nixos/hosts/vm/reverseproxy/reverseproxy.nix

{
  pkgs,
  ...
}:

let
  formatJSON = pkgs.formats.json { };
  formatYAML = pkgs.formats.yaml { };

  antiBot = formatYAML.generate "antibot.yaml" [
    {
      name = "whitelist-crans";
      action = "ALLOW";
      remote_addresses = [
        "185.230.79.0/22"
        "2a0c:700::/32"
        "46.105.102.188/32"
        "2001:41d0:2:d5bc::/128"
      ];
    }
    {
      # On refuse les bots qui font souvent de la merde.
      # https://github.com/TecharoHQ/anubis/blob/main/data/bots/_deny-pathological.yaml
      import = "(data)/bots/_deny-pathological.yaml";
    }
    {
      # allow google-inspection pour indexer les pages
      name = "google-inspection-tool";
      action = "ALLOW";
      user_agent_regex = ".*Google-InspectionTool.*";
    }
    {
      # On autorise les indexers des moteurs de recherche.
      # https://github.com/TecharoHQ/anubis/blob/main/data/crawlers/_allow-good.yaml
      import = "(data)/crawlers/_allow-good.yaml";
    }
    {
      # On autorise l'accès à favicon, robots.txt, well-known, ...
      # https://github.com/TecharoHQ/anubis/blob/main/data/common/keep-internet-working.yaml
      import = "(data)/common/keep-internet-working.yaml";
    }
    {
      # On refuse si userAgent = ""
      # https://github.com/TecharoHQ/anubis/blob/main/data/common/rfc-violations.yaml
      import = "(data)/common/rfc-violations.yaml";
    }
    {
      # On bloque les AI aggressivement (bots/agent, training et user search par IA)
      # https://github.com/TecharoHQ/anubis/blob/main/data/meta/ai-block-aggressive.yaml
      import = "(data)/meta/ai-block-aggressive.yaml";
    }
  ];

  anubisChallenge = formatJSON.generate "anubis_challenge.json" {
    "bots" = [
      {
        import = "${antiBot}";
      }
      {
        name = "challenge-other";
        path_regex = "^*";
        action = "CHALLENGE";
      }
    ];
  };

  anubisAllowOther = formatJSON.generate "anubis_allow.json" {
    "bots" = [
      {
        import = "${antiBot}";
      }
      {
        name = "allow-other";
        path_regex = "^*";
        action = "ALLOW";
      }
    ];
  };

  anubisPerso = formatJSON.generate "anubis_perso.json" {
    "bots" = [
      {
        import = "${antiBot}";
      }
      {
        name = "allow-public";
        path_regex = "^/[a-zA-Z0-9_-]*/public/.*";
        action = "ALLOW";
      }
      {
        name = "allow-phpmyadmin";
        path_regex = "^/phpmyadmin/.*";
        action = "ALLOW";
      }
      {
        # geneau utilisait ses pages persos avant la mise en place d'Anubis.
        # Le déploiement d'Anubis l'a impacté (cf les mails de fin 2025).
        # À titre transitoire, il a été décidé en décembre 2025 de faire une
        # exception pour lui permettre de continuer son utilisation des pages
        # persos en attente d'une meilleure méthode.
        name = "allow-geneau";
        path_regex = "^/geneau/.*";
        action = "ALLOW";
      }
      {
        import = "${antiBot}";
      }
      {
        name = "challenge-other";
        path_regex = "^.*";
        action = "CHALLENGE";
      }
    ];
  };

  anubisMirrors = formatJSON.generate "anubis_mirrors.json" {
    "bots" = [
      {
        import = "${antiBot}";
      }
      {
        name = "deny-other";
        path_regex = ".*cdimage-.*";
        action = "ALLOW";
      }
      {
        name = "allow-repo";
        path_regex = "^...*";
        action = "ALLOW";
      }
      {
        name = "deny-other";
        path_regex = ".*";
        action = "CHALLENGE";
      }
    ];
  };

  anubisWiki = formatJSON.generate "anubis_wiki.json" {
    "bots" = [
      {
        import = "${antiBot}";
      }
      {
        name = "allow-mediawiki-images";
        path_regex = "^/w/images/.*";
        action = "ALLOW";
      }
      {
        name = "allow-mediawiki-api";
        path_regex = "^/w/api.php.*";
        action = "ALLOW";
      }
      {
        name = "challenge-other";
        path_regex = ".*";
        action = "CHALLENGE";
      }
    ];
  };

  fetchFromCrans =
    opts:
    pkgs.fetchFromGitLab (
      {
        domain = "gitlab.adm.crans.org";
        owner = "nounous";
      }
      // opts
    );

  installPartySite = pkgs.python3Packages.buildPythonApplication {
    name = "site-install-party";
    pyproject = false;

    src = fetchFromCrans {
      repo = "site-install-party";
      rev = "master";
      hash = "sha256-KVB4m/ms0WuArrkLn05INVLqhaGxzCg30GMICI6tM5E=";
    };

    build-system = with pkgs.python3Packages; [
      mkdocs
      mkdocs-material
    ];
    buildPhase = ''
      python3 -m mkdocs -- build -d $out
    '';
  };

  homepagePkg = pkgs.stdenv.mkDerivation {
    name = "site-homepage";

    src = fetchFromCrans {
      repo = "homepage";
      rev = "master";
      hash = "sha256-e9tttzKEWcBhogQY2ITDqqTbix/zcnBAylj1eKY791E=";
    };

    nativeBuildInputs = with pkgs; [
      hugo
    ];

    buildPhase = ''
      hugo build -d $out
    '';
  };
in
{
  crans = {
    reverseProxy = {
      enable = true;
      virtualHosts = {
        "autoconfig".serveLocalFiles = ./staticsites/autoconfig;
        "cas".proxyPass = "172.16.10.120";
        "collabora" = {
          proxyPass = "172.16.10.149";
          proxyWebsockets = true;
        };
        "eclat" = {
          anubisConfig = "${anubisMirrors}";
          httpOnly = true;
          proxyPass = "172.16.10.104";
        };
        "eclats" = {
          anubisConfig = "${anubisMirrors}";
          proxyPass = "172.16.10.104";
        };
        "element".proxyPass = "172.16.10.118";
        "ethercalc" = {
          proxyPass = "172.16.10.133:8000";
          serverAliases = [ "excel" ];
        };
        "framadate".proxyPass = "172.16.10.109";
        "grafana" = {
          proxyPass = "172.16.10.121:3000";
          serverAliases = [ "fyre" ];
        };
        "imprimante" = {
          proxyPass = "172.16.10.131";
          serverAliases = [ "helloworld" ];
        };
        "intranet" = {
          proxyPass = "172.16.10.156";
          serverAliases = [ "re2o" ];
        };
        "install-party" = {
          anubisConfig = "${anubisChallenge}";
          serveLocalFiles = installPartySite;
          serverAliases = [
            "i-p"
            "adopteunmanchot"
            "adopteunpingouin"
          ];
        };
        "lists" = {
          anubisConfig = "${anubisChallenge}";
          proxyPass = "172.16.10.110";
        };
        "mediawiki" = {
          anubisConfig = "${anubisWiki}";
          proxyPass = "172.16.10.144";
          serverAliases = [ "mediakiwi" ];
        };
        "mirrors" = {
          anubisConfig = "${anubisMirrors}";
          proxyPass = "172.16.10.104";
        };
        "mirror" = {
          anubisConfig = "${anubisMirrors}";
          httpOnly = true;
          proxyPass = "172.16.10.104";
        };
        "nekorale".globalRedirect = "perso.crans.org/club-nekorale";
        "nextcloud".proxyPass = "172.16.10.146";
        "owncloud".proxyPass = "172.16.10.136";
        "pad".proxyPass = "172.16.10.130:9001";
        "pdf" = {
          proxyPass = "172.16.10.140";
          serverAliases = [
            "livre"
            "stirling"
            "stirling-pdf"
          ];
        };
        "perso" = {
          anubisConfig = "${anubisPerso}";
          proxyPass = "172.16.10.31";
          serverAliases = [ "clubs" ];
        };
        "pot-vieux".globalRedirect = "perso.crans.org/club-vieux";
        "re2o-dev".proxyPass = "172.16.10.166";
        "services".serveLocalFiles = fetchFromCrans {
          repo = "services-page";
          rev = "master";
          hash = "sha256-ov4r6Oeta+vRcEv8bp7lFQg+2n4JTG4buetram5kN08=";
        };
        "snl".globalRedirect = "perso.crans.org/sonetlumens";
        "tmpad".proxyPass = "172.16.10.130:9002";
        "vaultwarden" = {
          proxyPass = "172.16.10.159";
          serverAliases = [ "pass" ];
        };
        "webirc".proxyPass = "172.16.10.31:9000";
        "webmail" = {
          proxyPass = "172.16.10.107";
          serverAliases = [ "roundcube" ];
        };
        "wiki" = {
          anubisConfig = "${anubisChallenge}";
          proxyPass = "172.16.10.161";
          serverAliases = [ "wikipedia" ];
        };
        "www" = {
          serveLocalFiles = homepagePkg;
          serverAliases = [ "." ];
        };
        "zero".proxyPass = "172.16.10.130";
      };
    };

    services = {
      acme.enable = true;
    };
  };
  services.nginx.virtualHosts."www-alias-crans.org".default = true;
}