From 93b9b3c17629f84ad956f6cbd10875ca9ef4cf04 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Sun, 5 Jul 2026 14:07:34 +0200
Subject: [PATCH 01/21] reverseproxy: add alias snl et nekorale

---
 hosts/vm/reverseproxy/reverseproxy.nix | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix
index 3401084..25c1437 100644
--- a/hosts/vm/reverseproxy/reverseproxy.nix
+++ b/hosts/vm/reverseproxy/reverseproxy.nix
@@ -176,6 +176,10 @@ in
           httpOnly = true;
           target = "172.16.10.104";
         };
+        "nekorale" = {
+          anubisConfig = "${anubisAllowOther}";
+          target = "172.16.10.31/club-nekorale/";
+        };
         "perso" = {
           anubisConfig = "${anubisPerso}";
           target = "172.16.10.31";
@@ -183,6 +187,10 @@ in
             "clubs"
           ];
         };
+        "snl" = {
+          anubisConfig = "${anubisAllowOther}";
+          target = "172.16.10.31/sonetlumens/";
+        };
         "wiki" = {
           anubisConfig = "${anubisChallenge}";
           target = "172.16.10.161";

From c93e770f940f7fac9dd95627d8308d4615afb02e Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Sun, 5 Jul 2026 14:15:29 +0200
Subject: [PATCH 02/21] reverseproxy: nix trailing /

---
 hosts/vm/reverseproxy/reverseproxy.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix
index 25c1437..7d82111 100644
--- a/hosts/vm/reverseproxy/reverseproxy.nix
+++ b/hosts/vm/reverseproxy/reverseproxy.nix
@@ -178,7 +178,7 @@ in
         };
         "nekorale" = {
           anubisConfig = "${anubisAllowOther}";
-          target = "172.16.10.31/club-nekorale/";
+          target = "172.16.10.31/club-nekorale";
         };
         "perso" = {
           anubisConfig = "${anubisPerso}";
@@ -189,7 +189,7 @@ in
         };
         "snl" = {
           anubisConfig = "${anubisAllowOther}";
-          target = "172.16.10.31/sonetlumens/";
+          target = "172.16.10.31/sonetlumens";
         };
         "wiki" = {
           anubisConfig = "${anubisChallenge}";

From 4e83b11d229cbc48690f6e6b3526b4cdaa53a193 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Sun, 5 Jul 2026 22:51:26 +0200
Subject: [PATCH 03/21] Refactor reverseproxy

---
 hosts/vm/reverseproxy/reverseproxy.nix |  24 +--
 modules/services/reverseproxy.nix      | 215 ++++++++++++++-----------
 2 files changed, 135 insertions(+), 104 deletions(-)

diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix
index 7d82111..e154c2c 100644
--- a/hosts/vm/reverseproxy/reverseproxy.nix
+++ b/hosts/vm/reverseproxy/reverseproxy.nix
@@ -135,21 +135,21 @@ in
       enable = true;
       virtualHosts = {
         "collabora" = {
-          target = "172.16.10.149";
+          proxyPass = "172.16.10.149";
           proxyWebsockets = true;
         };
         "eclat" = {
           anubisConfig = "${anubisMirrors}";
           httpOnly = true;
-          target = "172.16.10.104";
+          proxyPass = "172.16.10.104";
         };
         "eclats" = {
           anubisConfig = "${anubisMirrors}";
-          target = "172.16.10.104";
+          proxyPass = "172.16.10.104";
         };
         "install-party" = {
           anubisConfig = "${anubisChallenge}";
-          target = "/var/www/install-party.crans.org";
+          serveLocalFiles = "/var/www/install-party.crans.org";
           serverAliases = [
             "i-p"
             "adopteunmanchot"
@@ -158,42 +158,42 @@ in
         };
         "lists" = {
           anubisConfig = "${anubisChallenge}";
-          target = "172.16.10.110";
+          proxyPass = "172.16.10.110";
         };
         "mediawiki" = {
           anubisConfig = "${anubisChallenge}";
-          target = "172.16.10.144";
+          proxyPass = "172.16.10.144";
           serverAliases = [
             "mediakiwi"
           ];
         };
         "mirrors" = {
           anubisConfig = "${anubisMirrors}";
-          target = "172.16.10.104";
+          proxyPass = "172.16.10.104";
         };
         "mirror" = {
           anubisConfig = "${anubisMirrors}";
           httpOnly = true;
-          target = "172.16.10.104";
+          proxyPass = "172.16.10.104";
         };
         "nekorale" = {
           anubisConfig = "${anubisAllowOther}";
-          target = "172.16.10.31/club-nekorale";
+          globalRedirect = "172.16.10.31/club-nekorale";
         };
         "perso" = {
           anubisConfig = "${anubisPerso}";
-          target = "172.16.10.31";
+          proxyPass = "172.16.10.31";
           serverAliases = [
             "clubs"
           ];
         };
         "snl" = {
           anubisConfig = "${anubisAllowOther}";
-          target = "172.16.10.31/sonetlumens";
+          globalRedirect = "172.16.10.31/sonetlumens";
         };
         "wiki" = {
           anubisConfig = "${anubisChallenge}";
-          target = "172.16.10.161";
+          proxyPass = "172.16.10.161";
           serverAliases = [
             "wikipedia"
           ];
diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix
index 5098771..ed386a7 100644
--- a/modules/services/reverseproxy.nix
+++ b/modules/services/reverseproxy.nix
@@ -65,18 +65,36 @@ in
               '';
             };
 
-            target = mkOption {
+            proxyPass = mkOption {
               type = types.str;
               default = "";
               description = ''
-                Indique la destination. Il peut s'agir du chemin vers des fichiers statiques.
+                Indique la destination à proxy.
               '';
               example = "172.16.10.128:8000";
             };
 
+            serveLocalFiles = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = ''
+                Chemin vers un dossier à exposer statiquement.
+              '';
+              example = "/var/local/adopter-un-manchot";
+            };
+
+            globalRedirect = mkOption {
+              type = types.nullOr types.str;
+              default = null;
+              description = ''
+                Si définie, toutes les requêtes sont redirigées (via 301) sur cet hôte.
+              '';
+              example = "perso.crans.org/club";
+            };
+
             anubisConfig = mkOption {
-              type = types.str;
-              default = "";
+              type = types.nullOr types.str;
+              default = null;
               description = ''
                 Chemin du fichier de configuration
               '';
@@ -95,7 +113,7 @@ in
               type = types.bool;
               default = false;
               description = ''
-                Interdit les connexions en ssh
+                Interdit les connexions en https
               '';
               example = "true";
             };
@@ -137,104 +155,117 @@ in
     services = mkIf cfg.enable {
       anubis = {
         defaultOptions.group = "nginx";
-        instances = lib.mapAttrs (vhostName: vhostConfig: {
-          enable = true;
-          settings = {
-            BIND = "/run/anubis/anubis-${vhostName}/socket.sock";
-            BIND_NETWORK = "unix";
-            METRICS_BIND = "/run/anubis/anubis-${vhostName}/anubis-${vhostName}-metrics.sock";
-            TARGET = "unix:///run/nginx/nginx-${vhostName}.sock";
-            COOKIE_DOMAIN = "crans.org";
-            REDIRECT_DOMAINS = "${vhostName}.crans.org";
-            SOCKET_MODE = "0660";
-            # OpenGraph config
-            OG_PASSTHROUGH = vhostConfig.anubisOpenGraph;
-            OG_EXPIRY_TIME = "24h";
-            OG_CACHE_CONSIDER_HOST = true;
-            # Policy config
-            POLICY_FNAME = if (vhostConfig.anubisConfig == "") then "${allowAll}" else vhostConfig.anubisConfig;
-          };
-        }) cfg.virtualHosts;
+        instances = lib.mapAttrs (
+          vhostName: vhostConfig:
+          mkIf (vhostConfig.anubisConfig != null) {
+            enable = true;
+            settings = {
+              BIND = "/run/anubis/anubis-${vhostName}/socket.sock";
+              BIND_NETWORK = "unix";
+              METRICS_BIND = "/run/anubis/anubis-${vhostName}/anubis-${vhostName}-metrics.sock";
+              TARGET = "unix:///run/nginx/nginx-${vhostName}.sock";
+              COOKIE_DOMAIN = "crans.org";
+              REDIRECT_DOMAINS = "${vhostName}.crans.org";
+              SOCKET_MODE = "0660";
+              # OpenGraph config
+              OG_PASSTHROUGH = vhostConfig.anubisOpenGraph;
+              OG_EXPIRY_TIME = "24h";
+              OG_CACHE_CONSIDER_HOST = true;
+              # Policy config
+              POLICY_FNAME = vhostConfig.anubisConfig;
+            };
+          }
+        ) cfg.virtualHosts;
       };
 
       nginx =
         let
-          # Configuration du serveur principal.
-          mainConfig = lib.mapAttrs' (
+          configVhost =
             vhostName: vhostConfig:
-            lib.nameValuePair (vhostName + "-anubis") {
-              enableACME = !vhostConfig.httpOnly;
-              forceSSL = !vhostConfig.httpOnly;
-              rejectSSL = vhostConfig.httpOnly;
-              locations."/" = {
-                proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock";
-                proxyWebsockets = vhostConfig.proxyWebsockets;
+            let
+              sslConf = {
+                enableACME = !vhostConfig.httpOnly;
+                forceSSL = !vhostConfig.httpOnly;
+                rejectSSL = vhostConfig.httpOnly;
               };
-              serverName = "${vhostName}.crans.${mainTld}";
-              extraConfig = "
-                set_real_ip_from 172.16.0.0/16;
-                set_real_ip_from fd00::/56;
-                real_ip_header X-Real-Ip;
-              ";
-            }
-          ) cfg.virtualHosts;
 
-          # Redirections
-          redirectConfig = lib.mapAttrs (vhostName: vhostConfig: {
-            # Redirection vers d'autres machines
-            locations = mkIf (!lib.strings.hasPrefix "/" vhostConfig.target) {
-              "/favicon.ico".root = "/var/www/logo/";
-              "/" = {
-                proxyPass = "http://${vhostConfig.target}";
-                proxyWebsockets = vhostConfig.proxyWebsockets;
-              };
-            };
-            # Redirection vers des fichiers locaux
-            root = mkIf (lib.strings.hasPrefix "/" vhostConfig.target) vhostConfig.target;
-            listen = [
-              { addr = "unix:/run/nginx/nginx-${vhostName}.sock"; }
-            ];
-            serverName = "${vhostName}.crans.${mainTld}";
-            extraConfig = "
-              set_real_ip_from unix:;
-              real_ip_header X-Real-IP;
-            ";
-          }) cfg.virtualHosts;
-
-          # Génération des alias
-          getAliases = name: config: lib.foldr (
-            tld: acc:
-            acc
-            ++
-            (lib.foldr (alias: acc: acc ++ ["${alias}.crans.${tld}"]) ["${name}.crans.${tld}"] config.serverAliases)
-          )
-          (lib.foldr (alias: acc: acc ++ ["${alias}.crans.${mainTld}"]) [] config.serverAliases)
-          otherTld;
-
-          # Configuration des alias
-          aliasConfig = lib.foldr (
-            vhost: acc:
-            acc
-            //
-            lib.foldr (
-              alias: acc:
-              acc
-              //
-              {
-                "${vhost.name}-alias-${alias}" = rec {
-                  rejectSSL = vhost.value.httpOnly;
-                  forceSSL = !rejectSSL;
-                  enableACME = !rejectSSL;
-                  serverName = alias;
-                  globalRedirect = "${vhost.name}.crans.${mainTld}";
-                };
+              # Conf pour l’host en entrès
+              entryExtraConf = {
+                extraConfig = ''
+                  set_real_ip_from 172.16.0.0/16;
+                  set_real_ip_from fd00::/56;
+                  real_ip_header X-Real-Ip;
+                '';
               }
-            ) { } (getAliases vhost.name vhost.value)
-          ) { } (lib.attrsToList cfg.virtualHosts);
+              // sslConf;
+              # Conf supplémentaire pour le proxy principal
+              vhostExtraConf =
+                if vhostConfig.anubisConfig != null then
+                  # Il reçoit les requêtes d’Anubis
+                  {
+                    listen = [
+                      { addr = "unix:/run/nginx/nginx-${vhostName}.sock"; }
+                    ];
+                    extraConfig = ''
+                      set_real_ip_from unix:;
+                      real_ip_header X-Real-IP;
+                    '';
+                  }
+                else
+                  # Il est en entrée
+                  entryExtraConf;
+
+              # Les alias : vhostName × otherTld U serverAliases × allTld
+              aliases =
+                lib.foldr
+                  (
+                    tld: acc:
+                    acc
+                    ++ (lib.foldr (alias: acc: acc ++ [ "${alias}.crans.${tld}" ]) [
+                      "${vhostName}.crans.${tld}"
+                    ] vhostConfig.serverAliases)
+                  )
+                  (lib.foldr (alias: acc: acc ++ [ "${alias}.crans.${mainTld}" ]) [ ] vhostConfig.serverAliases)
+                  otherTld;
+            in
+            {
+              # Configuration du service à proxy.
+              "${vhostName}" = vhostExtraConf // {
+                serverName = "${vhostName}.crans.${mainTld}";
+                locations."/" = mkIf (vhostConfig.proxyPass != "") {
+                  proxyPass = "http://${vhostConfig.proxyPass}";
+                  proxyWebsockets = vhostConfig.proxyWebsockets;
+                };
+                root = vhostConfig.serveLocalFiles;
+                globalRedirect = vhostConfig.globalRedirect;
+              };
+
+              # Entrée d’Anubis
+              "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) entryExtraConf // {
+                locations."/" = {
+                  proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock";
+                  proxyWebsockets = vhostConfig.proxyWebsockets;
+                  extraConfig = entryExtraConf.extraConfig + ''
+                    access_log /var/log/nginx/anubis.access.log;
+                    error_log /var/log/nginx/anubis.error.log;
+                  '';
+                };
+                serverName = "${vhostName}.crans.${mainTld}";
+              };
+            }
+            # Les alias
+            // lib.mergeAttrsList (
+              lib.map (alias: {
+                "${vhostName}-alias-${alias}" = sslConf // {
+                  serverName = alias;
+                  globalRedirect = vhostConfig.globalRedirect or "${vhostName}.crans.${mainTld}";
+                };
+              }) aliases
+            );
         in
         {
           enable = true;
-          virtualHosts = redirectConfig // aliasConfig // mainConfig;
+          virtualHosts = lib.concatMapAttrs configVhost cfg.virtualHosts;
         };
     };
   };

From 0af3d1071c5289b7cee2c49bf34717d707884c70 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Mon, 6 Jul 2026 11:52:33 +0200
Subject: [PATCH 04/21] Small reverseproxy fixes

---
 hosts/vm/reverseproxy/reverseproxy.nix | 10 ++--------
 modules/services/reverseproxy.nix      | 18 +++++++++---------
 2 files changed, 11 insertions(+), 17 deletions(-)

diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix
index e154c2c..5c09e66 100644
--- a/hosts/vm/reverseproxy/reverseproxy.nix
+++ b/hosts/vm/reverseproxy/reverseproxy.nix
@@ -176,10 +176,7 @@ in
           httpOnly = true;
           proxyPass = "172.16.10.104";
         };
-        "nekorale" = {
-          anubisConfig = "${anubisAllowOther}";
-          globalRedirect = "172.16.10.31/club-nekorale";
-        };
+        "nekorale".globalRedirect = "172.16.10.31/club-nekorale";
         "perso" = {
           anubisConfig = "${anubisPerso}";
           proxyPass = "172.16.10.31";
@@ -187,10 +184,7 @@ in
             "clubs"
           ];
         };
-        "snl" = {
-          anubisConfig = "${anubisAllowOther}";
-          globalRedirect = "172.16.10.31/sonetlumens";
-        };
+        "snl".globalRedirect = "172.16.10.31/sonetlumens";
         "wiki" = {
           anubisConfig = "${anubisChallenge}";
           proxyPass = "172.16.10.161";
diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix
index ed386a7..57c9486 100644
--- a/modules/services/reverseproxy.nix
+++ b/modules/services/reverseproxy.nix
@@ -66,8 +66,8 @@ in
             };
 
             proxyPass = mkOption {
-              type = types.str;
-              default = "";
+              type = types.nullOr types.str;
+              default = null;
               description = ''
                 Indique la destination à proxy.
               '';
@@ -75,7 +75,7 @@ in
             };
 
             serveLocalFiles = mkOption {
-              type = types.nullOr types.str;
+              type = types.nullOr types.path;
               default = null;
               description = ''
                 Chemin vers un dossier à exposer statiquement.
@@ -232,7 +232,7 @@ in
               # Configuration du service à proxy.
               "${vhostName}" = vhostExtraConf // {
                 serverName = "${vhostName}.crans.${mainTld}";
-                locations."/" = mkIf (vhostConfig.proxyPass != "") {
+                locations."/" = mkIf (vhostConfig.proxyPass != null) {
                   proxyPass = "http://${vhostConfig.proxyPass}";
                   proxyWebsockets = vhostConfig.proxyWebsockets;
                 };
@@ -242,15 +242,15 @@ in
 
               # Entrée d’Anubis
               "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) entryExtraConf // {
+                serverName = "${vhostName}.crans.${mainTld}";
                 locations."/" = {
                   proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock";
                   proxyWebsockets = vhostConfig.proxyWebsockets;
-                  extraConfig = entryExtraConf.extraConfig + ''
-                    access_log /var/log/nginx/anubis.access.log;
-                    error_log /var/log/nginx/anubis.error.log;
-                  '';
                 };
-                serverName = "${vhostName}.crans.${mainTld}";
+                extraConfig = entryExtraConf.extraConfig + ''
+                  access_log /var/log/nginx/anubis.access.log;
+                  error_log /var/log/nginx/anubis.error.log;
+                '';
               };
             }
             # Les alias

From 721133147d0f3f791f6a1b95d6a57dcc0d0aa310 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Mon, 6 Jul 2026 12:09:04 +0200
Subject: [PATCH 05/21] Fix missing parenthesis

---
 modules/services/reverseproxy.nix | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix
index 57c9486..ec1c1eb 100644
--- a/modules/services/reverseproxy.nix
+++ b/modules/services/reverseproxy.nix
@@ -241,17 +241,20 @@ in
               };
 
               # Entrée d’Anubis
-              "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) entryExtraConf // {
-                serverName = "${vhostName}.crans.${mainTld}";
-                locations."/" = {
-                  proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock";
-                  proxyWebsockets = vhostConfig.proxyWebsockets;
-                };
-                extraConfig = entryExtraConf.extraConfig + ''
-                  access_log /var/log/nginx/anubis.access.log;
-                  error_log /var/log/nginx/anubis.error.log;
-                '';
-              };
+              "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) (
+                entryExtraConf
+                // {
+                  serverName = "${vhostName}.crans.${mainTld}";
+                  locations."/" = {
+                    proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock";
+                    proxyWebsockets = vhostConfig.proxyWebsockets;
+                  };
+                  extraConfig = entryExtraConf.extraConfig + ''
+                    access_log /var/log/nginx/anubis.access.log;
+                    error_log /var/log/nginx/anubis.error.log;
+                  '';
+                }
+              );
             }
             # Les alias
             // lib.mergeAttrsList (

From 24a71dd509f48ca9bf2671eeb421f03b07dcd0f2 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Mon, 6 Jul 2026 12:17:44 +0200
Subject: [PATCH 06/21] fix perso.crans.org redirection

---
 hosts/vm/reverseproxy/reverseproxy.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix
index 5c09e66..ef36132 100644
--- a/hosts/vm/reverseproxy/reverseproxy.nix
+++ b/hosts/vm/reverseproxy/reverseproxy.nix
@@ -176,7 +176,7 @@ in
           httpOnly = true;
           proxyPass = "172.16.10.104";
         };
-        "nekorale".globalRedirect = "172.16.10.31/club-nekorale";
+        "nekorale".globalRedirect = "perso.crans.org/club-nekorale";
         "perso" = {
           anubisConfig = "${anubisPerso}";
           proxyPass = "172.16.10.31";
@@ -184,7 +184,7 @@ in
             "clubs"
           ];
         };
-        "snl".globalRedirect = "172.16.10.31/sonetlumens";
+        "snl".globalRedirect = "perso.crans.org/sonetlumens";
         "wiki" = {
           anubisConfig = "${anubisChallenge}";
           proxyPass = "172.16.10.161";

From b90c2af0ecce37e49b6d9feb4104f6ee4f100781 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Sat, 11 Jul 2026 10:58:32 +0200
Subject: [PATCH 07/21] Suppression code mort

---
 modules/services/reverseproxy.nix | 23 -----------------------
 1 file changed, 23 deletions(-)

diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix
index ec1c1eb..66874cc 100644
--- a/modules/services/reverseproxy.nix
+++ b/modules/services/reverseproxy.nix
@@ -1,5 +1,4 @@
 {
-  pkgs,
   lib,
   config,
   ...
@@ -8,28 +7,6 @@
 let
   cfg = config.crans.reverseProxy;
 
-  formatJSON = pkgs.formats.json { };
-
-  allowAll = formatJSON.generate "allow_all.json" {
-    bots = [
-      {
-        name = "allow_all";
-        path_regex = ".*";
-        action = "ALLOW";
-      }
-    ];
-  };
-
-  open_graph = formatJSON.generate "opengraph.json" {
-    openGraph = [
-      {
-        enabled = true;
-        considerHost = true;
-        ttl = "24h";
-      }
-    ];
-  };
-
   mainTld = "org";
   otherTld = [
     "fr"

From b90e461f45210e364b65600f50427c8fc5b9ac02 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Sun, 12 Jul 2026 12:21:02 +0200
Subject: [PATCH 08/21] fix redirects

---
 modules/services/reverseproxy.nix | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix
index 66874cc..589b94d 100644
--- a/modules/services/reverseproxy.nix
+++ b/modules/services/reverseproxy.nix
@@ -166,7 +166,7 @@ in
                 rejectSSL = vhostConfig.httpOnly;
               };
 
-              # Conf pour l’host en entrès
+              # Conf pour l’hôte en entrée
               entryExtraConf = {
                 extraConfig = ''
                   set_real_ip_from 172.16.0.0/16;
@@ -238,7 +238,7 @@ in
               lib.map (alias: {
                 "${vhostName}-alias-${alias}" = sslConf // {
                   serverName = alias;
-                  globalRedirect = vhostConfig.globalRedirect or "${vhostName}.crans.${mainTld}";
+                  globalRedirect = lib.defaultTo "${vhostName}.crans.${mainTld}" vhostConfig.globalRedirect;
                 };
               }) aliases
             );

From 9222bf3d292b42f086d4ad535cf930e674fb4a57 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Sun, 12 Jul 2026 14:00:47 +0200
Subject: [PATCH 09/21] Package static sites

---
 hosts/vm/reverseproxy/reverseproxy.nix | 43 ++++++++++++++++++++++++--
 1 file changed, 41 insertions(+), 2 deletions(-)

diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix
index ef36132..4820f84 100644
--- a/hosts/vm/reverseproxy/reverseproxy.nix
+++ b/hosts/vm/reverseproxy/reverseproxy.nix
@@ -1,4 +1,7 @@
-{ pkgs, ... }:
+{
+  pkgs,
+  ...
+}:
 
 let
   formatJSON = pkgs.formats.json { };
@@ -128,6 +131,37 @@ let
     ];
   };
 
+  fetchFromCrans =
+    opts:
+    pkgs.fetchFromGitLab (
+      {
+        domain = "gitlab.adm.crans.org";
+        owner = "nounous";
+      }
+      // opts
+    );
+
+  installPartySite = pkgs.python3Packages.buildPythonApplication {
+    name = "site-install-party";
+    pyproject = false;
+
+    src = fetchFromCrans {
+      repo = "site-install-party";
+      rev = "master";
+      hash = "sha256-KVB4m/ms0WuArrkLn05INVLqhaGxzCg30GMICI6tM5E=";
+    };
+
+    build-system = with pkgs.python3Packages; [
+      mkdocs
+      mkdocs-material
+    ];
+    buildPhase = ''
+      python3 -m mkdocs -- build -d build
+    '';
+    installPhase = ''
+      mv build $out
+    '';
+  };
 in
 {
   crans = {
@@ -149,7 +183,7 @@ in
         };
         "install-party" = {
           anubisConfig = "${anubisChallenge}";
-          serveLocalFiles = "/var/www/install-party.crans.org";
+          serveLocalFiles = installPartySite;
           serverAliases = [
             "i-p"
             "adopteunmanchot"
@@ -184,6 +218,11 @@ in
             "clubs"
           ];
         };
+        "services".serveLocalFiles = fetchFromCrans {
+          repo = "services-page";
+          rev = "master";
+          hash = "sha256-ov4r6Oeta+vRcEv8bp7lFQg+2n4JTG4buetram5kN08=";
+        };
         "snl".globalRedirect = "perso.crans.org/sonetlumens";
         "wiki" = {
           anubisConfig = "${anubisChallenge}";

From 071aebf7d5ffddb0002bf4a2e80486481217efd6 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Wed, 15 Jul 2026 19:32:57 +0200
Subject: [PATCH 10/21] Stirling v2

---
 hosts/vm/livre/stirling.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/hosts/vm/livre/stirling.nix b/hosts/vm/livre/stirling.nix
index a18fe97..f5fadfc 100644
--- a/hosts/vm/livre/stirling.nix
+++ b/hosts/vm/livre/stirling.nix
@@ -1,13 +1,19 @@
-{ config, ... }:
+{ config, pkgs, ... }:
 
 {
+  environment.systemPackages = with pkgs; [
+    imagemagick # Pour la compression des PDFs
+  ];
   services.stirling-pdf = {
     enable = true;
     environment = {
       ENDPOINTS_TOREMOVE = "url-to-pdf";
-      INSTALL_BOOK_AND_ADVANCED_HTML_OPS = "true";
+      UI_APPNAMENAVBAR = "Stirling PDF du Cr@ns";
+      SECURITY_ENABLELOGIN = false;
       SERVER_PORT = 8000;
       SYSTEM_DEFAULTLOCALE = "fr-FR";
+      SYSTEM_ENABLEDESKTOPINSTALLSLIDE = false;
+      SYSTEM_SHOWUPDATE = false;
     };
   };
 

From fddbbaf10e2a14b72b5869ab9f0aaf24baf64adf Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Sun, 19 Jul 2026 12:01:46 +0200
Subject: [PATCH 11/21] Sites statics et SSL

---
 hosts/vm/reverseproxy/reverseproxy.nix | 30 ++++++++++++++++++---
 modules/services/acme.nix              |  7 ++++-
 modules/services/reverseproxy.nix      | 36 ++++++++++++++++++++------
 3 files changed, 60 insertions(+), 13 deletions(-)

diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix
index 4820f84..317d604 100644
--- a/hosts/vm/reverseproxy/reverseproxy.nix
+++ b/hosts/vm/reverseproxy/reverseproxy.nix
@@ -135,7 +135,7 @@ let
     opts:
     pkgs.fetchFromGitLab (
       {
-        domain = "gitlab.adm.crans.org";
+        domain = "gitlab.crans.org";
         owner = "nounous";
       }
       // opts
@@ -156,10 +156,26 @@ let
       mkdocs-material
     ];
     buildPhase = ''
-      python3 -m mkdocs -- build -d build
+      python3 -m mkdocs -- build -d $out
     '';
-    installPhase = ''
-      mv build $out
+  };
+
+  homepagePkg = pkgs.stdenv.mkDerivation {
+    name = "site-homepage";
+
+    src = fetchFromCrans {
+      repo = "homepage";
+      rev = "master";
+      hash = "sha256-e9tttzKEWcBhogQY2ITDqqTbix/zcnBAylj1eKY791E=";
+    };
+
+    nativeBuildInputs = with pkgs; [
+      hugo
+      git
+    ];
+
+    buildPhase = ''
+      hugo build -d $out
     '';
   };
 in
@@ -231,6 +247,12 @@ in
             "wikipedia"
           ];
         };
+        "www" = {
+          serveLocalFiles = homepagePkg;
+          serverAliases = [
+            "."
+          ];
+        };
       };
     };
 
diff --git a/modules/services/acme.nix b/modules/services/acme.nix
index 1b90021..b975eed 100644
--- a/modules/services/acme.nix
+++ b/modules/services/acme.nix
@@ -24,12 +24,17 @@ in
         dnsPropagationCheck = false;
       };
 
-      certs."crans.org" = {
+      certs."all.crans.all" = {
         domain = "*.crans.org";
         dnsProvider = "rfc2136";
         # Contient le serveur à contacter avec le protocole
         # et le mot de passe
         environmentFile = config.age.secrets.acme-env.path;
+        extraDomainNames = [
+          "*.crans.fr"
+          "*.crans.eu"
+        ];
+        group = config.services.nginx.group;
       };
     };
   };
diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix
index 589b94d..893f538 100644
--- a/modules/services/reverseproxy.nix
+++ b/modules/services/reverseproxy.nix
@@ -129,6 +129,24 @@ in
       wantedBy = [ "multi-user.target" ];
     }) cfg.virtualHosts;
 
+    # On fait un certificat commun pour tous les hosts
+    security.acme.certs."all.crans.all" = {
+      domain = "*.crans.${mainTld}";
+      dnsProvider = "rfc2136";
+      # Contient le serveur à contacter avec le protocole
+      # et le mot de passe
+      environmentFile = config.age.secrets.acme-env.path;
+      extraDomainNames =
+        lib.concatMap (tld: [
+          "*.crans.${tld}"
+          "crans.${tld}"
+        ]) otherTld
+        ++ [
+          "crans.${mainTld}"
+        ];
+      group = config.services.nginx.group;
+    };
+
     services = mkIf cfg.enable {
       anubis = {
         defaultOptions.group = "nginx";
@@ -141,8 +159,8 @@ in
               BIND_NETWORK = "unix";
               METRICS_BIND = "/run/anubis/anubis-${vhostName}/anubis-${vhostName}-metrics.sock";
               TARGET = "unix:///run/nginx/nginx-${vhostName}.sock";
-              COOKIE_DOMAIN = "crans.org";
-              REDIRECT_DOMAINS = "${vhostName}.crans.org";
+              COOKIE_DOMAIN = "crans.${mainTld}";
+              REDIRECT_DOMAINS = "${vhostName}.crans.${mainTld}";
               SOCKET_MODE = "0660";
               # OpenGraph config
               OG_PASSTHROUGH = vhostConfig.anubisOpenGraph;
@@ -161,9 +179,10 @@ in
             vhostName: vhostConfig:
             let
               sslConf = {
-                enableACME = !vhostConfig.httpOnly;
                 forceSSL = !vhostConfig.httpOnly;
                 rejectSSL = vhostConfig.httpOnly;
+                useACMEHost = mkIf (!vhostConfig.httpOnly) "all.crans.all";
+                acmeRoot = null;
               };
 
               # Conf pour l’hôte en entrée
@@ -193,22 +212,23 @@ in
                   entryExtraConf;
 
               # Les alias : vhostName × otherTld U serverAliases × allTld
+              mkHostName = als: tld: if als == "." then "crans.${tld}" else "${als}.crans.${tld}";
               aliases =
                 lib.foldr
                   (
                     tld: acc:
                     acc
-                    ++ (lib.foldr (alias: acc: acc ++ [ "${alias}.crans.${tld}" ]) [
-                      "${vhostName}.crans.${tld}"
+                    ++ (lib.foldr (alias: acc: acc ++ [ (mkHostName alias tld) ]) [
+                      (mkHostName vhostName tld)
                     ] vhostConfig.serverAliases)
                   )
-                  (lib.foldr (alias: acc: acc ++ [ "${alias}.crans.${mainTld}" ]) [ ] vhostConfig.serverAliases)
+                  (lib.foldr (alias: acc: acc ++ [ (mkHostName alias mainTld) ]) [ ] vhostConfig.serverAliases)
                   otherTld;
             in
             {
               # Configuration du service à proxy.
               "${vhostName}" = vhostExtraConf // {
-                serverName = "${vhostName}.crans.${mainTld}";
+                serverName = mkHostName vhostName mainTld;
                 locations."/" = mkIf (vhostConfig.proxyPass != null) {
                   proxyPass = "http://${vhostConfig.proxyPass}";
                   proxyWebsockets = vhostConfig.proxyWebsockets;
@@ -221,7 +241,7 @@ in
               "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) (
                 entryExtraConf
                 // {
-                  serverName = "${vhostName}.crans.${mainTld}";
+                  serverName = mkHostName vhostName mainTld;
                   locations."/" = {
                     proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock";
                     proxyWebsockets = vhostConfig.proxyWebsockets;

From 86af4f8ee3b87b376ef502acd58d51e03584af45 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Sun, 19 Jul 2026 12:03:54 +0200
Subject: [PATCH 12/21] =?UTF-8?q?Suppression=20certificat=20*.crans.org=20?=
 =?UTF-8?q?syst=C3=A9matique?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 modules/services/acme.nix | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/modules/services/acme.nix b/modules/services/acme.nix
index b975eed..5165af6 100644
--- a/modules/services/acme.nix
+++ b/modules/services/acme.nix
@@ -23,19 +23,6 @@ in
         email = "root@crans.org";
         dnsPropagationCheck = false;
       };
-
-      certs."all.crans.all" = {
-        domain = "*.crans.org";
-        dnsProvider = "rfc2136";
-        # Contient le serveur à contacter avec le protocole
-        # et le mot de passe
-        environmentFile = config.age.secrets.acme-env.path;
-        extraDomainNames = [
-          "*.crans.fr"
-          "*.crans.eu"
-        ];
-        group = config.services.nginx.group;
-      };
     };
   };
 }

From a13be3e441cbae673d9ecd1e1a614ceb9ee49b34 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Sun, 19 Jul 2026 12:08:21 +0200
Subject: [PATCH 13/21] Fix: Enable option

---
 modules/services/reverseproxy.nix | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix
index 893f538..d423bc1 100644
--- a/modules/services/reverseproxy.nix
+++ b/modules/services/reverseproxy.nix
@@ -130,7 +130,7 @@ in
     }) cfg.virtualHosts;
 
     # On fait un certificat commun pour tous les hosts
-    security.acme.certs."all.crans.all" = {
+    security.acme.certs."all.crans.all" = mkIf cfg.enable {
       domain = "*.crans.${mainTld}";
       dnsProvider = "rfc2136";
       # Contient le serveur à contacter avec le protocole

From c70171d128f6e3eee14cc05347efaf646630b887 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Sun, 19 Jul 2026 14:45:08 +0200
Subject: [PATCH 14/21] =?UTF-8?q?nixification=20d=E2=80=99hodaur?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 hosts/vm/reverseproxy/reverseproxy.nix        | 60 +++++++++++++++----
 .../autoconfig/mail/config-v1.1.xml           | 23 +++++++
 2 files changed, 71 insertions(+), 12 deletions(-)
 create mode 100644 hosts/vm/reverseproxy/staticsites/autoconfig/mail/config-v1.1.xml

diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix
index 317d604..cf4cb76 100644
--- a/hosts/vm/reverseproxy/reverseproxy.nix
+++ b/hosts/vm/reverseproxy/reverseproxy.nix
@@ -184,6 +184,8 @@ in
     reverseProxy = {
       enable = true;
       virtualHosts = {
+        "autoconfig".serveLocalFiles = ./staticsites/autoconfig;
+        "cas".proxyPass = "172.16.10.120";
         "collabora" = {
           proxyPass = "172.16.10.149";
           proxyWebsockets = true;
@@ -197,6 +199,24 @@ in
           anubisConfig = "${anubisMirrors}";
           proxyPass = "172.16.10.104";
         };
+        "element".proxyPass = "172.16.10.118";
+        "ethercalc" = {
+          proxyPass = "172.16.10.133:8000";
+          serverAliases = [ "excel" ];
+        };
+        "framadate".proxyPass = "172.16.10.109";
+        "grafana" = {
+          proxyPass = "172.16.10.121:3000";
+          serverAliases = [ "fyre" ];
+        };
+        "imprimante" = {
+          proxyPass = "172.16.10.131";
+          serverAliases = [ "helloworld" ];
+        };
+        "intranet" = {
+          proxyPass = "172.16.10.156";
+          serverAliases = [ "re2o" ];
+        };
         "install-party" = {
           anubisConfig = "${anubisChallenge}";
           serveLocalFiles = installPartySite;
@@ -213,9 +233,7 @@ in
         "mediawiki" = {
           anubisConfig = "${anubisChallenge}";
           proxyPass = "172.16.10.144";
-          serverAliases = [
-            "mediakiwi"
-          ];
+          serverAliases = [ "mediakiwi" ];
         };
         "mirrors" = {
           anubisConfig = "${anubisMirrors}";
@@ -227,32 +245,50 @@ in
           proxyPass = "172.16.10.104";
         };
         "nekorale".globalRedirect = "perso.crans.org/club-nekorale";
+        "nextcloud".proxyPass = "172.16.10.146";
+        "owncloud".proxyPass = "172.16.10.136";
+        "pad".proxyPass = "172.16.10.130:9001";
+        "pdf" = {
+          proxyPass = "172.16.10.140";
+          serverAliases = [
+            "livre"
+            "stirling"
+            "stirling-pdf"
+          ];
+        };
         "perso" = {
           anubisConfig = "${anubisPerso}";
           proxyPass = "172.16.10.31";
-          serverAliases = [
-            "clubs"
-          ];
+          serverAliases = [ "clubs" ];
         };
+        "pot-vieux".globalRedirect = "perso.crans.org/club-vieux";
+        "re2o-dev".proxyPass = "172.16.10.166";
         "services".serveLocalFiles = fetchFromCrans {
           repo = "services-page";
           rev = "master";
           hash = "sha256-ov4r6Oeta+vRcEv8bp7lFQg+2n4JTG4buetram5kN08=";
         };
         "snl".globalRedirect = "perso.crans.org/sonetlumens";
+        "tmpad".proxyPass = "172.16.10.130:9002";
+        "vaultwarden" = {
+          proxyPass = "172.16.10.159";
+          serverAliases = [ "pass" ];
+        };
+        "webirc".proxyPass = "172.16.10.31:9000";
+        "webmail" = {
+          proxyPass = "172.16.10.107";
+          serverAliases = [ "roundcube" ];
+        };
         "wiki" = {
           anubisConfig = "${anubisChallenge}";
           proxyPass = "172.16.10.161";
-          serverAliases = [
-            "wikipedia"
-          ];
+          serverAliases = [ "wikipedia" ];
         };
         "www" = {
           serveLocalFiles = homepagePkg;
-          serverAliases = [
-            "."
-          ];
+          serverAliases = [ "." ];
         };
+        "zero".proxyPass = "172.16.10.130";
       };
     };
 
diff --git a/hosts/vm/reverseproxy/staticsites/autoconfig/mail/config-v1.1.xml b/hosts/vm/reverseproxy/staticsites/autoconfig/mail/config-v1.1.xml
new file mode 100644
index 0000000..95ad1ea
--- /dev/null
+++ b/hosts/vm/reverseproxy/staticsites/autoconfig/mail/config-v1.1.xml
@@ -0,0 +1,23 @@
+<clientConfig version="1.0">
+  <emailProvider id="crans.org">
+    <domain>crans.org</domain>
+    <domain>crans.eu</domain>
+    <domain>crans.fr</domain>
+    <displayName>Cr@ns Mail</displayName>
+    <displayShortName>Cr@ns</displayShortName>
+    <incomingServer type="imap">
+      <hostname>imap.crans.org</hostname>
+      <port>993</port>
+      <socketType>SSL</socketType>
+      <username>%EMAILLOCALPART%</username>
+      <authentication>plain</authentication>
+    </incomingServer>
+    <outgoingServer type="smtp">
+      <hostname>smtp.crans.org</hostname>
+      <port>465</port>
+      <socketType>SSL</socketType>
+      <username>%EMAILLOCALPART%</username>
+      <authentication>plain</authentication>
+    </outgoingServer>
+  </emailProvider>
+</clientConfig>

From 3575c130ae0700646cde21825a1579d77c8e1008 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Sun, 19 Jul 2026 15:55:24 +0200
Subject: [PATCH 15/21] reverseproxy: logrotate

---
 hosts/vm/reverseproxy/reverseproxy.nix |  4 +--
 modules/services/reverseproxy.nix      | 41 ++++++++++++++++++++++++--
 2 files changed, 41 insertions(+), 4 deletions(-)

diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix
index cf4cb76..1f95959 100644
--- a/hosts/vm/reverseproxy/reverseproxy.nix
+++ b/hosts/vm/reverseproxy/reverseproxy.nix
@@ -135,7 +135,7 @@ let
     opts:
     pkgs.fetchFromGitLab (
       {
-        domain = "gitlab.crans.org";
+        domain = "gitlab.adm.crans.org";
         owner = "nounous";
       }
       // opts
@@ -171,7 +171,6 @@ let
 
     nativeBuildInputs = with pkgs; [
       hugo
-      git
     ];
 
     buildPhase = ''
@@ -296,4 +295,5 @@ in
       acme.enable = true;
     };
   };
+  services.nginx.virtualHosts."www-alias-crans.org".default = true;
 }
diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix
index d423bc1..111ac04 100644
--- a/modules/services/reverseproxy.nix
+++ b/modules/services/reverseproxy.nix
@@ -173,6 +173,35 @@ in
         ) cfg.virtualHosts;
       };
 
+      logrotate.settings =
+        let
+          # https://github.com/NixOS/nixpkgs/blob/nixos-26.05/nixos/modules/services/web-servers/nginx/default.nix
+          base = {
+            su = "${config.services.nginx.user} ${config.services.nginx.group}";
+            postrotate = "[ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`";
+            frequency = "daily";
+            notifempty = true;
+          };
+        in
+        {
+          nginx-anubis = base // {
+            files = [ "/var/log/nginx/anubis/*.log" ];
+            rotate = 7; # une semaine de log pour débugguer
+            delaycompress = false;
+          };
+          nginx-aliases = base // {
+            files = [ "/var/log/nginx/aliases/*.log" ];
+            rotate = 7; # une semaine de log pour débugguer
+            delaycompress = false;
+          };
+          nginx-hosts = base // {
+            files = [ "/var/log/nginx/host/*/*.log" ];
+            rotate = 173; # 6 mois de logs
+            dateext = true;
+            dateformat = "%Y-%m-%d";
+          };
+        };
+
       nginx =
         let
           configVhost =
@@ -235,6 +264,10 @@ in
                 };
                 root = vhostConfig.serveLocalFiles;
                 globalRedirect = vhostConfig.globalRedirect;
+                extraConfig = vhostExtraConf.extraConfig + ''
+                  access_log /var/log/nginx/host/${vhostName}/access.log;
+                  error_log /var/log/nginx/host/${vhostName}/error.log;
+                '';
               };
 
               # Entrée d’Anubis
@@ -247,8 +280,8 @@ in
                     proxyWebsockets = vhostConfig.proxyWebsockets;
                   };
                   extraConfig = entryExtraConf.extraConfig + ''
-                    access_log /var/log/nginx/anubis.access.log;
-                    error_log /var/log/nginx/anubis.error.log;
+                    access_log /var/log/nginx/anubis/access.log;
+                    error_log /var/log/nginx/anubis/error.log;
                   '';
                 }
               );
@@ -259,6 +292,10 @@ in
                 "${vhostName}-alias-${alias}" = sslConf // {
                   serverName = alias;
                   globalRedirect = lib.defaultTo "${vhostName}.crans.${mainTld}" vhostConfig.globalRedirect;
+                  extraConfig = ''
+                    access_log /var/log/nginx/aliases/access.log;
+                    error_log /var/log/nginx/aliases/eror.log;
+                  '';
                 };
               }) aliases
             );

From 11b39e46a1c3d6b82198839437a387cc56759d66 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Sun, 19 Jul 2026 19:38:23 +0200
Subject: [PATCH 16/21] fix: create log folders

---
 modules/services/reverseproxy.nix | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix
index 111ac04..1481c7d 100644
--- a/modules/services/reverseproxy.nix
+++ b/modules/services/reverseproxy.nix
@@ -147,6 +147,21 @@ in
       group = config.services.nginx.group;
     };
 
+    # Création des dossiers de logs
+    system.activationScripts = {
+      nginx-logs = {
+        text =
+          lib.concatMapStrings (f: "mkdir -p /var/log/nginx/${f}/\n") (
+            [
+              "anubis"
+              "aliases"
+            ]
+            ++ (lib.map (hn: "host/${hn}") (builtins.attrNames cfg.virtualHosts))
+          )
+          + "chown -R ${config.services.nginx.user}:${config.services.nginx.group} /var/log/nginx/\n";
+      };
+    };
+
     services = mkIf cfg.enable {
       anubis = {
         defaultOptions.group = "nginx";

From a4a04f1fb868ef5f19dee64d3d31490a5b1c70df Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Tue, 21 Jul 2026 18:53:45 +0200
Subject: [PATCH 17/21] Fix logs

---
 modules/services/reverseproxy.nix | 32 ++++++++++++-------------------
 1 file changed, 12 insertions(+), 20 deletions(-)

diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix
index 1481c7d..874635e 100644
--- a/modules/services/reverseproxy.nix
+++ b/modules/services/reverseproxy.nix
@@ -152,11 +152,7 @@ in
       nginx-logs = {
         text =
           lib.concatMapStrings (f: "mkdir -p /var/log/nginx/${f}/\n") (
-            [
-              "anubis"
-              "aliases"
-            ]
-            ++ (lib.map (hn: "host/${hn}") (builtins.attrNames cfg.virtualHosts))
+            [ "anubis" ] ++ (lib.map (hn: "host/${hn}") (builtins.attrNames cfg.virtualHosts))
           )
           + "chown -R ${config.services.nginx.user}:${config.services.nginx.group} /var/log/nginx/\n";
       };
@@ -195,19 +191,16 @@ in
             su = "${config.services.nginx.user} ${config.services.nginx.group}";
             postrotate = "[ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`";
             frequency = "daily";
-            notifempty = true;
+            ifempty = true;
+            compress = true;
+            delaycompress = true;
+            dateyesterday = true;
           };
         in
         {
           nginx-anubis = base // {
             files = [ "/var/log/nginx/anubis/*.log" ];
             rotate = 7; # une semaine de log pour débugguer
-            delaycompress = false;
-          };
-          nginx-aliases = base // {
-            files = [ "/var/log/nginx/aliases/*.log" ];
-            rotate = 7; # une semaine de log pour débugguer
-            delaycompress = false;
           };
           nginx-hosts = base // {
             files = [ "/var/log/nginx/host/*/*.log" ];
@@ -255,6 +248,11 @@ in
                   # Il est en entrée
                   entryExtraConf;
 
+              logHostConf = ''
+                access_log /var/log/nginx/host/${vhostName}/access.log;
+                error_log /var/log/nginx/host/${vhostName}/error.log;
+              '';
+
               # Les alias : vhostName × otherTld U serverAliases × allTld
               mkHostName = als: tld: if als == "." then "crans.${tld}" else "${als}.crans.${tld}";
               aliases =
@@ -279,10 +277,7 @@ in
                 };
                 root = vhostConfig.serveLocalFiles;
                 globalRedirect = vhostConfig.globalRedirect;
-                extraConfig = vhostExtraConf.extraConfig + ''
-                  access_log /var/log/nginx/host/${vhostName}/access.log;
-                  error_log /var/log/nginx/host/${vhostName}/error.log;
-                '';
+                extraConfig = vhostExtraConf.extraConfig + logHostConf;
               };
 
               # Entrée d’Anubis
@@ -307,10 +302,7 @@ in
                 "${vhostName}-alias-${alias}" = sslConf // {
                   serverName = alias;
                   globalRedirect = lib.defaultTo "${vhostName}.crans.${mainTld}" vhostConfig.globalRedirect;
-                  extraConfig = ''
-                    access_log /var/log/nginx/aliases/access.log;
-                    error_log /var/log/nginx/aliases/eror.log;
-                  '';
+                  extraConfig = logHostConf;
                 };
               }) aliases
             );

From 89d9bc4bc33e80cfedbd7784d730c45110a5baa4 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Tue, 21 Jul 2026 19:02:02 +0200
Subject: [PATCH 18/21] Revert acme

---
 modules/services/acme.nix | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/modules/services/acme.nix b/modules/services/acme.nix
index 5165af6..f08bd9a 100644
--- a/modules/services/acme.nix
+++ b/modules/services/acme.nix
@@ -23,6 +23,16 @@ in
         email = "root@crans.org";
         dnsPropagationCheck = false;
       };
+
+      # Certificat wildcard par défaut pour les services utilisant acme
+      # TODO: À déplacer sur les VMs qui en ont besoin (e.g. coturn…).
+      certs."crans.org" = {
+        domain = "*.crans.org";
+        dnsProvider = "rfc2136";
+        # Contient le serveur à contacter avec le protocole
+        # et le mot de passe
+        environmentFile = config.age.secrets.acme-env.path;
+      };
     };
   };
 }

From f8e6674d3561809313a297a805e552de033758a7 Mon Sep 17 00:00:00 2001
From: Hachino <glevy@crans.org>
Date: Fri, 24 Jul 2026 18:17:46 +0200
Subject: [PATCH 19/21] test: ajout d'un site

---
 hosts/vm/reverseproxy/reverseproxy.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix
index 1f95959..237df0d 100644
--- a/hosts/vm/reverseproxy/reverseproxy.nix
+++ b/hosts/vm/reverseproxy/reverseproxy.nix
@@ -268,6 +268,7 @@ in
           hash = "sha256-ov4r6Oeta+vRcEv8bp7lFQg+2n4JTG4buetram5kN08=";
         };
         "snl".globalRedirect = "perso.crans.org/sonetlumens";
+        "test-melon".proxyPass = "172.16.10.150:8080";
         "tmpad".proxyPass = "172.16.10.130:9002";
         "vaultwarden" = {
           proxyPass = "172.16.10.159";

From 281325c0b1a15e548c4c9b2f74def229e05e784e Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Sat, 25 Jul 2026 18:37:39 +0200
Subject: [PATCH 20/21] anubis: improve php-my-admin and mediawiki

---
 hosts/vm/reverseproxy/reverseproxy.nix | 32 ++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix
index 1f95959..e55fe2f 100644
--- a/hosts/vm/reverseproxy/reverseproxy.nix
+++ b/hosts/vm/reverseproxy/reverseproxy.nix
@@ -87,6 +87,11 @@ let
         path_regex = "^/[a-zA-Z0-9_-]*/public/.*";
         action = "ALLOW";
       }
+      {
+        name = "allow-phpmyadmin";
+        path_regex = "^/phpmyadmin/.*";
+        action = "ALLOW";
+      }
       {
         # geneau utilisait ses pages persos avant la mise en place d'Anubis.
         # Le déploiement d'Anubis l'a impacté (cf les mails de fin 2025).
@@ -102,7 +107,7 @@ let
       }
       {
         name = "challenge-other";
-        path_regex = "^*";
+        path_regex = "^.*";
         action = "CHALLENGE";
       }
     ];
@@ -131,6 +136,29 @@ let
     ];
   };
 
+  anubisWiki = formatJSON.generate "anubis_wiki.json" {
+    "bots" = [
+      {
+        import = "${antiBot}";
+      }
+      {
+        name = "allow-mediawiki-images";
+        path_regex = "^/w/images/.*";
+        action = "ALLOW";
+      }
+      {
+        name = "allow-mediawiki-api";
+        path_regex = "^/w/api.php.*";
+        action = "ALLOW";
+      }
+      {
+        name = "challenge-other";
+        path_regex = ".*";
+        action = "CHALLENGE";
+      }
+    ];
+  };
+
   fetchFromCrans =
     opts:
     pkgs.fetchFromGitLab (
@@ -230,7 +258,7 @@ in
           proxyPass = "172.16.10.110";
         };
         "mediawiki" = {
-          anubisConfig = "${anubisChallenge}";
+          anubisConfig = "${anubisWiki}";
           proxyPass = "172.16.10.144";
           serverAliases = [ "mediakiwi" ];
         };

From 47f3300633c3b588b8cc74dfd29619c8640330e2 Mon Sep 17 00:00:00 2001
From: Pyjacpp <pyjacpp@crans.org>
Date: Mon, 27 Jul 2026 11:27:37 +0200
Subject: [PATCH 21/21] flake update

---
 flake.lock | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/flake.lock b/flake.lock
index a606991..7a248c1 100644
--- a/flake.lock
+++ b/flake.lock
@@ -50,11 +50,11 @@
         "nixpkgs-lib": "nixpkgs-lib"
       },
       "locked": {
-        "lastModified": 1778716662,
-        "narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
+        "lastModified": 1782949081,
+        "narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
+        "rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
         "type": "github"
       },
       "original": {
@@ -86,11 +86,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1780902259,
-        "narHash": "sha256-q8yYEC5f1mFlQO9RGna4LTc9QrcvWunX6FYp83munkQ=",
+        "lastModified": 1785104993,
+        "narHash": "sha256-eKbrvPoAOFutbYMdbB3r5EQVmFxKv24iKqHPPUXA0gM=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
+        "rev": "8623c4c20aa4ca2f5fb81510d2944066c3fb0d96",
         "type": "github"
       },
       "original": {
@@ -102,11 +102,11 @@
     },
     "nixpkgs-lib": {
       "locked": {
-        "lastModified": 1777168982,
-        "narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
+        "lastModified": 1782614948,
+        "narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
         "owner": "nix-community",
         "repo": "nixpkgs.lib",
-        "rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
+        "rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
         "type": "github"
       },
       "original": {
@@ -145,11 +145,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1780220602,
-        "narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
+        "lastModified": 1784369104,
+        "narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=",
         "owner": "numtide",
         "repo": "treefmt-nix",
-        "rev": "db947814a175b7ca6ded66e21383d938df01c227",
+        "rev": "df3c0640565d04a0261253cdd89fce78ec50168a",
         "type": "github"
       },
       "original": {