Sites statics et SSL

hosts/vm/reverseproxy/reverseproxy.nix

@@ -135,7 +135,7 @@ let
     opts:
     pkgs.fetchFromGitLab (
       {
-        domain = "gitlab.adm.crans.org";
+        domain = "gitlab.crans.org";
         owner = "nounous";
       }
       // opts
@@ -156,10 +156,26 @@ let
       mkdocs-material
     ];
     buildPhase = ''
-      python3 -m mkdocs -- build -d build
+      python3 -m mkdocs -- build -d $out
     '';
-    installPhase = ''
-      mv build $out
+  };
+
+  homepagePkg = pkgs.stdenv.mkDerivation {
+    name = "site-homepage";
+
+    src = fetchFromCrans {
+      repo = "homepage";
+      rev = "master";
+      hash = "sha256-e9tttzKEWcBhogQY2ITDqqTbix/zcnBAylj1eKY791E=";
+    };
+
+    nativeBuildInputs = with pkgs; [
+      hugo
+      git
+    ];
+
+    buildPhase = ''
+      hugo build -d $out
     '';
   };
 in
@@ -231,6 +247,12 @@ in
             "wikipedia"
           ];
         };
+        "www" = {
+          serveLocalFiles = homepagePkg;
+          serverAliases = [
+            "."
+          ];
+        };
       };
     };
 

modules/services/acme.nix

@@ -24,12 +24,17 @@ in
         dnsPropagationCheck = false;
       };
 
-      certs."crans.org" = {
+      certs."all.crans.all" = {
         domain = "*.crans.org";
         dnsProvider = "rfc2136";
         # Contient le serveur à contacter avec le protocole
         # et le mot de passe
         environmentFile = config.age.secrets.acme-env.path;
+        extraDomainNames = [
+          "*.crans.fr"
+          "*.crans.eu"
+        ];
+        group = config.services.nginx.group;
       };
     };
   };

modules/services/reverseproxy.nix

@@ -129,6 +129,24 @@ in
       wantedBy = [ "multi-user.target" ];
     }) cfg.virtualHosts;
 
+    # On fait un certificat commun pour tous les hosts
+    security.acme.certs."all.crans.all" = {
+      domain = "*.crans.${mainTld}";
+      dnsProvider = "rfc2136";
+      # Contient le serveur à contacter avec le protocole
+      # et le mot de passe
+      environmentFile = config.age.secrets.acme-env.path;
+      extraDomainNames =
+        lib.concatMap (tld: [
+          "*.crans.${tld}"
+          "crans.${tld}"
+        ]) otherTld
+        ++ [
+          "crans.${mainTld}"
+        ];
+      group = config.services.nginx.group;
+    };
+
     services = mkIf cfg.enable {
       anubis = {
         defaultOptions.group = "nginx";
@@ -141,8 +159,8 @@ in
               BIND_NETWORK = "unix";
               METRICS_BIND = "/run/anubis/anubis-${vhostName}/anubis-${vhostName}-metrics.sock";
               TARGET = "unix:///run/nginx/nginx-${vhostName}.sock";
-              COOKIE_DOMAIN = "crans.org";
-              REDIRECT_DOMAINS = "${vhostName}.crans.org";
+              COOKIE_DOMAIN = "crans.${mainTld}";
+              REDIRECT_DOMAINS = "${vhostName}.crans.${mainTld}";
               SOCKET_MODE = "0660";
               # OpenGraph config
               OG_PASSTHROUGH = vhostConfig.anubisOpenGraph;
@@ -161,9 +179,10 @@ in
             vhostName: vhostConfig:
             let
               sslConf = {
-                enableACME = !vhostConfig.httpOnly;
                 forceSSL = !vhostConfig.httpOnly;
                 rejectSSL = vhostConfig.httpOnly;
+                useACMEHost = mkIf (!vhostConfig.httpOnly) "all.crans.all";
+                acmeRoot = null;
               };
 
               # Conf pour l’hôte en entrée
@@ -193,22 +212,23 @@ in
                   entryExtraConf;
 
               # Les alias : vhostName × otherTld U serverAliases × allTld
+              mkHostName = als: tld: if als == "." then "crans.${tld}" else "${als}.crans.${tld}";
               aliases =
                 lib.foldr
                   (
                     tld: acc:
                     acc
-                    ++ (lib.foldr (alias: acc: acc ++ [ "${alias}.crans.${tld}" ]) [
-                      "${vhostName}.crans.${tld}"
+                    ++ (lib.foldr (alias: acc: acc ++ [ (mkHostName alias tld) ]) [
+                      (mkHostName vhostName tld)
                     ] vhostConfig.serverAliases)
                   )
-                  (lib.foldr (alias: acc: acc ++ [ "${alias}.crans.${mainTld}" ]) [ ] vhostConfig.serverAliases)
+                  (lib.foldr (alias: acc: acc ++ [ (mkHostName alias mainTld) ]) [ ] vhostConfig.serverAliases)
                   otherTld;
             in
             {
               # Configuration du service à proxy.
               "${vhostName}" = vhostExtraConf // {
-                serverName = "${vhostName}.crans.${mainTld}";
+                serverName = mkHostName vhostName mainTld;
                 locations."/" = mkIf (vhostConfig.proxyPass != null) {
                   proxyPass = "http://${vhostConfig.proxyPass}";
                   proxyWebsockets = vhostConfig.proxyWebsockets;
@@ -221,7 +241,7 @@ in
               "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) (
                 entryExtraConf
                 // {
-                  serverName = "${vhostName}.crans.${mainTld}";
+                  serverName = mkHostName vhostName mainTld;
                   locations."/" = {
                     proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock";
                     proxyWebsockets = vhostConfig.proxyWebsockets;