Merge branch 'reverseproxy' into 'main'

reverseproxy: add alias snl et nekorale

See merge request nounous/nixos!72

hosts/vm/reverseproxy/reverseproxy.nix

@@ -135,21 +135,21 @@ in
       enable = true;
       virtualHosts = {
         "collabora" = {
-          target = "172.16.10.149";
+          proxyPass = "172.16.10.149";
           proxyWebsockets = true;
         };
         "eclat" = {
           anubisConfig = "${anubisMirrors}";
           httpOnly = true;
-          target = "172.16.10.104";
+          proxyPass = "172.16.10.104";
         };
         "eclats" = {
           anubisConfig = "${anubisMirrors}";
-          target = "172.16.10.104";
+          proxyPass = "172.16.10.104";
         };
         "install-party" = {
           anubisConfig = "${anubisChallenge}";
-          target = "/var/www/install-party.crans.org";
+          serveLocalFiles = "/var/www/install-party.crans.org";
           serverAliases = [
             "i-p"
             "adopteunmanchot"
@@ -158,34 +158,36 @@ in
         };
         "lists" = {
           anubisConfig = "${anubisChallenge}";
-          target = "172.16.10.110";
+          proxyPass = "172.16.10.110";
         };
         "mediawiki" = {
           anubisConfig = "${anubisChallenge}";
-          target = "172.16.10.144";
+          proxyPass = "172.16.10.144";
           serverAliases = [
             "mediakiwi"
           ];
         };
         "mirrors" = {
           anubisConfig = "${anubisMirrors}";
-          target = "172.16.10.104";
+          proxyPass = "172.16.10.104";
         };
         "mirror" = {
           anubisConfig = "${anubisMirrors}";
           httpOnly = true;
-          target = "172.16.10.104";
+          proxyPass = "172.16.10.104";
         };
+        "nekorale".globalRedirect = "perso.crans.org/club-nekorale";
         "perso" = {
           anubisConfig = "${anubisPerso}";
-          target = "172.16.10.31";
+          proxyPass = "172.16.10.31";
           serverAliases = [
             "clubs"
           ];
         };
+        "snl".globalRedirect = "perso.crans.org/sonetlumens";
         "wiki" = {
           anubisConfig = "${anubisChallenge}";
-          target = "172.16.10.161";
+          proxyPass = "172.16.10.161";
           serverAliases = [
             "wikipedia"
           ];

modules/services/reverseproxy.nix

@@ -65,18 +65,36 @@ in
               '';
             };
 
-            target = mkOption {
+            proxyPass = mkOption {
-              type = types.str;
+              type = types.nullOr types.str;
-              default = "";
+              default = null;
               description = ''
-                Indique la destination. Il peut s'agir du chemin vers des fichiers statiques.
+                Indique la destination à proxy.
               '';
               example = "172.16.10.128:8000";
             };
 
+            serveLocalFiles = mkOption {
+              type = types.nullOr types.path;
+              default = null;
+              description = ''
+                Chemin vers un dossier à exposer statiquement.
+              '';
+              example = "/var/local/adopter-un-manchot";
+            };
+
+            globalRedirect = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = ''
+                Si définie, toutes les requêtes sont redirigées (via 301) sur cet hôte.
+              '';
+              example = "perso.crans.org/club";
+            };
+
             anubisConfig = mkOption {
-              type = types.str;
+              type = types.nullOr types.str;
-              default = "";
+              default = null;
               description = ''
                 Chemin du fichier de configuration
               '';
@@ -95,7 +113,7 @@ in
               type = types.bool;
               default = false;
               description = ''
-                Interdit les connexions en ssh
+                Interdit les connexions en https
               '';
               example = "true";
             };
@@ -137,7 +155,9 @@ in
     services = mkIf cfg.enable {
       anubis = {
         defaultOptions.group = "nginx";
-        instances = lib.mapAttrs (vhostName: vhostConfig: {
+        instances = lib.mapAttrs (
+          vhostName: vhostConfig:
+          mkIf (vhostConfig.anubisConfig != null) {
             enable = true;
             settings = {
               BIND = "/run/anubis/anubis-${vhostName}/socket.sock";
@@ -152,89 +172,103 @@ in
               OG_EXPIRY_TIME = "24h";
               OG_CACHE_CONSIDER_HOST = true;
               # Policy config
-            POLICY_FNAME = if (vhostConfig.anubisConfig == "") then "${allowAll}" else vhostConfig.anubisConfig;
+              POLICY_FNAME = vhostConfig.anubisConfig;
             };
-        }) cfg.virtualHosts;
+          }
+        ) cfg.virtualHosts;
       };
 
       nginx =
         let
-          # Configuration du serveur principal.
+          configVhost =
-          mainConfig = lib.mapAttrs' (
             vhostName: vhostConfig:
-            lib.nameValuePair (vhostName + "-anubis") {
+            let
+              sslConf = {
                 enableACME = !vhostConfig.httpOnly;
                 forceSSL = !vhostConfig.httpOnly;
                 rejectSSL = vhostConfig.httpOnly;
+              };
+
+              # Conf pour l’host en entrès
+              entryExtraConf = {
+                extraConfig = ''
+                  set_real_ip_from 172.16.0.0/16;
+                  set_real_ip_from fd00::/56;
+                  real_ip_header X-Real-Ip;
+                '';
+              }
+              // sslConf;
+              # Conf supplémentaire pour le proxy principal
+              vhostExtraConf =
+                if vhostConfig.anubisConfig != null then
+                  # Il reçoit les requêtes d’Anubis
+                  {
+                    listen = [
+                      { addr = "unix:/run/nginx/nginx-${vhostName}.sock"; }
+                    ];
+                    extraConfig = ''
+                      set_real_ip_from unix:;
+                      real_ip_header X-Real-IP;
+                    '';
+                  }
+                else
+                  # Il est en entrée
+                  entryExtraConf;
+
+              # Les alias : vhostName × otherTld U serverAliases × allTld
+              aliases =
+                lib.foldr
+                  (
+                    tld: acc:
+                    acc
+                    ++ (lib.foldr (alias: acc: acc ++ [ "${alias}.crans.${tld}" ]) [
+                      "${vhostName}.crans.${tld}"
+                    ] vhostConfig.serverAliases)
+                  )
+                  (lib.foldr (alias: acc: acc ++ [ "${alias}.crans.${mainTld}" ]) [ ] vhostConfig.serverAliases)
+                  otherTld;
+            in
+            {
+              # Configuration du service à proxy.
+              "${vhostName}" = vhostExtraConf // {
+                serverName = "${vhostName}.crans.${mainTld}";
+                locations."/" = mkIf (vhostConfig.proxyPass != null) {
+                  proxyPass = "http://${vhostConfig.proxyPass}";
+                  proxyWebsockets = vhostConfig.proxyWebsockets;
+                };
+                root = vhostConfig.serveLocalFiles;
+                globalRedirect = vhostConfig.globalRedirect;
+              };
+
+              # Entrée d’Anubis
+              "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) (
+                entryExtraConf
+                // {
+                  serverName = "${vhostName}.crans.${mainTld}";
                   locations."/" = {
                     proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock";
                     proxyWebsockets = vhostConfig.proxyWebsockets;
                   };
-              serverName = "${vhostName}.crans.${mainTld}";
+                  extraConfig = entryExtraConf.extraConfig + ''
-              extraConfig = "
+                    access_log /var/log/nginx/anubis.access.log;
-                set_real_ip_from 172.16.0.0/16;
+                    error_log /var/log/nginx/anubis.error.log;
-                set_real_ip_from fd00::/56;
+                  '';
-                real_ip_header X-Real-Ip;
-              ";
                 }
-          ) cfg.virtualHosts;
+              );
-
+            }
-          # Redirections
+            # Les alias
-          redirectConfig = lib.mapAttrs (vhostName: vhostConfig: {
+            // lib.mergeAttrsList (
-            # Redirection vers d'autres machines
+              lib.map (alias: {
-            locations = mkIf (!lib.strings.hasPrefix "/" vhostConfig.target) {
+                "${vhostName}-alias-${alias}" = sslConf // {
-              "/favicon.ico".root = "/var/www/logo/";
-              "/" = {
-                proxyPass = "http://${vhostConfig.target}";
-                proxyWebsockets = vhostConfig.proxyWebsockets;
-              };
-            };
-            # Redirection vers des fichiers locaux
-            root = mkIf (lib.strings.hasPrefix "/" vhostConfig.target) vhostConfig.target;
-            listen = [
-              { addr = "unix:/run/nginx/nginx-${vhostName}.sock"; }
-            ];
-            serverName = "${vhostName}.crans.${mainTld}";
-            extraConfig = "
-              set_real_ip_from unix:;
-              real_ip_header X-Real-IP;
-            ";
-          }) cfg.virtualHosts;
-
-          # Génération des alias
-          getAliases = name: config: lib.foldr (
-            tld: acc:
-            acc
-            ++
-            (lib.foldr (alias: acc: acc ++ ["${alias}.crans.${tld}"]) ["${name}.crans.${tld}"] config.serverAliases)
-          )
-          (lib.foldr (alias: acc: acc ++ ["${alias}.crans.${mainTld}"]) [] config.serverAliases)
-          otherTld;
-
-          # Configuration des alias
-          aliasConfig = lib.foldr (
-            vhost: acc:
-            acc
-            //
-            lib.foldr (
-              alias: acc:
-              acc
-              //
-              {
-                "${vhost.name}-alias-${alias}" = rec {
-                  rejectSSL = vhost.value.httpOnly;
-                  forceSSL = !rejectSSL;
-                  enableACME = !rejectSSL;
                   serverName = alias;
-                  globalRedirect = "${vhost.name}.crans.${mainTld}";
+                  globalRedirect = vhostConfig.globalRedirect or "${vhostName}.crans.${mainTld}";
                 };
-              }
+              }) aliases
-            ) { } (getAliases vhost.name vhost.value)
+            );
-          ) { } (lib.attrsToList cfg.virtualHosts);
         in
         {
           enable = true;
-          virtualHosts = redirectConfig // aliasConfig // mainConfig;
+          virtualHosts = lib.concatMapAttrs configVhost cfg.virtualHosts;
         };
     };
   };