Refactor reverseproxy

hosts/vm/reverseproxy/reverseproxy.nix

@@ -135,21 +135,21 @@ in
       enable = true;
       virtualHosts = {
         "collabora" = {
-          target = "172.16.10.149";
+          proxyPass = "172.16.10.149";
           proxyWebsockets = true;
         };
         "eclat" = {
           anubisConfig = "${anubisMirrors}";
           httpOnly = true;
-          target = "172.16.10.104";
+          proxyPass = "172.16.10.104";
         };
         "eclats" = {
           anubisConfig = "${anubisMirrors}";
-          target = "172.16.10.104";
+          proxyPass = "172.16.10.104";
         };
         "install-party" = {
           anubisConfig = "${anubisChallenge}";
-          target = "/var/www/install-party.crans.org";
+          serveLocalFiles = "/var/www/install-party.crans.org";
           serverAliases = [
             "i-p"
             "adopteunmanchot"
@@ -158,42 +158,42 @@ in
         };
         "lists" = {
           anubisConfig = "${anubisChallenge}";
-          target = "172.16.10.110";
+          proxyPass = "172.16.10.110";
         };
         "mediawiki" = {
           anubisConfig = "${anubisChallenge}";
-          target = "172.16.10.144";
+          proxyPass = "172.16.10.144";
           serverAliases = [
             "mediakiwi"
           ];
         };
         "mirrors" = {
           anubisConfig = "${anubisMirrors}";
-          target = "172.16.10.104";
+          proxyPass = "172.16.10.104";
         };
         "mirror" = {
           anubisConfig = "${anubisMirrors}";
           httpOnly = true;
-          target = "172.16.10.104";
+          proxyPass = "172.16.10.104";
         };
         "nekorale" = {
           anubisConfig = "${anubisAllowOther}";
-          target = "172.16.10.31/club-nekorale";
+          globalRedirect = "172.16.10.31/club-nekorale";
         };
         "perso" = {
           anubisConfig = "${anubisPerso}";
-          target = "172.16.10.31";
+          proxyPass = "172.16.10.31";
           serverAliases = [
             "clubs"
           ];
         };
         "snl" = {
           anubisConfig = "${anubisAllowOther}";
-          target = "172.16.10.31/sonetlumens";
+          globalRedirect = "172.16.10.31/sonetlumens";
         };
         "wiki" = {
           anubisConfig = "${anubisChallenge}";
-          target = "172.16.10.161";
+          proxyPass = "172.16.10.161";
           serverAliases = [
             "wikipedia"
           ];

modules/services/reverseproxy.nix

@@ -65,18 +65,36 @@ in
               '';
             };
 
-            target = mkOption {
+            proxyPass = mkOption {
               type = types.str;
               default = "";
               description = ''
-                Indique la destination. Il peut s'agir du chemin vers des fichiers statiques.
+                Indique la destination à proxy.
               '';
               example = "172.16.10.128:8000";
             };
 
+            serveLocalFiles = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = ''
+                Chemin vers un dossier à exposer statiquement.
+              '';
+              example = "/var/local/adopter-un-manchot";
+            };
+
+            globalRedirect = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = ''
+                Si définie, toutes les requêtes sont redirigées (via 301) sur cet hôte.
+              '';
+              example = "perso.crans.org/club";
+            };
+
             anubisConfig = mkOption {
-              type = types.str;
+              type = types.nullOr types.str;
-              default = "";
+              default = null;
               description = ''
                 Chemin du fichier de configuration
               '';
@@ -95,7 +113,7 @@ in
               type = types.bool;
               default = false;
               description = ''
-                Interdit les connexions en ssh
+                Interdit les connexions en https
               '';
               example = "true";
             };
@@ -137,7 +155,9 @@ in
     services = mkIf cfg.enable {
       anubis = {
         defaultOptions.group = "nginx";
-        instances = lib.mapAttrs (vhostName: vhostConfig: {
+        instances = lib.mapAttrs (
+          vhostName: vhostConfig:
+          mkIf (vhostConfig.anubisConfig != null) {
             enable = true;
             settings = {
               BIND = "/run/anubis/anubis-${vhostName}/socket.sock";
@@ -152,89 +172,100 @@ in
               OG_EXPIRY_TIME = "24h";
               OG_CACHE_CONSIDER_HOST = true;
               # Policy config
-            POLICY_FNAME = if (vhostConfig.anubisConfig == "") then "${allowAll}" else vhostConfig.anubisConfig;
+              POLICY_FNAME = vhostConfig.anubisConfig;
             };
-        }) cfg.virtualHosts;
+          }
+        ) cfg.virtualHosts;
       };
 
       nginx =
         let
-          # Configuration du serveur principal.
+          configVhost =
-          mainConfig = lib.mapAttrs' (
             vhostName: vhostConfig:
-            lib.nameValuePair (vhostName + "-anubis") {
+            let
+              sslConf = {
                 enableACME = !vhostConfig.httpOnly;
                 forceSSL = !vhostConfig.httpOnly;
                 rejectSSL = vhostConfig.httpOnly;
-              locations."/" = {
-                proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock";
-                proxyWebsockets = vhostConfig.proxyWebsockets;
               };
-              serverName = "${vhostName}.crans.${mainTld}";
+
-              extraConfig = "
+              # Conf pour l’host en entrès
+              entryExtraConf = {
+                extraConfig = ''
                   set_real_ip_from 172.16.0.0/16;
                   set_real_ip_from fd00::/56;
                   real_ip_header X-Real-Ip;
-              ";
+                '';
               }
-          ) cfg.virtualHosts;
+              // sslConf;
-
+              # Conf supplémentaire pour le proxy principal
-          # Redirections
+              vhostExtraConf =
-          redirectConfig = lib.mapAttrs (vhostName: vhostConfig: {
+                if vhostConfig.anubisConfig != null then
-            # Redirection vers d'autres machines
+                  # Il reçoit les requêtes d’Anubis
-            locations = mkIf (!lib.strings.hasPrefix "/" vhostConfig.target) {
+                  {
-              "/favicon.ico".root = "/var/www/logo/";
-              "/" = {
-                proxyPass = "http://${vhostConfig.target}";
-                proxyWebsockets = vhostConfig.proxyWebsockets;
-              };
-            };
-            # Redirection vers des fichiers locaux
-            root = mkIf (lib.strings.hasPrefix "/" vhostConfig.target) vhostConfig.target;
                     listen = [
                       { addr = "unix:/run/nginx/nginx-${vhostName}.sock"; }
                     ];
-            serverName = "${vhostName}.crans.${mainTld}";
+                    extraConfig = ''
-            extraConfig = "
                       set_real_ip_from unix:;
                       real_ip_header X-Real-IP;
-            ";
+                    '';
-          }) cfg.virtualHosts;
+                  }
+                else
+                  # Il est en entrée
+                  entryExtraConf;
 
-          # Génération des alias
+              # Les alias : vhostName × otherTld U serverAliases × allTld
-          getAliases = name: config: lib.foldr (
+              aliases =
+                lib.foldr
+                  (
                     tld: acc:
                     acc
-            ++
+                    ++ (lib.foldr (alias: acc: acc ++ [ "${alias}.crans.${tld}" ]) [
-            (lib.foldr (alias: acc: acc ++ ["${alias}.crans.${tld}"]) ["${name}.crans.${tld}"] config.serverAliases)
+                      "${vhostName}.crans.${tld}"
+                    ] vhostConfig.serverAliases)
                   )
-          (lib.foldr (alias: acc: acc ++ ["${alias}.crans.${mainTld}"]) [] config.serverAliases)
+                  (lib.foldr (alias: acc: acc ++ [ "${alias}.crans.${mainTld}" ]) [ ] vhostConfig.serverAliases)
                   otherTld;
-
+            in
-          # Configuration des alias
-          aliasConfig = lib.foldr (
-            vhost: acc:
-            acc
-            //
-            lib.foldr (
-              alias: acc:
-              acc
-              //
             {
-                "${vhost.name}-alias-${alias}" = rec {
+              # Configuration du service à proxy.
-                  rejectSSL = vhost.value.httpOnly;
+              "${vhostName}" = vhostExtraConf // {
-                  forceSSL = !rejectSSL;
+                serverName = "${vhostName}.crans.${mainTld}";
-                  enableACME = !rejectSSL;
+                locations."/" = mkIf (vhostConfig.proxyPass != "") {
-                  serverName = alias;
+                  proxyPass = "http://${vhostConfig.proxyPass}";
-                  globalRedirect = "${vhost.name}.crans.${mainTld}";
+                  proxyWebsockets = vhostConfig.proxyWebsockets;
+                };
+                root = vhostConfig.serveLocalFiles;
+                globalRedirect = vhostConfig.globalRedirect;
+              };
+
+              # Entrée d’Anubis
+              "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) entryExtraConf // {
+                locations."/" = {
+                  proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock";
+                  proxyWebsockets = vhostConfig.proxyWebsockets;
+                  extraConfig = entryExtraConf.extraConfig + ''
+                    access_log /var/log/nginx/anubis.access.log;
+                    error_log /var/log/nginx/anubis.error.log;
+                  '';
+                };
+                serverName = "${vhostName}.crans.${mainTld}";
               };
             }
-            ) { } (getAliases vhost.name vhost.value)
+            # Les alias
-          ) { } (lib.attrsToList cfg.virtualHosts);
+            // lib.mergeAttrsList (
+              lib.map (alias: {
+                "${vhostName}-alias-${alias}" = sslConf // {
+                  serverName = alias;
+                  globalRedirect = vhostConfig.globalRedirect or "${vhostName}.crans.${mainTld}";
+                };
+              }) aliases
+            );
         in
         {
           enable = true;
-          virtualHosts = redirectConfig // aliasConfig // mainConfig;
+          virtualHosts = lib.concatMapAttrs configVhost cfg.virtualHosts;
         };
     };
   };