getenv("SPIP_MYSQL_DB"),
+  'mysql',
+  'spip',
+  'ldap.php'
+);
 ?>
diff --git a/nixops/modules/websites/connexionswing/connexionswing.nix b/nixops/modules/websites/connexionswing/connexionswing.nix
index f394574..a9ee2ba 100644
--- a/nixops/modules/websites/connexionswing/connexionswing.nix
+++ b/nixops/modules/websites/connexionswing/connexionswing.nix
@@ -7,8 +7,8 @@ let
       writeText "parameters.yml" ''
         # This file is auto-generated during the composer install
         parameters:
-            database_host: db-1.immae.eu
-            database_port: null
+            database_host: ${config.mysql.host}
+            database_port: ${config.mysql.port}
             database_name: ${config.mysql.name}
             database_user: ${config.mysql.user}
             database_password: ${config.mysql.password}
diff --git a/nixops/modules/websites/ludivine/ludivinecassal.nix b/nixops/modules/websites/ludivine/ludivinecassal.nix
index eff0bf8..e17a64e 100644
--- a/nixops/modules/websites/ludivine/ludivinecassal.nix
+++ b/nixops/modules/websites/ludivine/ludivinecassal.nix
@@ -7,8 +7,8 @@ let
       writeText "parameters.yml" ''
         # This file is auto-generated during the composer install
         parameters:
-            database_host: db-1.immae.eu
-            database_port: null
+            database_host: ${config.mysql.host}
+            database_port: ${config.mysql.port}
             database_name: ${config.mysql.name}
             database_user: ${config.mysql.user}
             database_password: ${config.mysql.password}
diff --git a/nixops/modules/websites/piedsjaloux/piedsjaloux.nix b/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
index 1b53c4a..52838c6 100644
--- a/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
+++ b/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
@@ -7,8 +7,8 @@ let
       writeText "parameters.yml" ''
         # This file is auto-generated during the composer install
         parameters:
-            database_host: db-1.immae.eu
-            database_port: null
+            database_host: ${config.mysql.host}
+            database_port: ${config.mysql.port}
             database_name: ${config.mysql.name}
             database_user: ${config.mysql.user}
             database_password: ${config.mysql.password}
diff --git a/nixops/modules/websites/tellesflorian/tellesflorian.nix b/nixops/modules/websites/tellesflorian/tellesflorian.nix
index 4237af8..41be4b0 100644
--- a/nixops/modules/websites/tellesflorian/tellesflorian.nix
+++ b/nixops/modules/websites/tellesflorian/tellesflorian.nix
@@ -7,8 +7,8 @@ let
       writeText "parameters.yml" ''
         # This file is auto-generated during the composer install
         parameters:
-            database_host: db-1.immae.eu
-            database_port: null
+            database_host: ${config.mysql.host}
+            database_port: ${config.mysql.port}
             database_name: ${config.mysql.name}
             database_user: ${config.mysql.user}
             database_password: ${config.mysql.password}
diff --git a/nixops/modules/websites/tools/dav/davical.nix b/nixops/modules/websites/tools/dav/davical.nix
index 4d0639f..3f43607 100644
--- a/nixops/modules/websites/tools/dav/davical.nix
+++ b/nixops/modules/websites/tools/dav/davical.nix
@@ -18,7 +18,7 @@ let
   davical = rec {
     config = writeText "davical_config.php" ''
         <?php
-        $c->pg_connect[] = "dbname=davical user=davical_app host=db-1.immae.eu password=${env.postgresql.password}";
+        $c->pg_connect[] = "dbname=${env.postgresql.database} user=${env.postgresql.user} host=${env.postgresql.socket} password=${env.postgresql.password}";
 
         $c->readonly_webdav_collections = false;
 
diff --git a/nixops/modules/websites/tools/diaspora/diaspora.nix b/nixops/modules/websites/tools/diaspora/diaspora.nix
index 798ebe6..765c0a5 100644
--- a/nixops/modules/websites/tools/diaspora/diaspora.nix
+++ b/nixops/modules/websites/tools/diaspora/diaspora.nix
@@ -99,9 +99,9 @@ let
   database_config = writeText "database.yml" ''
       postgresql: &postgresql
         adapter: postgresql
-        host: db-1.immae.eu
-        port: 5432
-        username: "diaspora"
+        host: "${env.postgresql.socket}"
+        port: "${env.postgresql.port}"
+        username: "${env.postgresql.user}"
         password: "${env.postgresql.password}"
         encoding: unicode
       common: &common
@@ -113,7 +113,7 @@ let
         database: diaspora_development
       production:
         <<: *combined
-        database: diaspora
+        database: ${env.postgresql.database}
       test:
         <<: *combined
         database: "diaspora_test"
diff --git a/nixops/modules/websites/tools/git/mantisbt/mantisbt.nix b/nixops/modules/websites/tools/git/mantisbt/mantisbt.nix
index bc2ff3a..c6c3bff 100644
--- a/nixops/modules/websites/tools/git/mantisbt/mantisbt.nix
+++ b/nixops/modules/websites/tools/git/mantisbt/mantisbt.nix
@@ -20,10 +20,10 @@ let
     config = 
       writeText "config_inc.php" ''
       <?php
-      $g_hostname              = 'db-1.immae.eu';
-      $g_db_username           = 'mantisbt';
+      $g_hostname              = '${env.postgresql.socket}';
+      $g_db_username           = '${env.postgresql.user}';
       $g_db_password           = '${env.postgresql.password}';
-      $g_database_name         = 'mantisbt';
+      $g_database_name         = '${env.postgresql.database}';
       $g_db_type               = 'pgsql';
       $g_crypto_master_salt    = '${env.master_salt}';
       $g_allow_signup          = OFF;
diff --git a/nixops/modules/websites/tools/tools/ttrss.nix b/nixops/modules/websites/tools/tools/ttrss.nix
index 76105be..95cca9d 100644
--- a/nixops/modules/websites/tools/tools/ttrss.nix
+++ b/nixops/modules/websites/tools/tools/ttrss.nix
@@ -66,11 +66,11 @@ let
         define('MYSQL_CHARSET', 'UTF8');
 
         define('DB_TYPE', 'pgsql');
-        define('DB_HOST', 'db-1.immae.eu');
-        define('DB_USER', 'ttrss');
-        define('DB_NAME', 'ttrss');
+        define('DB_HOST', '${env.postgresql.socket}');
+        define('DB_USER', '${env.postgresql.user}');
+        define('DB_NAME', '${env.postgresql.database}');
         define('DB_PASS', '${env.postgresql.password}');
-        define('DB_PORT', '5432');
+        define('DB_PORT', '${env.postgresql.port}');
 
         define('AUTH_AUTO_CREATE', true);
         define('AUTH_AUTO_LOGIN', true);
diff --git a/nixops/modules/websites/tools/tools/yourls.nix b/nixops/modules/websites/tools/tools/yourls.nix
index b97dac9..66dd2fd 100644
--- a/nixops/modules/websites/tools/tools/yourls.nix
+++ b/nixops/modules/websites/tools/tools/yourls.nix
@@ -18,9 +18,9 @@ let
         define( 'YOURLS_DB_USER', '${env.mysql.user}' );
         define( 'YOURLS_DB_PASS', '${env.mysql.password}' );
         define( 'YOURLS_DB_NAME', '${env.mysql.database}' );
-        define( 'YOURLS_DB_HOST', 'db-1.immae.eu' );
+        define( 'YOURLS_DB_HOST', '${env.mysql.host}' );
         define( 'YOURLS_DB_PREFIX', 'yourls_' );
-        define( 'YOURLS_SITE', 'http://tools.immae.eu/url' );
+        define( 'YOURLS_SITE', 'https://tools.immae.eu/url' );
         define( 'YOURLS_HOURS_OFFSET', 0 ); 
         define( 'YOURLS_LANG', ''' ); 
         define( 'YOURLS_UNIQUE_URLS', true );