Squash changes containing private information

There were a lot of changes since the previous commit, but a lot of them
contained personnal information about users. All thos changes got
stashed into a single commit (history is kept in a different place) and
private information was moved in a separate private repository

3 files changed, 310 insertions, 0 deletions

diff --git a/systems/eldiron/websites/dav/davical.nix b/systems/eldiron/websites/dav/davical.nix
new file mode 100644
index 0000000..b418cb8
--- /dev/null
+++ b/systems/eldiron/websites/dav/davical.nix
@@ -0,0 +1,128 @@
+{ stdenv, fetchurl, gettext, writeText, env, awl, davical, config }:
+rec {
+  keys."webapps/dav-davical" = {
+    user = apache.user;
+    group = apache.group;
+    permissions = "0400";
+    text = ''
+      <?php
+      $c->pg_connect[] = "dbname=${env.postgresql.database} user=${env.postgresql.user} host=${env.postgresql.socket} password=${env.postgresql.password}";
+
+      $c->readonly_webdav_collections = false;
+
+      $c->admin_email ='davical@tools.immae.eu';
+
+      $c->restrict_setup_to_admin = true;
+
+      $c->collections_always_exist = false;
+
+      $c->external_refresh = 60;
+
+      $c->enable_scheduling = true;
+
+      $c->iMIP = (object) array("send_email" => true);
+
+      $c->authenticate_hook['optional'] = false;
+      $c->authenticate_hook['call'] = 'LDAP_check';
+      $c->authenticate_hook['config'] = array(
+          'host' => '${env.ldap.host}',
+          'port' => '389',
+          'startTLS' => 'yes',
+          'bindDN'=> '${env.ldap.dn}',
+          'passDN'=> '${env.ldap.password}',
+          'protocolVersion' => '3',
+          'baseDNUsers'=> array('ou=users,${env.ldap.base}', 'ou=group_users,${env.ldap.base}'),
+          'filterUsers' => '${env.ldap.filter}',
+          'baseDNGroups' => 'ou=groups,${env.ldap.base}',
+          'filterGroups' => 'memberOf=cn=groups,${env.ldap.dn}',
+          'mapping_field' => array(
+            "username" => "uid",
+            "fullname" => "cn",
+            "email"    => "mail",
+            "modified" => "modifyTimestamp",
+          ),
+          'format_updated'=> array('Y' => array(0,4),'m' => array(4,2),'d'=> array(6,2),'H' => array(8,2),'M'=>array(10,2),'S' => array(12,2)),
+            /** used to set default value for all users, will be overcharged by ldap if defined also in mapping_field **/
+      //    'default_value' => array("date_format_type" => "E","locale" => "fr_FR"),
+          'group_mapping_field' => array(
+            "username"    => "cn",
+            "updated"     => "modifyTimestamp",
+            "fullname"    => "givenName",
+            "displayname" => "givenName",
+            "members"     => "memberUid",
+            "email"       => "mail",
+          ),
+        );
+
+      $c->do_not_sync_from_ldap = array('admin' => true);
+      include('drivers_ldap.php');
+    '';
+  };
+  webapp = davical.override { davical_config = config.secrets.fullPaths."webapps/dav-davical"; };
+  webRoot = "${webapp}/htdocs";
+  apache = rec {
+    user = "wwwrun";
+    group = "wwwrun";
+    modules = [ "proxy_fcgi" ];
+    root = webRoot;
+    vhostConf = socket: ''
+      Alias /davical "${root}"
+      Alias /caldav.php  "${root}/caldav.php"
+      <Directory "${root}">
+        DirectoryIndex index.php index.html
+        AcceptPathInfo On
+        AllowOverride None
+        Require all granted
+
+        <FilesMatch "\.php$">
+          CGIPassAuth on
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
+        </FilesMatch>
+
+        RewriteEngine On
+        <IfModule mod_headers.c>
+                Header unset Access-Control-Allow-Origin
+                Header unset Access-Control-Allow-Methods
+                Header unset Access-Control-Allow-Headers
+                Header unset Access-Control-Allow-Credentials
+                Header unset Access-Control-Expose-Headers
+
+                Header always set Access-Control-Allow-Origin "*"
+                Header always set Access-Control-Allow-Methods "GET,POST,OPTIONS,PROPFIND,PROPPATCH,REPORT,PUT,MOVE,DELETE,LOCK,UNLOCK"
+                Header always set Access-Control-Allow-Headers "User-Agent,Authorization,Content-type,Depth,If-match,If-None-Match,Lock-Token,Timeout,Destination,Overwrite,Prefer,X-client,X-Requested-With"
+                Header always set Access-Control-Allow-Credentials false
+                Header always set Access-Control-Expose-Headers "Etag,Preference-Applied"
+
+                RewriteCond %{HTTP:Access-Control-Request-Method} !^$
+                RewriteCond %{REQUEST_METHOD} OPTIONS
+                RewriteRule ^(.*)$ $1 [R=200,L]
+        </IfModule>
+      </Directory>
+      '';
+  };
+  phpFpm = rec {
+    serviceDeps = [ "postgresql.service" "openldap.service" ];
+    basedir = builtins.concatStringsSep ":" [ webapp config.secrets.fullPaths."webapps/dav-davical" awl ];
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "dynamic";
+      "pm.max_children" = "60";
+      "pm.start_servers" = "2";
+      "pm.min_spare_servers" = "1";
+      "pm.max_spare_servers" = "10";
+
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "DavicalPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[include_path]" = "${awl}/inc:${webapp}/inc";
+      "php_admin_value[session.save_handler]" = "redis";
+      "php_admin_value[session.save_path]" = "'unix:///run/redis-php-sessions/redis.sock?persistent=1&prefix=Tools:Davical:'";
+      "php_flag[magic_quotes_gpc]" = "Off";
+      "php_flag[register_globals]" = "Off";
+      "php_admin_value[error_reporting]" = "E_ALL & ~E_NOTICE";
+      "php_admin_value[default_charset]" = "utf-8";
+      "php_flag[magic_quotes_runtime]" = "Off";
+    };
+  };
+}
diff --git a/systems/eldiron/websites/dav/default.nix b/systems/eldiron/websites/dav/default.nix
new file mode 100644
index 0000000..109715d
--- /dev/null
+++ b/systems/eldiron/websites/dav/default.nix
@@ -0,0 +1,140 @@
+{ lib, pkgs, config,  ... }:
+let
+    infcloud = rec {
+      root = pkgs.webapps-infcloud;
+      vhostConf = ''
+          Alias /carddavmate ${root}
+          Alias /caldavzap ${root}
+          Alias /infcloud ${root}
+          <Directory ${root}>
+            AllowOverride All
+            Options FollowSymlinks
+            Require all granted
+            DirectoryIndex index.html
+          </Directory>
+      '';
+    };
+    davical = pkgs.callPackage ./davical.nix {
+      env = config.myEnv.tools.davical;
+      davical = pkgs.webapps-davical;
+      awl = pkgs.webapps-awl;
+      inherit config;
+    };
+
+    cfg = config.myServices.websites.tools.dav;
+in {
+  options.myServices.websites.tools.dav = {
+    enable = lib.mkEnableOption "enable dav website";
+  };
+
+  config = lib.mkIf cfg.enable {
+    myServices.dns.zones."immae.eu".subdomains.dav =
+      with config.myServices.dns.helpers; ips servers.eldiron.ips.main;
+
+    myServices.chatonsProperties.services = {
+      davical = {
+        file.datetime = "2022-08-21T01:33:00";
+        service = {
+          name = "Davical";
+          description = "DAViCal is a server for calendar sharing";
+          website = "https://dav.immae.eu";
+          logo = "https://www.davical.org/images/logo.gif";
+          status.level = "OK";
+          status.description = "OK";
+          registration."" = ["MEMBER" "CLIENT"];
+          registration.load = "OPEN";
+          install.type = "PACKAGE";
+        };
+        software = {
+          name = "Davical";
+          website = "https://www.davical.org/";
+          license.url = "https://gitlab.com/davical-project/davical/-/blob/master/COPYING";
+          license.name = "GNU General Public License Version 2";
+          version = pkgs.webapps-davical.version;
+          source.url = "https://gitlab.com/davical-project/davical/";
+          modules = "infcloud";
+        };
+      };
+      #calendar = {
+      #  file.datetime = "2022-08-22T00:00:00";
+      #  service = {
+      #    name = "Calendar";
+      #    description = "Opensource CalDAV web client";
+      #    website = "https://dav.immae.eu/caldavzap/";
+      #    logo = "https://dav.immae.eu/caldavzap/images/infcloud_logo.svg";
+      #    status.level = "OK";
+      #    status.description = "OK";
+      #    registration."" = ["MEMBER" "CLIENT"];
+      #    registration.load = "OPEN";
+      #    install.type = "PACKAGE";
+      #  };
+      #  software = {
+      #    name = "InfCloud";
+      #    website = "https://inf-it.com/open-source/clients/infcloud/";
+      #    license.url = "https://www.gnu.org/licenses/agpl-3.0.en.html";
+      #    license.name = "GNU Affero General Public License (version 3.0)";
+      #    version = pkgs.webapps-infcloud.version;
+      #    source.url = "https://inf-it.com/open-source/clients/infcloud/";
+      #  };
+      #};
+      #contacts = {
+      #  file.datetime = "2022-08-22T00:00:00";
+      #  service = {
+      #    name = "Contacts";
+      #    description = "Opensource Carddav web client";
+      #    website = "https://dav.immae.eu/carddavmate/";
+      #    logo = "https://dav.immae.eu/caldavzap/images/infcloud_logo.svg";
+      #    status.level = "OK";
+      #    status.description = "OK";
+      #    registration."" = ["MEMBER" "CLIENT"];
+      #    registration.load = "OPEN";
+      #    install.type = "PACKAGE";
+      #  };
+      #  software = {
+      #    name = "InfCloud";
+      #    website = "https://inf-it.com/open-source/clients/infcloud/";
+      #    license.url = "https://www.gnu.org/licenses/agpl-3.0.en.html";
+      #    license.name = "GNU Affero General Public License (version 3.0)";
+      #    version = pkgs.webapps-infcloud.version;
+      #    source.url = "https://inf-it.com/open-source/clients/infcloud/";
+      #  };
+      #};
+    };
+    secrets.keys = davical.keys;
+    services.websites.env.tools.modules = davical.apache.modules;
+
+    security.acme.certs.eldiron.extraDomainNames = [ "dav.immae.eu" ];
+    services.websites.env.tools.vhostConfs.dav = {
+      certName    = "eldiron";
+      hosts       = ["dav.immae.eu" ];
+      root        = ./www;
+      extraConfig = [
+        infcloud.vhostConf
+        (davical.apache.vhostConf config.services.phpfpm.pools.davical.socket)
+      ];
+    };
+
+    services.phpfpm.pools = {
+      davical = {
+        user = config.services.websites.env.tools.user;
+        group = config.services.websites.env.tools.group;
+        settings = davical.phpFpm.pool;
+        phpPackage = pkgs.php72.withExtensions({ enabled, all }: enabled ++ [all.redis]);
+      };
+    };
+    myServices.monitoring.fromMasterActivatedPlugins = [ "http" ];
+    myServices.monitoring.fromMasterObjects.service = [
+      {
+        service_description = "davical website is running on dav.immae.eu";
+        host_name = config.hostEnv.fqdn;
+        use = "external-web-service";
+        check_command = ["check_https" "dav.immae.eu" "/davical/" "Log On Please"];
+
+        servicegroups = "webstatus-webapps";
+        _webstatus_name = "Davical";
+        _webstatus_url = "https://dav.immae.eu/davical";
+      }
+    ];
+  };
+}
+
diff --git a/systems/eldiron/websites/dav/www/index.html b/systems/eldiron/websites/dav/www/index.html
new file mode 100644
index 0000000..91c25ba
--- /dev/null
+++ b/systems/eldiron/websites/dav/www/index.html
@@ -0,0 +1,42 @@
+<!doctype html>
+<html lang="fr">
+  <head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Dav configuration</title>
+    <style type="text/css">
+      body {
+        padding-top: 1em;
+        padding-left: 5px;
+        padding-right: 5px;
+        text-align: left;
+        margin: auto;
+        font: 20px Helvetica, sans-serif;
+        color: #333;
+        height: 100%;
+        min-height: 100%;
+      }
+      span.code {
+        font-family: monospace;
+      }
+    </style>
+  </head>
+  <body>
+    <p>
+      Dav configuration:
+      <ul>
+        <li>Server: <span class="code">https://dav.immae.eu/caldav.php</span>
+        </li>
+      </ul>
+    </p>
+    <p>Clients:
+      <ul>
+        <li><a href="/infcloud">Infcloud (calendar, address book, todo lists)</a></li>
+        <li><a href="/carddavmate">Carddavmate (address book)</a></li>
+        <li><a href="/caldavzap">Caldavzap (calendar, todo lists)</a></li>
+        <li><a href="/davical">Davical (Manage dav account)</a></li>
+      </ul>
+    </p>
+  </body>
+</html>
+