From 8040cdfe2eb608b6d38e92069482e3e0c799395d Mon Sep 17 00:00:00 2001 From: Lyes Saadi Date: Fri, 31 Jul 2026 17:09:52 +0200 Subject: [PATCH 01/14] Adding autorestart for stirling --- hosts/vm/livre/stirling.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/hosts/vm/livre/stirling.nix b/hosts/vm/livre/stirling.nix index f5fadfc..1abe54d 100644 --- a/hosts/vm/livre/stirling.nix +++ b/hosts/vm/livre/stirling.nix @@ -4,6 +4,7 @@ environment.systemPackages = with pkgs; [ imagemagick # Pour la compression des PDFs ]; + services.stirling-pdf = { enable = true; environment = { @@ -17,6 +18,11 @@ }; }; + systemd.services.stirling-pdf.serviceConfig = { + Restart = "always"; + RestartSec = "5s"; + }; + services.nginx = { enable = true; From b8bbf370cbb55423cf2343ca54c680a689757557 Mon Sep 17 00:00:00 2001 From: aeltheos Date: Wed, 29 Jul 2026 00:17:39 +0200 Subject: [PATCH 02/14] =?UTF-8?q?M=C3=A0J=20de=20services.crans.org=20et?= =?UTF-8?q?=20passage=20au=20rev-commit?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- hosts/vm/reverseproxy/reverseproxy.nix | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix index 485ba25..2692895 100644 --- a/hosts/vm/reverseproxy/reverseproxy.nix +++ b/hosts/vm/reverseproxy/reverseproxy.nix @@ -1,5 +1,6 @@ { pkgs, + lib, ... }: @@ -292,8 +293,8 @@ in "re2o-dev".proxyPass = "172.16.10.166"; "services".serveLocalFiles = fetchFromCrans { repo = "services-page"; - rev = "master"; - hash = "sha256-ov4r6Oeta+vRcEv8bp7lFQg+2n4JTG4buetram5kN08="; + rev = "ef5e998a09d298e75a94daae089f65407d40e331"; + hash = "sha256-GzFmU+U9OzZ0m40NKmrtDGKqfWdUO/fBsWBWKYFL8xs="; }; "snl".globalRedirect = "perso.crans.org/sonetlumens"; "test-melon".proxyPass = "172.16.10.150:8080"; From f9a2902025f18e5fd2bd8b0b56374112e13b55e4 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Fri, 7 Aug 2026 11:31:52 +0200 Subject: [PATCH 03/14] =?UTF-8?q?fix:=E2=80=AFd=C3=A9sactivation=20de=20l?= =?UTF-8?q?=E2=80=99indexation=20du=20pot=20de=20miel?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- modules/services/reverseproxy.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix index 874635e..f66ce0f 100644 --- a/modules/services/reverseproxy.nix +++ b/modules/services/reverseproxy.nix @@ -283,12 +283,17 @@ in # Entrée d’Anubis "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) ( entryExtraConf - // { + // rec { serverName = mkHostName vhostName mainTld; locations."/" = { proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock"; proxyWebsockets = vhostConfig.proxyWebsockets; }; + locations."/.within.website/x/cmd/anubis/api/honeypot/" = locations."/" // { + extraConfig = '' + add_header 'X-Robots-Tag' 'noindex,nofollow' always; + ''; + }; extraConfig = entryExtraConf.extraConfig + '' access_log /var/log/nginx/anubis/access.log; error_log /var/log/nginx/anubis/error.log; From 3851b8c3403088c2cc3325b8a3919855c86f06fb Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Fri, 7 Aug 2026 11:45:10 +0200 Subject: [PATCH 04/14] reverseproxy: rev=branch -> rev=commit --- hosts/vm/reverseproxy/reverseproxy.nix | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix index 2692895..0cb5191 100644 --- a/hosts/vm/reverseproxy/reverseproxy.nix +++ b/hosts/vm/reverseproxy/reverseproxy.nix @@ -176,8 +176,8 @@ let src = fetchFromCrans { repo = "site-install-party"; - rev = "master"; - hash = "sha256-KVB4m/ms0WuArrkLn05INVLqhaGxzCg30GMICI6tM5E="; + rev = "ac44f6e4387e0182f2c7dbda3eeccba0be87c9b6"; + hash = "sha256-xFwDXMmzjeIfhV5Ez1EmNfJcOSMljUZ4aycPppoLtqY="; }; build-system = with pkgs.python3Packages; [ @@ -194,8 +194,8 @@ let src = fetchFromCrans { repo = "homepage"; - rev = "master"; - hash = "sha256-e9tttzKEWcBhogQY2ITDqqTbix/zcnBAylj1eKY791E="; + rev = "51ae6b9f4d59815d14963209ff30988200eff944"; + hash = "sha256-un0LIIIFn56Zm1uF32+suc2/QrBDMRVTv/A0bOgbFJQ="; }; nativeBuildInputs = with pkgs; [ From bf2103f9d48a01045c0806b52983a4cad39786f5 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Wed, 26 Aug 2026 23:13:19 +0200 Subject: [PATCH 05/14] =?UTF-8?q?MOTD=20avec=20version=20de=20la=20flake?= =?UTF-8?q?=E2=80=AF!?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- modules/crans/users.nix | 21 ++++++++++++++++++++- modules/default.nix | 5 ++++- 2 files changed, 24 insertions(+), 2 deletions(-) diff --git a/modules/crans/users.nix b/modules/crans/users.nix index c229bf4..9c14880 100644 --- a/modules/crans/users.nix +++ b/modules/crans/users.nix @@ -1,4 +1,9 @@ -{ config, lib, ... }: +{ + config, + lib, + self, + ... +}: let cfg = config.crans.users; @@ -34,6 +39,20 @@ in users = { mutableUsers = false; + motd = + let + shortRev = self.shortRev or self.dirtyShortRev or "inconnue"; + rev = self.rev or (lib.strings.removeSuffix "-dirty" (self.dirtyRev or "inconnue")); + isDirty = !(self ? rev); + in + '' + ${ + if isDirty then "!! DIRTY !! " else "" + }Version déployée ${shortRev}, modifiée le ${self.lastModifiedDate or "??"}. + + https://gitlab.crans.org/nounous/nixos/-/commit/${rev} + ''; + users.root = { hashedPasswordFile = config.age.secrets.root-passwd-hash.path; }; diff --git a/modules/default.nix b/modules/default.nix index be2ac91..9685e31 100644 --- a/modules/default.nix +++ b/modules/default.nix @@ -1,4 +1,4 @@ -{ lib, ... }: +{ lib, self, ... }: { imports = [ @@ -25,6 +25,9 @@ cleanOnBoot = true; }; + # Version de la flake pour nixos-version --configuration-revision + system.configurationRevision = self.rev or self.dirtyRev or "inconnue"; + # Recommandé depuis le passage à 26.05 boot.zfs.forceImportAll = lib.mkDefault false; boot.zfs.forceImportRoot = lib.mkDefault false; From e35d8f35d1e607743b3d6e44ce249720b95c989f Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Tue, 28 Jul 2026 18:02:03 +0200 Subject: [PATCH 06/14] nextcloud: fix email conf --- hosts/vm/nextcloud/nextcloud.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/hosts/vm/nextcloud/nextcloud.nix b/hosts/vm/nextcloud/nextcloud.nix index 0636726..c77cf3b 100644 --- a/hosts/vm/nextcloud/nextcloud.nix +++ b/hosts/vm/nextcloud/nextcloud.nix @@ -42,8 +42,12 @@ # hodaur "172.16.10.145" ]; - }; + mail_domain = "crans.org"; + mail_from_address = "root"; + mail_smtphost = "smtp.crans.org"; + mail_smtpport = 25; + }; appstoreEnable = true; extraAppsEnable = true; From 6d1a899ab97a7cc1cc4c71b3eeb9c6b6a3cb3b37 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Mon, 3 Aug 2026 19:01:31 +0200 Subject: [PATCH 07/14] nextcloud: ajout CORS pour wiki --- hosts/vm/nextcloud/nextcloud.nix | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/hosts/vm/nextcloud/nextcloud.nix b/hosts/vm/nextcloud/nextcloud.nix index c77cf3b..ae17b0a 100644 --- a/hosts/vm/nextcloud/nextcloud.nix +++ b/hosts/vm/nextcloud/nextcloud.nix @@ -52,4 +52,17 @@ appstoreEnable = true; extraAppsEnable = true; }; + + # Activation CORS pour récuppérer les agendas depuis le wiki + services.nginx.virtualHosts.${config.services.nextcloud.hostName}.locations."~* /remote.php/dav/public-calendars/[a-z]+\?export".extraConfig = + '' + add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + if ($request_method = 'OPTIONS') { + add_header 'Access-Control-Max-Age' 86400; + add_header 'Content-Type' 'text/plain; charset=utf-8'; + add_header 'Content-Length' 0; + return 204; + } + ''; } From 72ac35f3dfa7ba1cd996d46a814cba34574bc1ea Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Mon, 3 Aug 2026 19:39:57 +0200 Subject: [PATCH 08/14] nextcloud: fix headers [add_header_redefinition] --- hosts/vm/nextcloud/nextcloud.nix | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/hosts/vm/nextcloud/nextcloud.nix b/hosts/vm/nextcloud/nextcloud.nix index ae17b0a..11dba6e 100644 --- a/hosts/vm/nextcloud/nextcloud.nix +++ b/hosts/vm/nextcloud/nextcloud.nix @@ -54,11 +54,24 @@ }; # Activation CORS pour récuppérer les agendas depuis le wiki + # On est obligé de répéter les headers communs de sécurité car ils ne sont pas au même niveau + # https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md services.nginx.virtualHosts.${config.services.nextcloud.hostName}.locations."~* /remote.php/dav/public-calendars/[a-z]+\?export".extraConfig = + let + base_headers = '' + add_header X-Content-Type-Options nosniff; + add_header X-Robots-Tag noindex, nofollow; + add_header X-Permitted-Cross-Domain-Policies none; + add_header X-Frame-Options sameorigin; + add_header Referrer-Policy no-referrer; + add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always; + add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + ''; + in '' - add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always; - add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; + ${base_headers} if ($request_method = 'OPTIONS') { + ${base_headers} add_header 'Access-Control-Max-Age' 86400; add_header 'Content-Type' 'text/plain; charset=utf-8'; add_header 'Content-Length' 0; From 01f9df7a0d3cf90bab247b4bc892e8847b388326 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Tue, 4 Aug 2026 11:55:09 +0200 Subject: [PATCH 09/14] =?UTF-8?q?nextcloud:=20CORS=20(cette=20fois=20c?= =?UTF-8?q?=E2=80=99est=20la=20bonne)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- hosts/vm/nextcloud/nextcloud.nix | 31 +++++++------------------------ 1 file changed, 7 insertions(+), 24 deletions(-) diff --git a/hosts/vm/nextcloud/nextcloud.nix b/hosts/vm/nextcloud/nextcloud.nix index 11dba6e..b4d125d 100644 --- a/hosts/vm/nextcloud/nextcloud.nix +++ b/hosts/vm/nextcloud/nextcloud.nix @@ -54,28 +54,11 @@ }; # Activation CORS pour récuppérer les agendas depuis le wiki - # On est obligé de répéter les headers communs de sécurité car ils ne sont pas au même niveau - # https://github.com/yandex/gixy/blob/master/docs/en/plugins/addheaderredefinition.md - services.nginx.virtualHosts.${config.services.nextcloud.hostName}.locations."~* /remote.php/dav/public-calendars/[a-z]+\?export".extraConfig = - let - base_headers = '' - add_header X-Content-Type-Options nosniff; - add_header X-Robots-Tag noindex, nofollow; - add_header X-Permitted-Cross-Domain-Policies none; - add_header X-Frame-Options sameorigin; - add_header Referrer-Policy no-referrer; - add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always; - add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS' always; - ''; - in - '' - ${base_headers} - if ($request_method = 'OPTIONS') { - ${base_headers} - add_header 'Access-Control-Max-Age' 86400; - add_header 'Content-Type' 'text/plain; charset=utf-8'; - add_header 'Content-Length' 0; - return 204; - } - ''; + # TODO: à mettre que sur /remote.php/dav/public-calendars/ pour éviter des requêtes malveillantes depuis le wiki. + services.nginx.virtualHosts.${config.services.nextcloud.hostName}.extraConfig = '' + add_header 'Access-Control-Allow-Origin' 'https://mediawiki.crans.org' always; + add_header 'Access-Control-Allow-Methods' 'GET' always; + add_header 'Access-Control-Allow-Credentials' 'false' always; + add_header 'Vary' 'Origin' always; + ''; } From ba4be3b122281ad2c8d589196ad31d910259b54c Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Sun, 9 Aug 2026 15:07:55 +0200 Subject: [PATCH 10/14] nextcloud: force https --- hosts/vm/nextcloud/nextcloud.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/hosts/vm/nextcloud/nextcloud.nix b/hosts/vm/nextcloud/nextcloud.nix index b4d125d..e0e0bf1 100644 --- a/hosts/vm/nextcloud/nextcloud.nix +++ b/hosts/vm/nextcloud/nextcloud.nix @@ -20,7 +20,7 @@ configureRedis = true; hostName = "nextcloud.crans.org"; - https = false; + https = true; maxUploadSize = "4G"; From 2af010216a67dcadce1e5f4d95ff4a505eca5dd2 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Wed, 19 Aug 2026 22:42:20 +0200 Subject: [PATCH 11/14] nginx: set real ip --- modules/services/nginx.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/modules/services/nginx.nix b/modules/services/nginx.nix index b15423d..ec78fdd 100644 --- a/modules/services/nginx.nix +++ b/modules/services/nginx.nix @@ -6,5 +6,13 @@ recommendedOptimisation = true; clientMaxBodySize = "512M"; + + # On trust nos ip internes pour bien indiquer le client au bout + # i.e. on considère pas le reverseproxy comme notre client + appendHttpConfig = '' + set_real_ip_from 172.16.0.0/16; + set_real_ip_from fd00::/56; + real_ip_header X-Real-Ip; + ''; }; } From 29804eeb9cf44f4d4cef3a021601d6b2abd2c3c7 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Fri, 28 Aug 2026 11:52:26 +0200 Subject: [PATCH 12/14] Ajout script auto.fs --- hosts/vm/nextcloud/default.nix | 81 +++++++++++++++++++++-- hosts/vm/nextcloud/nextcloud.nix | 5 ++ secrets/nextcloud/nextcloud_ldap_pass.age | 34 ++++++++++ 3 files changed, 113 insertions(+), 7 deletions(-) create mode 100644 secrets/nextcloud/nextcloud_ldap_pass.age diff --git a/hosts/vm/nextcloud/default.nix b/hosts/vm/nextcloud/default.nix index 99c1ae6..5f9a1fa 100644 --- a/hosts/vm/nextcloud/default.nix +++ b/hosts/vm/nextcloud/default.nix @@ -1,4 +1,4 @@ -{ pkgs, ... }: +{ pkgs, config, ... }: { imports = [ @@ -28,13 +28,80 @@ resticClient.enable = false; }; - services.autofs = { - enable = true; + services.autofs = + let + autoMaster = pkgs.writeScript "home-nextcloud" '' + #!/usr/bin/env bash + USER=$(echo $1 | sed "s/_[1-9]*$//") - autoMaster = '' - /home-nextcloud /etc/auto.master.d/home-nextcloud.sh -t60 - ''; - }; + UHOME=/home-adh/$USER + + USERID=$(ldapsearch -LLL -b "dc=crans,dc=org" -H ldap://172.16.10.157 -D "cn=admin,dc=crans,dc=org" -y ${config.age.secrets.nextcloud_ldap_pass.path} "uid=$USER" uidNumber | grep uidNumber | awk '{print $2}') + UGROUP=$(ldapsearch -LLL -b "dc=crans,dc=org" -H ldap://172.16.10.157 -D "cn=admin,dc=crans,dc=org" -y ${config.age.secrets.nextcloud_ldap_pass.path} "uid=$USER" gidNumber | grep gidNumber | awk '{print $2}') + + # On quitte si l'utilisateur $USER n'existe pas + if [ -z "$USERID" ]; then + logger -p local0.error -t autofs "user $USER n'existe pas" + exit 1 + fi + + # Rafraîchi les stats du dossier + ls ''\${UHOME}/NextCloud/ &>/dev/null || /bin/ls ''\${UHOME} &>/dev/null + + # Création du lien symbolique Nextcloud s'il n'existe pas + if [ ! -e "''\${UHOME}/NextCloud" ] || ! ( + find ''\${UHOME}/NextCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} | + grep -q ''\${UHOME}/NextCloud/ + ); then + if [ ! -e "''\${UHOME}/NextCloud" ]; then + ln -fs OwnCloud ''\${UHOME}/NextCloud + fi + + if [ ! -e "''\${UHOME}/NextCloud" ] || ! ( + find ''\${UHOME}/NextCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} | + grep -q ''\${UHOME}/NextCloud/ + ); then + logger -p local0.error -t autofs "impossible de créer le lien symbolique ''\${UHOME}/NextCloud" + exit 1 + fi + + logger -p local0.info -t autofs "Lien symbolique ''\${UHOME}/NextCloud -> ''\${UHOME}/OwnCloud créé" + fi + + # Création du dossier OwnCloud s'il n'existe pas ou n'appartient pas a l'utilisateur + if [ ! -d "''\${UHOME}/OwnCloud" ] || ! ( + find ''\${UHOME}/OwnCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} | + grep -q ''\${UHOME}/OwnCloud/ + ); then + if [ ! -d "''\${UHOME}/OwnCloud" ]; then + mkdir ''\${UHOME}/OwnCloud + fi + chmod 700 ''\${UHOME}/OwnCloud && + chown $USERID:''\${UGROUP} ''\${UHOME}/OwnCloud + + if [ ! -d "''\${UHOME}/OwnCloud" ] || ! ( + find ''\${UHOME}/OwnCloud/ -maxdepth 0 -user $USERID -group ''\${UGROUP} | + grep -q ''\${UHOME}/OwnCloud/ + ); then + logger -p local0.error -t autofs "impossible de créer le dossier ''\${UHOME}/OwnCloud" + exit 1 + fi + + logger -p local0.info -t autofs "Dossier ''\${UHOME}/OwnCloud créé" + fi + + chmod 750 /home-nextcloud && + chown nextcloud:nextcloud /home-nextcloud && + echo "-fstype=fuse.bindfs,map=$USERID/nextcloud:@$UGROUP/@nextcloud,resolve-symlinks,allow_other :''\${UHOME}/NextCloud" + ''; + in + { + enable = true; + + autoMaster = '' + /home-nextcloud ${autoMaster} -t60 + ''; + }; programs.fuse.userAllowOther = true; systemd.services.autofs = { diff --git a/hosts/vm/nextcloud/nextcloud.nix b/hosts/vm/nextcloud/nextcloud.nix index e0e0bf1..9ae0031 100644 --- a/hosts/vm/nextcloud/nextcloud.nix +++ b/hosts/vm/nextcloud/nextcloud.nix @@ -12,6 +12,9 @@ owner = "nextcloud"; group = "nextcloud"; }; + nextcloud_ldap_pass = { + file = ../../../secrets/nextcloud/nextcloud_ldap_pass.age; + }; }; services.nextcloud = { @@ -41,6 +44,8 @@ trusted_proxies = [ # hodaur "172.16.10.145" + # reverseproxy + "172.16.10.151" ]; mail_domain = "crans.org"; diff --git a/secrets/nextcloud/nextcloud_ldap_pass.age b/secrets/nextcloud/nextcloud_ldap_pass.age new file mode 100644 index 0000000..131f5c2 --- /dev/null +++ b/secrets/nextcloud/nextcloud_ldap_pass.age @@ -0,0 +1,34 @@ +age-encryption.org/v1 +-> ssh-ed25519 APVFfA fL5Pu7eaaIaEXvmU0IMAi09iqYfd3jUzWTSjJohj8R8 +DIK3kfFZRrCWjHnphBqtAKanvsX5s5IR+KBqgRg12yY +-> piv-p256 ewCc3w Aj0Lf5GPZAdHDKKw47MZ5s3FjikxN4Cd7gtv2h6rVV63 +2Ml0ZA/rS+yp6Bg2H9mhZAxLZdcs1iAiC0JKI+mFcCw +-> piv-p256 6CL/Pw A3z/96JwMoCKX0Gm3JDCa4cSfKmvYm4f+6FsEY+6LmLz +dh+ksufqr0KXDNYnZ2AUOF324Asp+oVpMHOM5oVhAdw +-> ssh-ed25519 eOAUSg 8yuY7bBFYdqGo06axuKiBOcPu0az2nM/MFhDa9xl9C8 +gfPbBZNUiT3Ax94npu1qNmO5v66+6ouMobO0RNs90dY +-> ssh-rsa REaZBA +EtJT0echOhz7t1bJuAR+/7R0VP81a1HH3XdO/Bn+N+EY4QBeYkqS2b7jBVsrllzW +iEL5AqKUz/yMg5iouwLR3YKb8+k6lbxK5liNOmebF1W1l8vK+e05RuNB9cNLYpcB +t5cXB9FID6fg+Gl6uc9aEuKwSEAd+V67M0IEoTNN2GuoAUr27Dawr7Zk3kIqoDUL +M6WoMwUVS9z6fyHqWtqnu8czamw6rTyHbMQD+lQQjruMSpPhI4HxbRWoX00T9Iu+ +FEniGLJLYwreRxqhedNNhTAOfkfVOGymjE8ZpAVGoS4Nxxg+u+5OMK+fhlPRt43M +MI4nr8gbvBWaNTEi4fBZkyCBkYt7XATbPVHeQS9W7tcAXvHBD7EgQ6cDYbZmJwZK +pdxV6vOjenOD73WmYo5rsGbZD3UzsGKBoe0mK6kZDA4ZGuPy03Y9F0lwf+AT6zS4 +G9hq4WOLQgaLhmgI6qtFkv9GtMVRRsGd4FnLBERNhQ3F2rB+TJggPAXfxaUToLbu + +-> ssh-ed25519 J/iReg ud0671a019HkCCQZCV1YqnG6nYH/ziIVGy+e+i9L8Xw +d++NdfUVxcl5NW3LH1ZbfxNe2kehPkZYA4RZMGWc8nU +-> ssh-ed25519 GNhSGw KiHYxkz+hIFnzdIDN/+UN6YAHru7SP/29HKSUFn0zTQ +kQvPDAeGW1GnZE+EQl784b4l2vCW9aepqhanXvCFlxY +-> ssh-ed25519 eXMAtA 8fVRDZkpYH2OyNvbnv5PxoNx8LsqagNYUPMfVXu4RD0 +P9VNb8AyM2R7EB1TFznL+CbDCxDYKvi3K/PYT8C8BP0 +-> ssh-ed25519 5hXocQ 7PqwxuOo6n/KeuXCYHkU/gaYV9qpkVLU/EQ2GBmD5y8 +NIX/Pxp/UW14iJf4oqaDlIyXhiGmgKRnqyyFjLfNKaA +-> ssh-ed25519 bRHVVA btmYmpxdOPeE/lL4J3stGX+rm2WM/vNumh81PGtv8D4 +X5ibu1gAoM7Gf89rLL9Bj54iJpOrkGSE74axOKQvqfw +-> ssh-ed25519 HgW9eA BbHGdYZYkip537IxufeKJoLaxbgijBDd9WXafwrEEQM +ArZJKVOCtrM8+1tlMe+U9CJJWAeV34ph+Gjeea32FEI +--- uXR+zL5hHC92bgFa7hAU33FZ2KBllilBFmjsERtEQ3U +sˎ0 +6E;{K2Rx9V 0 \ No newline at end of file From a43fabc8d05ea69577c937fe84761fb70f0263b6 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Sat, 29 Aug 2026 11:46:43 +0200 Subject: [PATCH 13/14] fix newline --- hosts/vm/nextcloud/nextcloud.nix | 1 + secrets/nextcloud/nextcloud_ldap_pass.age | 61 +++++++++++------------ 2 files changed, 31 insertions(+), 31 deletions(-) diff --git a/hosts/vm/nextcloud/nextcloud.nix b/hosts/vm/nextcloud/nextcloud.nix index 9ae0031..b006469 100644 --- a/hosts/vm/nextcloud/nextcloud.nix +++ b/hosts/vm/nextcloud/nextcloud.nix @@ -12,6 +12,7 @@ owner = "nextcloud"; group = "nextcloud"; }; + # Attention : sensible au retour à la ligne final (il n’en faut pas) ! nextcloud_ldap_pass = { file = ../../../secrets/nextcloud/nextcloud_ldap_pass.age; }; diff --git a/secrets/nextcloud/nextcloud_ldap_pass.age b/secrets/nextcloud/nextcloud_ldap_pass.age index 131f5c2..57f58dc 100644 --- a/secrets/nextcloud/nextcloud_ldap_pass.age +++ b/secrets/nextcloud/nextcloud_ldap_pass.age @@ -1,34 +1,33 @@ age-encryption.org/v1 --> ssh-ed25519 APVFfA fL5Pu7eaaIaEXvmU0IMAi09iqYfd3jUzWTSjJohj8R8 -DIK3kfFZRrCWjHnphBqtAKanvsX5s5IR+KBqgRg12yY --> piv-p256 ewCc3w Aj0Lf5GPZAdHDKKw47MZ5s3FjikxN4Cd7gtv2h6rVV63 -2Ml0ZA/rS+yp6Bg2H9mhZAxLZdcs1iAiC0JKI+mFcCw --> piv-p256 6CL/Pw A3z/96JwMoCKX0Gm3JDCa4cSfKmvYm4f+6FsEY+6LmLz -dh+ksufqr0KXDNYnZ2AUOF324Asp+oVpMHOM5oVhAdw --> ssh-ed25519 eOAUSg 8yuY7bBFYdqGo06axuKiBOcPu0az2nM/MFhDa9xl9C8 -gfPbBZNUiT3Ax94npu1qNmO5v66+6ouMobO0RNs90dY +-> ssh-ed25519 APVFfA Z+0daNofon4xgikMa0TUQjUgp9jPPrQkOZJuEJDUmzM +l/QeEQvggQtfgyrDcs9lRpvuFMEgn9i/wQFpuaVoAZ0 +-> piv-p256 ewCc3w AzbC2uqqhtetX1z1XlyVxexejzk8tvPNi/3rcGgOyMSZ +cpl1dYYvqgkXbpvy0JcVabP7Ftb7cGY+IahV/yyDbhs +-> piv-p256 6CL/Pw AixE5HedgCUVyin52g5YHUQFKaSr7hlF9LfsmbQPMf1l +loUpO6pz/Qv+F0mSefpCP3IeDeJ/pq5hYlzacdAtlo4 +-> ssh-ed25519 eOAUSg b49cZWhT7+NLJlrH9EyWu6GPLkST9/T5BGU1azdQoBI +dhzYN+L3k8CZRMbVgff1ofqlImyuD19PUGhhsxTHaMY -> ssh-rsa REaZBA -EtJT0echOhz7t1bJuAR+/7R0VP81a1HH3XdO/Bn+N+EY4QBeYkqS2b7jBVsrllzW -iEL5AqKUz/yMg5iouwLR3YKb8+k6lbxK5liNOmebF1W1l8vK+e05RuNB9cNLYpcB -t5cXB9FID6fg+Gl6uc9aEuKwSEAd+V67M0IEoTNN2GuoAUr27Dawr7Zk3kIqoDUL -M6WoMwUVS9z6fyHqWtqnu8czamw6rTyHbMQD+lQQjruMSpPhI4HxbRWoX00T9Iu+ -FEniGLJLYwreRxqhedNNhTAOfkfVOGymjE8ZpAVGoS4Nxxg+u+5OMK+fhlPRt43M -MI4nr8gbvBWaNTEi4fBZkyCBkYt7XATbPVHeQS9W7tcAXvHBD7EgQ6cDYbZmJwZK -pdxV6vOjenOD73WmYo5rsGbZD3UzsGKBoe0mK6kZDA4ZGuPy03Y9F0lwf+AT6zS4 -G9hq4WOLQgaLhmgI6qtFkv9GtMVRRsGd4FnLBERNhQ3F2rB+TJggPAXfxaUToLbu +CWiPTj/40DTjN2GWUsR92frMYiBP7tfSVADQ/+GCapOMNJD91MGxaiK0IocbJr0P +KpOjfdjRDG8KIYszNgaS8XkHn/CUj2KsnRV2WBg3HWSrMdD4quoOxKWbFaU3b38C +4mUK8gIkjbJFWFMSTOhAexHGYSRLl7fG/0VmRvc2ibs5CahbPsMbFDKuto7ApYhY +e/t5SsYgIkbrNpeTLolO943YCIlU/JVP5XOuEDk1ZlKPRc+igpgqFjsD3LsV56Rr +LFrjp4i5wJeA72HeH/S7nP96sAwxyLDHQrWhw3ntM0n2SRRVCVmLqNNOebUL59gy +HRHHoZosepmHzMEOHQ+CrIxuYMiUQ/AyMkZmMTjxQsLniakJWI06G54f1+aaA0F9 +BhwFateWkLBNdkSdwqJpBAzh427yetzp/bac8dcTv45ylgsvCVSDpoew5NLoIuh5 +I/54NC6Pr5BF0LOW7b2fR9pzk7Rv6hnSxTbeyATeMhh7nTjdcFalUI3Bd1P3RL+i --> ssh-ed25519 J/iReg ud0671a019HkCCQZCV1YqnG6nYH/ziIVGy+e+i9L8Xw -d++NdfUVxcl5NW3LH1ZbfxNe2kehPkZYA4RZMGWc8nU --> ssh-ed25519 GNhSGw KiHYxkz+hIFnzdIDN/+UN6YAHru7SP/29HKSUFn0zTQ -kQvPDAeGW1GnZE+EQl784b4l2vCW9aepqhanXvCFlxY --> ssh-ed25519 eXMAtA 8fVRDZkpYH2OyNvbnv5PxoNx8LsqagNYUPMfVXu4RD0 -P9VNb8AyM2R7EB1TFznL+CbDCxDYKvi3K/PYT8C8BP0 --> ssh-ed25519 5hXocQ 7PqwxuOo6n/KeuXCYHkU/gaYV9qpkVLU/EQ2GBmD5y8 -NIX/Pxp/UW14iJf4oqaDlIyXhiGmgKRnqyyFjLfNKaA --> ssh-ed25519 bRHVVA btmYmpxdOPeE/lL4J3stGX+rm2WM/vNumh81PGtv8D4 -X5ibu1gAoM7Gf89rLL9Bj54iJpOrkGSE74axOKQvqfw --> ssh-ed25519 HgW9eA BbHGdYZYkip537IxufeKJoLaxbgijBDd9WXafwrEEQM -ArZJKVOCtrM8+1tlMe+U9CJJWAeV34ph+Gjeea32FEI ---- uXR+zL5hHC92bgFa7hAU33FZ2KBllilBFmjsERtEQ3U -sˎ0 -6E;{K2Rx9V 0 \ No newline at end of file +-> ssh-ed25519 J/iReg wbkKYkdu/cxnZNEGXH0a5R5jV6cQlMpWFMdQiUpWTiQ +cW3rZQMYrzhx93lsxoPhA8AVQLygKytSue3eEF/yxcc +-> ssh-ed25519 GNhSGw Hd4AOis8kPKDKrOgRZNj9pG0bHFHgLfJwo6sd1/dSFg +07UA5cZbEpf3pA7i04CDX6m9FZF5ahAorfp5GzXJSS4 +-> ssh-ed25519 eXMAtA hZ278rlg0u1Bp8rkEQGFagLYg3lkXK3uSolnUbIy0Bo +k2sPaUhiCCaBUogPxrUk3Fm386DKuR7UBrGMAteykps +-> ssh-ed25519 5hXocQ sYQmrGm4eQlgE4Lkn+ZFE4uI6czxM46SMpQHFRedtQU +cIFA9Vk091Q5hFUUrjf6PRr/WS7XN1BfgpSOZN1m0xI +-> ssh-ed25519 bRHVVA 2n976nXhvJzoFjP+JFe6L1rmCEmTr4YwhTR1rqyA1y4 +/X27rYKrHUB0Jltxc190yPXCiHlOXX3QEXM52BnON60 +-> ssh-ed25519 HgW9eA nNf/0O1vh6+uv5i1+HEy6MgF3VUImMru8BFCcJY7R1s +fPSK5LcFR6WP25nFvJRs9RatiJ4t/LvIFYqdoOYxu/k +--- QKKNQqbCPvtps4QlI3ric0JdAcdJ9g3QkTPj+RUGAis +[xqZSDcO fk N;H]IɣAA \ No newline at end of file From 452c275074f406e8ae6393c68cff4db80a1167c7 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Sat, 29 Aug 2026 15:43:02 +0200 Subject: [PATCH 14/14] =?UTF-8?q?Anubis=E2=80=AF:=20ne=20pas=20refresh=20s?= =?UTF-8?q?yst=C3=A9matiquement=20en=20changeant=20de=20site?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- hosts/vm/reverseproxy/reverseproxy.nix | 23 ++++++++++++------ modules/services/reverseproxy.nix | 28 +++++++++++++++++----- secrets/reverseproxy/anubis-secret.age | 33 ++++++++++++++++++++++++++ 3 files changed, 71 insertions(+), 13 deletions(-) create mode 100644 secrets/reverseproxy/anubis-secret.age diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix index 0cb5191..c262998 100644 --- a/hosts/vm/reverseproxy/reverseproxy.nix +++ b/hosts/vm/reverseproxy/reverseproxy.nix @@ -194,8 +194,8 @@ let src = fetchFromCrans { repo = "homepage"; - rev = "51ae6b9f4d59815d14963209ff30988200eff944"; - hash = "sha256-un0LIIIFn56Zm1uF32+suc2/QrBDMRVTv/A0bOgbFJQ="; + rev = "a71446ad7c125241835190a4035159bc7be751bc"; + hash = "sha256-dAKJpBnGeDtv0UM8gXsdqUCzbliskRMYUEQ1KGCW1Cw="; }; nativeBuildInputs = with pkgs; [ @@ -293,8 +293,8 @@ in "re2o-dev".proxyPass = "172.16.10.166"; "services".serveLocalFiles = fetchFromCrans { repo = "services-page"; - rev = "ef5e998a09d298e75a94daae089f65407d40e331"; - hash = "sha256-GzFmU+U9OzZ0m40NKmrtDGKqfWdUO/fBsWBWKYFL8xs="; + rev = "e32ac21513d88e5123eb4138835453df64aa21d0"; + hash = "sha256-nc4IjA/wtj7WXnt0wZqGymGz/NR45STlMLbsTdnSzJ0="; }; "snl".globalRedirect = "perso.crans.org/sonetlumens"; "test-melon".proxyPass = "172.16.10.150:8080"; @@ -313,9 +313,9 @@ in proxyPass = "172.16.10.161"; serverAliases = [ "wikipedia" ]; }; - "www" = { + "_crans-org" = { serveLocalFiles = homepagePkg; - serverAliases = [ "." ]; + serverAliases = [ "www" ]; }; "zero".proxyPass = "172.16.10.130"; }; @@ -325,5 +325,14 @@ in acme.enable = true; }; }; - services.nginx.virtualHosts."www-alias-crans.org".default = true; + + # Règle particulières + services.nginx.virtualHosts = { + "www-alias-crans.org".default = true; + + "_crans-org".locations = { + "/_matrix/".proxyPass = "https://matrix.crans.org/_matrix/"; + "/_synapse/".proxyPass = "https://matrix.crans.org/_synapse/"; + }; + }; } diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix index f66ce0f..23146c3 100644 --- a/modules/services/reverseproxy.nix +++ b/modules/services/reverseproxy.nix @@ -20,6 +20,8 @@ let mkOption types ; + + mkHostName = als: tld: if als == "_crans-org" then "crans.${tld}" else "${als}.crans.${tld}"; in { @@ -158,11 +160,19 @@ in }; }; + age.secrets.anubis-secret = { + file = ../../secrets/reverseproxy/anubis-secret.age; + owner = "anubis"; + }; + services = mkIf cfg.enable { anubis = { defaultOptions.group = "nginx"; instances = lib.mapAttrs ( vhostName: vhostConfig: + let + hostname = mkHostName vhostName mainTld; + in mkIf (vhostConfig.anubisConfig != null) { enable = true; settings = { @@ -170,9 +180,14 @@ in BIND_NETWORK = "unix"; METRICS_BIND = "/run/anubis/anubis-${vhostName}/anubis-${vhostName}-metrics.sock"; TARGET = "unix:///run/nginx/nginx-${vhostName}.sock"; - COOKIE_DOMAIN = "crans.${mainTld}"; - REDIRECT_DOMAINS = "${vhostName}.crans.${mainTld}"; + COOKIE_DOMAIN = hostname; + # TODO: db pour mettre en commun les token. + # Transitoirement on les sépare + COOKIE_PREFIX = "anubis-${vhostName}"; + REDIRECT_DOMAINS = hostname; SOCKET_MODE = "0660"; + # Secret partagé entre les instances + ED25519_PRIVATE_KEY_HEX_FILE = config.age.secrets.anubis-secret.path; # OpenGraph config OG_PASSTHROUGH = vhostConfig.anubisOpenGraph; OG_EXPIRY_TIME = "24h"; @@ -215,6 +230,8 @@ in configVhost = vhostName: vhostConfig: let + hostname = mkHostName vhostName mainTld; + sslConf = { forceSSL = !vhostConfig.httpOnly; rejectSSL = vhostConfig.httpOnly; @@ -254,7 +271,6 @@ in ''; # Les alias : vhostName × otherTld U serverAliases × allTld - mkHostName = als: tld: if als == "." then "crans.${tld}" else "${als}.crans.${tld}"; aliases = lib.foldr ( @@ -270,7 +286,7 @@ in { # Configuration du service à proxy. "${vhostName}" = vhostExtraConf // { - serverName = mkHostName vhostName mainTld; + serverName = hostname; locations."/" = mkIf (vhostConfig.proxyPass != null) { proxyPass = "http://${vhostConfig.proxyPass}"; proxyWebsockets = vhostConfig.proxyWebsockets; @@ -284,7 +300,7 @@ in "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) ( entryExtraConf // rec { - serverName = mkHostName vhostName mainTld; + serverName = hostname; locations."/" = { proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock"; proxyWebsockets = vhostConfig.proxyWebsockets; @@ -306,7 +322,7 @@ in lib.map (alias: { "${vhostName}-alias-${alias}" = sslConf // { serverName = alias; - globalRedirect = lib.defaultTo "${vhostName}.crans.${mainTld}" vhostConfig.globalRedirect; + globalRedirect = lib.defaultTo hostname vhostConfig.globalRedirect; extraConfig = logHostConf; }; }) aliases diff --git a/secrets/reverseproxy/anubis-secret.age b/secrets/reverseproxy/anubis-secret.age new file mode 100644 index 0000000..578c302 --- /dev/null +++ b/secrets/reverseproxy/anubis-secret.age @@ -0,0 +1,33 @@ +age-encryption.org/v1 +-> ssh-ed25519 GCcVXA qD1f4YdP88JvuPLS6H416O0LF+rKN/gJ+gPf0lFWIRs +B0LuHjXX0UiHHTwY7v1HqP4VF5/5yn0d/gNW4zUOC5w +-> piv-p256 ewCc3w A8Wnjz7tLNpV/m5bUzuq/MBTHn+jQiaCSUb4vFvGDH7N +gNBEsgdHogaz3OSJBelB39bGrOBt8+hkNXpAYcFcy28 +-> piv-p256 6CL/Pw AoJBcpyhK+hpZOfHOBUHh0Kivvn6YJ4xepo7IWppbMuJ +f1fwsu8okH7F+6nSHowxHpTdtjU72lvd6FmwFIMmV8E +-> ssh-ed25519 eOAUSg 0bH2dDdNzKapr54HKndKJpKO5iTQtbhY957NIJQcvBo +LYVsTuKNsE4JlBxbf2e+Qo9ZjRxnz6saEHEjyfCcAjc +-> ssh-rsa REaZBA +Pho7O15lWd5/2Uy1OQmA/JzE0wmOji6IPKGj03nK9aYSQjsTTc30YhNCrkddglGX +MCClDyGDlQ0mCwHKVfpFeeSC9VQWQDDYk90dM4MF//6hHPqU/zn8dR25NyxDgyyi +DVrCFB+S09LsKI4isbDoCru6fWXfdN4Fj8I44c64dBpIVh4XhSzUtmlzmge//35C +y6EvAjVIhVTbbgnQ5CJFgnRlSPaN5BHDq76aJ3c+8Ajkjowa2YcYu7w8asi7PsIs +WH6J2qMIPvPdxOEKczGc401ysUfz9fNFKs0Xx4spduwv8I3Sv4ImURDkYmCl/k7J +rwRXbUGr8JzZu093cmkjVxDrSfb9VhqlZVJD7uc2VSTk8ntwStLWafSuE03bIN2L +on0t/4/wXtvFtwlGoDe9QGYAJpPYWM0ZUPMZfpddOz9vYvL1+6nUcDroLMvCIItI +blwJZ0970K/Je99SmI3+6mUEAw8nJ/pBFaF/LmTJecypLEalLNsu2IALyCMIdTa0 + +-> ssh-ed25519 J/iReg fpgi4t31rVl+KvOYd0Ph0Nd2gInJAZXNhQC5ekpv0kI +lznh3YwmqVr05vjWxf1HKRWAFZGXbypAYygjUe+ELlk +-> ssh-ed25519 GNhSGw 2cVptD/h5NWcYsjPPwQcP/b9tjJPDbhjDKh2hKhA5GM +JZvQvXkb1RRw+NHnJ+HMV5tlwiBnLf4+cwm6J2hZD9Y +-> ssh-ed25519 eXMAtA axP3hHgfgWJScGLIGpYgu0iYW1qZRQzMK9XjIeszrnc +rBzAqSVoRqj/drZSOlxSIZLgZZU/wqGML1gKCEHtcy4 +-> ssh-ed25519 5hXocQ b3kjoM+FfQ434V7X8FdpIHVFjTn4sc+psj+9jyRljxU +l5rna7ap0ydVXPCSr4qrPnu2MV2n7XwoSh/T87OkuMU +-> ssh-ed25519 bRHVVA 92Rj1gMmueSHWzxsKWVs+7nF4JzuekhfaB2u5AWnazk +yg4qa9lyHsGCOXWOTm7/XH9F8JzvRLjzsxyXe88oXnE +-> ssh-ed25519 HgW9eA mpIFRqMXj08JuyYLf6Hx4p9fOLbxXZquSMAjh0e/lSU +h1kvwnu+mLOeRfVFUXgE9IDo/MQ+4gtkYwrF3JWQfwY +--- MCDm2NH5NWgwnFYQ+zJ4obfdxWpiv3BGohnIJ1bRkco +_ֹ`FvF3[;197%490M[Ip:s|CR6,C;[;