diff options
author | Ismaël Bouya <ismael.bouya@normalesup.org> | 2023-10-04 01:35:06 +0200 |
---|---|---|
committer | Ismaël Bouya <ismael.bouya@normalesup.org> | 2023-10-04 02:11:48 +0200 |
commit | 1a64deeb894dc95e2645a75771732c6cc53a79ad (patch) | |
tree | 1b9df4838f894577a09b9b260151756272efeb53 /systems/eldiron/websites/cryptpad | |
parent | fa25ffd4583cc362075cd5e1b4130f33306103f0 (diff) | |
download | Nix-1a64deeb894dc95e2645a75771732c6cc53a79ad.tar.gz Nix-1a64deeb894dc95e2645a75771732c6cc53a79ad.tar.zst Nix-1a64deeb894dc95e2645a75771732c6cc53a79ad.zip |
Squash changes containing private information
There were a lot of changes since the previous commit, but a lot of them
contained personnal information about users. All thos changes got
stashed into a single commit (history is kept in a different place) and
private information was moved in a separate private repository
Diffstat (limited to 'systems/eldiron/websites/cryptpad')
-rw-r--r-- | systems/eldiron/websites/cryptpad/default.nix | 89 | ||||
-rw-r--r-- | systems/eldiron/websites/cryptpad/farm.nix | 186 |
2 files changed, 275 insertions, 0 deletions
diff --git a/systems/eldiron/websites/cryptpad/default.nix b/systems/eldiron/websites/cryptpad/default.nix new file mode 100644 index 0000000..4635548 --- /dev/null +++ b/systems/eldiron/websites/cryptpad/default.nix | |||
@@ -0,0 +1,89 @@ | |||
1 | { config, pkgs, lib, ... }: | ||
2 | let | ||
3 | cfg = config.myServices.websites.tools.cryptpad; | ||
4 | envCfg = config.myEnv.tools.cryptpad; | ||
5 | domain = "cryptpad.immae.eu"; | ||
6 | port = envCfg.port; | ||
7 | configFile = pkgs.writeText "config.js" '' | ||
8 | // ${pkgs.cryptpad}/lib/node_modules/cryptpad/config/config.example.js | ||
9 | module.exports = { | ||
10 | httpUnsafeOrigin: 'https://${domain}', | ||
11 | httpPort: ${toString port}, | ||
12 | adminEmail: '${envCfg.email}', | ||
13 | filePath: './datastore/', | ||
14 | archivePath: './data/archive', | ||
15 | pinPath: './data/pins', | ||
16 | taskPath: './data/tasks', | ||
17 | blockPath: './block', | ||
18 | blobPath: './blob', | ||
19 | blobStagingPath: './data/blobstage', | ||
20 | decreePath: './data/decrees', | ||
21 | logPath: './data/logs', | ||
22 | logToStdout: false, | ||
23 | logLevel: 'info', | ||
24 | logFeedback: false, | ||
25 | verbose: false, | ||
26 | inactiveTime: false, | ||
27 | maxUploadSize: 100 * 1024 * 1024, | ||
28 | adminKeys: ${builtins.toJSON envCfg.admins}, | ||
29 | }; | ||
30 | ''; | ||
31 | in | ||
32 | { | ||
33 | options.myServices.websites.tools.cryptpad.enable = lib.mkEnableOption "Enable Cryptpad"; | ||
34 | config = lib.mkIf cfg.enable { | ||
35 | myServices.dns.zones."immae.eu".subdomains.cryptpad = | ||
36 | with config.myServices.dns.helpers; ips servers.eldiron.ips.main; | ||
37 | |||
38 | myServices.chatonsProperties.hostings.cryptpad = { | ||
39 | file.datetime = "2022-08-21T01:20:00"; | ||
40 | hosting = { | ||
41 | name = "Cryptpad"; | ||
42 | description = "Collaboration suite, encrypted and open-source"; | ||
43 | website = "https://cryptpad.immae.eu/"; | ||
44 | logo = "https://cryptpad.immae.eu/customize/favicon/main-favicon.png"; | ||
45 | type = "INSTANCE"; | ||
46 | status.level = "OK"; | ||
47 | status.description = "OK"; | ||
48 | registration.load = "OPEN"; | ||
49 | install.type = "PACKAGE"; | ||
50 | }; | ||
51 | }; | ||
52 | myServices.chatonsProperties.services.cryptpad = { | ||
53 | file.datetime = "2022-08-21T01:20:00"; | ||
54 | service = { | ||
55 | name = "Cryptpad"; | ||
56 | description = "Collaboration suite, encrypted and open-source"; | ||
57 | website = "https://cryptpad.immae.eu/"; | ||
58 | logo = "https://cryptpad.immae.eu/customize/favicon/main-favicon.png"; | ||
59 | status.level = "OK"; | ||
60 | status.description = "OK"; | ||
61 | registration."" = ["NONE" "FREE" "MEMBER" "CLIENT"]; | ||
62 | registration.load = "OPEN"; | ||
63 | install.type = "PACKAGE"; | ||
64 | }; | ||
65 | software = { | ||
66 | name = "Cryptpad"; | ||
67 | website = "https://cryptpad.org/"; | ||
68 | license.url = "https://github.com/xwiki-labs/cryptpad/blob/main/LICENSE"; | ||
69 | license.name = "GNU Affero General Public License v3.0"; | ||
70 | version = pkgs.cryptpad.version; | ||
71 | source.url = "https://github.com/xwiki-labs/cryptpad"; | ||
72 | }; | ||
73 | }; | ||
74 | myServices.tools.cryptpad.farm.hosts.immaeEu = { | ||
75 | inherit domain port; | ||
76 | config = configFile; | ||
77 | }; | ||
78 | services.websites.env.tools.modules = [ "proxy_wstunnel" ]; | ||
79 | security.acme.certs.eldiron.extraDomainNames = [ domain ]; | ||
80 | services.websites.env.tools.vhostConfs.cryptpad = { | ||
81 | certName = "eldiron"; | ||
82 | hosts = [domain]; | ||
83 | root = config.myServices.tools.cryptpad.farm.vhostRoots.immaeEu; | ||
84 | extraConfig = [ | ||
85 | config.myServices.tools.cryptpad.farm.vhosts.immaeEu | ||
86 | ]; | ||
87 | }; | ||
88 | }; | ||
89 | } | ||
diff --git a/systems/eldiron/websites/cryptpad/farm.nix b/systems/eldiron/websites/cryptpad/farm.nix new file mode 100644 index 0000000..58393ab --- /dev/null +++ b/systems/eldiron/websites/cryptpad/farm.nix | |||
@@ -0,0 +1,186 @@ | |||
1 | { pkgs, config, lib, ... }: | ||
2 | let | ||
3 | cfg = config.myServices.tools.cryptpad.farm; | ||
4 | toService = name: | ||
5 | let | ||
6 | inherit (cfg.hosts.${name}) package config; | ||
7 | in { | ||
8 | description = "Cryptpad ${name} Service"; | ||
9 | wantedBy = [ "multi-user.target" ]; | ||
10 | after = [ "networking.target" ]; | ||
11 | serviceConfig = { | ||
12 | User = "cryptpad"; | ||
13 | Group = "cryptpad"; | ||
14 | Environment = [ | ||
15 | "CRYPTPAD_CONFIG=${config}" | ||
16 | "HOME=%S/cryptpad/${name}" | ||
17 | ]; | ||
18 | ExecStart = "${package}/bin/cryptpad"; | ||
19 | PrivateTmp = true; | ||
20 | Restart = "always"; | ||
21 | StateDirectory = "cryptpad/${name}"; | ||
22 | WorkingDirectory = "%S/cryptpad/${name}"; | ||
23 | }; | ||
24 | }; | ||
25 | toVhostRoot = name: "${cfg.hosts.${name}.package}/lib/node_modules/cryptpad"; | ||
26 | toVhost = name: | ||
27 | let | ||
28 | inherit (cfg.hosts.${name}) package domain port; | ||
29 | api_domain = domain; | ||
30 | files_domain = domain; | ||
31 | in '' | ||
32 | RewriteEngine On | ||
33 | |||
34 | Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" | ||
35 | Header set X-XSS-Protection "1; mode=block" | ||
36 | Header set X-Content-Type-Options "nosniff" | ||
37 | Header set Access-Control-Allow-Origin "*" | ||
38 | Header set Permissions-Policy "interest-cohort=()" | ||
39 | |||
40 | Header set Cross-Origin-Resource-Policy "cross-origin" | ||
41 | <If "%{REQUEST_URI} =~ m#^/(sheet|presentation|doc)/.*$#"> | ||
42 | Header set Cross-Origin-Opener-Policy "same-origin" | ||
43 | </If> | ||
44 | Header set Cross-Origin-Embedder-Policy "require-corp" | ||
45 | |||
46 | ErrorDocument 404 /customize.dist/404.html | ||
47 | |||
48 | <If "%{QUERY_STRING} =~ m#ver=.*?#"> | ||
49 | Header set Cache-Control "max-age=31536000" | ||
50 | </If> | ||
51 | <If "%{REQUEST_URI} =~ m#^/.*(\/|\.html)$#"> | ||
52 | Header set Cache-Control "no-cache" | ||
53 | </If> | ||
54 | |||
55 | SetEnv styleSrc "'unsafe-inline' 'self' ${domain}" | ||
56 | SetEnv connectSrc "'self' https://${domain} ${domain} https://${api_domain} blob: wss://${api_domain} ${api_domain} ${files_domain}" | ||
57 | SetEnv fontSrc "'self' data: ${domain}" | ||
58 | SetEnv imgSrc "'self' data: * blob: ${domain}" | ||
59 | SetEnv frameSrc "'self' blob:" | ||
60 | SetEnv mediaSrc "'self' data: * blob: ${domain}" | ||
61 | SetEnv childSrc "https://${domain}" | ||
62 | SetEnv workerSrc "https://${domain}" | ||
63 | SetEnv scriptSrc "'self' 'unsafe-eval' 'unsafe-inline' resource: ${domain}" | ||
64 | |||
65 | Header set Content-Security-Policy "default-src 'none'; child-src %{childSrc}e; worker-src %{workerSrc}e; media-src %{mediaSrc}e; style-src %{styleSrc}e; script-src %{scriptSrc}e; connect-src %{connectSrc}e; font-src %{fontSrc}e; img-src %{imgSrc}e; frame-src %{frameSrc}e;" | ||
66 | |||
67 | RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC] | ||
68 | RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC] | ||
69 | RewriteRule .* ws://localhost:${toString port}%{REQUEST_URI} [P,NE,QSA,L] | ||
70 | |||
71 | RewriteRule ^/customize/(.*)$ /customize.dist/$1 [L] | ||
72 | |||
73 | ProxyPassMatch "^/(api/(config|broadcast).*)$" "http://localhost:${toString port}/$1" | ||
74 | ProxyPassReverse /api http://localhost:${toString port}/api | ||
75 | ProxyPreserveHost On | ||
76 | RequestHeader set X-Real-IP %{REMOTE_ADDR}s | ||
77 | |||
78 | Alias /blob /var/lib/cryptpad/${name}/blob | ||
79 | <Directory /var/lib/cryptpad/${name}/blob> | ||
80 | Require all granted | ||
81 | AllowOverride None | ||
82 | </Directory> | ||
83 | Alias /block /var/lib/cryptpad/${name}/block | ||
84 | <Directory /var/lib/cryptpad/${name}/block> | ||
85 | Require all granted | ||
86 | AllowOverride None | ||
87 | </Directory> | ||
88 | <LocationMatch /blob/> | ||
89 | Header set Cache-Control "max-age=31536000" | ||
90 | Header set Access-Control-Allow-Origin "*" | ||
91 | Header set Access-Control-Allow-Methods "GET, POST, OPTIONS" | ||
92 | Header set Access-Control-Allow-Headers "DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Content-Length" | ||
93 | Header set Access-Control-Expose-Headers "DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Content-Range,Range,Content-Length" | ||
94 | |||
95 | RewriteCond %{REQUEST_METHOD} OPTIONS | ||
96 | RewriteRule ^(.*)$ $1 [R=204,L] | ||
97 | </LocationMatch> | ||
98 | |||
99 | <LocationMatch /block/> | ||
100 | Header set Cache-Control "max-age=0" | ||
101 | </locationMatch> | ||
102 | |||
103 | RewriteRule ^/(register|login|settings|user|pad|drive|poll|slide|code|whiteboard|file|media|profile|contacts|todo|filepicker|debug|kanban|sheet|support|admin|notifications|teams|calendar|presentation|doc)$ $1/ [R=302,L] | ||
104 | |||
105 | RewriteCond %{DOCUMENT_ROOT}/www/%{REQUEST_URI} -f | ||
106 | RewriteRule (.*) /www/$1 [L] | ||
107 | |||
108 | RewriteCond %{DOCUMENT_ROOT}/www/%{REQUEST_URI}/index.html -f | ||
109 | RewriteRule (.*) /www/$1/index.html [L] | ||
110 | |||
111 | RewriteCond %{DOCUMENT_ROOT}/customize.dist/%{REQUEST_URI} -f | ||
112 | RewriteRule (.*) /customize.dist/$1 [L] | ||
113 | |||
114 | <Directory ${package}/lib/node_modules/cryptpad/www> | ||
115 | AllowOverride None | ||
116 | Require all granted | ||
117 | DirectoryIndex index.html | ||
118 | </Directory> | ||
119 | <Directory ${package}/lib/node_modules/cryptpad/customize.dist> | ||
120 | AllowOverride None | ||
121 | Require all granted | ||
122 | DirectoryIndex index.html | ||
123 | </Directory> | ||
124 | ''; | ||
125 | in | ||
126 | { | ||
127 | options.myServices.tools.cryptpad.farm = { | ||
128 | hosts = lib.mkOption { | ||
129 | default = {}; | ||
130 | description = "Hosts to install"; | ||
131 | type = lib.types.attrsOf (lib.types.submodule { | ||
132 | options = { | ||
133 | port = lib.mkOption { | ||
134 | type = lib.types.port; | ||
135 | }; | ||
136 | package = lib.mkOption { | ||
137 | type = lib.types.package; | ||
138 | description = "Cryptpad package to use"; | ||
139 | default = pkgs.cryptpad; | ||
140 | }; | ||
141 | domain = lib.mkOption { | ||
142 | type = lib.types.str; | ||
143 | description = "Domain for main host"; | ||
144 | }; | ||
145 | config = lib.mkOption { | ||
146 | type = lib.types.path; | ||
147 | description = "Path to configuration"; | ||
148 | }; | ||
149 | }; | ||
150 | }); | ||
151 | }; | ||
152 | vhosts = lib.mkOption { | ||
153 | description = "Instance vhosts configs"; | ||
154 | readOnly = true; | ||
155 | type = lib.types.attrsOf lib.types.str; | ||
156 | default = lib.genAttrs (builtins.attrNames cfg.hosts) toVhost; | ||
157 | }; | ||
158 | vhostRoots = lib.mkOption { | ||
159 | description = "Instance vhosts document roots"; | ||
160 | readOnly = true; | ||
161 | type = lib.types.attrsOf lib.types.path; | ||
162 | default = lib.genAttrs (builtins.attrNames cfg.hosts) toVhostRoot; | ||
163 | }; | ||
164 | vhostVarDirs = lib.mkOption { | ||
165 | description = "Instance vhosts var dirs"; | ||
166 | readOnly = true; | ||
167 | type = lib.types.attrsOf lib.types.path; | ||
168 | default = lib.genAttrs (builtins.attrNames cfg.hosts) (n: "/var/lib/cryptpad/${n}"); | ||
169 | }; | ||
170 | }; | ||
171 | config = { | ||
172 | users.users = lib.optionalAttrs (cfg.hosts != {}) { | ||
173 | cryptpad = { | ||
174 | uid = config.ids.uids.cryptpad; | ||
175 | group = "cryptpad"; | ||
176 | description = "Cryptpad user"; | ||
177 | }; | ||
178 | }; | ||
179 | users.groups = lib.optionalAttrs (cfg.hosts != {}) { | ||
180 | cryptpad = { | ||
181 | gid = config.ids.gids.cryptpad; | ||
182 | }; | ||
183 | }; | ||
184 | systemd.services = lib.listToAttrs (map (n: lib.nameValuePair "cryptpad-${n}" (toService n)) (builtins.attrNames cfg.hosts)); | ||
185 | }; | ||
186 | } | ||