mirror of https://gitlab.crans.org/nounous/nixos
Merge branch 'main' into wiki
Pyjacpp
commit
ab38d46125
24
flake.lock
24
flake.lock
|
|
@ -50,11 +50,11 @@
|
|||
"nixpkgs-lib": "nixpkgs-lib"
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1778716662,
|
||||
"narHash": "sha256-m1Yf0wZ8j1OHjTc2UwHwyQRSnNeSgLJOd7q5Y45hzi4=",
|
||||
"lastModified": 1782949081,
|
||||
"narHash": "sha256-vp6Y/Grm98ESt6ceOkWiHWyZRDV3J1RID4w+6NWK9yA=",
|
||||
"owner": "hercules-ci",
|
||||
"repo": "flake-parts",
|
||||
"rev": "f7c1a2d347e4c52d5fb8d10cb4d94b5884e546fb",
|
||||
"rev": "17c9d6cdfc60c64f4ee8d306f9bc0b4ccb51481e",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -86,11 +86,11 @@
|
|||
},
|
||||
"nixpkgs": {
|
||||
"locked": {
|
||||
"lastModified": 1780902259,
|
||||
"narHash": "sha256-q8yYEC5f1mFlQO9RGna4LTc9QrcvWunX6FYp83munkQ=",
|
||||
"lastModified": 1785104993,
|
||||
"narHash": "sha256-eKbrvPoAOFutbYMdbB3r5EQVmFxKv24iKqHPPUXA0gM=",
|
||||
"owner": "NixOS",
|
||||
"repo": "nixpkgs",
|
||||
"rev": "bd0ff2d3eac24699c3664d5966b9ef36f388e2ca",
|
||||
"rev": "8623c4c20aa4ca2f5fb81510d2944066c3fb0d96",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -102,11 +102,11 @@
|
|||
},
|
||||
"nixpkgs-lib": {
|
||||
"locked": {
|
||||
"lastModified": 1777168982,
|
||||
"narHash": "sha256-GOkGPcboWE9BmGCRMLX3worL4EMnsnG8MyKmXNeYuhQ=",
|
||||
"lastModified": 1782614948,
|
||||
"narHash": "sha256-ePjCwr1sNm9NYUqywL7QfK3JnlS015msC+eBu2zKlp8=",
|
||||
"owner": "nix-community",
|
||||
"repo": "nixpkgs.lib",
|
||||
"rev": "f5901329dade4a6ea039af1433fb087bd9c1fe14",
|
||||
"rev": "db3f255737b94216eb71cce308e2912cf6bc2d7c",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
@ -145,11 +145,11 @@
|
|||
]
|
||||
},
|
||||
"locked": {
|
||||
"lastModified": 1780220602,
|
||||
"narHash": "sha256-eynAfOmbmxJnkp7YewvCEbShNnnYJ9gLLqkzsYtBPeM=",
|
||||
"lastModified": 1784369104,
|
||||
"narHash": "sha256-47cxbcZODibHv3rELFQ9vZly0vUNkND/atn/U7HLeb0=",
|
||||
"owner": "numtide",
|
||||
"repo": "treefmt-nix",
|
||||
"rev": "db947814a175b7ca6ded66e21383d938df01c227",
|
||||
"rev": "df3c0640565d04a0261253cdd89fce78ec50168a",
|
||||
"type": "github"
|
||||
},
|
||||
"original": {
|
||||
|
|
|
|||
|
|
@ -1,13 +1,19 @@
|
|||
{ config, ... }:
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
environment.systemPackages = with pkgs; [
|
||||
imagemagick # Pour la compression des PDFs
|
||||
];
|
||||
services.stirling-pdf = {
|
||||
enable = true;
|
||||
environment = {
|
||||
ENDPOINTS_TOREMOVE = "url-to-pdf";
|
||||
INSTALL_BOOK_AND_ADVANCED_HTML_OPS = "true";
|
||||
UI_APPNAMENAVBAR = "Stirling PDF du Cr@ns";
|
||||
SECURITY_ENABLELOGIN = false;
|
||||
SERVER_PORT = 8000;
|
||||
SYSTEM_DEFAULTLOCALE = "fr-FR";
|
||||
SYSTEM_ENABLEDESKTOPINSTALLSLIDE = false;
|
||||
SYSTEM_SHOWUPDATE = false;
|
||||
};
|
||||
};
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,7 @@
|
|||
{ pkgs, ... }:
|
||||
{
|
||||
pkgs,
|
||||
...
|
||||
}:
|
||||
|
||||
let
|
||||
formatJSON = pkgs.formats.json { };
|
||||
|
|
@ -84,6 +87,11 @@ let
|
|||
path_regex = "^/[a-zA-Z0-9_-]*/public/.*";
|
||||
action = "ALLOW";
|
||||
}
|
||||
{
|
||||
name = "allow-phpmyadmin";
|
||||
path_regex = "^/phpmyadmin/.*";
|
||||
action = "ALLOW";
|
||||
}
|
||||
{
|
||||
# geneau utilisait ses pages persos avant la mise en place d'Anubis.
|
||||
# Le déploiement d'Anubis l'a impacté (cf les mails de fin 2025).
|
||||
|
|
@ -99,7 +107,7 @@ let
|
|||
}
|
||||
{
|
||||
name = "challenge-other";
|
||||
path_regex = "^*";
|
||||
path_regex = "^.*";
|
||||
action = "CHALLENGE";
|
||||
}
|
||||
];
|
||||
|
|
@ -128,28 +136,117 @@ let
|
|||
];
|
||||
};
|
||||
|
||||
anubisWiki = formatJSON.generate "anubis_wiki.json" {
|
||||
"bots" = [
|
||||
{
|
||||
import = "${antiBot}";
|
||||
}
|
||||
{
|
||||
name = "allow-mediawiki-images";
|
||||
path_regex = "^/w/images/.*";
|
||||
action = "ALLOW";
|
||||
}
|
||||
{
|
||||
name = "allow-mediawiki-api";
|
||||
path_regex = "^/w/api.php.*";
|
||||
action = "ALLOW";
|
||||
}
|
||||
{
|
||||
name = "challenge-other";
|
||||
path_regex = ".*";
|
||||
action = "CHALLENGE";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
fetchFromCrans =
|
||||
opts:
|
||||
pkgs.fetchFromGitLab (
|
||||
{
|
||||
domain = "gitlab.adm.crans.org";
|
||||
owner = "nounous";
|
||||
}
|
||||
// opts
|
||||
);
|
||||
|
||||
installPartySite = pkgs.python3Packages.buildPythonApplication {
|
||||
name = "site-install-party";
|
||||
pyproject = false;
|
||||
|
||||
src = fetchFromCrans {
|
||||
repo = "site-install-party";
|
||||
rev = "master";
|
||||
hash = "sha256-KVB4m/ms0WuArrkLn05INVLqhaGxzCg30GMICI6tM5E=";
|
||||
};
|
||||
|
||||
build-system = with pkgs.python3Packages; [
|
||||
mkdocs
|
||||
mkdocs-material
|
||||
];
|
||||
buildPhase = ''
|
||||
python3 -m mkdocs -- build -d $out
|
||||
'';
|
||||
};
|
||||
|
||||
homepagePkg = pkgs.stdenv.mkDerivation {
|
||||
name = "site-homepage";
|
||||
|
||||
src = fetchFromCrans {
|
||||
repo = "homepage";
|
||||
rev = "master";
|
||||
hash = "sha256-e9tttzKEWcBhogQY2ITDqqTbix/zcnBAylj1eKY791E=";
|
||||
};
|
||||
|
||||
nativeBuildInputs = with pkgs; [
|
||||
hugo
|
||||
];
|
||||
|
||||
buildPhase = ''
|
||||
hugo build -d $out
|
||||
'';
|
||||
};
|
||||
in
|
||||
{
|
||||
crans = {
|
||||
reverseProxy = {
|
||||
enable = true;
|
||||
virtualHosts = {
|
||||
"autoconfig".serveLocalFiles = ./staticsites/autoconfig;
|
||||
"cas".proxyPass = "172.16.10.120";
|
||||
"collabora" = {
|
||||
target = "172.16.10.149";
|
||||
proxyPass = "172.16.10.149";
|
||||
proxyWebsockets = true;
|
||||
};
|
||||
"eclat" = {
|
||||
anubisConfig = "${anubisMirrors}";
|
||||
httpOnly = true;
|
||||
target = "172.16.10.104";
|
||||
proxyPass = "172.16.10.104";
|
||||
};
|
||||
"eclats" = {
|
||||
anubisConfig = "${anubisMirrors}";
|
||||
target = "172.16.10.104";
|
||||
proxyPass = "172.16.10.104";
|
||||
};
|
||||
"element".proxyPass = "172.16.10.118";
|
||||
"ethercalc" = {
|
||||
proxyPass = "172.16.10.133:8000";
|
||||
serverAliases = [ "excel" ];
|
||||
};
|
||||
"framadate".proxyPass = "172.16.10.109";
|
||||
"grafana" = {
|
||||
proxyPass = "172.16.10.121:3000";
|
||||
serverAliases = [ "fyre" ];
|
||||
};
|
||||
"imprimante" = {
|
||||
proxyPass = "172.16.10.131";
|
||||
serverAliases = [ "helloworld" ];
|
||||
};
|
||||
"intranet" = {
|
||||
proxyPass = "172.16.10.156";
|
||||
serverAliases = [ "re2o" ];
|
||||
};
|
||||
"install-party" = {
|
||||
anubisConfig = "${anubisChallenge}";
|
||||
target = "/var/www/install-party.crans.org";
|
||||
serveLocalFiles = installPartySite;
|
||||
serverAliases = [
|
||||
"i-p"
|
||||
"adopteunmanchot"
|
||||
|
|
@ -158,38 +255,68 @@ in
|
|||
};
|
||||
"lists" = {
|
||||
anubisConfig = "${anubisChallenge}";
|
||||
target = "172.16.10.110";
|
||||
proxyPass = "172.16.10.110";
|
||||
};
|
||||
"mediawiki" = {
|
||||
anubisConfig = "${anubisChallenge}";
|
||||
target = "172.16.10.144";
|
||||
serverAliases = [
|
||||
"mediakiwi"
|
||||
];
|
||||
anubisConfig = "${anubisWiki}";
|
||||
proxyPass = "172.16.10.144";
|
||||
serverAliases = [ "mediakiwi" ];
|
||||
};
|
||||
"mirrors" = {
|
||||
anubisConfig = "${anubisMirrors}";
|
||||
target = "172.16.10.104";
|
||||
proxyPass = "172.16.10.104";
|
||||
};
|
||||
"mirror" = {
|
||||
anubisConfig = "${anubisMirrors}";
|
||||
httpOnly = true;
|
||||
target = "172.16.10.104";
|
||||
proxyPass = "172.16.10.104";
|
||||
};
|
||||
"nekorale".globalRedirect = "perso.crans.org/club-nekorale";
|
||||
"nextcloud".proxyPass = "172.16.10.146";
|
||||
"owncloud".proxyPass = "172.16.10.136";
|
||||
"pad".proxyPass = "172.16.10.130:9001";
|
||||
"pdf" = {
|
||||
proxyPass = "172.16.10.140";
|
||||
serverAliases = [
|
||||
"livre"
|
||||
"stirling"
|
||||
"stirling-pdf"
|
||||
];
|
||||
};
|
||||
"perso" = {
|
||||
anubisConfig = "${anubisPerso}";
|
||||
target = "172.16.10.31";
|
||||
serverAliases = [
|
||||
"clubs"
|
||||
];
|
||||
proxyPass = "172.16.10.31";
|
||||
serverAliases = [ "clubs" ];
|
||||
};
|
||||
"pot-vieux".globalRedirect = "perso.crans.org/club-vieux";
|
||||
"re2o-dev".proxyPass = "172.16.10.166";
|
||||
"services".serveLocalFiles = fetchFromCrans {
|
||||
repo = "services-page";
|
||||
rev = "master";
|
||||
hash = "sha256-ov4r6Oeta+vRcEv8bp7lFQg+2n4JTG4buetram5kN08=";
|
||||
};
|
||||
"snl".globalRedirect = "perso.crans.org/sonetlumens";
|
||||
"test-melon".proxyPass = "172.16.10.150:8080";
|
||||
"tmpad".proxyPass = "172.16.10.130:9002";
|
||||
"vaultwarden" = {
|
||||
proxyPass = "172.16.10.159";
|
||||
serverAliases = [ "pass" ];
|
||||
};
|
||||
"webirc".proxyPass = "172.16.10.31:9000";
|
||||
"webmail" = {
|
||||
proxyPass = "172.16.10.107";
|
||||
serverAliases = [ "roundcube" ];
|
||||
};
|
||||
"wiki" = {
|
||||
anubisConfig = "${anubisChallenge}";
|
||||
target = "172.16.10.161";
|
||||
serverAliases = [
|
||||
"wikipedia"
|
||||
];
|
||||
proxyPass = "172.16.10.161";
|
||||
serverAliases = [ "wikipedia" ];
|
||||
};
|
||||
"www" = {
|
||||
serveLocalFiles = homepagePkg;
|
||||
serverAliases = [ "." ];
|
||||
};
|
||||
"zero".proxyPass = "172.16.10.130";
|
||||
};
|
||||
};
|
||||
|
||||
|
|
@ -197,4 +324,5 @@ in
|
|||
acme.enable = true;
|
||||
};
|
||||
};
|
||||
services.nginx.virtualHosts."www-alias-crans.org".default = true;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -0,0 +1,23 @@
|
|||
<clientConfig version="1.0">
|
||||
<emailProvider id="crans.org">
|
||||
<domain>crans.org</domain>
|
||||
<domain>crans.eu</domain>
|
||||
<domain>crans.fr</domain>
|
||||
<displayName>Cr@ns Mail</displayName>
|
||||
<displayShortName>Cr@ns</displayShortName>
|
||||
<incomingServer type="imap">
|
||||
<hostname>imap.crans.org</hostname>
|
||||
<port>993</port>
|
||||
<socketType>SSL</socketType>
|
||||
<username>%EMAILLOCALPART%</username>
|
||||
<authentication>plain</authentication>
|
||||
</incomingServer>
|
||||
<outgoingServer type="smtp">
|
||||
<hostname>smtp.crans.org</hostname>
|
||||
<port>465</port>
|
||||
<socketType>SSL</socketType>
|
||||
<username>%EMAILLOCALPART%</username>
|
||||
<authentication>plain</authentication>
|
||||
</outgoingServer>
|
||||
</emailProvider>
|
||||
</clientConfig>
|
||||
|
|
@ -24,6 +24,8 @@ in
|
|||
dnsPropagationCheck = false;
|
||||
};
|
||||
|
||||
# Certificat wildcard par défaut pour les services utilisant acme
|
||||
# TODO: À déplacer sur les VMs qui en ont besoin (e.g. coturn…).
|
||||
certs."crans.org" = {
|
||||
domain = "*.crans.org";
|
||||
dnsProvider = "rfc2136";
|
||||
|
|
|
|||
|
|
@ -1,5 +1,4 @@
|
|||
{
|
||||
pkgs,
|
||||
lib,
|
||||
config,
|
||||
...
|
||||
|
|
@ -8,28 +7,6 @@
|
|||
let
|
||||
cfg = config.crans.reverseProxy;
|
||||
|
||||
formatJSON = pkgs.formats.json { };
|
||||
|
||||
allowAll = formatJSON.generate "allow_all.json" {
|
||||
bots = [
|
||||
{
|
||||
name = "allow_all";
|
||||
path_regex = ".*";
|
||||
action = "ALLOW";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
open_graph = formatJSON.generate "opengraph.json" {
|
||||
openGraph = [
|
||||
{
|
||||
enabled = true;
|
||||
considerHost = true;
|
||||
ttl = "24h";
|
||||
}
|
||||
];
|
||||
};
|
||||
|
||||
mainTld = "org";
|
||||
otherTld = [
|
||||
"fr"
|
||||
|
|
@ -65,18 +42,36 @@ in
|
|||
'';
|
||||
};
|
||||
|
||||
target = mkOption {
|
||||
type = types.str;
|
||||
default = "";
|
||||
proxyPass = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
description = ''
|
||||
Indique la destination. Il peut s'agir du chemin vers des fichiers statiques.
|
||||
Indique la destination à proxy.
|
||||
'';
|
||||
example = "172.16.10.128:8000";
|
||||
};
|
||||
|
||||
serveLocalFiles = mkOption {
|
||||
type = types.nullOr types.path;
|
||||
default = null;
|
||||
description = ''
|
||||
Chemin vers un dossier à exposer statiquement.
|
||||
'';
|
||||
example = "/var/local/adopter-un-manchot";
|
||||
};
|
||||
|
||||
globalRedirect = mkOption {
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
description = ''
|
||||
Si définie, toutes les requêtes sont redirigées (via 301) sur cet hôte.
|
||||
'';
|
||||
example = "perso.crans.org/club";
|
||||
};
|
||||
|
||||
anubisConfig = mkOption {
|
||||
type = types.str;
|
||||
default = "";
|
||||
type = types.nullOr types.str;
|
||||
default = null;
|
||||
description = ''
|
||||
Chemin du fichier de configuration
|
||||
'';
|
||||
|
|
@ -95,7 +90,7 @@ in
|
|||
type = types.bool;
|
||||
default = false;
|
||||
description = ''
|
||||
Interdit les connexions en ssh
|
||||
Interdit les connexions en https
|
||||
'';
|
||||
example = "true";
|
||||
};
|
||||
|
|
@ -134,107 +129,187 @@ in
|
|||
wantedBy = [ "multi-user.target" ];
|
||||
}) cfg.virtualHosts;
|
||||
|
||||
# On fait un certificat commun pour tous les hosts
|
||||
security.acme.certs."all.crans.all" = mkIf cfg.enable {
|
||||
domain = "*.crans.${mainTld}";
|
||||
dnsProvider = "rfc2136";
|
||||
# Contient le serveur à contacter avec le protocole
|
||||
# et le mot de passe
|
||||
environmentFile = config.age.secrets.acme-env.path;
|
||||
extraDomainNames =
|
||||
lib.concatMap (tld: [
|
||||
"*.crans.${tld}"
|
||||
"crans.${tld}"
|
||||
]) otherTld
|
||||
++ [
|
||||
"crans.${mainTld}"
|
||||
];
|
||||
group = config.services.nginx.group;
|
||||
};
|
||||
|
||||
# Création des dossiers de logs
|
||||
system.activationScripts = {
|
||||
nginx-logs = {
|
||||
text =
|
||||
lib.concatMapStrings (f: "mkdir -p /var/log/nginx/${f}/\n") (
|
||||
[ "anubis" ] ++ (lib.map (hn: "host/${hn}") (builtins.attrNames cfg.virtualHosts))
|
||||
)
|
||||
+ "chown -R ${config.services.nginx.user}:${config.services.nginx.group} /var/log/nginx/\n";
|
||||
};
|
||||
};
|
||||
|
||||
services = mkIf cfg.enable {
|
||||
anubis = {
|
||||
defaultOptions.group = "nginx";
|
||||
instances = lib.mapAttrs (vhostName: vhostConfig: {
|
||||
instances = lib.mapAttrs (
|
||||
vhostName: vhostConfig:
|
||||
mkIf (vhostConfig.anubisConfig != null) {
|
||||
enable = true;
|
||||
settings = {
|
||||
BIND = "/run/anubis/anubis-${vhostName}/socket.sock";
|
||||
BIND_NETWORK = "unix";
|
||||
METRICS_BIND = "/run/anubis/anubis-${vhostName}/anubis-${vhostName}-metrics.sock";
|
||||
TARGET = "unix:///run/nginx/nginx-${vhostName}.sock";
|
||||
COOKIE_DOMAIN = "crans.org";
|
||||
REDIRECT_DOMAINS = "${vhostName}.crans.org";
|
||||
COOKIE_DOMAIN = "crans.${mainTld}";
|
||||
REDIRECT_DOMAINS = "${vhostName}.crans.${mainTld}";
|
||||
SOCKET_MODE = "0660";
|
||||
# OpenGraph config
|
||||
OG_PASSTHROUGH = vhostConfig.anubisOpenGraph;
|
||||
OG_EXPIRY_TIME = "24h";
|
||||
OG_CACHE_CONSIDER_HOST = true;
|
||||
# Policy config
|
||||
POLICY_FNAME = if (vhostConfig.anubisConfig == "") then "${allowAll}" else vhostConfig.anubisConfig;
|
||||
POLICY_FNAME = vhostConfig.anubisConfig;
|
||||
};
|
||||
}
|
||||
) cfg.virtualHosts;
|
||||
};
|
||||
|
||||
logrotate.settings =
|
||||
let
|
||||
# https://github.com/NixOS/nixpkgs/blob/nixos-26.05/nixos/modules/services/web-servers/nginx/default.nix
|
||||
base = {
|
||||
su = "${config.services.nginx.user} ${config.services.nginx.group}";
|
||||
postrotate = "[ ! -f /var/run/nginx/nginx.pid ] || kill -USR1 `cat /var/run/nginx/nginx.pid`";
|
||||
frequency = "daily";
|
||||
ifempty = true;
|
||||
compress = true;
|
||||
delaycompress = true;
|
||||
dateyesterday = true;
|
||||
};
|
||||
in
|
||||
{
|
||||
nginx-anubis = base // {
|
||||
files = [ "/var/log/nginx/anubis/*.log" ];
|
||||
rotate = 7; # une semaine de log pour débugguer
|
||||
};
|
||||
nginx-hosts = base // {
|
||||
files = [ "/var/log/nginx/host/*/*.log" ];
|
||||
rotate = 173; # 6 mois de logs
|
||||
dateext = true;
|
||||
dateformat = "%Y-%m-%d";
|
||||
};
|
||||
}) cfg.virtualHosts;
|
||||
};
|
||||
|
||||
nginx =
|
||||
let
|
||||
# Configuration du serveur principal.
|
||||
mainConfig = lib.mapAttrs' (
|
||||
configVhost =
|
||||
vhostName: vhostConfig:
|
||||
lib.nameValuePair (vhostName + "-anubis") {
|
||||
enableACME = !vhostConfig.httpOnly;
|
||||
let
|
||||
sslConf = {
|
||||
forceSSL = !vhostConfig.httpOnly;
|
||||
rejectSSL = vhostConfig.httpOnly;
|
||||
useACMEHost = mkIf (!vhostConfig.httpOnly) "all.crans.all";
|
||||
acmeRoot = null;
|
||||
};
|
||||
|
||||
# Conf pour l’hôte en entrée
|
||||
entryExtraConf = {
|
||||
extraConfig = ''
|
||||
set_real_ip_from 172.16.0.0/16;
|
||||
set_real_ip_from fd00::/56;
|
||||
real_ip_header X-Real-Ip;
|
||||
'';
|
||||
}
|
||||
// sslConf;
|
||||
# Conf supplémentaire pour le proxy principal
|
||||
vhostExtraConf =
|
||||
if vhostConfig.anubisConfig != null then
|
||||
# Il reçoit les requêtes d’Anubis
|
||||
{
|
||||
listen = [
|
||||
{ addr = "unix:/run/nginx/nginx-${vhostName}.sock"; }
|
||||
];
|
||||
extraConfig = ''
|
||||
set_real_ip_from unix:;
|
||||
real_ip_header X-Real-IP;
|
||||
'';
|
||||
}
|
||||
else
|
||||
# Il est en entrée
|
||||
entryExtraConf;
|
||||
|
||||
logHostConf = ''
|
||||
access_log /var/log/nginx/host/${vhostName}/access.log;
|
||||
error_log /var/log/nginx/host/${vhostName}/error.log;
|
||||
'';
|
||||
|
||||
# Les alias : vhostName × otherTld U serverAliases × allTld
|
||||
mkHostName = als: tld: if als == "." then "crans.${tld}" else "${als}.crans.${tld}";
|
||||
aliases =
|
||||
lib.foldr
|
||||
(
|
||||
tld: acc:
|
||||
acc
|
||||
++ (lib.foldr (alias: acc: acc ++ [ (mkHostName alias tld) ]) [
|
||||
(mkHostName vhostName tld)
|
||||
] vhostConfig.serverAliases)
|
||||
)
|
||||
(lib.foldr (alias: acc: acc ++ [ (mkHostName alias mainTld) ]) [ ] vhostConfig.serverAliases)
|
||||
otherTld;
|
||||
in
|
||||
{
|
||||
# Configuration du service à proxy.
|
||||
"${vhostName}" = vhostExtraConf // {
|
||||
serverName = mkHostName vhostName mainTld;
|
||||
locations."/" = mkIf (vhostConfig.proxyPass != null) {
|
||||
proxyPass = "http://${vhostConfig.proxyPass}";
|
||||
proxyWebsockets = vhostConfig.proxyWebsockets;
|
||||
};
|
||||
root = vhostConfig.serveLocalFiles;
|
||||
globalRedirect = vhostConfig.globalRedirect;
|
||||
extraConfig = vhostExtraConf.extraConfig + logHostConf;
|
||||
};
|
||||
|
||||
# Entrée d’Anubis
|
||||
"${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) (
|
||||
entryExtraConf
|
||||
// {
|
||||
serverName = mkHostName vhostName mainTld;
|
||||
locations."/" = {
|
||||
proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock";
|
||||
proxyWebsockets = vhostConfig.proxyWebsockets;
|
||||
};
|
||||
serverName = "${vhostName}.crans.${mainTld}";
|
||||
extraConfig = "
|
||||
set_real_ip_from 172.16.0.0/16;
|
||||
set_real_ip_from fd00::/56;
|
||||
real_ip_header X-Real-Ip;
|
||||
";
|
||||
extraConfig = entryExtraConf.extraConfig + ''
|
||||
access_log /var/log/nginx/anubis/access.log;
|
||||
error_log /var/log/nginx/anubis/error.log;
|
||||
'';
|
||||
}
|
||||
) cfg.virtualHosts;
|
||||
|
||||
# Redirections
|
||||
redirectConfig = lib.mapAttrs (vhostName: vhostConfig: {
|
||||
# Redirection vers d'autres machines
|
||||
locations = mkIf (!lib.strings.hasPrefix "/" vhostConfig.target) {
|
||||
"/favicon.ico".root = "/var/www/logo/";
|
||||
"/" = {
|
||||
proxyPass = "http://${vhostConfig.target}";
|
||||
proxyWebsockets = vhostConfig.proxyWebsockets;
|
||||
};
|
||||
};
|
||||
# Redirection vers des fichiers locaux
|
||||
root = mkIf (lib.strings.hasPrefix "/" vhostConfig.target) vhostConfig.target;
|
||||
listen = [
|
||||
{ addr = "unix:/run/nginx/nginx-${vhostName}.sock"; }
|
||||
];
|
||||
serverName = "${vhostName}.crans.${mainTld}";
|
||||
extraConfig = "
|
||||
set_real_ip_from unix:;
|
||||
real_ip_header X-Real-IP;
|
||||
";
|
||||
}) cfg.virtualHosts;
|
||||
|
||||
# Génération des alias
|
||||
getAliases = name: config: lib.foldr (
|
||||
tld: acc:
|
||||
acc
|
||||
++
|
||||
(lib.foldr (alias: acc: acc ++ ["${alias}.crans.${tld}"]) ["${name}.crans.${tld}"] config.serverAliases)
|
||||
)
|
||||
(lib.foldr (alias: acc: acc ++ ["${alias}.crans.${mainTld}"]) [] config.serverAliases)
|
||||
otherTld;
|
||||
|
||||
# Configuration des alias
|
||||
aliasConfig = lib.foldr (
|
||||
vhost: acc:
|
||||
acc
|
||||
//
|
||||
lib.foldr (
|
||||
alias: acc:
|
||||
acc
|
||||
//
|
||||
{
|
||||
"${vhost.name}-alias-${alias}" = rec {
|
||||
rejectSSL = vhost.value.httpOnly;
|
||||
forceSSL = !rejectSSL;
|
||||
enableACME = !rejectSSL;
|
||||
);
|
||||
}
|
||||
# Les alias
|
||||
// lib.mergeAttrsList (
|
||||
lib.map (alias: {
|
||||
"${vhostName}-alias-${alias}" = sslConf // {
|
||||
serverName = alias;
|
||||
globalRedirect = "${vhost.name}.crans.${mainTld}";
|
||||
globalRedirect = lib.defaultTo "${vhostName}.crans.${mainTld}" vhostConfig.globalRedirect;
|
||||
extraConfig = logHostConf;
|
||||
};
|
||||
}
|
||||
) { } (getAliases vhost.name vhost.value)
|
||||
) { } (lib.attrsToList cfg.virtualHosts);
|
||||
}) aliases
|
||||
);
|
||||
in
|
||||
{
|
||||
enable = true;
|
||||
virtualHosts = redirectConfig // aliasConfig // mainConfig;
|
||||
virtualHosts = lib.concatMapAttrs configVhost cfg.virtualHosts;
|
||||
};
|
||||
};
|
||||
};
|
||||
|
|
|
|||
Loading…
Reference in New Issue