Move httpd service to module

4 files changed, 179 insertions, 7 deletions

diff --git a/virtual/modules/gitolite.nix b/virtual/modules/gitolite.nix
index 85c7be1..d6b9c79 100644
--- a/virtual/modules/gitolite.nix
+++ b/virtual/modules/gitolite.nix
@@ -4,6 +4,10 @@ let
 in {
   options.services.myGitolite = {
     enable = lib.mkEnableOption "my gitolite service";
+    gitoliteDir = lib.mkOption {
+      type = lib.types.string;
+      default = "/var/lib/gitolite";
+    };
   };
 
   config = lib.mkIf cfg.enable {
@@ -20,6 +24,13 @@ in {
       });
     };
 
+    services.gitDaemon = {
+      enable = true;
+      user = "gitolite";
+      group = "gitolite";
+      basePath = "${cfg.gitoliteDir}/repositories";
+    };
+
     system.activationScripts.gitolite =
       assert mylibs.checkEnv "NIXOPS_GITOLITE_LDAP_PASSWORD";
       let
@@ -34,12 +45,12 @@ in {
     in {
       deps = [ "users" ];
       text = ''
-        if [ -d /var/lib/gitolite ]; then
-          ln -sf ${gitolite_ldap_groups} /var/lib/gitolite/gitolite_ldap_groups.sh
-          chmod g+rx /var/lib/gitolite
+        if [ -d ${cfg.gitoliteDir} ]; then
+          ln -sf ${gitolite_ldap_groups} ${cfg.gitoliteDir}/gitolite_ldap_groups.sh
+          chmod g+rx ${cfg.gitoliteDir}
         fi
-        if [ -f /var/lib/gitolite/projects.list ]; then
-          chmod g+r /var/lib/gitolite/projects.list
+        if [ -f ${cfg.gitoliteDir}/projects.list ]; then
+          chmod g+r ${cfg.gitoliteDir}/projects.list
         fi
       '';
     };
diff --git a/virtual/modules/gitweb.nix b/virtual/modules/gitweb/default.nix
index f3ef1bd..2a860ba 100644
--- a/virtual/modules/gitweb.nix
+++ b/virtual/modules/gitweb/default.nix
@@ -1,5 +1,7 @@
 { lib, pkgs, config, mylibs, ... }:
 let
+    # FIXME: add buildbot
+    gitweb = pkgs.callPackage ./gitweb.nix { gitoliteDir = config.services.myGitolite.gitoliteDir; };
     cfg = config.services.myGitweb;
 in {
   options.services.myGitweb = {
@@ -12,10 +14,17 @@ in {
     nixpkgs.config.packageOverrides = oldpkgs: rec {
       gitweb = oldpkgs.gitweb.overrideAttrs(old: {
         installPhase = old.installPhase + ''
-          cp -r ${./gitweb/theme} $out/gitweb-theme;
+          cp -r ${./theme} $out/gitweb-theme;
           '';
       });
     };
 
+    services.myWebsites.tools.modules = gitweb.apache.modules;
+    services.myWebsites.tools.vhostConfs.git = {
+      certName    = "eldiron";
+      hosts       = ["git.immae.eu" ];
+      root        = gitweb.webRoot;
+      extraConfig = [ gitweb.apache.vhostConf ];
+    };
   };
 }
diff --git a/virtual/modules/gitweb/gitweb.nix b/virtual/modules/gitweb/gitweb.nix
new file mode 100644
index 0000000..7b4dcac
--- /dev/null
+++ b/virtual/modules/gitweb/gitweb.nix
@@ -0,0 +1,64 @@
+{ gitweb, writeText, gitolite, git, gitoliteDir }:
+rec {
+  varDir = gitoliteDir;
+  webRoot = gitweb;
+  config = writeText "gitweb.conf" ''
+    $git_temp = "/tmp";
+
+    # The directories where your projects are. Must not end with a
+    # slash.
+    $projectroot = "${varDir}/repositories";
+
+    $projects_list = "${varDir}/projects.list";
+    $strict_export = "true";
+
+    # Base URLs for links displayed in the web interface.
+    our @git_base_url_list = qw(ssh://gitolite@git.immae.eu https://git.immae.eu);
+
+    $feature{'blame'}{'default'} = [1];
+    $feature{'avatar'}{'default'} = ['gravatar'];
+    $feature{'highlight'}{'default'} = [1];
+
+    @stylesheets = ("gitweb-theme/gitweb.css");
+    $logo = "gitweb-theme/git-logo.png";
+    $favicon = "gitweb-theme/git-favicon.png";
+    $javascript = "gitweb-theme/gitweb.js";
+    $logo_url = "https://git.immae.eu/";
+    $projects_list_group_categories = "true";
+    $projects_list_description_width = 60;
+    $project_list_default_category = "__Others__";
+    '';
+  apache = {
+    user = "wwwrun";
+    group = "wwwrun";
+    modules = [ "cgid" ];
+    vhostConf = ''
+      SetEnv GIT_PROJECT_ROOT ${varDir}/repositories/
+      ScriptAliasMatch \
+                  "(?x)^/(.*/(HEAD | \
+                                  info/refs | \
+                                  objects/(info/[^/]+ | \
+                                          [0-9a-f]{2}/[0-9a-f]{38} | \
+                                          pack/pack-[0-9a-f]{40}\.(pack|idx)) | \
+                                  git-(upload|receive)-pack))$" \
+                  ${git}/libexec/git-core/git-http-backend/$1
+
+      <Directory "${gitolite}">
+        Require all granted
+      </Directory>
+      <Directory "${git}/libexec/git-core">
+        Require all granted
+      </Directory>
+      <Directory "${webRoot}">
+        DirectoryIndex gitweb.cgi
+        Require all granted
+        AllowOverride None
+        Options ExecCGI FollowSymLinks
+        <Files gitweb.cgi>
+          SetHandler cgi-script
+          SetEnv  GITWEB_CONFIG  "${config}"
+        </Files>
+      </Directory>
+      '';
+  };
+}
diff --git a/virtual/modules/websites/default.nix b/virtual/modules/websites/default.nix
index a9e62a5..b027b81 100644
--- a/virtual/modules/websites/default.nix
+++ b/virtual/modules/websites/default.nix
@@ -1,5 +1,8 @@
 { lib, pkgs, config, mylibs, myconfig, ... }:
 let
+  mypkgs = pkgs.callPackage ../../packages.nix {
+    inherit (mylibs) checkEnv fetchedGit fetchedGithub;
+  };
   cfg = config.services.myWebsites;
   makeService = name: cfg: let
     toVhost = vhostConf: {
@@ -16,6 +19,28 @@ let
       documentRoot = vhostConf.root;
       extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
     };
+    redirectVhost = { # Should go last, catchall http -> https redirect
+      listen = [ { ip = cfg.ip; port = 80; } ];
+      hostName = "redirectSSL";
+      serverAliases = [ "*" ];
+      enableSSL = false;
+      logFormat = "combinedVhost";
+      documentRoot = "/var/lib/acme/acme-challenge";
+      extraConfig = ''
+        RewriteEngine on
+        RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
+        RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
+        # To redirect in specific "VirtualHost *:80", do
+        #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
+        # rather than rewrite
+      '';
+    };
+    fallbackVhost = toVhost { # Should go first, default choice
+      certName    = "eldiron";
+      hosts       = ["eldiron.immae.eu" ];
+      root        = ../../www;
+      extraConfig = [ "DirectoryIndex index.htm" ];
+    };
   in rec {
     enable = true;
     listen = [
@@ -28,7 +53,9 @@ let
     logFormat = "combinedVhost";
     extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
     extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
-    virtualHosts = pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs;
+    virtualHosts = [ fallbackVhost ]
+      ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
+      ++ [ redirectVhost ];
   };
   makeServiceOptions = name: ip: {
     enable = lib.mkEnableOption "enable websites in ${name}";
@@ -74,6 +101,7 @@ in
   options.services.myWebsites = {
     production = makeServiceOptions "production" myconfig.ips.production;
     integration = makeServiceOptions "integration" myconfig.ips.integration;
+    tools = makeServiceOptions "tools" myconfig.ips.main;
 
     apacheConfig = lib.mkOption {
       type = lib.types.attrsOf (lib.types.submodule {
@@ -208,5 +236,65 @@ in
     services.httpdInte = makeService "integration" config.services.myWebsites.integration;
     services.myWebsites.integration.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
     services.myWebsites.integration.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
+
+    services.httpd = makeService "tools" config.services.myWebsites.tools;
+    services.myWebsites.tools.modules =
+      mypkgs.adminer.apache.modules ++
+      mypkgs.nextcloud.apache.modules ++
+      mypkgs.ympd.apache.modules ++
+      mypkgs.mantisbt.apache.modules ++
+      mypkgs.ttrss.apache.modules ++
+      mypkgs.roundcubemail.apache.modules ++
+      pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
+    services.myWebsites.tools.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
+    # FIXME: move them all to separate modules
+    services.myWebsites.tools.vhostConfs.eldiron = {
+      certName    = "eldiron";
+      hosts       = ["eldiron.immae.eu" ];
+      root        = ../../www;
+      extraConfig = [ "DirectoryIndex index.htm" ];
+    };
+    services.myWebsites.tools.vhostConfs.db-1 = {
+      certName    = "eldiron";
+      hosts       = ["db-1.immae.eu" ];
+      root        = null;
+      extraConfig = [ mypkgs.adminer.apache.vhostConf ];
+    };
+    services.myWebsites.tools.vhostConfs.tools = {
+      certName    = "eldiron";
+      hosts       = ["tools.immae.eu" ];
+      root        = null;
+      extraConfig = [
+        mypkgs.adminer.apache.vhostConf
+        mypkgs.ympd.apache.vhostConf
+        mypkgs.ttrss.apache.vhostConf
+        mypkgs.roundcubemail.apache.vhostConf
+      ];
+    };
+    services.myWebsites.tools.vhostConfs.dav = {
+      certName    = "eldiron";
+      hosts       = ["dav.immae.eu" ];
+      root        = null;
+      extraConfig = [
+        mypkgs.infcloud.apache.vhostConf
+        mypkgs.davical.apache.vhostConf
+      ];
+    };
+    services.myWebsites.tools.vhostConfs.cloud = {
+      certName    = "eldiron";
+      hosts       = ["cloud.immae.eu" ];
+      root        = mypkgs.nextcloud.webRoot;
+      extraConfig = [
+        mypkgs.nextcloud.apache.vhostConf
+      ];
+    };
+    services.myWebsites.tools.vhostConfs.git.extraConfig = [
+      mypkgs.mantisbt.apache.vhostConf
+      ''
+        RewriteEngine on
+        RewriteCond %{REQUEST_URI}       ^/releases
+        RewriteRule /releases(.*)        https://release.immae.eu$1 [P,L]
+        ''
+    ];
   };
 }