1 files changed, 131 insertions, 210 deletions

diff --git a/nixops/modules/websites/default.nix b/nixops/modules/websites/default.nix
index 627d01a..5b839af 100644
--- a/nixops/modules/websites/default.nix
+++ b/nixops/modules/websites/default.nix
@@ -3,104 +3,66 @@ let
   cfg = config.services.myWebsites;
   www_root = "/run/current-system/webapps/_www";
   theme_root = "/run/current-system/webapps/_theme";
-  makeService = name: cfg: let
-    toVhost = vhostConf: {
-      enableSSL = true;
-      sslServerCert = "/var/lib/acme/${vhostConf.certName}/cert.pem";
-      sslServerKey = "/var/lib/acme/${vhostConf.certName}/key.pem";
-      sslServerChain = "/var/lib/acme/${vhostConf.certName}/chain.pem";
-      logFormat = "combinedVhost";
-      listen = map (ip: { inherit ip; port = 443; }) cfg.ips;
-      hostName = builtins.head vhostConf.hosts;
-      serverAliases = builtins.tail vhostConf.hosts or [];
-      documentRoot = vhostConf.root;
-      extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig;
-    };
-    nosslVhost = {
-      listen = map (ip: { inherit ip; port = 80; }) cfg.ips;
-      hostName = "nossl.immae.eu";
-      enableSSL = false;
-      logFormat = "combinedVhost";
-      documentRoot = www_root;
+  apacheConfig = {
+    gzip = {
+      modules = [ "deflate" "filter" ];
       extraConfig = ''
-        <Directory ${www_root}>
-          DirectoryIndex nossl.html
-          AllowOverride None
-          Require all granted
-
-          RewriteEngine on
-          RewriteRule ^/(.+)   /   [L]
-        </Directory>
-        '';
+        AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
+      '';
+    };
+    macros = {
+      modules = [ "macro" ];
     };
-    redirectVhost = { # Should go last, catchall http -> https redirect
-      listen = map (ip: { inherit ip; port = 80; }) cfg.ips;
-      hostName = "redirectSSL";
-      serverAliases = [ "*" ];
-      enableSSL = false;
-      logFormat = "combinedVhost";
-      documentRoot = "/var/lib/acme/acme-challenge";
+    stats = {
       extraConfig = ''
-        RewriteEngine on
-        RewriteCond "%{REQUEST_URI}"   "!^/\.well-known"
-        RewriteRule ^(.+)              https://%{HTTP_HOST}$1  [R=301]
-        # To redirect in specific "VirtualHost *:80", do
-        #   RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1
-        # rather than rewrite
+        <Macro Stats %{domain}>
+          Alias /webstats ${config.services.webstats.dataDir}/%{domain}
+          <Directory ${config.services.webstats.dataDir}/%{domain}>
+            DirectoryIndex index.html
+            AllowOverride None
+            Require all granted
+          </Directory>
+          <Location /webstats>
+            Use LDAPConnect
+            Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
+          </Location>
+        </Macro>
       '';
     };
-    fallbackVhost = toVhost { # Should go first, default choice
-      certName    = "eldiron";
-      hosts       = ["eldiron.immae.eu" ];
-      root        = www_root;
-      extraConfig = [ "DirectoryIndex index.htm" ];
+    ldap = {
+      modules = [ "ldap" "authnz_ldap" ];
+      extraConfig = ''
+        <IfModule ldap_module>
+          LDAPSharedCacheSize 500000
+          LDAPCacheEntries 1024
+          LDAPCacheTTL 600
+          LDAPOpCacheEntries 1024
+          LDAPOpCacheTTL 600
+        </IfModule>
+
+        Include /var/secrets/apache-ldap
+      '';
     };
-  in rec {
-    enable = true;
-    listen = map (ip: { inherit ip; port = 443; }) cfg.ips;
-    stateDir = "/run/httpd_${name}";
-    logPerVirtualHost = true;
-    multiProcessingModule = "worker";
-    adminAddr = "httpd@immae.eu";
-    logFormat = "combinedVhost";
-    extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules);
-    extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig;
-    virtualHosts = [ fallbackVhost ]
-      ++ lib.optionals (name == "tools") [ nosslVhost ]
-      ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs)
-      ++ [ redirectVhost ];
-  };
-  makeServiceOptions = name: {
-    enable = lib.mkEnableOption "enable websites in ${name}";
-    ips = lib.mkOption {
-      type = lib.types.listOf lib.types.string;
-      default = let
-        ips = myconfig.env.servers.eldiron.ips.${name};
-      in
-        [ips.ip4] ++ (ips.ip6 or []);
-      description = "${name} ips to listen to";
+    global = {
+      extraConfig = (pkgs.webapps.apache-default.override { inherit www_root;}).apacheConfig;
     };
-    modules = lib.mkOption {
-      type = lib.types.listOf (lib.types.str);
-      default = [];
+    apaxy = {
+      extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
     };
-    extraConfig = lib.mkOption {
-      type = lib.types.listOf (lib.types.lines);
-      default = [];
+    http2 = {
+      modules = [ "http2" ];
+      extraConfig = ''
+        Protocols h2 http/1.1
+      '';
     };
-    vhostConfs = lib.mkOption {
-      type = lib.types.attrsOf (lib.types.submodule {
-        options = {
-          certName = lib.mkOption { type = lib.types.string; };
-          hosts    = lib.mkOption { type = lib.types.listOf lib.types.string; };
-          root     = lib.mkOption { type = lib.types.nullOr lib.types.path; };
-          extraConfig = lib.mkOption { type = lib.types.listOf lib.types.lines; default = []; };
-        };
-      });
+    customLog = {
+      extraConfig = ''
+        LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
+      '';
     };
   };
-  makeModules = cfg: pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig);
-  makeExtraConfig = cfg: (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig));
+  makeModules = lib.lists.flatten (lib.attrsets.mapAttrsToList (n: v: v.modules or []) apacheConfig);
+  makeExtraConfig = (builtins.filter (x: x != null) (lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) apacheConfig));
 in
 {
   imports = [
@@ -135,30 +97,6 @@ in
     ./phpfpm
   ];
 
-  options.services.myWebsites = {
-    production = makeServiceOptions "production";
-    integration = makeServiceOptions "integration";
-    tools = makeServiceOptions "main";
-
-    apacheConfig = lib.mkOption {
-      type = lib.types.attrsOf (lib.types.submodule {
-        options = {
-          modules = lib.mkOption {
-            type = lib.types.listOf (lib.types.str);
-            default = [];
-          };
-          extraConfig = lib.mkOption {
-            type = lib.types.nullOr lib.types.lines;
-            default = null;
-          };
-        };
-      });
-      default = {};
-      description = "Extra global config";
-    };
-
-  };
-
   config = {
     users.users.wwwrun.extraGroups = [ "keys" ];
     networking.firewall.allowedTCPPorts = [ 80 443 ];
@@ -195,28 +133,28 @@ in
     services.myWebsites.tools.etherpad-lite.enable = true;
     services.myWebsites.tools.peertube.enable = true;
 
-    services.myWebsites.Chloe.production.enable = cfg.production.enable;
-    services.myWebsites.Ludivine.production.enable = cfg.production.enable;
-    services.myWebsites.Aten.production.enable = cfg.production.enable;
-    services.myWebsites.PiedsJaloux.production.enable = cfg.production.enable;
-    services.myWebsites.Connexionswing.production.enable = cfg.production.enable;
-    services.myWebsites.Jerome.production.enable = cfg.production.enable;
-    services.myWebsites.Nassime.production.enable = cfg.production.enable;
-    services.myWebsites.Florian.production.enable = cfg.production.enable;
-    services.myWebsites.Leila.production.enable = cfg.production.enable;
-    services.myWebsites.Papa.production.enable = cfg.production.enable;
-    services.myWebsites.DeniseJerome.production.enable = cfg.production.enable;
-    services.myWebsites.Emilia.production.enable = cfg.production.enable;
-    services.myWebsites.Capitaines.production.enable = cfg.production.enable;
-    services.myWebsites.Immae.production.enable = cfg.production.enable;
-    services.myWebsites.Release.production.enable = cfg.production.enable;
-    services.myWebsites.Temp.production.enable = cfg.production.enable;
+    services.myWebsites.Chloe.production.enable = true;
+    services.myWebsites.Ludivine.production.enable = true;
+    services.myWebsites.Aten.production.enable = true;
+    services.myWebsites.PiedsJaloux.production.enable = true;
+    services.myWebsites.Connexionswing.production.enable = true;
+    services.myWebsites.Jerome.production.enable = true;
+    services.myWebsites.Nassime.production.enable = true;
+    services.myWebsites.Florian.production.enable = true;
+    services.myWebsites.Leila.production.enable = true;
+    services.myWebsites.Papa.production.enable = true;
+    services.myWebsites.DeniseJerome.production.enable = true;
+    services.myWebsites.Emilia.production.enable = true;
+    services.myWebsites.Capitaines.production.enable = true;
+    services.myWebsites.Immae.production.enable = true;
+    services.myWebsites.Release.production.enable = true;
+    services.myWebsites.Temp.production.enable = true;
 
-    services.myWebsites.Chloe.integration.enable = cfg.integration.enable;
-    services.myWebsites.Ludivine.integration.enable = cfg.integration.enable;
-    services.myWebsites.Aten.integration.enable = cfg.integration.enable;
-    services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
-    services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
+    services.myWebsites.Chloe.integration.enable = true;
+    services.myWebsites.Ludivine.integration.enable = true;
+    services.myWebsites.Aten.integration.enable = true;
+    services.myWebsites.PiedsJaloux.integration.enable = true;
+    services.myWebsites.Connexionswing.integration.enable = true;
     services.myWebsites.TellesFlorian.integration.enable = true;
     services.myWebsites.Florian.integration.enable = true;
 
@@ -239,65 +177,6 @@ in
         '';
     }];
 
-    services.myWebsites.apacheConfig = {
-      gzip = {
-        modules = [ "deflate" "filter" ];
-        extraConfig = ''
-          AddOutputFilterByType DEFLATE text/html text/plain text/xml text/css text/javascript application/javascript
-        '';
-      };
-      macros = {
-        modules = [ "macro" ];
-      };
-      stats = {
-        extraConfig = ''
-          <Macro Stats %{domain}>
-            Alias /webstats ${config.services.webstats.dataDir}/%{domain}
-            <Directory ${config.services.webstats.dataDir}/%{domain}>
-              DirectoryIndex index.html
-              AllowOverride None
-              Require all granted
-            </Directory>
-            <Location /webstats>
-              Use LDAPConnect
-              Require ldap-group cn=%{domain},ou=stats,cn=httpd,ou=services,dc=immae,dc=eu
-            </Location>
-          </Macro>
-        '';
-      };
-      ldap = {
-        modules = [ "ldap" "authnz_ldap" ];
-        extraConfig = ''
-          <IfModule ldap_module>
-            LDAPSharedCacheSize 500000
-            LDAPCacheEntries 1024
-            LDAPCacheTTL 600
-            LDAPOpCacheEntries 1024
-            LDAPOpCacheTTL 600
-          </IfModule>
-
-          Include /var/secrets/apache-ldap
-        '';
-      };
-      global = {
-        extraConfig = (pkgs.webapps.apache-default.override { inherit www_root;}).apacheConfig;
-      };
-      apaxy = {
-        extraConfig = (pkgs.webapps.apache-theme.override { inherit theme_root; }).apacheConfig;
-      };
-      http2 = {
-        modules = [ "http2" ];
-        extraConfig = ''
-          Protocols h2 http/1.1
-        '';
-      };
-      customLog = {
-        extraConfig = ''
-          LogFormat "%v:%p %h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combinedVhost
-        '';
-      };
-    };
-
     system.activationScripts = {
       httpd = ''
         install -d -m 0755 /var/lib/acme/acme-challenge
@@ -334,26 +213,68 @@ in
         '';
     };
 
-    services.httpdProd = makeService "production" config.services.myWebsites.production;
-    services.myWebsites.production.modules = makeModules cfg;
-    services.myWebsites.production.extraConfig = makeExtraConfig cfg;
+    services.websites.production = {
+      enable = true;
+      adminAddr = "httpd@immae.eu";
+      httpdName = "Prod";
+      ips =
+        let ips = myconfig.env.servers.eldiron.ips.production;
+        in [ips.ip4] ++ (ips.ip6 or []);
+      modules = makeModules;
+      extraConfig = makeExtraConfig;
+      fallbackVhost = {
+        certName    = "eldiron";
+        hosts       = ["eldiron.immae.eu" ];
+        root        = www_root;
+        extraConfig = [ "DirectoryIndex index.htm" ];
+      };
+    };
 
-    services.httpdInte = makeService "integration" config.services.myWebsites.integration;
-    services.myWebsites.integration.modules = makeModules cfg;
-    services.myWebsites.integration.extraConfig = makeExtraConfig cfg;
+    services.websites.integration = {
+      enable = true;
+      adminAddr = "httpd@immae.eu";
+      httpdName = "Inte";
+      ips =
+        let ips = myconfig.env.servers.eldiron.ips.integration;
+        in [ips.ip4] ++ (ips.ip6 or []);
+      modules = makeModules;
+      extraConfig = makeExtraConfig;
+      fallbackVhost = {
+        certName    = "eldiron";
+        hosts       = ["eldiron.immae.eu" ];
+        root        = www_root;
+        extraConfig = [ "DirectoryIndex index.htm" ];
+      };
+    };
 
-    services.httpdTools = makeService "tools" config.services.myWebsites.tools;
-    services.myWebsites.tools.modules = makeModules cfg;
-    services.myWebsites.tools.extraConfig = makeExtraConfig cfg ++
-    [ ''
-        RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
-        RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
-        RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
-        RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
-        RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
-        RedirectMatch ^/CGU$ https://www.immae.eu/CGU
-      ''
-      ]
-    ;
+    services.websites.tools = {
+      enable = true;
+      adminAddr = "httpd@immae.eu";
+      httpdName = "Tools";
+      ips =
+        let ips = myconfig.env.servers.eldiron.ips.main;
+        in [ips.ip4] ++ (ips.ip6 or []);
+      modules = makeModules;
+      extraConfig = makeExtraConfig ++
+        [ ''
+            RedirectMatch ^/licen[cs]es?_et_tip(ping)?$ https://www.immae.eu/licences_et_tip.html
+            RedirectMatch ^/licen[cs]es?_and_tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
+            RedirectMatch ^/licen[cs]es?$ https://www.immae.eu/licenses_and_tipping.html
+            RedirectMatch ^/tip(ping)?$ https://www.immae.eu/licenses_and_tipping.html
+            RedirectMatch ^/(mentions|mentions_legales|legal)$ https://www.immae.eu/mentions.html
+            RedirectMatch ^/CGU$ https://www.immae.eu/CGU
+          ''
+          ];
+      nosslVhost = {
+        enable = true;
+        host = "nossl.immae.eu";
+      };
+      fallbackVhost = {
+        certName    = "eldiron";
+        hosts       = ["eldiron.immae.eu" ];
+        root        = www_root;
+        extraConfig = [ "DirectoryIndex index.htm" ];
+      };
+    };
   };
 }