From 950ca5ee979ae2467f3471216140de2c1d572f4b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Sat, 12 Jan 2019 10:24:15 +0100 Subject: Move httpd service to module --- virtual/modules/gitolite.nix | 21 +++++++-- virtual/modules/gitweb.nix | 21 --------- virtual/modules/gitweb/default.nix | 30 ++++++++++++ virtual/modules/gitweb/gitweb.nix | 64 +++++++++++++++++++++++++ virtual/modules/websites/default.nix | 90 +++++++++++++++++++++++++++++++++++- 5 files changed, 199 insertions(+), 27 deletions(-) delete mode 100644 virtual/modules/gitweb.nix create mode 100644 virtual/modules/gitweb/default.nix create mode 100644 virtual/modules/gitweb/gitweb.nix (limited to 'virtual/modules') diff --git a/virtual/modules/gitolite.nix b/virtual/modules/gitolite.nix index 85c7be1..d6b9c79 100644 --- a/virtual/modules/gitolite.nix +++ b/virtual/modules/gitolite.nix @@ -4,6 +4,10 @@ let in { options.services.myGitolite = { enable = lib.mkEnableOption "my gitolite service"; + gitoliteDir = lib.mkOption { + type = lib.types.string; + default = "/var/lib/gitolite"; + }; }; config = lib.mkIf cfg.enable { @@ -20,6 +24,13 @@ in { }); }; + services.gitDaemon = { + enable = true; + user = "gitolite"; + group = "gitolite"; + basePath = "${cfg.gitoliteDir}/repositories"; + }; + system.activationScripts.gitolite = assert mylibs.checkEnv "NIXOPS_GITOLITE_LDAP_PASSWORD"; let @@ -34,12 +45,12 @@ in { in { deps = [ "users" ]; text = '' - if [ -d /var/lib/gitolite ]; then - ln -sf ${gitolite_ldap_groups} /var/lib/gitolite/gitolite_ldap_groups.sh - chmod g+rx /var/lib/gitolite + if [ -d ${cfg.gitoliteDir} ]; then + ln -sf ${gitolite_ldap_groups} ${cfg.gitoliteDir}/gitolite_ldap_groups.sh + chmod g+rx ${cfg.gitoliteDir} fi - if [ -f /var/lib/gitolite/projects.list ]; then - chmod g+r /var/lib/gitolite/projects.list + if [ -f ${cfg.gitoliteDir}/projects.list ]; then + chmod g+r ${cfg.gitoliteDir}/projects.list fi ''; }; diff --git a/virtual/modules/gitweb.nix b/virtual/modules/gitweb.nix deleted file mode 100644 index f3ef1bd..0000000 --- a/virtual/modules/gitweb.nix +++ /dev/null @@ -1,21 +0,0 @@ -{ lib, pkgs, config, mylibs, ... }: -let - cfg = config.services.myGitweb; -in { - options.services.myGitweb = { - enable = lib.mkEnableOption "my gitweb service"; - }; - - config = lib.mkIf cfg.enable { - security.acme.certs."eldiron".extraDomains."git.immae.eu" = null; - - nixpkgs.config.packageOverrides = oldpkgs: rec { - gitweb = oldpkgs.gitweb.overrideAttrs(old: { - installPhase = old.installPhase + '' - cp -r ${./gitweb/theme} $out/gitweb-theme; - ''; - }); - }; - - }; -} diff --git a/virtual/modules/gitweb/default.nix b/virtual/modules/gitweb/default.nix new file mode 100644 index 0000000..2a860ba --- /dev/null +++ b/virtual/modules/gitweb/default.nix @@ -0,0 +1,30 @@ +{ lib, pkgs, config, mylibs, ... }: +let + # FIXME: add buildbot + gitweb = pkgs.callPackage ./gitweb.nix { gitoliteDir = config.services.myGitolite.gitoliteDir; }; + cfg = config.services.myGitweb; +in { + options.services.myGitweb = { + enable = lib.mkEnableOption "my gitweb service"; + }; + + config = lib.mkIf cfg.enable { + security.acme.certs."eldiron".extraDomains."git.immae.eu" = null; + + nixpkgs.config.packageOverrides = oldpkgs: rec { + gitweb = oldpkgs.gitweb.overrideAttrs(old: { + installPhase = old.installPhase + '' + cp -r ${./theme} $out/gitweb-theme; + ''; + }); + }; + + services.myWebsites.tools.modules = gitweb.apache.modules; + services.myWebsites.tools.vhostConfs.git = { + certName = "eldiron"; + hosts = ["git.immae.eu" ]; + root = gitweb.webRoot; + extraConfig = [ gitweb.apache.vhostConf ]; + }; + }; +} diff --git a/virtual/modules/gitweb/gitweb.nix b/virtual/modules/gitweb/gitweb.nix new file mode 100644 index 0000000..7b4dcac --- /dev/null +++ b/virtual/modules/gitweb/gitweb.nix @@ -0,0 +1,64 @@ +{ gitweb, writeText, gitolite, git, gitoliteDir }: +rec { + varDir = gitoliteDir; + webRoot = gitweb; + config = writeText "gitweb.conf" '' + $git_temp = "/tmp"; + + # The directories where your projects are. Must not end with a + # slash. + $projectroot = "${varDir}/repositories"; + + $projects_list = "${varDir}/projects.list"; + $strict_export = "true"; + + # Base URLs for links displayed in the web interface. + our @git_base_url_list = qw(ssh://gitolite@git.immae.eu https://git.immae.eu); + + $feature{'blame'}{'default'} = [1]; + $feature{'avatar'}{'default'} = ['gravatar']; + $feature{'highlight'}{'default'} = [1]; + + @stylesheets = ("gitweb-theme/gitweb.css"); + $logo = "gitweb-theme/git-logo.png"; + $favicon = "gitweb-theme/git-favicon.png"; + $javascript = "gitweb-theme/gitweb.js"; + $logo_url = "https://git.immae.eu/"; + $projects_list_group_categories = "true"; + $projects_list_description_width = 60; + $project_list_default_category = "__Others__"; + ''; + apache = { + user = "wwwrun"; + group = "wwwrun"; + modules = [ "cgid" ]; + vhostConf = '' + SetEnv GIT_PROJECT_ROOT ${varDir}/repositories/ + ScriptAliasMatch \ + "(?x)^/(.*/(HEAD | \ + info/refs | \ + objects/(info/[^/]+ | \ + [0-9a-f]{2}/[0-9a-f]{38} | \ + pack/pack-[0-9a-f]{40}\.(pack|idx)) | \ + git-(upload|receive)-pack))$" \ + ${git}/libexec/git-core/git-http-backend/$1 + + + Require all granted + + + Require all granted + + + DirectoryIndex gitweb.cgi + Require all granted + AllowOverride None + Options ExecCGI FollowSymLinks + + SetHandler cgi-script + SetEnv GITWEB_CONFIG "${config}" + + + ''; + }; +} diff --git a/virtual/modules/websites/default.nix b/virtual/modules/websites/default.nix index a9e62a5..b027b81 100644 --- a/virtual/modules/websites/default.nix +++ b/virtual/modules/websites/default.nix @@ -1,5 +1,8 @@ { lib, pkgs, config, mylibs, myconfig, ... }: let + mypkgs = pkgs.callPackage ../../packages.nix { + inherit (mylibs) checkEnv fetchedGit fetchedGithub; + }; cfg = config.services.myWebsites; makeService = name: cfg: let toVhost = vhostConf: { @@ -16,6 +19,28 @@ let documentRoot = vhostConf.root; extraConfig = builtins.concatStringsSep "\n" vhostConf.extraConfig; }; + redirectVhost = { # Should go last, catchall http -> https redirect + listen = [ { ip = cfg.ip; port = 80; } ]; + hostName = "redirectSSL"; + serverAliases = [ "*" ]; + enableSSL = false; + logFormat = "combinedVhost"; + documentRoot = "/var/lib/acme/acme-challenge"; + extraConfig = '' + RewriteEngine on + RewriteCond "%{REQUEST_URI}" "!^/\.well-known" + RewriteRule ^(.+) https://%{HTTP_HOST}$1 [R=301] + # To redirect in specific "VirtualHost *:80", do + # RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://host/$1 + # rather than rewrite + ''; + }; + fallbackVhost = toVhost { # Should go first, default choice + certName = "eldiron"; + hosts = ["eldiron.immae.eu" ]; + root = ../../www; + extraConfig = [ "DirectoryIndex index.htm" ]; + }; in rec { enable = true; listen = [ @@ -28,7 +53,9 @@ let logFormat = "combinedVhost"; extraModules = pkgs.lib.lists.unique (pkgs.lib.lists.flatten cfg.modules); extraConfig = builtins.concatStringsSep "\n" cfg.extraConfig; - virtualHosts = pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs; + virtualHosts = [ fallbackVhost ] + ++ (pkgs.lib.attrsets.mapAttrsToList (n: v: toVhost v) cfg.vhostConfs) + ++ [ redirectVhost ]; }; makeServiceOptions = name: ip: { enable = lib.mkEnableOption "enable websites in ${name}"; @@ -74,6 +101,7 @@ in options.services.myWebsites = { production = makeServiceOptions "production" myconfig.ips.production; integration = makeServiceOptions "integration" myconfig.ips.integration; + tools = makeServiceOptions "tools" myconfig.ips.main; apacheConfig = lib.mkOption { type = lib.types.attrsOf (lib.types.submodule { @@ -208,5 +236,65 @@ in services.httpdInte = makeService "integration" config.services.myWebsites.integration; services.myWebsites.integration.modules = pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig); services.myWebsites.integration.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig)); + + services.httpd = makeService "tools" config.services.myWebsites.tools; + services.myWebsites.tools.modules = + mypkgs.adminer.apache.modules ++ + mypkgs.nextcloud.apache.modules ++ + mypkgs.ympd.apache.modules ++ + mypkgs.mantisbt.apache.modules ++ + mypkgs.ttrss.apache.modules ++ + mypkgs.roundcubemail.apache.modules ++ + pkgs.lib.lists.flatten (pkgs.lib.attrsets.mapAttrsToList (n: v: v.modules or []) cfg.apacheConfig); + services.myWebsites.tools.extraConfig = (builtins.filter (x: x != null) (pkgs.lib.attrsets.mapAttrsToList (n: v: v.extraConfig or null) cfg.apacheConfig)); + # FIXME: move them all to separate modules + services.myWebsites.tools.vhostConfs.eldiron = { + certName = "eldiron"; + hosts = ["eldiron.immae.eu" ]; + root = ../../www; + extraConfig = [ "DirectoryIndex index.htm" ]; + }; + services.myWebsites.tools.vhostConfs.db-1 = { + certName = "eldiron"; + hosts = ["db-1.immae.eu" ]; + root = null; + extraConfig = [ mypkgs.adminer.apache.vhostConf ]; + }; + services.myWebsites.tools.vhostConfs.tools = { + certName = "eldiron"; + hosts = ["tools.immae.eu" ]; + root = null; + extraConfig = [ + mypkgs.adminer.apache.vhostConf + mypkgs.ympd.apache.vhostConf + mypkgs.ttrss.apache.vhostConf + mypkgs.roundcubemail.apache.vhostConf + ]; + }; + services.myWebsites.tools.vhostConfs.dav = { + certName = "eldiron"; + hosts = ["dav.immae.eu" ]; + root = null; + extraConfig = [ + mypkgs.infcloud.apache.vhostConf + mypkgs.davical.apache.vhostConf + ]; + }; + services.myWebsites.tools.vhostConfs.cloud = { + certName = "eldiron"; + hosts = ["cloud.immae.eu" ]; + root = mypkgs.nextcloud.webRoot; + extraConfig = [ + mypkgs.nextcloud.apache.vhostConf + ]; + }; + services.myWebsites.tools.vhostConfs.git.extraConfig = [ + mypkgs.mantisbt.apache.vhostConf + '' + RewriteEngine on + RewriteCond %{REQUEST_URI} ^/releases + RewriteRule /releases(.*) https://release.immae.eu$1 [P,L] + '' + ]; }; } -- cgit v1.2.3