reverseproxy: logrotate

hosts/vm/reverseproxy/reverseproxy.nix

@@ -135,7 +135,7 @@ let
     opts:
     pkgs.fetchFromGitLab (
       {
-        domain = "gitlab.crans.org";
+        domain = "gitlab.adm.crans.org";
         owner = "nounous";
       }
       // opts
@@ -171,7 +171,6 @@ let
 
     nativeBuildInputs = with pkgs; [
       hugo
-      git
     ];
 
     buildPhase = ''
@@ -296,4 +295,5 @@ in
       acme.enable = true;
     };
   };
+  services.nginx.virtualHosts."www-alias-crans.org".default = true;
 }

modules/services/reverseproxy.nix

@@ -173,6 +173,35 @@ in
         ) cfg.virtualHosts;
       };
 
+      logrotate.settings =
+        let
+          # https://github.com/NixOS/nixpkgs/blob/nixos-26.05/nixos/modules/services/web-servers/nginx/default.nix
+          base = {
+            su = "${config.services.nginx.user} ${config.services.nginx.group}";
+            postrotate = "[ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`";
+            frequency = "daily";
+            notifempty = true;
+          };
+        in
+        {
+          nginx-anubis = base // {
+            files = [ "/var/log/nginx/anubis/*.log" ];
+            rotate = 7; # une semaine de log pour débugguer
+            delaycompress = false;
+          };
+          nginx-aliases = base // {
+            files = [ "/var/log/nginx/aliases/*.log" ];
+            rotate = 7; # une semaine de log pour débugguer
+            delaycompress = false;
+          };
+          nginx-hosts = base // {
+            files = [ "/var/log/nginx/host/*/*.log" ];
+            rotate = 173; # 6 mois de logs
+            dateext = true;
+            dateformat = "%Y-%m-%d";
+          };
+        };
+
       nginx =
         let
           configVhost =
@@ -235,6 +264,10 @@ in
                 };
                 root = vhostConfig.serveLocalFiles;
                 globalRedirect = vhostConfig.globalRedirect;
+                extraConfig = vhostExtraConf.extraConfig + ''
+                  access_log /var/log/nginx/host/${vhostName}/access.log;
+                  error_log /var/log/nginx/host/${vhostName}/error.log;
+                '';
               };
 
               # Entrée d’Anubis
@@ -247,8 +280,8 @@ in
                     proxyWebsockets = vhostConfig.proxyWebsockets;
                   };
                   extraConfig = entryExtraConf.extraConfig + ''
-                    access_log /var/log/nginx/anubis.access.log;
+                    access_log /var/log/nginx/anubis/access.log;
-                    error_log /var/log/nginx/anubis.error.log;
+                    error_log /var/log/nginx/anubis/error.log;
                   '';
                 }
               );
@@ -259,6 +292,10 @@ in
                 "${vhostName}-alias-${alias}" = sslConf // {
                   serverName = alias;
                   globalRedirect = lib.defaultTo "${vhostName}.crans.${mainTld}" vhostConfig.globalRedirect;
+                  extraConfig = ''
+                    access_log /var/log/nginx/aliases/access.log;
+                    error_log /var/log/nginx/aliases/eror.log;
+                  '';
                 };
               }) aliases
             );