Refactor websites.

This commit refactors websites into module per "vhost".

12 files changed, 511 insertions, 0 deletions

diff --git a/virtual/modules/websites/tools/tools/default.nix b/virtual/modules/websites/tools/tools/default.nix
new file mode 100644
index 0000000..f29ac11
--- /dev/null
+++ b/virtual/modules/websites/tools/tools/default.nix
@@ -0,0 +1,65 @@
+{ lib, pkgs, config, mylibs, ... }:
+let
+    adminer = pkgs.callPackage ../../commons/adminer.nix {};
+    ympd = pkgs.callPackage ./ympd.nix {};
+    ttrss = pkgs.callPackage ./ttrss.nix { inherit (mylibs) checkEnv fetchedGithub fetchedGit; };
+    roundcubemail = pkgs.callPackage ./roundcubemail.nix { inherit (mylibs) checkEnv; };
+
+    cfg = config.services.myWebsites.tools.tools;
+in {
+  options.services.myWebsites.tools.tools = {
+    enable = lib.mkEnableOption "enable tools website";
+  };
+
+  config = lib.mkIf cfg.enable {
+    security.acme.certs."eldiron".extraDomains."tools.immae.eu" = null;
+
+    services.myWebsites.tools.modules =
+      adminer.apache.modules
+      ++ ympd.apache.modules
+      ++ ttrss.apache.modules
+      ++ roundcubemail.apache.modules;
+
+    services.ympd = ympd.config // { enable = false; };
+
+    services.myWebsites.tools.vhostConfs.tools = {
+      certName    = "eldiron";
+      hosts       = ["tools.immae.eu" ];
+      root        = null;
+      extraConfig = [
+        adminer.apache.vhostConf
+        ympd.apache.vhostConf
+        ttrss.apache.vhostConf
+        roundcubemail.apache.vhostConf
+      ];
+    };
+
+    services.myPhpfpm.poolConfigs = {
+      adminer = adminer.phpFpm.pool;
+      ttrss = ttrss.phpFpm.pool;
+      roundcubemail = roundcubemail.phpFpm.pool;
+    };
+
+    system.activationScripts = {
+      ttrss = ttrss.activationScript;
+      roundcubemail = roundcubemail.activationScript;
+    };
+
+    systemd.services.tt-rss = {
+      description = "Tiny Tiny RSS feeds update daemon";
+      serviceConfig = {
+        User = "wwwrun";
+        ExecStart = "${pkgs.php}/bin/php ${ttrss.webRoot}/update.php --daemon";
+        StandardOutput = "syslog";
+        StandardError = "syslog";
+        PermissionsStartOnly = true;
+      };
+
+      wantedBy = [ "multi-user.target" ];
+      requires = ["postgresql.service"];
+      after = ["network.target" "postgresql.service"];
+    };
+
+  };
+}
+
diff --git a/virtual/modules/websites/tools/tools/roundcubemail.nix b/virtual/modules/websites/tools/tools/roundcubemail.nix
new file mode 100644
index 0000000..1aa2d87
--- /dev/null
+++ b/virtual/modules/websites/tools/tools/roundcubemail.nix
@@ -0,0 +1,110 @@
+{ lib, checkEnv, writeText, stdenv, fetchurl }:
+let
+  roundcubemail = let
+    plugins = {};
+  in rec {
+    varDir = "/var/lib/roundcubemail";
+    # FIXME: initial sync
+    activationScript = {
+      deps = [ "wrappers" ];
+      text = ''
+        install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir} \
+          ${varDir}/cache
+        install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
+      '';
+    };
+    config =
+      # FIXME: LOG_DESTINATION syslog?
+      assert checkEnv "NIXOPS_ROUNDCUBEMAIL_PSQL_URL";
+      assert checkEnv "NIXOPS_ROUNDCUBEMAIL_SECRET";
+      writeText "config.php" ''
+      <?php
+        $config['db_dsnw'] = '${builtins.getEnv "NIXOPS_ROUNDCUBEMAIL_PSQL_URL"}';
+        $config['default_host'] = 'ssl://mail.immae.eu';
+        $config['imap_conn_options'] = array("ssl" => array("verify_peer" => false));
+        $config['smtp_server'] = 'tls://mail.immae.eu';
+
+        $config['imap_cache'] = 'db';
+        $config['messages_cache'] = 'db';
+
+        $config['support_url'] = ''';
+
+        $config['des_key'] = '${builtins.getEnv "NIXOPS_ROUNDCUBEMAIL_SECRET"}';
+
+        $config['plugins'] = array();
+
+        $config['language'] = 'fr_FR';
+
+        $config['drafts_mbox'] = 'Mail/Drafts';
+        $config['junk_mbox'] = 'Mail/Spam';
+        $config['sent_mbox'] = 'Mail/sent';
+        $config['trash_mbox'] = ''';
+        $config['default_folders'] = array('INBOX', 'Mail/Drafts', 'Mail/sent', 'Mail/Spam', ''');
+        $config['draft_autosave'] = 60;
+        $config['enable_installer'] = false;
+        $config['log_driver'] = 'stdout';
+        $config['temp_dir'] = '${varDir}/cache';
+        $config['debug_level'] = 1;
+      '';
+    webRoot = stdenv.mkDerivation rec {
+      version = "1.3.8";
+      name = "roundcubemail-${version}";
+      src= fetchurl {
+        url = "https://github.com/roundcube/roundcubemail/releases/download/${version}/${name}-complete.tar.gz";
+        sha256 = "018djad7ygfl9c9f2l2j42qkg31ml3hs2f01f0dk361zckwk77n4";
+      };
+      buildPhase = ''
+        sed -i \
+          -e "s|RCUBE_INSTALL_PATH . 'temp.*|'${varDir}/cache';|" \
+          config/defaults.inc.php
+      '';
+      installPhase = ''
+        cp -a . $out
+        ln -s ${config} $out/config/config.inc.php
+        ${builtins.concatStringsSep "\n" (
+          lib.attrsets.mapAttrsToList (name: value: "ln -sf ${value} $out/plugins/${name}") plugins
+        )}
+      '';
+    };
+    apache = {
+      user = "wwwrun";
+      group = "wwwrun";
+      modules = [ "proxy_fcgi" ];
+      vhostConf = ''
+      Alias /roundcube "${webRoot}"
+      <Directory "${webRoot}">
+          DirectoryIndex index.php
+          AllowOverride All
+          Options FollowSymlinks
+          Require all granted
+
+          <FilesMatch "\.php$">
+            SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          </FilesMatch>
+        </Directory>
+        '';
+    };
+    phpFpm = rec {
+      basedir = builtins.concatStringsSep ":" (
+        [ webRoot config varDir ]
+        ++ lib.attrsets.mapAttrsToList (name: value: value) plugins);
+      socket = "/var/run/phpfpm/roundcubemail.sock";
+      pool = ''
+        listen = ${socket}
+        user = ${apache.user}
+        group = ${apache.group}
+        listen.owner = ${apache.user}
+        listen.group = ${apache.group}
+        pm = ondemand
+        pm.max_children = 60
+        pm.process_idle_timeout = 60
+
+        ; Needed to avoid clashes in browser cookies (same domain)
+        php_value[session.name] = RoundcubemailPHPSESSID
+        php_admin_value[open_basedir] = "${basedir}:/tmp"
+        php_admin_value[session.save_path] = "${varDir}/phpSessions"
+        '';
+    };
+  };
+in 
+  roundcubemail
diff --git a/virtual/modules/websites/tools/tools/tt-rss.json b/virtual/modules/websites/tools/tools/tt-rss.json
new file mode 100644
index 0000000..e2731b0
--- /dev/null
+++ b/virtual/modules/websites/tools/tools/tt-rss.json
@@ -0,0 +1,14 @@
+{
+  "tag": "986ca25-master",
+  "meta": {
+    "name": "tt-rss",
+    "url": "https://git.tt-rss.org/fox/tt-rss.git",
+    "branch": "master"
+  },
+  "git": {
+    "url": "https://git.tt-rss.org/fox/tt-rss.git",
+    "rev": "986ca251f995f7754a0470d3e0c44538a545081f",
+    "sha256": "0xkafkh7l9zazm5d6snlq03kdfxfhkb4c8fdsb32wn8b9bhdzf5s",
+    "fetchSubmodules": true
+  }
+}
diff --git a/virtual/modules/websites/tools/tools/ttrss-af-feedmod_type_replace.patch b/virtual/modules/websites/tools/tools/ttrss-af-feedmod_type_replace.patch
new file mode 100644
index 0000000..d622577
--- /dev/null
+++ b/virtual/modules/websites/tools/tools/ttrss-af-feedmod_type_replace.patch
@@ -0,0 +1,12 @@
+--- a/init.php  2014-06-16 14:21:06.995480038 +0200
++++ b/init.php  2014-06-16 14:22:00.151027654 +0200
+@@ -147,6 +147,9 @@
+                         }
+                     }
+                     break;
++                case 'replace':
++                    $article['content'] = preg_replace("/".$config['pattern']."/",$config['replacement'],$article['content']);
++                    break;
+ 
+                 default:
+                     // unknown type or invalid config
diff --git a/virtual/modules/websites/tools/tools/ttrss-af_feedmod.json b/virtual/modules/websites/tools/tools/ttrss-af_feedmod.json
new file mode 100644
index 0000000..e57fcce
--- /dev/null
+++ b/virtual/modules/websites/tools/tools/ttrss-af_feedmod.json
@@ -0,0 +1,15 @@
+{
+  "tag": "0ea2092-master",
+  "meta": {
+    "name": "ttrss-af_feedmod",
+    "url": "https://github.com/mbirth/ttrss_plugin-af_feedmod",
+    "branch": "master"
+  },
+  "github": {
+    "owner": "mbirth",
+    "repo": "ttrss_plugin-af_feedmod",
+    "rev": "0ea2092dd34067ecd898802cfca3570023d1ecfe",
+    "sha256": "02ibf47zcrsc2rr45wsix8gxyyf371davj8n8i0gj1zdq95klvnv",
+    "fetchSubmodules": true
+  }
+}
diff --git a/virtual/modules/websites/tools/tools/ttrss-auth-ldap.json b/virtual/modules/websites/tools/tools/ttrss-auth-ldap.json
new file mode 100644
index 0000000..c8aaab5
--- /dev/null
+++ b/virtual/modules/websites/tools/tools/ttrss-auth-ldap.json
@@ -0,0 +1,15 @@
+{
+  "tag": "4d751b0-master",
+  "meta": {
+    "name": "ttrss-auth-ldap",
+    "url": "https://github.com/hydrian/TTRSS-Auth-LDAP",
+    "branch": "master"
+  },
+  "github": {
+    "owner": "hydrian",
+    "repo": "TTRSS-Auth-LDAP",
+    "rev": "4d751b095c29a8dbe2dc7bb07777742956136e94",
+    "sha256": "0b9fl86acrzpcv41r7pj3bl8b3n72hpkdywzx9zjyfqv5pskxyim",
+    "fetchSubmodules": true
+  }
+}
diff --git a/virtual/modules/websites/tools/tools/ttrss-feediron.json b/virtual/modules/websites/tools/tools/ttrss-feediron.json
new file mode 100644
index 0000000..5dbec92
--- /dev/null
+++ b/virtual/modules/websites/tools/tools/ttrss-feediron.json
@@ -0,0 +1,15 @@
+{
+  "tag": "407168c-master",
+  "meta": {
+    "name": "ttrss-feediron",
+    "url": "https://github.com/m42e/ttrss_plugin-feediron",
+    "branch": "master"
+  },
+  "github": {
+    "owner": "m42e",
+    "repo": "ttrss_plugin-feediron",
+    "rev": "407168c628880b5ced572cc549db6d50e866d3c8",
+    "sha256": "17b95ifpcph6m03hjd1mhi8gi1hw9yd3fnffmw66fqr5c9l3zd9r",
+    "fetchSubmodules": true
+  }
+}
diff --git a/virtual/modules/websites/tools/tools/ttrss-feediron_json_reformat.patch b/virtual/modules/websites/tools/tools/ttrss-feediron_json_reformat.patch
new file mode 100644
index 0000000..e1c44d9
--- /dev/null
+++ b/virtual/modules/websites/tools/tools/ttrss-feediron_json_reformat.patch
@@ -0,0 +1,18 @@
+diff --git a/init.php b/init.php
+index 3c0f2f9..1aad146 100644
+--- a/init.php
++++ b/init.php
+@@ -600,10 +600,11 @@ class Feediron extends Plugin implements IHandler
+                        return false;
+                }
+ 
+-               $this->host->set($this, 'json_conf', Feediron_Json::format($json_conf));
++                $new_conf = json_encode(json_decode($json_conf), JSON_PRETTY_PRINT);
++                $this->host->set($this, 'json_conf', $new_conf);
+                $json_reply['success'] = true;
+                $json_reply['message'] = __('Configuration saved.');
+-               $json_reply['json_conf'] = Feediron_Json::format($json_conf);
++                $json_reply['json_conf'] = $new_conf;
+                echo json_encode($json_reply);
+        }
+ 
diff --git a/virtual/modules/websites/tools/tools/ttrss-ff_instagram.json b/virtual/modules/websites/tools/tools/ttrss-ff_instagram.json
new file mode 100644
index 0000000..1f241b9
--- /dev/null
+++ b/virtual/modules/websites/tools/tools/ttrss-ff_instagram.json
@@ -0,0 +1,15 @@
+{
+  "tag": "0366ffb-master",
+  "meta": {
+    "name": "ttrss-ff_instagram",
+    "url": "https://github.com/wltb/ff_instagram",
+    "branch": "master"
+  },
+  "github": {
+    "owner": "wltb",
+    "repo": "ff_instagram",
+    "rev": "0366ffb18c4d490c8fbfba2f5f3367a5af23cfe8",
+    "sha256": "0vvzl6wi6jmrqknsfddvckjgsgfizz1d923d1nyrpzjfn6bda1vk",
+    "fetchSubmodules": true
+  }
+}
diff --git a/virtual/modules/websites/tools/tools/ttrss-tumblr_gdpr_ua.json b/virtual/modules/websites/tools/tools/ttrss-tumblr_gdpr_ua.json
new file mode 100644
index 0000000..eafbcfe
--- /dev/null
+++ b/virtual/modules/websites/tools/tools/ttrss-tumblr_gdpr_ua.json
@@ -0,0 +1,15 @@
+{
+  "tag": "287c584-master",
+  "meta": {
+    "name": "ttrss-tumblr_gdpr_ua",
+    "url": "https://github.com/hkockerbeck/ttrss-tumblr-gdpr-ua",
+    "branch": "master"
+  },
+  "github": {
+    "owner": "hkockerbeck",
+    "repo": "ttrss-tumblr-gdpr-ua",
+    "rev": "287c584e68845d524f920156bff0b2eaa6f65117",
+    "sha256": "1fviawgcclqky4k4xv1sqzvpb8i74w9f0pclm09m78s8l85wh9py",
+    "fetchSubmodules": true
+  }
+}
diff --git a/virtual/modules/websites/tools/tools/ttrss.nix b/virtual/modules/websites/tools/tools/ttrss.nix
new file mode 100644
index 0000000..f7b0f61
--- /dev/null
+++ b/virtual/modules/websites/tools/tools/ttrss.nix
@@ -0,0 +1,182 @@
+{ lib, php, checkEnv, writeText, stdenv, fetchedGit, fetchedGithub }:
+let
+  ttrss = let
+    plugins = {
+      auth_ldap = stdenv.mkDerivation (fetchedGithub ./ttrss-auth-ldap.json // rec {
+        installPhase = ''
+          mkdir $out
+          cp plugins/auth_ldap/init.php $out
+        '';
+      });
+      af_feedmod = stdenv.mkDerivation (fetchedGithub ./ttrss-af_feedmod.json // rec {
+        patches = [ ./ttrss-af-feedmod_type_replace.patch ];
+        installPhase = ''
+          mkdir $out
+          cp init.php $out
+        '';
+      });
+      feediron = stdenv.mkDerivation (fetchedGithub ./ttrss-feediron.json // rec {
+        patches = [ ./ttrss-feediron_json_reformat.patch ];
+        installPhase = ''
+          mkdir $out
+          cp -a . $out
+        '';
+      });
+      ff_instagram = stdenv.mkDerivation (fetchedGithub ./ttrss-ff_instagram.json // rec {
+        installPhase = ''
+          mkdir $out
+          cp -a . $out
+        '';
+      });
+      tumblr_gdpr_ua = stdenv.mkDerivation (fetchedGithub ./ttrss-tumblr_gdpr_ua.json // rec {
+        installPhase = ''
+          mkdir $out
+          cp -a . $out
+        '';
+      });
+    };
+  in rec {
+    varDir = "/var/lib/ttrss";
+    # FIXME: initial sync
+    activationScript = {
+      deps = [ "wrappers" ];
+      text = ''
+        install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir} \
+          ${varDir}/lock ${varDir}/cache ${varDir}/feed-icons
+        install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir}/cache/export/ \
+          ${varDir}/cache/feeds/ \
+          ${varDir}/cache/images/ \
+          ${varDir}/cache/js/ \
+          ${varDir}/cache/simplepie/ \
+          ${varDir}/cache/upload/
+        touch ${varDir}/feed-icons/index.html
+        install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
+      '';
+    };
+    config =
+      # FIXME: LOG_DESTINATION syslog?
+      assert checkEnv "NIXOPS_TTRSS_DB_PASSWORD";
+      assert checkEnv "NIXOPS_TTRSS_LDAP_PASSWORD";
+      writeText "config.php" ''
+      <?php
+
+        define('PHP_EXECUTABLE', '${php}/bin/php');
+
+        define('LOCK_DIRECTORY', 'lock');
+        define('CACHE_DIR', 'cache');
+        define('ICONS_DIR', 'feed-icons');
+        define('ICONS_URL', 'feed-icons');
+        define('SELF_URL_PATH', 'https://tools.immae.eu/ttrss/');
+
+        define('MYSQL_CHARSET', 'UTF8');
+
+        define('DB_TYPE', 'pgsql');
+        define('DB_HOST', 'db-1.immae.eu');
+        define('DB_USER', 'ttrss');
+        define('DB_NAME', 'ttrss');
+        define('DB_PASS', '${builtins.getEnv "NIXOPS_TTRSS_DB_PASSWORD"}');
+        define('DB_PORT', '5432');
+
+        define('AUTH_AUTO_CREATE', true);
+        define('AUTH_AUTO_LOGIN', true);
+
+        define('SINGLE_USER_MODE', false);
+
+        define('SIMPLE_UPDATE_MODE', false);
+        define('CHECK_FOR_UPDATES', true);
+
+        define('FORCE_ARTICLE_PURGE', 0);
+        define('SESSION_COOKIE_LIFETIME', 60*60*24*120);
+        define('ENABLE_GZIP_OUTPUT', false);
+
+        define('PLUGINS', 'auth_ldap, note, instances');
+
+        define('LOG_DESTINATION', ''');
+        define('CONFIG_VERSION', 26);
+
+
+        define('SPHINX_SERVER', 'localhost:9312');
+        define('SPHINX_INDEX', 'ttrss, delta');
+
+        define('ENABLE_REGISTRATION', false);
+        define('REG_NOTIFY_ADDRESS', 'outils@immae.eu');
+        define('REG_MAX_USERS', 10);
+
+        define('SMTP_SERVER', 'mail.immae.eu:25');
+        define('SMTP_LOGIN', ''');
+        define('SMTP_PASSWORD', ''');
+        define('SMTP_SECURE', 'tls');
+
+        define('SMTP_FROM_NAME', 'Tiny Tiny RSS');
+        define('SMTP_FROM_ADDRESS', 'outils@immae.eu');
+        define('DIGEST_SUBJECT', '[tt-rss] New headlines for last 24 hours');
+
+        define('LDAP_AUTH_SERVER_URI', 'ldap://ldap.immae.eu:389/');
+        define('LDAP_AUTH_USETLS', TRUE);
+        define('LDAP_AUTH_ALLOW_UNTRUSTED_CERT', TRUE);
+        define('LDAP_AUTH_BASEDN', 'dc=immae,dc=eu');
+        define('LDAP_AUTH_ANONYMOUSBEFOREBIND', FALSE);
+        define('LDAP_AUTH_SEARCHFILTER', '(&(memberOf=cn=users,cn=ttrss,ou=services,dc=immae,dc=eu)(|(cn=???)(uid=???)(&(uid:dn:=???)(ou=ttrss))))');
+
+        define('LDAP_AUTH_BINDDN', 'cn=ttrss,ou=services,dc=immae,dc=eu');
+        define('LDAP_AUTH_BINDPW', '${builtins.getEnv "NIXOPS_TTRSS_LDAP_PASSWORD"}');
+        define('LDAP_AUTH_LOGIN_ATTRIB', 'immaeTtrssLogin');
+
+        define('LDAP_AUTH_LOG_ATTEMPTS', FALSE);
+        define('LDAP_AUTH_DEBUG', FALSE);
+      '';
+    webRoot = stdenv.mkDerivation (fetchedGit ./tt-rss.json // rec {
+      buildPhase = ''
+        rm -rf lock feed-icons cache
+        ln -sf ../../../../../${varDir}/{lock,feed-icons,cache} .
+      '';
+      installPhase = ''
+        cp -a . $out
+        ln -s ${config} $out/config.php
+        ${builtins.concatStringsSep "\n" (
+          lib.attrsets.mapAttrsToList (name: value: "ln -sf ${value} $out/plugins/${name}") plugins
+        )}
+      '';
+    });
+    apache = {
+      user = "wwwrun";
+      group = "wwwrun";
+      modules = [ "proxy_fcgi" ];
+      vhostConf = ''
+        Alias /ttrss "${webRoot}"
+        <Directory "${webRoot}">
+          DirectoryIndex index.php
+          <FilesMatch "\.php$">
+            SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          </FilesMatch>
+
+          AllowOverride All
+          Options FollowSymlinks
+          Require all granted
+        </Directory>
+        '';
+    };
+    phpFpm = rec {
+      basedir = builtins.concatStringsSep ":" (
+        [ webRoot config varDir ]
+        ++ lib.attrsets.mapAttrsToList (name: value: value) plugins);
+      socket = "/var/run/phpfpm/ttrss.sock";
+      pool = ''
+        listen = ${socket}
+        user = ${apache.user}
+        group = ${apache.group}
+        listen.owner = ${apache.user}
+        listen.group = ${apache.group}
+        pm = ondemand
+        pm.max_children = 60
+        pm.process_idle_timeout = 60
+
+        ; Needed to avoid clashes in browser cookies (same domain)
+        php_value[session.name] = TtrssPHPSESSID
+        php_admin_value[open_basedir] = "${basedir}:/tmp"
+        php_admin_value[session.save_path] = "${varDir}/phpSessions"
+        '';
+    };
+  };
+in 
+  ttrss
diff --git a/virtual/modules/websites/tools/tools/ympd.nix b/virtual/modules/websites/tools/tools/ympd.nix
new file mode 100644
index 0000000..74bf2e5
--- /dev/null
+++ b/virtual/modules/websites/tools/tools/ympd.nix
@@ -0,0 +1,35 @@
+{}:
+let
+  ympd = rec {
+    config = {
+      webPort = "localhost:18001";
+      mpd = {
+        host = "malige.home.immae.eu";
+        port = 6600;
+      };
+    };
+    apache = {
+      modules = [
+        "proxy_wstunnel"
+        ];
+      vhostConf = ''
+        <LocationMatch "^/mpd">
+          Use LDAPConnect
+          Require ldap-group   cn=users,cn=mpd,ou=services,dc=immae,dc=eu
+          Require local
+        </LocationMatch>
+
+        RedirectMatch permanent "^/mpd$" "/mpd/"
+        <Location "/mpd/">
+          ProxyPass http://${config.webPort}/
+          ProxyPassReverse http://${config.webPort}/
+          ProxyPreserveHost on
+        </Location>
+        <Location "/mpd/ws">
+          ProxyPass ws://${config.webPort}/ws
+        </Location>
+      '';
+    };
+  };
+in
+  ympd