aboutsummaryrefslogtreecommitdiff
path: root/modules/private
diff options
context:
space:
mode:
Diffstat (limited to 'modules/private')
-rw-r--r--modules/private/default.nix5
-rw-r--r--modules/private/websites/bakeer/cloud.nix98
-rw-r--r--modules/private/websites/default.nix4
-rw-r--r--modules/private/websites/ressourcerie_banon/cloud.nix20
-rw-r--r--modules/private/websites/ressourcerie_banon/cryptpad.nix33
-rw-r--r--modules/private/websites/ressourcerie_banon/production.nix70
-rw-r--r--modules/private/websites/tools/cloud/farm.nix123
7 files changed, 258 insertions, 95 deletions
diff --git a/modules/private/default.nix b/modules/private/default.nix
index 8542e20..f12fc48 100644
--- a/modules/private/default.nix
+++ b/modules/private/default.nix
@@ -71,6 +71,10 @@ set = {
71 piedsjalouxInte = ./websites/piedsjaloux/integration.nix; 71 piedsjalouxInte = ./websites/piedsjaloux/integration.nix;
72 piedsjalouxProd = ./websites/piedsjaloux/production.nix; 72 piedsjalouxProd = ./websites/piedsjaloux/production.nix;
73 73
74 ressourcerieBanonProd = ./websites/ressourcerie_banon/production.nix;
75 ressourcerieBanonCloud = ./websites/ressourcerie_banon/cloud.nix;
76 ressourcerieBanonCryptpad = ./websites/ressourcerie_banon/cryptpad.nix;
77
74 richieProd = ./websites/richie/production.nix; 78 richieProd = ./websites/richie/production.nix;
75 79
76 sydenPeertube = ./websites/syden/peertube.nix; 80 sydenPeertube = ./websites/syden/peertube.nix;
@@ -80,6 +84,7 @@ set = {
80 # Tools 84 # Tools
81 assetsTools = ./websites/tools/assets; 85 assetsTools = ./websites/tools/assets;
82 cloudTool = ./websites/tools/cloud; 86 cloudTool = ./websites/tools/cloud;
87 cloudFarmTool = ./websites/tools/cloud/farm.nix;
83 commentoTool = ./websites/tools/commento; 88 commentoTool = ./websites/tools/commento;
84 davTool = ./websites/tools/dav; 89 davTool = ./websites/tools/dav;
85 vpnTool = ./websites/tools/vpn; 90 vpnTool = ./websites/tools/vpn;
diff --git a/modules/private/websites/bakeer/cloud.nix b/modules/private/websites/bakeer/cloud.nix
index 001ca03..bf78317 100644
--- a/modules/private/websites/bakeer/cloud.nix
+++ b/modules/private/websites/bakeer/cloud.nix
@@ -1,69 +1,12 @@
1{ lib, pkgs, config, ... }: 1{ lib, pkgs, config, ... }:
2let 2let
3 cfg = config.myServices.websites.bakeer.cloud; 3 cfg = config.myServices.websites.bakeer.cloud;
4 varDir = "/var/lib/nextcloud_farm/bakeer"; 4 nextcloud = config.myServices.tools.cloud.farm.package;
5 apacheUser = config.services.httpd.Prod.user;
6 apacheGroup = config.services.httpd.Prod.group;
7 nextcloud = (pkgs.webapps.nextcloud.override { varDir = null; }).withApps (a: [
8 a.apporder a.audioplayer a.bookmarks a.calendar a.carnet a.contacts
9 a.cookbook a.deck a.extract a.files_markdown a.files_readmemd
10 a.flowupload a.gpxedit a.gpxpod a.impersonate a.keeweb a.maps
11 a.metadata a.music a.notes a.ocsms a.passman a.polls a.spreed
12 a.tasks
13 ]);
14 phpBaseDir = builtins.concatStringsSep ":" ([ nextcloud varDir ] ++ nextcloud.apps);
15in { 5in {
16 options.myServices.websites.bakeer.cloud.enable = lib.mkEnableOption "enable Bakeer’s cloud"; 6 options.myServices.websites.bakeer.cloud.enable = lib.mkEnableOption "enable Bakeer’s cloud";
17 7
18 config = lib.mkIf cfg.enable { 8 config = lib.mkIf cfg.enable {
19 system.activationScripts.bakeer_cloud = { 9 myServices.tools.cloud.farm.instances = [ "bakeer" ];
20 deps = [ "httpd" ];
21 text = ''
22 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${varDir}
23 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d /var/lib/nextcloud_farm/phpSessions
24 '';
25 };
26 systemd.services.phpfpm-nextcloud_farm.after = lib.mkAfter [ "postgresql.service" ];
27 systemd.services.phpfpm-nextcloud_farm.wants = [ "postgresql.service" ];
28 services.phpfpm.pools.nextcloud_farm = {
29 user = apacheUser;
30 group = apacheGroup;
31 settings = {
32 "listen.owner" = apacheUser;
33 "listen.group" = apacheGroup;
34 "pm" = "ondemand";
35 "pm.max_children" = "60";
36 "pm.process_idle_timeout" = "60";
37
38 "php_admin_value[output_buffering]" = "0";
39 "php_admin_value[max_execution_time]" = "1800";
40 "php_admin_value[zend_extension]" = "opcache";
41 #already enabled by default?
42 #"php_value[opcache.enable]" = "1";
43 "php_value[opcache.enable_cli]" = "1";
44 "php_value[opcache.interned_strings_buffer]" = "8";
45 "php_value[opcache.max_accelerated_files]" = "10000";
46 "php_value[opcache.memory_consumption]" = "128";
47 "php_value[opcache.save_comments]" = "1";
48 "php_value[opcache.revalidate_freq]" = "1";
49 "php_admin_value[memory_limit]" = "512M";
50
51 "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:${phpBaseDir}:/proc/meminfo:/dev/urandom:/proc/self/fd:/tmp";
52 "php_admin_value[session.save_path]" = "/var/lib/nextcloud_farm/phpSessions";
53 };
54 phpPackage = pkgs.php74.withExtensions({ enabled, all }: enabled ++ [ all.redis all.apcu all.opcache ]);
55 };
56 users.users.root.packages = let
57 occ = pkgs.writeScriptBin "nextcloud-occ-bakeer" ''
58 #! ${pkgs.stdenv.shell}
59 cd ${nextcloud}
60 NEXTCLOUD_CONFIG_DIR="${varDir}" \
61 exec \
62 sudo -E -u wwwrun ${pkgs.php74}/bin/php \
63 -c ${pkgs.php74}/etc/php.ini \
64 occ $*
65 '';
66 in [ occ ];
67 services.websites.env.production.modules = [ "proxy_fcgi" ]; 10 services.websites.env.production.modules = [ "proxy_fcgi" ];
68 services.websites.env.production.vhostConfs.bakeer = { 11 services.websites.env.production.vhostConfs.bakeer = {
69 certName = "bakeer"; 12 certName = "bakeer";
@@ -72,42 +15,7 @@ in {
72 hosts = ["bakeer.immae.eu" "baxsolution.immae.eu"]; 15 hosts = ["bakeer.immae.eu" "baxsolution.immae.eu"];
73 root = nextcloud; 16 root = nextcloud;
74 extraConfig = [ 17 extraConfig = [
75 '' 18 config.myServices.tools.cloud.farm.vhosts.bakeer
76 SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
77 SetEnv NEXTCLOUD_CONFIG_DIR "${varDir}"
78 <Directory ${nextcloud}>
79 AcceptPathInfo On
80 DirectoryIndex index.php
81 Options FollowSymlinks
82 Require all granted
83 AllowOverride all
84
85 <IfModule mod_headers.c>
86 Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
87 </IfModule>
88 <FilesMatch "\.php$">
89 CGIPassAuth on
90 SetHandler "proxy:unix:${config.services.phpfpm.pools.nextcloud_farm.socket}|fcgi://localhost"
91 </FilesMatch>
92
93 </Directory>
94 ''
95 ];
96 };
97 services.cron = {
98 enable = true;
99 systemCronJobs = let
100 script = pkgs.writeScriptBin "nextcloud-cron" ''
101 #! ${pkgs.stdenv.shell}
102 export LOCALE_ARCHIVE=/run/current-system/sw/lib/locale/locale-archive
103 export PATH=/run/wrappers/bin:$PATH
104 export NEXTCLOUD_CONFIG_DIR="${varDir}"
105 ${pkgs.php74}/bin/php -d memory_limit=512M -f ${nextcloud}/cron.php
106 '';
107 in [
108 ''
109 */15 * * * * wwwrun ${script}/bin/nextcloud-cron
110 ''
111 ]; 19 ];
112 }; 20 };
113 }; 21 };
diff --git a/modules/private/websites/default.nix b/modules/private/websites/default.nix
index bacfb53..b0c7496 100644
--- a/modules/private/websites/default.nix
+++ b/modules/private/websites/default.nix
@@ -292,6 +292,10 @@ in
292 production.enable = true; 292 production.enable = true;
293 }; 293 };
294 294
295 ressourcerie_banon.production.enable = true;
296 ressourcerie_banon.cryptpad.enable = true;
297 ressourcerie_banon.cloud.enable = true;
298
295 richie.production.enable = true; 299 richie.production.enable = true;
296 300
297 syden.peertube.enable = true; 301 syden.peertube.enable = true;
diff --git a/modules/private/websites/ressourcerie_banon/cloud.nix b/modules/private/websites/ressourcerie_banon/cloud.nix
new file mode 100644
index 0000000..5179218
--- /dev/null
+++ b/modules/private/websites/ressourcerie_banon/cloud.nix
@@ -0,0 +1,20 @@
1{ lib, pkgs, config, ... }:
2let
3 cfg = config.myServices.websites.ressourcerie_banon.cloud;
4 nextcloud = config.myServices.tools.cloud.farm.package;
5in {
6 options.myServices.websites.ressourcerie_banon.cloud.enable = lib.mkEnableOption "enable Ressourcerie Banon’s cloud";
7
8 config = lib.mkIf cfg.enable {
9 myServices.tools.cloud.farm.instances = [ "ressourcerie_banon" ];
10 services.websites.env.production.modules = [ "proxy_fcgi" ];
11 services.websites.env.production.vhostConfs.ressourcerie_banon_cloud = {
12 certName = "ressourcerie_banon";
13 addToCerts = true;
14 hosts = ["cloud.le-garage-autonome.org"];
15 root = nextcloud;
16 extraConfig = [ config.myServices.tools.cloud.farm.vhosts.ressourcerie_banon ];
17 };
18 };
19}
20
diff --git a/modules/private/websites/ressourcerie_banon/cryptpad.nix b/modules/private/websites/ressourcerie_banon/cryptpad.nix
new file mode 100644
index 0000000..961302d
--- /dev/null
+++ b/modules/private/websites/ressourcerie_banon/cryptpad.nix
@@ -0,0 +1,33 @@
1{ lib, pkgs, config, ... }:
2let
3 cfg = config.myServices.websites.ressourcerie_banon.cryptpad;
4 configFile = "${pkgs.cryptpad}/lib/node_modules/cryptpad/config/config.example.js";
5in {
6 options.myServices.websites.ressourcerie_banon.cryptpad.enable = lib.mkEnableOption "Enable Ressourcerie Banon’s cryptpad";
7
8 config = lib.mkIf cfg.enable {
9 systemd.services.cryptpad-ressourcerie_banon = {
10 description = "Cryptpad Banon Service";
11 wantedBy = [ "multi-user.target" ];
12 after = [ "networking.target" ];
13 serviceConfig = {
14 DynamicUser = true;
15 Environment = [
16 "CRYPTPAD_CONFIG=${configFile}"
17 "HOME=%S/cryptpad/ressourcerie_banon"
18 ];
19 ExecStart = "${pkgs.cryptpad}/bin/cryptpad";
20 PrivateTmp = true;
21 Restart = "always";
22 StateDirectory = "cryptpad/ressourcerie_banon";
23 WorkingDirectory = "%S/cryptpad/ressourcerie_banon";
24 };
25 };
26 services.websites.env.production.vhostConfs.ressourcerie_banon_cryptpad = {
27 certName = "ressourcerie_banon";
28 addToCerts = true;
29 hosts = ["pad.le-garage-autonome.org"];
30 root = null;
31 };
32 };
33}
diff --git a/modules/private/websites/ressourcerie_banon/production.nix b/modules/private/websites/ressourcerie_banon/production.nix
new file mode 100644
index 0000000..fa00d92
--- /dev/null
+++ b/modules/private/websites/ressourcerie_banon/production.nix
@@ -0,0 +1,70 @@
1{ lib, pkgs, config, ... }:
2let
3 cfg = config.myServices.websites.ressourcerie_banon.production;
4 varDir = "/var/lib/ftp/ressourcerie_banon";
5 apacheUser = config.services.httpd.Prod.user;
6 apacheGroup = config.services.httpd.Prod.group;
7in {
8 options.myServices.websites.ressourcerie_banon.production.enable = lib.mkEnableOption "enable Ressourcerie Banon's website";
9
10 config = lib.mkIf cfg.enable {
11 services.webstats.sites = [ { name = "ressourcerie-banon.org"; } ];
12
13 system.activationScripts.ressourcerie_banon = {
14 deps = [ "httpd" ];
15 text = ''
16 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d /var/lib/php/sessions/ressourcerie_banon
17 '';
18 };
19 systemd.services.phpfpm-ressourcerie_banon.after = lib.mkAfter [ "mysql.service" ];
20 systemd.services.phpfpm-ressourcerie_banon.wants = [ "mysql.service" ];
21 services.phpfpm.pools.ressourcerie_banon = {
22 user = apacheUser;
23 group = apacheGroup;
24 settings = {
25 "listen.owner" = apacheUser;
26 "listen.group" = apacheGroup;
27
28 "pm" = "ondemand";
29 "pm.max_children" = "5";
30 "pm.process_idle_timeout" = "60";
31
32 "php_admin_value[open_basedir]" = "/var/lib/php/sessions/ressourcerie_banon:${varDir}:/tmp";
33 "php_admin_value[session.save_path]" = "/var/lib/php/sessions/ressourcerie_banon";
34 };
35 phpOptions = config.services.phpfpm.phpOptions + ''
36 disable_functions = "mail"
37 '';
38 phpPackage = pkgs.php72;
39 };
40 services.websites.env.production.modules = [ "proxy_fcgi" ];
41 services.websites.env.production.vhostConfs.ressourcerie_banon = {
42 certName = "ressourcerie_banon";
43 certMainHost = "ressourcerie-banon.org";
44 hosts = ["ressourcerie-banon.org" "www.ressourcerie-banon.org" "ressourcerie-sault.org" "www.ressourcerie-sault.org" "le-garage-autonome.org"
45 "www.le-garage-autonome.org"];
46 root = varDir;
47 extraConfig = [
48 ''
49 Use Stats ressourcerie-banon.org
50
51 RewriteEngine on
52 RewriteCond "%{HTTP_HOST}" "!^ressourcerie-banon\.org$" [NC]
53 RewriteRule ^(.+)$ https://ressourcerie-banon.org$1 [R=302,L]
54
55 <FilesMatch "\.php$">
56 SetHandler "proxy:unix:${config.services.phpfpm.pools.ressourcerie_banon.socket}|fcgi://localhost"
57 </FilesMatch>
58
59 <Directory ${varDir}>
60 DirectoryIndex index.php index.htm index.html
61 Options Indexes FollowSymLinks MultiViews Includes
62 AllowOverride all
63 Require all granted
64 </Directory>
65 ''
66 ];
67 };
68 };
69}
70
diff --git a/modules/private/websites/tools/cloud/farm.nix b/modules/private/websites/tools/cloud/farm.nix
new file mode 100644
index 0000000..7be774c
--- /dev/null
+++ b/modules/private/websites/tools/cloud/farm.nix
@@ -0,0 +1,123 @@
1{ lib, pkgs, config, ... }:
2let
3 cfg = config.myServices.tools.cloud.farm;
4 apacheUser = config.services.httpd.Prod.user;
5 apacheGroup = config.services.httpd.Prod.group;
6 nextcloud = (pkgs.webapps.nextcloud.override { varDir = null; }).withApps (a: [
7 a.apporder a.audioplayer a.bookmarks a.calendar a.carnet a.contacts
8 a.cookbook a.deck a.extract a.files_markdown a.files_readmemd
9 a.flowupload a.gpxedit a.gpxpod a.impersonate a.keeweb a.maps
10 a.metadata a.music a.notes a.ocsms a.passman a.polls a.spreed
11 a.tasks
12 ]);
13 toVardir = name: "/var/lib/nextcloud_farm/${name}";
14 varDirs = map toVardir cfg.instances;
15 phpBaseDir = builtins.concatStringsSep ":" ([ nextcloud ] ++ varDirs ++ nextcloud.apps);
16 toVhost = name: ''
17 SetEnvIf Authorization "(.*)" HTTP_AUTHORIZATION=$1
18 SetEnv NEXTCLOUD_CONFIG_DIR "${toVardir name}"
19 <Directory ${nextcloud}>
20 AcceptPathInfo On
21 DirectoryIndex index.php
22 Options FollowSymlinks
23 Require all granted
24 AllowOverride all
25
26 <IfModule mod_headers.c>
27 Header always set Strict-Transport-Security "max-age=15552000; includeSubDomains; preload"
28 </IfModule>
29 <FilesMatch "\.php$">
30 CGIPassAuth on
31 SetHandler "proxy:unix:${config.services.phpfpm.pools.nextcloud_farm.socket}|fcgi://localhost"
32 </FilesMatch>
33
34 </Directory>
35 '';
36in
37{
38 options.myServices.tools.cloud.farm = {
39 instances = lib.mkOption {
40 description = "Instances names for the nextcloud Farm";
41 default = [];
42 type = lib.types.listOf lib.types.str;
43 };
44 vhosts = lib.mkOption {
45 description = "Instance vhosts configs";
46 readOnly = true;
47 type = lib.types.attrsOf lib.types.str;
48 default = lib.genAttrs cfg.instances toVhost;
49 };
50 package = lib.mkOption {
51 description = "Nextcloud derivation";
52 readOnly = true;
53 type = lib.types.package;
54 default = nextcloud;
55 };
56 };
57
58 config = lib.mkIf (builtins.length cfg.instances > 0) {
59 system.activationScripts.cloud_farm_vardirs = {
60 deps = [ "httpd" ];
61 text = ''
62 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${builtins.concatStringsSep " " varDirs}
63 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d /var/lib/nextcloud_farm/phpSessions
64 '';
65 };
66 systemd.services.phpfpm-nextcloud_farm.after = lib.mkAfter [ "postgresql.service" ];
67 systemd.services.phpfpm-nextcloud_farm.wants = [ "postgresql.service" ];
68 services.phpfpm.pools.nextcloud_farm = {
69 user = apacheUser;
70 group = apacheGroup;
71 settings = {
72 "listen.owner" = apacheUser;
73 "listen.group" = apacheGroup;
74 "pm" = "ondemand";
75 "pm.max_children" = "60";
76 "pm.process_idle_timeout" = "60";
77
78 "php_admin_value[output_buffering]" = "0";
79 "php_admin_value[max_execution_time]" = "1800";
80 "php_admin_value[zend_extension]" = "opcache";
81 #already enabled by default?
82 #"php_value[opcache.enable]" = "1";
83 "php_value[opcache.enable_cli]" = "1";
84 "php_value[opcache.interned_strings_buffer]" = "8";
85 "php_value[opcache.max_accelerated_files]" = "10000";
86 "php_value[opcache.memory_consumption]" = "128";
87 "php_value[opcache.save_comments]" = "1";
88 "php_value[opcache.revalidate_freq]" = "1";
89 "php_admin_value[memory_limit]" = "512M";
90
91 "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:${phpBaseDir}:/proc/meminfo:/dev/urandom:/proc/self/fd:/tmp";
92 "php_admin_value[session.save_path]" = "/var/lib/nextcloud_farm/phpSessions";
93 };
94 phpPackage = pkgs.php74.withExtensions({ enabled, all }: enabled ++ [ all.redis all.apcu all.opcache ]);
95 };
96 users.users.root.packages = let
97 toOcc = name: pkgs.writeScriptBin "nextcloud-occ-${name}" ''
98 #! ${pkgs.stdenv.shell}
99 cd ${nextcloud}
100 NEXTCLOUD_CONFIG_DIR="${toVardir name}" \
101 exec \
102 sudo -E -u wwwrun ${pkgs.php74}/bin/php \
103 -c ${pkgs.php74}/etc/php.ini \
104 occ $*
105 '';
106 in map toOcc cfg.instances;
107 services.cron = {
108 enable = true;
109 systemCronJobs = let
110 toScript = name: pkgs.writeScriptBin "nextcloud-cron" ''
111 #! ${pkgs.stdenv.shell}
112 export LOCALE_ARCHIVE=/run/current-system/sw/lib/locale/locale-archive
113 export PATH=/run/wrappers/bin:$PATH
114 export NEXTCLOUD_CONFIG_DIR="${toVardir name}"
115 ${pkgs.php74}/bin/php -d memory_limit=512M -f ${nextcloud}/cron.php
116 '';
117 toLine = name: ''
118 */15 * * * * wwwrun ${toScript name}/bin/nextcloud-cron
119 '';
120 in map toLine cfg.instances;
121 };
122 };
123}