Merge branch 'reverseproxy' into 'main'

Anubis : ne pas refresh systématiquement en changeant de site

See merge request nounous/nixos!77

hosts/vm/reverseproxy/reverseproxy.nix

@@ -194,8 +194,8 @@ let
 
     src = fetchFromCrans {
       repo = "homepage";
-      rev = "51ae6b9f4d59815d14963209ff30988200eff944";
-      hash = "sha256-un0LIIIFn56Zm1uF32+suc2/QrBDMRVTv/A0bOgbFJQ=";
+      rev = "a71446ad7c125241835190a4035159bc7be751bc";
+      hash = "sha256-dAKJpBnGeDtv0UM8gXsdqUCzbliskRMYUEQ1KGCW1Cw=";
     };
 
     nativeBuildInputs = with pkgs; [
@@ -293,8 +293,8 @@ in
         "re2o-dev".proxyPass = "172.16.10.166";
         "services".serveLocalFiles = fetchFromCrans {
           repo = "services-page";
-          rev = "ef5e998a09d298e75a94daae089f65407d40e331";
-          hash = "sha256-GzFmU+U9OzZ0m40NKmrtDGKqfWdUO/fBsWBWKYFL8xs=";
+          rev = "e32ac21513d88e5123eb4138835453df64aa21d0";
+          hash = "sha256-nc4IjA/wtj7WXnt0wZqGymGz/NR45STlMLbsTdnSzJ0=";
         };
         "snl".globalRedirect = "perso.crans.org/sonetlumens";
         "test-melon".proxyPass = "172.16.10.150:8080";
@@ -313,9 +313,9 @@ in
           proxyPass = "172.16.10.161";
           serverAliases = [ "wikipedia" ];
         };
-        "www" = {
+        "_crans-org" = {
           serveLocalFiles = homepagePkg;
-          serverAliases = [ "." ];
+          serverAliases = [ "www" ];
         };
         "zero".proxyPass = "172.16.10.130";
       };
@@ -325,5 +325,14 @@ in
       acme.enable = true;
     };
   };
-  services.nginx.virtualHosts."www-alias-crans.org".default = true;
+
+  # Règle particulières
+  services.nginx.virtualHosts = {
+    "www-alias-crans.org".default = true;
+
+    "_crans-org".locations = {
+      "/_matrix/".proxyPass = "https://matrix.crans.org/_matrix/";
+      "/_synapse/".proxyPass = "https://matrix.crans.org/_synapse/";
+    };
+  };
 }

modules/services/reverseproxy.nix

@@ -20,6 +20,8 @@ let
     mkOption
     types
     ;
+
+  mkHostName = als: tld: if als == "_crans-org" then "crans.${tld}" else "${als}.crans.${tld}";
 in
 
 {
@@ -158,11 +160,19 @@ in
       };
     };
 
+    age.secrets.anubis-secret = {
+      file = ../../secrets/reverseproxy/anubis-secret.age;
+      owner = "anubis";
+    };
+
     services = mkIf cfg.enable {
       anubis = {
         defaultOptions.group = "nginx";
         instances = lib.mapAttrs (
           vhostName: vhostConfig:
+          let
+            hostname = mkHostName vhostName mainTld;
+          in
           mkIf (vhostConfig.anubisConfig != null) {
             enable = true;
             settings = {
@@ -170,9 +180,14 @@ in
               BIND_NETWORK = "unix";
               METRICS_BIND = "/run/anubis/anubis-${vhostName}/anubis-${vhostName}-metrics.sock";
               TARGET = "unix:///run/nginx/nginx-${vhostName}.sock";
-              COOKIE_DOMAIN = "crans.${mainTld}";
-              REDIRECT_DOMAINS = "${vhostName}.crans.${mainTld}";
+              COOKIE_DOMAIN = hostname;
+              # TODO: db pour mettre en commun les token.
+              # Transitoirement on les sépare
+              COOKIE_PREFIX = "anubis-${vhostName}";
+              REDIRECT_DOMAINS = hostname;
               SOCKET_MODE = "0660";
+              # Secret partagé entre les instances
+              ED25519_PRIVATE_KEY_HEX_FILE = config.age.secrets.anubis-secret.path;
               # OpenGraph config
               OG_PASSTHROUGH = vhostConfig.anubisOpenGraph;
               OG_EXPIRY_TIME = "24h";
@@ -215,6 +230,8 @@ in
           configVhost =
             vhostName: vhostConfig:
             let
+              hostname = mkHostName vhostName mainTld;
+
               sslConf = {
                 forceSSL = !vhostConfig.httpOnly;
                 rejectSSL = vhostConfig.httpOnly;
@@ -254,7 +271,6 @@ in
               '';
 
               # Les alias : vhostName × otherTld U serverAliases × allTld
-              mkHostName = als: tld: if als == "." then "crans.${tld}" else "${als}.crans.${tld}";
               aliases =
                 lib.foldr
                   (
@@ -270,7 +286,7 @@ in
             {
               # Configuration du service à proxy.
               "${vhostName}" = vhostExtraConf // {
-                serverName = mkHostName vhostName mainTld;
+                serverName = hostname;
                 locations."/" = mkIf (vhostConfig.proxyPass != null) {
                   proxyPass = "http://${vhostConfig.proxyPass}";
                   proxyWebsockets = vhostConfig.proxyWebsockets;
@@ -284,7 +300,7 @@ in
               "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) (
                 entryExtraConf
                 // rec {
-                  serverName = mkHostName vhostName mainTld;
+                  serverName = hostname;
                   locations."/" = {
                     proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock";
                     proxyWebsockets = vhostConfig.proxyWebsockets;
@@ -306,7 +322,7 @@ in
               lib.map (alias: {
                 "${vhostName}-alias-${alias}" = sslConf // {
                   serverName = alias;
-                  globalRedirect = lib.defaultTo "${vhostName}.crans.${mainTld}" vhostConfig.globalRedirect;
+                  globalRedirect = lib.defaultTo hostname vhostConfig.globalRedirect;
                   extraConfig = logHostConf;
                 };
               }) aliases

secrets/reverseproxy/anubis-secret.age

@@ -0,0 +1,33 @@
+age-encryption.org/v1
+-> ssh-ed25519 GCcVXA qD1f4YdP88JvuPLS6H416O0LF+rKN/gJ+gPf0lFWIRs
+B0LuHjXX0UiHHTwY7v1HqP4VF5/5yn0d/gNW4zUOC5w
+-> piv-p256 ewCc3w A8Wnjz7tLNpV/m5bUzuq/MBTHn+jQiaCSUb4vFvGDH7N
+gNBEsgdHogaz3OSJBelB39bGrOBt8+hkNXpAYcFcy28
+-> piv-p256 6CL/Pw AoJBcpyhK+hpZOfHOBUHh0Kivvn6YJ4xepo7IWppbMuJ
+f1fwsu8okH7F+6nSHowxHpTdtjU72lvd6FmwFIMmV8E
+-> ssh-ed25519 eOAUSg 0bH2dDdNzKapr54HKndKJpKO5iTQtbhY957NIJQcvBo
+LYVsTuKNsE4JlBxbf2e+Qo9ZjRxnz6saEHEjyfCcAjc
+-> ssh-rsa REaZBA
+Pho7O15lWd5/2Uy1OQmA/JzE0wmOji6IPKGj03nK9aYSQjsTTc30YhNCrkddglGX
+MCClDyGDlQ0mCwHKVfpFeeSC9VQWQDDYk90dM4MF//6hHPqU/zn8dR25NyxDgyyi
+DVrCFB+S09LsKI4isbDoCru6fWXfdN4Fj8I44c64dBpIVh4XhSzUtmlzmge//35C
+y6EvAjVIhVTbbgnQ5CJFgnRlSPaN5BHDq76aJ3c+8Ajkjowa2YcYu7w8asi7PsIs
+WH6J2qMIPvPdxOEKczGc401ysUfz9fNFKs0Xx4spduwv8I3Sv4ImURDkYmCl/k7J
+rwRXbUGr8JzZu093cmkjVxDrSfb9VhqlZVJD7uc2VSTk8ntwStLWafSuE03bIN2L
+on0t/4/wXtvFtwlGoDe9QGYAJpPYWM0ZUPMZfpddOz9vYvL1+6nUcDroLMvCIItI
+blwJZ0970K/Je99SmI3+6mUEAw8nJ/pBFaF/LmTJecypLEalLNsu2IALyCMIdTa0
+
+-> ssh-ed25519 J/iReg fpgi4t31rVl+KvOYd0Ph0Nd2gInJAZXNhQC5ekpv0kI
+lznh3YwmqVr05vjWxf1HKRWAFZGXbypAYygjUe+ELlk
+-> ssh-ed25519 GNhSGw 2cVptD/h5NWcYsjPPwQcP/b9tjJPDbhjDKh2hKhA5GM
+JZvQvXkb1RRw+NHnJ+HMV5tlwiBnLf4+cwm6J2hZD9Y
+-> ssh-ed25519 eXMAtA axP3hHgfgWJScGLIGpYgu0iYW1qZRQzMK9XjIeszrnc
+rBzAqSVoRqj/drZSOlxSIZLgZZU/wqGML1gKCEHtcy4
+-> ssh-ed25519 5hXocQ b3kjoM+FfQ434V7X8FdpIHVFjTn4sc+psj+9jyRljxU
+l5rna7ap0ydVXPCSr4qrPnu2MV2n7XwoSh/T87OkuMU
+-> ssh-ed25519 bRHVVA 92Rj1gMmueSHWzxsKWVs+7nF4JzuekhfaB2u5AWnazk
+yg4qa9lyHsGCOXWOTm7/XH9F8JzvRLjzsxyXe88oXnE
+-> ssh-ed25519 HgW9eA mpIFRqMXj08JuyYLf6Hx4p9fOLbxXZquSMAjh0e/lSU
+h1kvwnu+mLOeRfVFUXgE9IDo/MQ+4gtkYwrF3JWQfwY
+--- MCDm2NH5NWgwnFYQ+zJ4obfdxWpiv3BGohnIJ1bRkco
+_Ö¹`ðãFËÉÑvF3[;œç197%»4¼90MÞ[ï¼Ip¢:Ÿs|ÈñC<C3B1>RÃ6,CÔè÷;á[³;<§Éû¤b(´fqÀg8îp÷p÷
÷Dk p/ÐwîÒ¿$9Ý\