aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--modules/private/default.nix11
-rw-r--r--modules/private/websites/aten/integration.nix5
-rw-r--r--modules/private/websites/aten/production.nix5
-rw-r--r--modules/private/websites/capitaines/production.nix5
-rw-r--r--modules/private/websites/chloe/integration.nix5
-rw-r--r--modules/private/websites/chloe/production.nix5
-rw-r--r--modules/private/websites/connexionswing/integration.nix5
-rw-r--r--modules/private/websites/connexionswing/production.nix5
-rw-r--r--modules/private/websites/default.nix274
-rw-r--r--modules/private/websites/emilia/production.nix5
-rw-r--r--modules/private/websites/florian/app.nix5
-rw-r--r--modules/private/websites/ludivinecassal/integration.nix5
-rw-r--r--modules/private/websites/ludivinecassal/production.nix5
-rw-r--r--modules/private/websites/naturaloutil/production.nix9
-rw-r--r--modules/private/websites/piedsjaloux/integration.nix5
-rw-r--r--modules/private/websites/piedsjaloux/production.nix5
-rw-r--r--modules/private/websites/tools/cloud/default.nix (renamed from nixops/modules/websites/tools/cloud.nix)4
-rw-r--r--modules/private/websites/tools/dav/davical.nix (renamed from nixops/modules/websites/tools/dav/davical.nix)6
-rw-r--r--modules/private/websites/tools/dav/default.nix (renamed from nixops/modules/websites/tools/dav/default.nix)12
-rw-r--r--modules/private/websites/tools/db/default.nix (renamed from nixops/modules/websites/tools/db.nix)6
-rw-r--r--modules/private/websites/tools/diaspora/default.nix (renamed from nixops/modules/websites/tools/diaspora.nix)4
-rw-r--r--modules/private/websites/tools/ether/default.nix (renamed from nixops/modules/websites/tools/ether.nix)4
-rw-r--r--modules/private/websites/tools/git/default.nix (renamed from nixops/modules/websites/tools/git/default.nix)12
-rw-r--r--modules/private/websites/tools/git/gitweb.nix (renamed from nixops/modules/websites/tools/git/gitweb.nix)0
-rw-r--r--modules/private/websites/tools/git/mantisbt.nix (renamed from nixops/modules/websites/tools/git/mantisbt.nix)6
-rw-r--r--modules/private/websites/tools/mastodon/default.nix (renamed from nixops/modules/websites/tools/mastodon.nix)4
-rw-r--r--modules/private/websites/tools/mgoblin/default.nix (renamed from nixops/modules/websites/tools/mediagoblin.nix)4
-rw-r--r--modules/private/websites/tools/peertube/default.nix (renamed from nixops/modules/websites/tools/peertube.nix)4
-rw-r--r--modules/private/websites/tools/tools/adminer.nix (renamed from nixops/modules/websites/commons/adminer.nix)11
-rw-r--r--modules/private/websites/tools/tools/default.nix (renamed from nixops/modules/websites/tools/tools/default.nix)110
-rw-r--r--modules/private/websites/tools/tools/dokuwiki.nix (renamed from nixops/modules/websites/tools/tools/dokuwiki.nix)0
-rw-r--r--modules/private/websites/tools/tools/kanboard.nix (renamed from nixops/modules/websites/tools/tools/kanboard.nix)0
-rw-r--r--modules/private/websites/tools/tools/ldap.nix (renamed from nixops/modules/websites/tools/tools/ldap.nix)6
-rw-r--r--modules/private/websites/tools/tools/rainloop.nix (renamed from nixops/modules/websites/tools/tools/rainloop.nix)0
-rw-r--r--modules/private/websites/tools/tools/rompr.nix (renamed from nixops/modules/websites/tools/tools/rompr.nix)0
-rw-r--r--modules/private/websites/tools/tools/roundcubemail.nix (renamed from nixops/modules/websites/tools/tools/roundcubemail.nix)0
-rw-r--r--modules/private/websites/tools/tools/shaarli.nix (renamed from nixops/modules/websites/tools/tools/shaarli.nix)0
-rw-r--r--modules/private/websites/tools/tools/ttrss.nix (renamed from nixops/modules/websites/tools/tools/ttrss.nix)0
-rw-r--r--modules/private/websites/tools/tools/wallabag.nix (renamed from nixops/modules/websites/tools/tools/wallabag.nix)0
-rw-r--r--modules/private/websites/tools/tools/ympd.nix (renamed from nixops/modules/websites/tools/tools/ympd.nix)0
-rw-r--r--modules/private/websites/tools/tools/yourls.nix (renamed from nixops/modules/websites/tools/tools/yourls.nix)9
-rw-r--r--nixops/eldiron.nix1
-rw-r--r--nixops/modules/task/default.nix4
-rw-r--r--nixops/modules/websites/default.nix236
44 files changed, 398 insertions, 404 deletions
diff --git a/modules/private/default.nix b/modules/private/default.nix
index 16258e4..242eeb9 100644
--- a/modules/private/default.nix
+++ b/modules/private/default.nix
@@ -36,6 +36,17 @@ set = {
36 piedsjalouxInte = ./websites/piedsjaloux/integration.nix; 36 piedsjalouxInte = ./websites/piedsjaloux/integration.nix;
37 piedsjalouxProd = ./websites/piedsjaloux/production.nix; 37 piedsjalouxProd = ./websites/piedsjaloux/production.nix;
38 38
39 cloudTool = ./websites/tools/cloud;
40 davTool = ./websites/tools/dav;
41 dbTool = ./websites/tools/db;
42 diasporaTool = ./websites/tools/diaspora;
43 etherTool = ./websites/tools/ether;
44 gitTool = ./websites/tools/git;
45 mastodonTool = ./websites/tools/mastodon;
46 mgoblinTool = ./websites/tools/mgoblin;
47 peertubeTool = ./websites/tools/peertube;
48 toolsTool = ./websites/tools/tools;
49
39 irc = ./irc.nix; 50 irc = ./irc.nix;
40}; 51};
41in 52in
diff --git a/modules/private/websites/aten/integration.nix b/modules/private/websites/aten/integration.nix
index 5ccc0c1..748e388 100644
--- a/modules/private/websites/aten/integration.nix
+++ b/modules/private/websites/aten/integration.nix
@@ -18,10 +18,7 @@ in {
18 systemd.services.phpfpm-aten_dev.wants = aten.phpFpm.serviceDeps; 18 systemd.services.phpfpm-aten_dev.wants = aten.phpFpm.serviceDeps;
19 services.phpfpm.poolConfigs.aten_dev = aten.phpFpm.pool; 19 services.phpfpm.poolConfigs.aten_dev = aten.phpFpm.pool;
20 system.activationScripts.aten_dev = aten.activationScript; 20 system.activationScripts.aten_dev = aten.activationScript;
21 system.extraSystemBuilderCmds = '' 21 myServices.websites.webappDirs."${aten.apache.webappName}" = aten.app.webRoot;
22 mkdir -p $out/webapps
23 ln -s ${aten.app.webRoot} $out/webapps/${aten.apache.webappName}
24 '';
25 services.websites.integration.modules = aten.apache.modules; 22 services.websites.integration.modules = aten.apache.modules;
26 services.websites.integration.vhostConfs.aten = { 23 services.websites.integration.vhostConfs.aten = {
27 certName = "eldiron"; 24 certName = "eldiron";
diff --git a/modules/private/websites/aten/production.nix b/modules/private/websites/aten/production.nix
index 7938241..7a4adb5 100644
--- a/modules/private/websites/aten/production.nix
+++ b/modules/private/websites/aten/production.nix
@@ -20,10 +20,7 @@ in {
20 systemd.services.phpfpm-aten_prod.wants = aten.phpFpm.serviceDeps; 20 systemd.services.phpfpm-aten_prod.wants = aten.phpFpm.serviceDeps;
21 services.phpfpm.poolConfigs.aten_prod = aten.phpFpm.pool; 21 services.phpfpm.poolConfigs.aten_prod = aten.phpFpm.pool;
22 system.activationScripts.aten_prod = aten.activationScript; 22 system.activationScripts.aten_prod = aten.activationScript;
23 system.extraSystemBuilderCmds = '' 23 myServices.websites.webappDirs."${aten.apache.webappName}" = aten.app.webRoot;
24 mkdir -p $out/webapps
25 ln -s ${aten.app.webRoot} $out/webapps/${aten.apache.webappName}
26 '';
27 services.websites.production.modules = aten.apache.modules; 24 services.websites.production.modules = aten.apache.modules;
28 services.websites.production.vhostConfs.aten = { 25 services.websites.production.vhostConfs.aten = {
29 certName = "aten"; 26 certName = "aten";
diff --git a/modules/private/websites/capitaines/production.nix b/modules/private/websites/capitaines/production.nix
index fe9c619..57d8787 100644
--- a/modules/private/websites/capitaines/production.nix
+++ b/modules/private/websites/capitaines/production.nix
@@ -9,10 +9,7 @@ in {
9 options.myServices.websites.capitaines.production.enable = lib.mkEnableOption "enable Capitaines's website"; 9 options.myServices.websites.capitaines.production.enable = lib.mkEnableOption "enable Capitaines's website";
10 10
11 config = lib.mkIf cfg.enable { 11 config = lib.mkIf cfg.enable {
12 system.extraSystemBuilderCmds = '' 12 myServices.websites.webappDirs."${webappName}" = siteDir;
13 mkdir -p $out/webapps
14 ln -s ${siteDir} $out/webapps/${webappName}
15 '';
16 13
17 services.websites.production.vhostConfs.capitaines_mastodon = { 14 services.websites.production.vhostConfs.capitaines_mastodon = {
18 certName = "capitaines"; 15 certName = "capitaines";
diff --git a/modules/private/websites/chloe/integration.nix b/modules/private/websites/chloe/integration.nix
index d49a85c..c42a428 100644
--- a/modules/private/websites/chloe/integration.nix
+++ b/modules/private/websites/chloe/integration.nix
@@ -23,10 +23,7 @@ in {
23 ''; 23 '';
24 }; 24 };
25 system.activationScripts.chloe_dev = chloe.activationScript; 25 system.activationScripts.chloe_dev = chloe.activationScript;
26 system.extraSystemBuilderCmds = '' 26 myServices.websites.webappDirs."${chloe.apache.webappName}" = chloe.app.webRoot;
27 mkdir -p $out/webapps
28 ln -s ${chloe.app.webRoot} $out/webapps/${chloe.apache.webappName}
29 '';
30 services.websites.integration.modules = chloe.apache.modules; 27 services.websites.integration.modules = chloe.apache.modules;
31 services.websites.integration.vhostConfs.chloe = { 28 services.websites.integration.vhostConfs.chloe = {
32 certName = "eldiron"; 29 certName = "eldiron";
diff --git a/modules/private/websites/chloe/production.nix b/modules/private/websites/chloe/production.nix
index d4b2299..0bf2d8f 100644
--- a/modules/private/websites/chloe/production.nix
+++ b/modules/private/websites/chloe/production.nix
@@ -25,10 +25,7 @@ in {
25 ''; 25 '';
26 }; 26 };
27 system.activationScripts.chloe_prod = chloe.activationScript; 27 system.activationScripts.chloe_prod = chloe.activationScript;
28 system.extraSystemBuilderCmds = '' 28 myServices.websites.webappDirs."${chloe.apache.webappName}" = chloe.app.webRoot;
29 mkdir -p $out/webapps
30 ln -s ${chloe.app.webRoot} $out/webapps/${chloe.apache.webappName}
31 '';
32 services.websites.production.modules = chloe.apache.modules; 29 services.websites.production.modules = chloe.apache.modules;
33 services.websites.production.vhostConfs.chloe = { 30 services.websites.production.vhostConfs.chloe = {
34 certName = "chloe"; 31 certName = "chloe";
diff --git a/modules/private/websites/connexionswing/integration.nix b/modules/private/websites/connexionswing/integration.nix
index 6570977..1d8488a 100644
--- a/modules/private/websites/connexionswing/integration.nix
+++ b/modules/private/websites/connexionswing/integration.nix
@@ -22,10 +22,7 @@ in {
22 phpOptions = config.services.phpfpm.phpOptions + connexionswing.phpFpm.phpConfig; 22 phpOptions = config.services.phpfpm.phpOptions + connexionswing.phpFpm.phpConfig;
23 }; 23 };
24 system.activationScripts.connexionswing_dev = connexionswing.activationScript; 24 system.activationScripts.connexionswing_dev = connexionswing.activationScript;
25 system.extraSystemBuilderCmds = '' 25 myServices.websites.webappDirs."${connexionswing.apache.webappName}" = connexionswing.app.webRoot;
26 mkdir -p $out/webapps
27 ln -s ${connexionswing.app.webRoot} $out/webapps/${connexionswing.apache.webappName}
28 '';
29 services.websites.integration.modules = connexionswing.apache.modules; 26 services.websites.integration.modules = connexionswing.apache.modules;
30 services.websites.integration.vhostConfs.connexionswing = { 27 services.websites.integration.vhostConfs.connexionswing = {
31 certName = "eldiron"; 28 certName = "eldiron";
diff --git a/modules/private/websites/connexionswing/production.nix b/modules/private/websites/connexionswing/production.nix
index b51c549..555f129 100644
--- a/modules/private/websites/connexionswing/production.nix
+++ b/modules/private/websites/connexionswing/production.nix
@@ -24,10 +24,7 @@ in {
24 phpOptions = config.services.phpfpm.phpOptions + connexionswing.phpFpm.phpConfig; 24 phpOptions = config.services.phpfpm.phpOptions + connexionswing.phpFpm.phpConfig;
25 }; 25 };
26 system.activationScripts.connexionswing_prod = connexionswing.activationScript; 26 system.activationScripts.connexionswing_prod = connexionswing.activationScript;
27 system.extraSystemBuilderCmds = '' 27 myServices.websites.webappDirs."${connexionswing.apache.webappName}" = connexionswing.app.webRoot;
28 mkdir -p $out/webapps
29 ln -s ${connexionswing.app.webRoot} $out/webapps/${connexionswing.apache.webappName}
30 '';
31 services.websites.production.modules = connexionswing.apache.modules; 28 services.websites.production.modules = connexionswing.apache.modules;
32 services.websites.production.vhostConfs.connexionswing = { 29 services.websites.production.vhostConfs.connexionswing = {
33 certName = "connexionswing"; 30 certName = "connexionswing";
diff --git a/modules/private/websites/default.nix b/modules/private/websites/default.nix
index 80d902e..8b02977 100644
--- a/modules/private/websites/default.nix
+++ b/modules/private/websites/default.nix
@@ -1,39 +1,265 @@
1{ ... }: 1{ lib, pkgs, config, myconfig, ... }:
2let
3 www_root = "/run/current-system/webapps/_www";
4 theme_root = "/run/current-system/webapps/_theme";
5 apacheConfig = {
6 gzip = {
7 modules = [ "deflate" "filter" ];
8 extraConfig = ''
9 AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
10 '';
11 };
12 macros = {
13 modules = [ "macro" ];
14 };
15 stats = {
16 extraConfig = ''
17 <Macro Stats %{domain}>
18 Alias /webstats ${config.services.webstats.dataDir}/%{domain}
19 <Directory ${config.services.webstats.dataDir}/%{domain}>
20 DirectoryIndex index.html
21 AllowOverride None
22 Require all granted
23 </Directory>
24 <Location /webstats>
25 Use LDAPConnect
26 Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
27 </Location>
28 </Macro>
29 '';
30 };
31 ldap = {
32 modules = [ "ldap" "authnz_ldap" ];
33 extraConfig = ''
34 <IfModule ldap_module>
35 LDAPSharedCacheSize 500000
36 LDAPCacheEntries 1024
37 LDAPCacheTTL 600
38 LDAPOpCacheEntries 1024
39 LDAPOpCacheTTL 600
40 </IfModule>
41
42 Include /var/secrets/apache-ldap
43 '';
44 };
45 global = {
46 extraConfig = (pkgs.webapps.apache-default.override { inherit www_root;}).apacheConfig;
47 };
48 apaxy = {
49 extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
50 };
51 http2 = {
52 modules = [ "http2" ];
53 extraConfig = ''
54 Protocols h2 http/1.1
55 '';
56 };
57 customLog = {
58 extraConfig = ''
59 LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
60 '';
61 };
62 };
63 makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
64 makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
65in
2{ 66{
3 config.myServices.websites.aten.integration.enable = true; 67 options.myServices.websites.webappDirs = lib.mkOption {
4 config.myServices.websites.aten.production.enable = true; 68 type = lib.types.attrsOf lib.types.path;
69 description = ''
70 Webapp paths to create in /run/current-system/webapps
71 '';
72 default = {};
73 };
74
75 config = {
76 users.users.wwwrun.extraGroups = [ "keys" ];
77 networking.firewall.allowedTCPPorts = [ 80 443 ];
78
79 nixpkgs.overlays = [ (self: super: rec {
80 #openssl = self.openssl_1_1;
81 php = php72;
82 php72 = (super.php72.override {
83 mysql.connector-c = self.mariadb;
84 config.php.mysqlnd = false;
85 config.php.mysqli = false;
86 }).overrideAttrs(old: rec {
87 # Didn't manage to build with mysqli + mysql_config connector
88 configureFlags = old.configureFlags ++ [
89 "--with-mysqli=shared,mysqlnd"
90 ];
91 # preConfigure = (old.preConfigure or "") + ''
92 # export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
93 # sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
94 # ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
95 # '';
96 });
97 phpPackages = super.php72Packages.override { inherit php; };
98 }) ];
99
100 secrets.keys = [{
101 dest = "apache-ldap";
102 user = "wwwrun";
103 group = "wwwrun";
104 permissions = "0400";
105 text = ''
106 <Macro LDAPConnect>
107 <IfModule authnz_ldap_module>
108 AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
109 AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
110 AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
111 AuthType Basic
112 AuthName "Authentification requise (Acces LDAP)"
113 AuthBasicProvider ldap
114 </IfModule>
115 </Macro>
116 '';
117 }];
118
119 system.activationScripts = {
120 httpd = ''
121 install -d -m 0755 ${config.security.acme.directory}/acme-challenge
122 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
123 '';
124 };
125
126 services.phpfpm = {
127 phpPackage = pkgs.php;
128 phpOptions = ''
129 session.save_path = "/var/lib/php/sessions"
130 post_max_size = 20M
131 ; 15 days (seconds)
132 session.gc_maxlifetime = 1296000
133 ; 30 days (minutes)
134 session.cache_expire = 43200
135 '';
136 extraConfig = ''
137 log_level = notice
138 '';
139 };
140
141 services.websites.production = {
142 enable = true;
143 adminAddr = "httpd@immae.eu";
144 httpdName = "Prod";
145 ips =
146 let ips = myconfig.env.servers.eldiron.ips.production;
147 in [ips.ip4] ++ (ips.ip6 or []);
148 modules = makeModules;
149 extraConfig = makeExtraConfig;
150 fallbackVhost = {
151 certName = "eldiron";
152 hosts = ["eldiron.immae.eu" ];
153 root = www_root;
154 extraConfig = [ "DirectoryIndex index.htm" ];
155 };
156 };
157
158 services.websites.integration = {
159 enable = true;
160 adminAddr = "httpd@immae.eu";
161 httpdName = "Inte";
162 ips =
163 let ips = myconfig.env.servers.eldiron.ips.integration;
164 in [ips.ip4] ++ (ips.ip6 or []);
165 modules = makeModules;
166 extraConfig = makeExtraConfig;
167 fallbackVhost = {
168 certName = "eldiron";
169 hosts = ["eldiron.immae.eu" ];
170 root = www_root;
171 extraConfig = [ "DirectoryIndex index.htm" ];
172 };
173 };
174
175 services.websites.tools = {
176 enable = true;
177 adminAddr = "httpd@immae.eu";
178 httpdName = "Tools";
179 ips =
180 let ips = myconfig.env.servers.eldiron.ips.main;
181 in [ips.ip4] ++ (ips.ip6 or []);
182 modules = makeModules;
183 extraConfig = makeExtraConfig ++
184 [ ''
185 RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
186 RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
187 RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
188 RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
189 RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
190 RedirectMatch ^/CGU$ https://www.immae.eu/CGU
191 ''
192 ];
193 nosslVhost = {
194 enable = true;
195 host = "nossl.immae.eu";
196 };
197 fallbackVhost = {
198 certName = "eldiron";
199 hosts = ["eldiron.immae.eu" ];
200 root = www_root;
201 extraConfig = [ "DirectoryIndex index.htm" ];
202 };
203 };
204
205 system.extraSystemBuilderCmds = lib.mkIf (builtins.length (builtins.attrValues config.myServices.websites.webappDirs) > 0) ''
206 mkdir -p $out/webapps
207 ${builtins.concatStringsSep "\n" (lib.attrsets.mapAttrsToList (name: path: "ln -s ${path} $out/webapps/${name}") config.myServices.websites.webappDirs)}
208 '';
209
210 myServices.websites = {
211 webappDirs = {
212 _www = pkgs.webapps.apache-default.www;
213 _theme = pkgs.webapps.apache-theme.theme;
214 };
215
216 aten.integration.enable = true;
217 aten.production.enable = true;
218
219 capitaines.production.enable = true;
5 220
6 config.myServices.websites.capitaines.production.enable = true; 221 chloe.integration.enable = true;
222 chloe.production.enable = true;
7 223
8 config.myServices.websites.chloe.integration.enable = true; 224 connexionswing.integration.enable = true;
9 config.myServices.websites.chloe.production.enable = true; 225 connexionswing.production.enable = true;
10 226
11 config.myServices.websites.connexionswing.integration.enable = true; 227 denisejerome.production.enable = true;
12 config.myServices.websites.connexionswing.production.enable = true;
13 228
14 config.myServices.websites.denisejerome.production.enable = true; 229 emilia.production.enable = true;
15 230
16 config.myServices.websites.emilia.production.enable = true; 231 florian.app.enable = true;
232 florian.integration.enable = true;
233 florian.production.enable = true;
17 234
18 config.myServices.websites.florian.app.enable = true; 235 immae.production.enable = true;
19 config.myServices.websites.florian.integration.enable = true; 236 immae.release.enable = true;
20 config.myServices.websites.florian.production.enable = true; 237 immae.temp.enable = true;
21 238
22 config.myServices.websites.immae.production.enable = true; 239 leila.production.enable = true;
23 config.myServices.websites.immae.release.enable = true;
24 config.myServices.websites.immae.temp.enable = true;
25 240
26 config.myServices.websites.leila.production.enable = true; 241 ludivinecassal.integration.enable = true;
242 ludivinecassal.production.enable = true;
27 243
28 config.myServices.websites.ludivinecassal.integration.enable = true; 244 nassime.production.enable = true;
29 config.myServices.websites.ludivinecassal.production.enable = true;
30 245
31 config.myServices.websites.nassime.production.enable = true; 246 naturaloutil.production.enable = true;
32 247
33 config.myServices.websites.naturaloutil.production.enable = true; 248 papa.surveillance.enable = true;
34 249
35 config.myServices.websites.papa.surveillance.enable = true; 250 piedsjaloux.integration.enable = true;
251 piedsjaloux.production.enable = true;
36 252
37 config.myServices.websites.piedsjaloux.integration.enable = true; 253 tools.cloud.enable = true;
38 config.myServices.websites.piedsjaloux.production.enable = true; 254 tools.dav.enable = true;
255 tools.db.enable = true;
256 tools.diaspora.enable = true;
257 tools.etherpad-lite.enable = true;
258 tools.git.enable = true;
259 tools.mastodon.enable = true;
260 tools.mediagoblin.enable = true;
261 tools.peertube.enable = true;
262 tools.tools.enable = true;
263 };
264 };
39} 265}
diff --git a/modules/private/websites/emilia/production.nix b/modules/private/websites/emilia/production.nix
index 2e705a1..13f008f 100644
--- a/modules/private/websites/emilia/production.nix
+++ b/modules/private/websites/emilia/production.nix
@@ -46,10 +46,7 @@ in {
46 system.activationScripts.emilia = '' 46 system.activationScripts.emilia = ''
47 install -m 0755 -o wwwrun -g wwwrun -d ${varDir} 47 install -m 0755 -o wwwrun -g wwwrun -d ${varDir}
48 ''; 48 '';
49 system.extraSystemBuilderCmds = '' 49 myServices.websites.webappDirs."${webappName}" = siteDir;
50 mkdir -p $out/webapps
51 ln -s ${siteDir} $out/webapps/${webappName}
52 '';
53 services.websites.production.vhostConfs.emilia = { 50 services.websites.production.vhostConfs.emilia = {
54 certName = "emilia"; 51 certName = "emilia";
55 certMainHost = "saison-photo.org"; 52 certMainHost = "saison-photo.org";
diff --git a/modules/private/websites/florian/app.nix b/modules/private/websites/florian/app.nix
index 905c66a..3a6d152 100644
--- a/modules/private/websites/florian/app.nix
+++ b/modules/private/websites/florian/app.nix
@@ -20,10 +20,7 @@ in {
20 systemd.services.phpfpm-tellesflorian_dev.preStart = lib.mkAfter tellesflorian.phpFpm.preStart; 20 systemd.services.phpfpm-tellesflorian_dev.preStart = lib.mkAfter tellesflorian.phpFpm.preStart;
21 services.phpfpm.poolConfigs.tellesflorian_dev = tellesflorian.phpFpm.pool; 21 services.phpfpm.poolConfigs.tellesflorian_dev = tellesflorian.phpFpm.pool;
22 system.activationScripts.tellesflorian_dev = tellesflorian.activationScript; 22 system.activationScripts.tellesflorian_dev = tellesflorian.activationScript;
23 system.extraSystemBuilderCmds = '' 23 myServices.websites.webappDirs."${tellesflorian.apache.webappName}" = tellesflorian.app.webRoot;
24 mkdir -p $out/webapps
25 ln -s ${tellesflorian.app.webRoot} $out/webapps/${tellesflorian.apache.webappName}
26 '';
27 services.websites.integration.modules = adminer.apache.modules ++ tellesflorian.apache.modules; 24 services.websites.integration.modules = adminer.apache.modules ++ tellesflorian.apache.modules;
28 services.websites.integration.vhostConfs.tellesflorian = { 25 services.websites.integration.vhostConfs.tellesflorian = {
29 certName = "eldiron"; 26 certName = "eldiron";
diff --git a/modules/private/websites/ludivinecassal/integration.nix b/modules/private/websites/ludivinecassal/integration.nix
index a53f1fe..ed0dc9f 100644
--- a/modules/private/websites/ludivinecassal/integration.nix
+++ b/modules/private/websites/ludivinecassal/integration.nix
@@ -19,10 +19,7 @@ in {
19 systemd.services.phpfpm-ludivinecassal_dev.preStart = lib.mkAfter ludivinecassal.phpFpm.preStart; 19 systemd.services.phpfpm-ludivinecassal_dev.preStart = lib.mkAfter ludivinecassal.phpFpm.preStart;
20 services.phpfpm.poolConfigs.ludivinecassal_dev = ludivinecassal.phpFpm.pool; 20 services.phpfpm.poolConfigs.ludivinecassal_dev = ludivinecassal.phpFpm.pool;
21 system.activationScripts.ludivinecassal_dev = ludivinecassal.activationScript; 21 system.activationScripts.ludivinecassal_dev = ludivinecassal.activationScript;
22 system.extraSystemBuilderCmds = '' 22 myServices.websites.webappDirs."${ludivinecassal.apache.webappName}" = ludivinecassal.app.webRoot;
23 mkdir -p $out/webapps
24 ln -s ${ludivinecassal.app.webRoot} $out/webapps/${ludivinecassal.apache.webappName}
25 '';
26 services.websites.integration.modules = ludivinecassal.apache.modules; 23 services.websites.integration.modules = ludivinecassal.apache.modules;
27 services.websites.integration.vhostConfs.ludivine = { 24 services.websites.integration.vhostConfs.ludivine = {
28 certName = "eldiron"; 25 certName = "eldiron";
diff --git a/modules/private/websites/ludivinecassal/production.nix b/modules/private/websites/ludivinecassal/production.nix
index 8fe6812..3df5613 100644
--- a/modules/private/websites/ludivinecassal/production.nix
+++ b/modules/private/websites/ludivinecassal/production.nix
@@ -20,10 +20,7 @@ in {
20 systemd.services.phpfpm-ludivinecassal_prod.preStart = lib.mkAfter ludivinecassal.phpFpm.preStart; 20 systemd.services.phpfpm-ludivinecassal_prod.preStart = lib.mkAfter ludivinecassal.phpFpm.preStart;
21 services.phpfpm.poolConfigs.ludivinecassal_prod = ludivinecassal.phpFpm.pool; 21 services.phpfpm.poolConfigs.ludivinecassal_prod = ludivinecassal.phpFpm.pool;
22 system.activationScripts.ludivinecassal_prod = ludivinecassal.activationScript; 22 system.activationScripts.ludivinecassal_prod = ludivinecassal.activationScript;
23 system.extraSystemBuilderCmds = '' 23 myServices.websites.webappDirs."${ludivinecassal.apache.webappName}" = ludivinecassal.app.webRoot;
24 mkdir -p $out/webapps
25 ln -s ${ludivinecassal.app.webRoot} $out/webapps/${ludivinecassal.apache.webappName}
26 '';
27 services.websites.production.modules = ludivinecassal.apache.modules; 24 services.websites.production.modules = ludivinecassal.apache.modules;
28 services.websites.production.vhostConfs.ludivine = { 25 services.websites.production.vhostConfs.ludivine = {
29 certName = "ludivinecassal"; 26 certName = "ludivinecassal";
diff --git a/modules/private/websites/naturaloutil/production.nix b/modules/private/websites/naturaloutil/production.nix
index 2315b30..f59957d 100644
--- a/modules/private/websites/naturaloutil/production.nix
+++ b/modules/private/websites/naturaloutil/production.nix
@@ -33,6 +33,12 @@ in {
33 ?> 33 ?>
34 ''; 34 '';
35 }]; 35 }];
36 system.activationScripts.naturaloutil = {
37 deps = [ "httpd" ];
38 text = ''
39 install -m 0755 -o wwwrun -g wwwrun -d /var/lib/php/sessions/naturaloutil
40 '';
41 };
36 systemd.services.phpfpm-jerome.after = lib.mkAfter [ "mysql.service" ]; 42 systemd.services.phpfpm-jerome.after = lib.mkAfter [ "mysql.service" ];
37 systemd.services.phpfpm-jerome.wants = [ "mysql.service" ]; 43 systemd.services.phpfpm-jerome.wants = [ "mysql.service" ];
38 services.phpfpm.pools.jerome = { 44 services.phpfpm.pools.jerome = {
@@ -48,7 +54,8 @@ in {
48 pm.process_idle_timeout = 60 54 pm.process_idle_timeout = 60
49 55
50 env[BDD_CONNECT] = "/var/secrets/webapps/prod-naturaloutil" 56 env[BDD_CONNECT] = "/var/secrets/webapps/prod-naturaloutil"
51 php_admin_value[open_basedir] = "/var/secrets/webapps/prod-naturaloutil:${varDir}:/tmp" 57 php_admin_value[open_basedir] = "/var/lib/php/sessions/naturaloutil:/var/secrets/webapps/prod-naturaloutil:${varDir}:/tmp"
58 php_admin_value[session.save_path] = "/var/lib/php/sessions/naturaloutil"
52 ''; 59 '';
53 phpOptions = config.services.phpfpm.phpOptions + '' 60 phpOptions = config.services.phpfpm.phpOptions + ''
54 extension=${pkgs.php}/lib/php/extensions/mysqli.so 61 extension=${pkgs.php}/lib/php/extensions/mysqli.so
diff --git a/modules/private/websites/piedsjaloux/integration.nix b/modules/private/websites/piedsjaloux/integration.nix
index 83b428a..5f574e1 100644
--- a/modules/private/websites/piedsjaloux/integration.nix
+++ b/modules/private/websites/piedsjaloux/integration.nix
@@ -18,10 +18,7 @@ in {
18 systemd.services.phpfpm-piedsjaloux_dev.preStart = lib.mkAfter piedsjaloux.phpFpm.preStart; 18 systemd.services.phpfpm-piedsjaloux_dev.preStart = lib.mkAfter piedsjaloux.phpFpm.preStart;
19 services.phpfpm.poolConfigs.piedsjaloux_dev = piedsjaloux.phpFpm.pool; 19 services.phpfpm.poolConfigs.piedsjaloux_dev = piedsjaloux.phpFpm.pool;
20 system.activationScripts.piedsjaloux_dev = piedsjaloux.activationScript; 20 system.activationScripts.piedsjaloux_dev = piedsjaloux.activationScript;
21 system.extraSystemBuilderCmds = '' 21 myServices.websites.webappDirs."${piedsjaloux.apache.webappName}" = piedsjaloux.app.webRoot;
22 mkdir -p $out/webapps
23 ln -s ${piedsjaloux.app.webRoot} $out/webapps/${piedsjaloux.apache.webappName}
24 '';
25 services.websites.integration.modules = piedsjaloux.apache.modules; 22 services.websites.integration.modules = piedsjaloux.apache.modules;
26 services.websites.integration.vhostConfs.piedsjaloux = { 23 services.websites.integration.vhostConfs.piedsjaloux = {
27 certName = "eldiron"; 24 certName = "eldiron";
diff --git a/modules/private/websites/piedsjaloux/production.nix b/modules/private/websites/piedsjaloux/production.nix
index 0efd56b..e3bd2dd 100644
--- a/modules/private/websites/piedsjaloux/production.nix
+++ b/modules/private/websites/piedsjaloux/production.nix
@@ -20,10 +20,7 @@ in {
20 systemd.services.phpfpm-piedsjaloux_prod.preStart = lib.mkAfter piedsjaloux.phpFpm.preStart; 20 systemd.services.phpfpm-piedsjaloux_prod.preStart = lib.mkAfter piedsjaloux.phpFpm.preStart;
21 services.phpfpm.poolConfigs.piedsjaloux_prod = piedsjaloux.phpFpm.pool; 21 services.phpfpm.poolConfigs.piedsjaloux_prod = piedsjaloux.phpFpm.pool;
22 system.activationScripts.piedsjaloux_prod = piedsjaloux.activationScript; 22 system.activationScripts.piedsjaloux_prod = piedsjaloux.activationScript;
23 system.extraSystemBuilderCmds = '' 23 myServices.websites.webappDirs."${piedsjaloux.apache.webappName}" = piedsjaloux.app.webRoot;
24 mkdir -p $out/webapps
25 ln -s ${piedsjaloux.app.webRoot} $out/webapps/${piedsjaloux.apache.webappName}
26 '';
27 services.websites.production.modules = piedsjaloux.apache.modules; 24 services.websites.production.modules = piedsjaloux.apache.modules;
28 services.websites.production.vhostConfs.piedsjaloux = { 25 services.websites.production.vhostConfs.piedsjaloux = {
29 certName = "piedsjaloux"; 26 certName = "piedsjaloux";
diff --git a/nixops/modules/websites/tools/cloud.nix b/modules/private/websites/tools/cloud/default.nix
index 5d2ca40..ceb8f77 100644
--- a/nixops/modules/websites/tools/cloud.nix
+++ b/modules/private/websites/tools/cloud/default.nix
@@ -5,7 +5,7 @@ let
5 varDir = "/var/lib/nextcloud"; 5 varDir = "/var/lib/nextcloud";
6 webappName = "tools_nextcloud"; 6 webappName = "tools_nextcloud";
7 apacheRoot = "/run/current-system/webapps/${webappName}"; 7 apacheRoot = "/run/current-system/webapps/${webappName}";
8 cfg = config.services.myWebsites.tools.cloud; 8 cfg = config.myServices.websites.tools.cloud;
9 phpFpm = rec { 9 phpFpm = rec {
10 basedir = builtins.concatStringsSep ":" ( 10 basedir = builtins.concatStringsSep ":" (
11 [ nextcloud varDir ] 11 [ nextcloud varDir ]
@@ -43,7 +43,7 @@ let
43 ''; 43 '';
44 }; 44 };
45in { 45in {
46 options.services.myWebsites.tools.cloud = { 46 options.myServices.websites.tools.cloud = {
47 enable = lib.mkEnableOption "enable cloud website"; 47 enable = lib.mkEnableOption "enable cloud website";
48 }; 48 };
49 49
diff --git a/nixops/modules/websites/tools/dav/davical.nix b/modules/private/websites/tools/dav/davical.nix
index 634359d..98cebee 100644
--- a/nixops/modules/websites/tools/dav/davical.nix
+++ b/modules/private/websites/tools/dav/davical.nix
@@ -1,5 +1,11 @@
1{ stdenv, fetchurl, gettext, writeText, env, awl, davical }: 1{ stdenv, fetchurl, gettext, writeText, env, awl, davical }:
2rec { 2rec {
3 activationScript = {
4 deps = [ "httpd" ];
5 text = ''
6 install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/davical
7 '';
8 };
3 keys = [{ 9 keys = [{
4 dest = "webapps/dav-davical"; 10 dest = "webapps/dav-davical";
5 user = apache.user; 11 user = apache.user;
diff --git a/nixops/modules/websites/tools/dav/default.nix b/modules/private/websites/tools/dav/default.nix
index 78e0ba3..fb0baae 100644
--- a/nixops/modules/websites/tools/dav/default.nix
+++ b/modules/private/websites/tools/dav/default.nix
@@ -20,13 +20,14 @@ let
20 inherit (pkgs.webapps) davical awl; 20 inherit (pkgs.webapps) davical awl;
21 }; 21 };
22 22
23 cfg = config.services.myWebsites.tools.dav; 23 cfg = config.myServices.websites.tools.dav;
24in { 24in {
25 options.services.myWebsites.tools.dav = { 25 options.myServices.websites.tools.dav = {
26 enable = lib.mkEnableOption "enable dav website"; 26 enable = lib.mkEnableOption "enable dav website";
27 }; 27 };
28 28
29 config = lib.mkIf cfg.enable { 29 config = lib.mkIf cfg.enable {
30 system.activationScripts.davical = davical.activationScript;
30 secrets.keys = davical.keys; 31 secrets.keys = davical.keys;
31 services.websites.tools.modules = davical.apache.modules; 32 services.websites.tools.modules = davical.apache.modules;
32 33
@@ -45,11 +46,8 @@ in {
45 davical = davical.phpFpm.pool; 46 davical = davical.phpFpm.pool;
46 }; 47 };
47 48
48 system.extraSystemBuilderCmds = '' 49 myServices.websites.webappDirs."${davical.apache.webappName}" = davical.webRoot;
49 mkdir -p $out/webapps 50 myServices.websites.webappDirs."${infcloud.webappName}" = pkgs.webapps.infcloud;
50 ln -s ${davical.webRoot} $out/webapps/${davical.apache.webappName}
51 ln -s ${pkgs.webapps.infcloud} $out/webapps/${infcloud.webappName}
52 '';
53 }; 51 };
54} 52}
55 53
diff --git a/nixops/modules/websites/tools/db.nix b/modules/private/websites/tools/db/default.nix
index 7c15c23..361e204 100644
--- a/nixops/modules/websites/tools/db.nix
+++ b/modules/private/websites/tools/db/default.nix
@@ -1,10 +1,10 @@
1{ lib, pkgs, config, ... }: 1{ lib, pkgs, config, ... }:
2let 2let
3 adminer = pkgs.callPackage ../commons/adminer.nix {}; 3 adminer = pkgs.callPackage ../../commons/adminer.nix {};
4 4
5 cfg = config.services.myWebsites.tools.databases; 5 cfg = config.myServices.websites.tools.db;
6in { 6in {
7 options.services.myWebsites.tools.databases = { 7 options.myServices.websites.tools.db = {
8 enable = lib.mkEnableOption "enable database's website"; 8 enable = lib.mkEnableOption "enable database's website";
9 }; 9 };
10 10
diff --git a/nixops/modules/websites/tools/diaspora.nix b/modules/private/websites/tools/diaspora/default.nix
index ee5507d..efa1fab 100644
--- a/nixops/modules/websites/tools/diaspora.nix
+++ b/modules/private/websites/tools/diaspora/default.nix
@@ -2,10 +2,10 @@
2let 2let
3 env = myconfig.env.tools.diaspora; 3 env = myconfig.env.tools.diaspora;
4 root = "/run/current-system/webapps/tools_diaspora"; 4 root = "/run/current-system/webapps/tools_diaspora";
5 cfg = config.services.myWebsites.tools.diaspora; 5 cfg = config.myServices.websites.tools.diaspora;
6 dcfg = config.services.diaspora; 6 dcfg = config.services.diaspora;
7in { 7in {
8 options.services.myWebsites.tools.diaspora = { 8 options.myServices.websites.tools.diaspora = {
9 enable = lib.mkEnableOption "enable diaspora's website"; 9 enable = lib.mkEnableOption "enable diaspora's website";
10 }; 10 };
11 11
diff --git a/nixops/modules/websites/tools/ether.nix b/modules/private/websites/tools/ether/default.nix
index 8c9bbb1..ebcbf61 100644
--- a/nixops/modules/websites/tools/ether.nix
+++ b/modules/private/websites/tools/ether/default.nix
@@ -1,13 +1,13 @@
1{ lib, pkgs, config, myconfig, ... }: 1{ lib, pkgs, config, myconfig, ... }:
2let 2let
3 env = myconfig.env.tools.etherpad-lite; 3 env = myconfig.env.tools.etherpad-lite;
4 cfg = config.services.myWebsites.tools.etherpad-lite; 4 cfg = config.myServices.websites.tools.etherpad-lite;
5 # Make sure we’re not rebuilding whole libreoffice just because of a 5 # Make sure we’re not rebuilding whole libreoffice just because of a
6 # dependency 6 # dependency
7 libreoffice = (import <nixpkgs> { overlays = []; }).libreoffice-fresh; 7 libreoffice = (import <nixpkgs> { overlays = []; }).libreoffice-fresh;
8 ecfg = config.services.etherpad-lite; 8 ecfg = config.services.etherpad-lite;
9in { 9in {
10 options.services.myWebsites.tools.etherpad-lite = { 10 options.myServices.websites.tools.etherpad-lite = {
11 enable = lib.mkEnableOption "enable etherpad's website"; 11 enable = lib.mkEnableOption "enable etherpad's website";
12 }; 12 };
13 13
diff --git a/nixops/modules/websites/tools/git/default.nix b/modules/private/websites/tools/git/default.nix
index 495c5ea..3e8b605 100644
--- a/nixops/modules/websites/tools/git/default.nix
+++ b/modules/private/websites/tools/git/default.nix
@@ -6,9 +6,9 @@ let
6 }; 6 };
7 gitweb = pkgs.callPackage ./gitweb.nix { gitoliteDir = config.services.myGitolite.gitoliteDir; }; 7 gitweb = pkgs.callPackage ./gitweb.nix { gitoliteDir = config.services.myGitolite.gitoliteDir; };
8 8
9 cfg = config.services.myWebsites.tools.git; 9 cfg = config.myServices.websites.tools.git;
10in { 10in {
11 options.services.myWebsites.tools.git = { 11 options.myServices.websites.tools.git = {
12 enable = lib.mkEnableOption "enable git's website"; 12 enable = lib.mkEnableOption "enable git's website";
13 }; 13 };
14 14
@@ -17,12 +17,10 @@ in {
17 services.websites.tools.modules = 17 services.websites.tools.modules =
18 gitweb.apache.modules ++ 18 gitweb.apache.modules ++
19 mantisbt.apache.modules; 19 mantisbt.apache.modules;
20 system.extraSystemBuilderCmds = '' 20 myServices.websites.webappDirs."${gitweb.apache.webappName}" = gitweb.webRoot;
21 mkdir -p $out/webapps 21 myServices.websites.webappDirs."${mantisbt.apache.webappName}" = mantisbt.webRoot;
22 ln -s ${gitweb.webRoot} $out/webapps/${gitweb.apache.webappName}
23 ln -s ${mantisbt.webRoot} $out/webapps/${mantisbt.apache.webappName}
24 '';
25 22
23 system.activationScripts.mantisbt = mantisbt.activationScript;
26 services.websites.tools.vhostConfs.git = { 24 services.websites.tools.vhostConfs.git = {
27 certName = "eldiron"; 25 certName = "eldiron";
28 addToCerts = true; 26 addToCerts = true;
diff --git a/nixops/modules/websites/tools/git/gitweb.nix b/modules/private/websites/tools/git/gitweb.nix
index 2ee7a63..2ee7a63 100644
--- a/nixops/modules/websites/tools/git/gitweb.nix
+++ b/modules/private/websites/tools/git/gitweb.nix
diff --git a/nixops/modules/websites/tools/git/mantisbt.nix b/modules/private/websites/tools/git/mantisbt.nix
index 0c459a7..a1b830e 100644
--- a/nixops/modules/websites/tools/git/mantisbt.nix
+++ b/modules/private/websites/tools/git/mantisbt.nix
@@ -1,5 +1,11 @@
1{ env, mantisbt_2, mantisbt_2-plugins }: 1{ env, mantisbt_2, mantisbt_2-plugins }:
2rec { 2rec {
3 activationScript = {
4 deps = [ "httpd" ];
5 text = ''
6 install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/mantisbt
7 '';
8 };
3 keys = [{ 9 keys = [{
4 dest = "webapps/tools-mantisbt"; 10 dest = "webapps/tools-mantisbt";
5 user = apache.user; 11 user = apache.user;
diff --git a/nixops/modules/websites/tools/mastodon.nix b/modules/private/websites/tools/mastodon/default.nix
index ffd59dd..d742a33 100644
--- a/nixops/modules/websites/tools/mastodon.nix
+++ b/modules/private/websites/tools/mastodon/default.nix
@@ -2,10 +2,10 @@
2let 2let
3 env = myconfig.env.tools.mastodon; 3 env = myconfig.env.tools.mastodon;
4 root = "/run/current-system/webapps/tools_mastodon"; 4 root = "/run/current-system/webapps/tools_mastodon";
5 cfg = config.services.myWebsites.tools.mastodon; 5 cfg = config.myServices.websites.tools.mastodon;
6 mcfg = config.services.mastodon; 6 mcfg = config.services.mastodon;
7in { 7in {
8 options.services.myWebsites.tools.mastodon = { 8 options.myServices.websites.tools.mastodon = {
9 enable = lib.mkEnableOption "enable mastodon's website"; 9 enable = lib.mkEnableOption "enable mastodon's website";
10 }; 10 };
11 11
diff --git a/nixops/modules/websites/tools/mediagoblin.nix b/modules/private/websites/tools/mgoblin/default.nix
index eb56b35..5da81f6 100644
--- a/nixops/modules/websites/tools/mediagoblin.nix
+++ b/modules/private/websites/tools/mgoblin/default.nix
@@ -1,10 +1,10 @@
1{ lib, pkgs, config, myconfig, ... }: 1{ lib, pkgs, config, myconfig, ... }:
2let 2let
3 env = myconfig.env.tools.mediagoblin; 3 env = myconfig.env.tools.mediagoblin;
4 cfg = config.services.myWebsites.tools.mediagoblin; 4 cfg = config.myServices.websites.tools.mediagoblin;
5 mcfg = config.services.mediagoblin; 5 mcfg = config.services.mediagoblin;
6in { 6in {
7 options.services.myWebsites.tools.mediagoblin = { 7 options.myServices.websites.tools.mediagoblin = {
8 enable = lib.mkEnableOption "enable mediagoblin's website"; 8 enable = lib.mkEnableOption "enable mediagoblin's website";
9 }; 9 };
10 10
diff --git a/nixops/modules/websites/tools/peertube.nix b/modules/private/websites/tools/peertube/default.nix
index 12ab3c4..dee1b81 100644
--- a/nixops/modules/websites/tools/peertube.nix
+++ b/modules/private/websites/tools/peertube/default.nix
@@ -1,10 +1,10 @@
1{ lib, pkgs, config, myconfig, ... }: 1{ lib, pkgs, config, myconfig, ... }:
2let 2let
3 env = myconfig.env.tools.peertube; 3 env = myconfig.env.tools.peertube;
4 cfg = config.services.myWebsites.tools.peertube; 4 cfg = config.myServices.websites.tools.peertube;
5 pcfg = config.services.peertube; 5 pcfg = config.services.peertube;
6in { 6in {
7 options.services.myWebsites.tools.peertube = { 7 options.myServices.websites.tools.peertube = {
8 enable = lib.mkEnableOption "enable Peertube's website"; 8 enable = lib.mkEnableOption "enable Peertube's website";
9 }; 9 };
10 10
diff --git a/nixops/modules/websites/commons/adminer.nix b/modules/private/websites/tools/tools/adminer.nix
index e911347..cd51e7f 100644
--- a/nixops/modules/websites/commons/adminer.nix
+++ b/modules/private/websites/tools/tools/adminer.nix
@@ -1,6 +1,13 @@
1{ stdenv, fetchurl, webapps }: 1{ adminer }:
2rec { 2rec {
3 webRoot = webapps.adminer; 3 activationScript = {
4 deps = [ "httpd" ];
5 text = ''
6 install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/adminer
7 install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/tmp/adminer
8 '';
9 };
10 webRoot = adminer;
4 phpFpm = rec { 11 phpFpm = rec {
5 socket = "/var/run/phpfpm/adminer.sock"; 12 socket = "/var/run/phpfpm/adminer.sock";
6 pool = '' 13 pool = ''
diff --git a/nixops/modules/websites/tools/tools/default.nix b/modules/private/websites/tools/tools/default.nix
index 642755f..94a2be1 100644
--- a/nixops/modules/websites/tools/tools/default.nix
+++ b/modules/private/websites/tools/tools/default.nix
@@ -1,47 +1,49 @@
1{ lib, pkgs, config, myconfig, ... }: 1{ lib, pkgs, config, myconfig, ... }:
2let 2let
3 adminer = pkgs.callPackage ../../commons/adminer.nix {}; 3 adminer = pkgs.callPackage ./adminer.nix {
4 ympd = pkgs.callPackage ./ympd.nix { 4 inherit (pkgs.webapps) adminer;
5 env = myconfig.env.tools.ympd; 5 };
6 }; 6 ympd = pkgs.callPackage ./ympd.nix {
7 ttrss = pkgs.callPackage ./ttrss.nix { 7 env = myconfig.env.tools.ympd;
8 inherit (pkgs.webapps) ttrss ttrss-plugins; 8 };
9 env = myconfig.env.tools.ttrss; 9 ttrss = pkgs.callPackage ./ttrss.nix {
10 }; 10 inherit (pkgs.webapps) ttrss ttrss-plugins;
11 roundcubemail = pkgs.callPackage ./roundcubemail.nix { 11 env = myconfig.env.tools.ttrss;
12 inherit (pkgs.webapps) roundcubemail roundcubemail-plugins roundcubemail-skins; 12 };
13 env = myconfig.env.tools.roundcubemail; 13 roundcubemail = pkgs.callPackage ./roundcubemail.nix {
14 }; 14 inherit (pkgs.webapps) roundcubemail roundcubemail-plugins roundcubemail-skins;
15 rainloop = pkgs.callPackage ./rainloop.nix {}; 15 env = myconfig.env.tools.roundcubemail;
16 kanboard = pkgs.callPackage ./kanboard.nix { 16 };
17 env = myconfig.env.tools.kanboard; 17 rainloop = pkgs.callPackage ./rainloop.nix {};
18 }; 18 kanboard = pkgs.callPackage ./kanboard.nix {
19 wallabag = pkgs.callPackage ./wallabag.nix { 19 env = myconfig.env.tools.kanboard;
20 inherit (pkgs.webapps) wallabag; 20 };
21 env = myconfig.env.tools.wallabag; 21 wallabag = pkgs.callPackage ./wallabag.nix {
22 }; 22 inherit (pkgs.webapps) wallabag;
23 yourls = pkgs.callPackage ./yourls.nix { 23 env = myconfig.env.tools.wallabag;
24 inherit (pkgs.webapps) yourls yourls-plugins; 24 };
25 env = myconfig.env.tools.yourls; 25 yourls = pkgs.callPackage ./yourls.nix {
26 }; 26 inherit (pkgs.webapps) yourls yourls-plugins;
27 rompr = pkgs.callPackage ./rompr.nix { 27 env = myconfig.env.tools.yourls;
28 inherit (pkgs.webapps) rompr; 28 };
29 env = myconfig.env.tools.rompr; 29 rompr = pkgs.callPackage ./rompr.nix {
30 }; 30 inherit (pkgs.webapps) rompr;
31 shaarli = pkgs.callPackage ./shaarli.nix { 31 env = myconfig.env.tools.rompr;
32 env = myconfig.env.tools.shaarli; 32 };
33 }; 33 shaarli = pkgs.callPackage ./shaarli.nix {
34 dokuwiki = pkgs.callPackage ./dokuwiki.nix { 34 env = myconfig.env.tools.shaarli;
35 inherit (pkgs.webapps) dokuwiki dokuwiki-plugins; 35 };
36 }; 36 dokuwiki = pkgs.callPackage ./dokuwiki.nix {
37 ldap = pkgs.callPackage ./ldap.nix { 37 inherit (pkgs.webapps) dokuwiki dokuwiki-plugins;
38 inherit (pkgs.webapps) phpldapadmin; 38 };
39 env = myconfig.env.tools.phpldapadmin; 39 ldap = pkgs.callPackage ./ldap.nix {
40 }; 40 inherit (pkgs.webapps) phpldapadmin;
41 env = myconfig.env.tools.phpldapadmin;
42 };
41 43
42 cfg = config.services.myWebsites.tools.tools; 44 cfg = config.myServices.websites.tools.tools;
43in { 45in {
44 options.services.myWebsites.tools.tools = { 46 options.myServices.websites.tools.tools = {
45 enable = lib.mkEnableOption "enable tools website"; 47 enable = lib.mkEnableOption "enable tools website";
46 }; 48 };
47 49
@@ -268,6 +270,7 @@ in {
268 }; 270 };
269 271
270 system.activationScripts = { 272 system.activationScripts = {
273 adminer = adminer.activationScript;
271 ttrss = ttrss.activationScript; 274 ttrss = ttrss.activationScript;
272 roundcubemail = roundcubemail.activationScript; 275 roundcubemail = roundcubemail.activationScript;
273 wallabag = wallabag.activationScript; 276 wallabag = wallabag.activationScript;
@@ -277,21 +280,22 @@ in {
277 dokuwiki = dokuwiki.activationScript; 280 dokuwiki = dokuwiki.activationScript;
278 rainloop = rainloop.activationScript; 281 rainloop = rainloop.activationScript;
279 kanboard = kanboard.activationScript; 282 kanboard = kanboard.activationScript;
283 ldap = ldap.activationScript;
280 }; 284 };
281 285
282 system.extraSystemBuilderCmds = '' 286 myServices.websites.webappDirs = {
283 mkdir -p $out/webapps 287 _adminer = adminer.webRoot;
284 ln -s ${dokuwiki.webRoot} $out/webapps/${dokuwiki.apache.webappName} 288 "${dokuwiki.apache.webappName}" = dokuwiki.webRoot;
285 ln -s ${ldap.webRoot}/htdocs $out/webapps/${ldap.apache.webappName} 289 "${ldap.apache.webappName}" = "${ldap.webRoot}/htdocs";
286 ln -s ${rompr.webRoot} $out/webapps/${rompr.apache.webappName} 290 "${rompr.apache.webappName}" = rompr.webRoot;
287 ln -s ${roundcubemail.webRoot} $out/webapps/${roundcubemail.apache.webappName} 291 "${roundcubemail.apache.webappName}" = roundcubemail.webRoot;
288 ln -s ${shaarli.webRoot} $out/webapps/${shaarli.apache.webappName} 292 "${shaarli.apache.webappName}" = shaarli.webRoot;
289 ln -s ${ttrss.webRoot} $out/webapps/${ttrss.apache.webappName} 293 "${ttrss.apache.webappName}" = ttrss.webRoot;
290 ln -s ${wallabag.webRoot} $out/webapps/${wallabag.apache.webappName} 294 "${wallabag.apache.webappName}" = wallabag.webRoot;
291 ln -s ${yourls.webRoot} $out/webapps/${yourls.apache.webappName} 295 "${yourls.apache.webappName}" = yourls.webRoot;
292 ln -s ${rainloop.webRoot} $out/webapps/${rainloop.apache.webappName} 296 "${rainloop.apache.webappName}" = rainloop.webRoot;
293 ln -s ${kanboard.webRoot} $out/webapps/${kanboard.apache.webappName} 297 "${kanboard.apache.webappName}" = kanboard.webRoot;
294 ''; 298 };
295 299
296 }; 300 };
297} 301}
diff --git a/nixops/modules/websites/tools/tools/dokuwiki.nix b/modules/private/websites/tools/tools/dokuwiki.nix
index c61d15f..c61d15f 100644
--- a/nixops/modules/websites/tools/tools/dokuwiki.nix
+++ b/modules/private/websites/tools/tools/dokuwiki.nix
diff --git a/nixops/modules/websites/tools/tools/kanboard.nix b/modules/private/websites/tools/tools/kanboard.nix
index 68f92b8..68f92b8 100644
--- a/nixops/modules/websites/tools/tools/kanboard.nix
+++ b/modules/private/websites/tools/tools/kanboard.nix
diff --git a/nixops/modules/websites/tools/tools/ldap.nix b/modules/private/websites/tools/tools/ldap.nix
index 8ee39f6..4585ee3 100644
--- a/nixops/modules/websites/tools/tools/ldap.nix
+++ b/modules/private/websites/tools/tools/ldap.nix
@@ -1,5 +1,11 @@
1{ lib, php, env, writeText, phpldapadmin }: 1{ lib, php, env, writeText, phpldapadmin }:
2rec { 2rec {
3 activationScript = {
4 deps = [ "httpd" ];
5 text = ''
6 install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/phpldapadmin
7 '';
8 };
3 keys = [{ 9 keys = [{
4 dest = "webapps/tools-ldap"; 10 dest = "webapps/tools-ldap";
5 user = apache.user; 11 user = apache.user;
diff --git a/nixops/modules/websites/tools/tools/rainloop.nix b/modules/private/websites/tools/tools/rainloop.nix
index dbf0f24..dbf0f24 100644
--- a/nixops/modules/websites/tools/tools/rainloop.nix
+++ b/modules/private/websites/tools/tools/rainloop.nix
diff --git a/nixops/modules/websites/tools/tools/rompr.nix b/modules/private/websites/tools/tools/rompr.nix
index fea59fc..fea59fc 100644
--- a/nixops/modules/websites/tools/tools/rompr.nix
+++ b/modules/private/websites/tools/tools/rompr.nix
diff --git a/nixops/modules/websites/tools/tools/roundcubemail.nix b/modules/private/websites/tools/tools/roundcubemail.nix
index 8974d1b..8974d1b 100644
--- a/nixops/modules/websites/tools/tools/roundcubemail.nix
+++ b/modules/private/websites/tools/tools/roundcubemail.nix
diff --git a/nixops/modules/websites/tools/tools/shaarli.nix b/modules/private/websites/tools/tools/shaarli.nix
index 2e89a47..2e89a47 100644
--- a/nixops/modules/websites/tools/tools/shaarli.nix
+++ b/modules/private/websites/tools/tools/shaarli.nix
diff --git a/nixops/modules/websites/tools/tools/ttrss.nix b/modules/private/websites/tools/tools/ttrss.nix
index 05c8cab..05c8cab 100644
--- a/nixops/modules/websites/tools/tools/ttrss.nix
+++ b/modules/private/websites/tools/tools/ttrss.nix
diff --git a/nixops/modules/websites/tools/tools/wallabag.nix b/modules/private/websites/tools/tools/wallabag.nix
index d6e5882..d6e5882 100644
--- a/nixops/modules/websites/tools/tools/wallabag.nix
+++ b/modules/private/websites/tools/tools/wallabag.nix
diff --git a/nixops/modules/websites/tools/tools/ympd.nix b/modules/private/websites/tools/tools/ympd.nix
index b54c486..b54c486 100644
--- a/nixops/modules/websites/tools/tools/ympd.nix
+++ b/modules/private/websites/tools/tools/ympd.nix
diff --git a/nixops/modules/websites/tools/tools/yourls.nix b/modules/private/websites/tools/tools/yourls.nix
index df1b3a2..0a8e837 100644
--- a/nixops/modules/websites/tools/tools/yourls.nix
+++ b/modules/private/websites/tools/tools/yourls.nix
@@ -1,8 +1,11 @@
1{ env, yourls, yourls-plugins }: 1{ env, yourls, yourls-plugins }:
2rec { 2rec {
3 activationScript = '' 3 activationScript = {
4 install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/yourls 4 deps = [ "httpd" ];
5 ''; 5 text = ''
6 install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/yourls
7 '';
8 };
6 keys = [{ 9 keys = [{
7 dest = "webapps/tools-yourls"; 10 dest = "webapps/tools-yourls";
8 user = apache.user; 11 user = apache.user;
diff --git a/nixops/eldiron.nix b/nixops/eldiron.nix
index a0c5c7c..59ff85a 100644
--- a/nixops/eldiron.nix
+++ b/nixops/eldiron.nix
@@ -36,7 +36,6 @@
36 ./modules/certificates.nix 36 ./modules/certificates.nix
37 ./modules/gitolite 37 ./modules/gitolite
38 ./modules/mpd.nix 38 ./modules/mpd.nix
39 ./modules/websites
40 ./modules/mail.nix 39 ./modules/mail.nix
41 ./modules/ftp.nix 40 ./modules/ftp.nix
42 ./modules/pub 41 ./modules/pub
diff --git a/nixops/modules/task/default.nix b/nixops/modules/task/default.nix
index e620318..9aeaa3f 100644
--- a/nixops/modules/task/default.nix
+++ b/nixops/modules/task/default.nix
@@ -180,9 +180,7 @@ in {
180 ''; 180 '';
181 }; 181 };
182 182
183 system.extraSystemBuilderCmds = '' 183 myServices.websites.webappDirs._task = ./www;
184 ln -s ${./www} $out/webapps/_task
185 '';
186 184
187 security.acme.certs."task" = config.services.myCertificates.certConfig // { 185 security.acme.certs."task" = config.services.myCertificates.certConfig // {
188 inherit user group; 186 inherit user group;
diff --git a/nixops/modules/websites/default.nix b/nixops/modules/websites/default.nix
deleted file mode 100644
index 1948fe9..0000000
--- a/nixops/modules/websites/default.nix
+++ /dev/null
@@ -1,236 +0,0 @@
1{ lib, pkgs, config, myconfig, ... }:
2let
3 cfg = config.services.myWebsites;
4 www_root = "/run/current-system/webapps/_www";
5 theme_root = "/run/current-system/webapps/_theme";
6 apacheConfig = {
7 gzip = {
8 modules = [ "deflate" "filter" ];
9 extraConfig = ''
10 AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
11 '';
12 };
13 macros = {
14 modules = [ "macro" ];
15 };
16 stats = {
17 extraConfig = ''
18 <Macro Stats %{domain}>
19 Alias /webstats ${config.services.webstats.dataDir}/%{domain}
20 <Directory ${config.services.webstats.dataDir}/%{domain}>
21 DirectoryIndex index.html
22 AllowOverride None
23 Require all granted
24 </Directory>
25 <Location /webstats>
26 Use LDAPConnect
27 Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
28 </Location>
29 </Macro>
30 '';
31 };
32 ldap = {
33 modules = [ "ldap" "authnz_ldap" ];
34 extraConfig = ''
35 <IfModule ldap_module>
36 LDAPSharedCacheSize 500000
37 LDAPCacheEntries 1024
38 LDAPCacheTTL 600
39 LDAPOpCacheEntries 1024
40 LDAPOpCacheTTL 600
41 </IfModule>
42
43 Include /var/secrets/apache-ldap
44 '';
45 };
46 global = {
47 extraConfig = (pkgs.webapps.apache-default.override { inherit www_root;}).apacheConfig;
48 };
49 apaxy = {
50 extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
51 };
52 http2 = {
53 modules = [ "http2" ];
54 extraConfig = ''
55 Protocols h2 http/1.1
56 '';
57 };
58 customLog = {
59 extraConfig = ''
60 LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
61 '';
62 };
63 };
64 makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
65 makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
66in
67{
68 imports = [
69 ./tools/db.nix
70 ./tools/tools
71 ./tools/dav
72 ./tools/cloud.nix
73 ./tools/git
74 ./tools/mastodon.nix
75 ./tools/mediagoblin.nix
76 ./tools/diaspora.nix
77 ./tools/ether.nix
78 ./tools/peertube.nix
79 ];
80
81 config = {
82 users.users.wwwrun.extraGroups = [ "keys" ];
83 networking.firewall.allowedTCPPorts = [ 80 443 ];
84
85 nixpkgs.overlays = [ (self: super: rec {
86 #openssl = self.openssl_1_1;
87 php = php72;
88 php72 = (super.php72.override {
89 mysql.connector-c = self.mariadb;
90 config.php.mysqlnd = false;
91 config.php.mysqli = false;
92 }).overrideAttrs(old: rec {
93 # Didn't manage to build with mysqli + mysql_config connector
94 configureFlags = old.configureFlags ++ [
95 "--with-mysqli=shared,mysqlnd"
96 ];
97 # preConfigure = (old.preConfigure or "") + ''
98 # export CPPFLAGS="$CPPFLAGS -I${pkgs.mariadb}/include/mysql/server";
99 # sed -i -e 's/#include "mysqli_priv.h"/#include "mysqli_priv.h"\n#include <mysql_version.h>/' \
100 # ext/mysqli/mysqli.c ext/mysqli/mysqli_prop.c
101 # '';
102 });
103 phpPackages = super.php72Packages.override { inherit php; };
104 }) ];
105
106 services.myWebsites.tools.databases.enable = true;
107 services.myWebsites.tools.tools.enable = true;
108 services.myWebsites.tools.dav.enable = true;
109 services.myWebsites.tools.cloud.enable = true;
110 services.myWebsites.tools.git.enable = true;
111 services.myWebsites.tools.mastodon.enable = true;
112 services.myWebsites.tools.mediagoblin.enable = true;
113 services.myWebsites.tools.diaspora.enable = true;
114 services.myWebsites.tools.etherpad-lite.enable = true;
115 services.myWebsites.tools.peertube.enable = true;
116
117 secrets.keys = [{
118 dest = "apache-ldap";
119 user = "wwwrun";
120 group = "wwwrun";
121 permissions = "0400";
122 text = ''
123 <Macro LDAPConnect>
124 <IfModule authnz_ldap_module>
125 AuthLDAPURL ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
126 AuthLDAPBindDN cn=httpd,ou=services,dc=immae,dc=eu
127 AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
128 AuthType Basic
129 AuthName "Authentification requise (Acces LDAP)"
130 AuthBasicProvider ldap
131 </IfModule>
132 </Macro>
133 '';
134 }];
135
136 system.activationScripts = {
137 httpd = ''
138 install -d -m 0755 ${config.security.acme.directory}/acme-challenge
139 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
140 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
141 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/tmp/adminer
142 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
143 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
144 install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/phpldapadmin
145 '';
146 };
147
148 system.extraSystemBuilderCmds = let
149 adminer = pkgs.callPackage ./commons/adminer.nix {};
150 in ''
151 mkdir -p $out/webapps
152 ln -s ${pkgs.webapps.apache-default.www} $out/webapps/_www
153 ln -s ${pkgs.webapps.apache-theme.theme} $out/webapps/_theme
154 ln -s ${adminer.webRoot} $out/webapps/${adminer.apache.webappName}
155 '';
156
157 services.phpfpm = {
158 phpPackage = pkgs.php;
159 phpOptions = ''
160 session.save_path = "/var/lib/php/sessions"
161 post_max_size = 20M
162 ; 15 days (seconds)
163 session.gc_maxlifetime = 1296000
164 ; 30 days (minutes)
165 session.cache_expire = 43200
166 '';
167 extraConfig = ''
168 log_level = notice
169 '';
170 };
171
172 services.websites.production = {
173 enable = true;
174 adminAddr = "httpd@immae.eu";
175 httpdName = "Prod";
176 ips =
177 let ips = myconfig.env.servers.eldiron.ips.production;
178 in [ips.ip4] ++ (ips.ip6 or []);
179 modules = makeModules;
180 extraConfig = makeExtraConfig;
181 fallbackVhost = {
182 certName = "eldiron";
183 hosts = ["eldiron.immae.eu" ];
184 root = www_root;
185 extraConfig = [ "DirectoryIndex index.htm" ];
186 };
187 };
188
189 services.websites.integration = {
190 enable = true;
191 adminAddr = "httpd@immae.eu";
192 httpdName = "Inte";
193 ips =
194 let ips = myconfig.env.servers.eldiron.ips.integration;
195 in [ips.ip4] ++ (ips.ip6 or []);
196 modules = makeModules;
197 extraConfig = makeExtraConfig;
198 fallbackVhost = {
199 certName = "eldiron";
200 hosts = ["eldiron.immae.eu" ];
201 root = www_root;
202 extraConfig = [ "DirectoryIndex index.htm" ];
203 };
204 };
205
206 services.websites.tools = {
207 enable = true;
208 adminAddr = "httpd@immae.eu";
209 httpdName = "Tools";
210 ips =
211 let ips = myconfig.env.servers.eldiron.ips.main;
212 in [ips.ip4] ++ (ips.ip6 or []);
213 modules = makeModules;
214 extraConfig = makeExtraConfig ++
215 [ ''
216 RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
217 RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
218 RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
219 RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
220 RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
221 RedirectMatch ^/CGU$ https://www.immae.eu/CGU
222 ''
223 ];
224 nosslVhost = {
225 enable = true;
226 host = "nossl.immae.eu";
227 };
228 fallbackVhost = {
229 certName = "eldiron";
230 hosts = ["eldiron.immae.eu" ];
231 root = www_root;
232 extraConfig = [ "DirectoryIndex index.htm" ];
233 };
234 };
235 };
236}