From ad6720fe82a9e7703ccb86664cfbd1471b6ce15c Mon Sep 17 00:00:00 2001 From: nyanloutre Date: Thu, 12 Apr 2018 20:36:46 +0200 Subject: [PATCH] Modularisation HAproxy --- haproxy-acme.nix | 113 +++++++++++++++++++++++++++++++++++++++++++++++ services.nix | 102 ++++++------------------------------------ 2 files changed, 126 insertions(+), 89 deletions(-) create mode 100644 haproxy-acme.nix diff --git a/haproxy-acme.nix b/haproxy-acme.nix new file mode 100644 index 000000000..221babf54 --- /dev/null +++ b/haproxy-acme.nix @@ -0,0 +1,113 @@ +{ lib, config, pkgs, ... }: + +with lib; + +let + cfg = config.services.haproxy-acme; + + nginx_port = 54321; +in +{ + options.services.haproxy-acme = { + enable = mkEnableOption "HAproxy + ACME"; + + domaine = mkOption { + type = types.string; + example = "example.com"; + description = '' + Sous domaine à utiliser + + Il est necessaire d'avoir un enregistrement pointant sur la wildcard de ce domaine vers le serveur + ''; + }; + + services = mkOption { + type = types.attrsOf types.attrs; + example = '' + haproxy_backends = { + example = { ip = "127.0.0.1"; port = 1234; auth = false; }; + }; + ''; + description = "Liste des noms de domaines associés à leur backend"; + }; + }; + + config = mkIf cfg.enable { + + services.haproxy.enable = true; + + services.haproxy.config = " +global + log /dev/log local0 + log /dev/log local1 notice + user haproxy + group haproxy + ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 + ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets + ssl-default-server-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 + ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets +defaults + option forwardfor + option http-server-close + timeout client 10s + timeout connect 4s + timeout server 30s +userlist LOUTRE + user paul password $6$6rDdCtzSVsAwB6KP$V8bR7KP7FSL2BSEh6n3op6iYhAnsVSPI2Ar3H6MwKrJ/lZRzUI8a0TwVBD2JPnAntUhLpmRudrvdq2Ls2odAy. +frontend public + bind :::80 v4v6 + bind :::443 v4v6 ssl crt /var/lib/acme/${cfg.domaine}/full.pem + mode http + acl letsencrypt-acl path_beg /.well-known/acme-challenge/ + redirect scheme https code 301 if !{ ssl_fc } !letsencrypt-acl + use_backend letsencrypt-backend if letsencrypt-acl + +${concatStrings ( + mapAttrsToList (name: value: + " acl ${name}-acl hdr(host) -i ${name}.${cfg.domaine}\n" + + " use_backend ${name}-backend if ${name}-acl\n" + ) cfg.services)} + +backend letsencrypt-backend + mode http + server letsencrypt 127.0.0.1:${toString nginx_port} + +${concatStrings ( + mapAttrsToList (name: value: + '' + backend ${name}-backend + mode http + server ${name} ${value.ip}:${toString value.port} + ${(if value.auth then ( + "\n acl AuthOK_LOUTRE http_auth(LOUTRE)\n" + + " http-request auth realm LOUTRE if !AuthOK_LOUTRE\n" + ) else "")} + + '' + ) cfg.services)} + "; + + services.nginx.enable = true; + services.nginx.virtualHosts = { + "acme" = { + listen = [ { addr = "127.0.0.1"; port = nginx_port; } ]; + locations = { "/" = { root = "/var/www/challenges"; }; }; + }; + }; + + security.acme.certs = { + ${cfg.domaine} = { + extraDomains = mapAttrs' (name: value: + nameValuePair ("${name}.${cfg.domaine}") (null) + ) cfg.services; + webroot = "/var/www/challenges/"; + email = "paul@nyanlout.re"; + user = "haproxy"; + group = "haproxy"; + postRun = "systemctl reload haproxy"; + }; + }; + security.acme.directory = "/var/lib/acme"; + + }; +} diff --git a/services.nix b/services.nix index f86758bae..a539a6827 100644 --- a/services.nix +++ b/services.nix @@ -3,8 +3,18 @@ with lib; let + domaine = "tars.nyanlout.re"; +in - haproxy_backends = { +{ + imports = [ + ./haproxy-acme.nix + ./mail-server.nix + ]; + + services.haproxy-acme.enable = true; + services.haproxy-acme.domaine = domaine; + services.haproxy-acme.services = { grafana = { ip = "127.0.0.1"; port = 3000; auth = false; }; emby = { ip = "127.0.0.1"; port = 8096; auth = false; }; radarr = { ip = "127.0.0.1"; port = 7878; auth = false; }; @@ -13,91 +23,8 @@ let syncthing = { ip = "127.0.0.1"; port = 8384; auth = true; }; }; - domaine = "tars.nyanlout.re"; - -in - -{ - imports = [ - ./mail-server.nix - ]; - - services.haproxy.enable = true; - - services.haproxy.config = '' - global - log /dev/log local0 - log /dev/log local1 notice - user haproxy - group haproxy - ssl-default-bind-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 - ssl-default-bind-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets - ssl-default-server-ciphers ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256 - ssl-default-server-options no-sslv3 no-tlsv10 no-tlsv11 no-tls-tickets - defaults - option forwardfor - option http-server-close - timeout client 10s - timeout connect 4s - timeout server 30s - userlist LOUTRE - user paul password $6$6rDdCtzSVsAwB6KP$V8bR7KP7FSL2BSEh6n3op6iYhAnsVSPI2Ar3H6MwKrJ/lZRzUI8a0TwVBD2JPnAntUhLpmRudrvdq2Ls2odAy. - frontend public - bind :::80 v4v6 - bind :::443 v4v6 ssl crt /var/lib/acme/${domaine}/full.pem - mode http - acl letsencrypt-acl path_beg /.well-known/acme-challenge/ - redirect scheme https code 301 if !{ ssl_fc } !letsencrypt-acl - use_backend letsencrypt-backend if letsencrypt-acl - - ${concatStrings ( - mapAttrsToList (name: value: - " - acl ${name}-acl hdr(host) -i ${name}.${domaine} - use_backend ${name}-backend if ${name}-acl - ") haproxy_backends)} - - backend letsencrypt-backend - mode http - server letsencrypt 127.0.0.1:54321 - - ${concatStrings ( - mapAttrsToList (name: value: - '' - -backend ${name}-backend - mode http - server ${name} ${value.ip}:${toString value.port} - ${(if value.auth then ( - " - acl AuthOK_LOUTRE http_auth(LOUTRE) - http-request auth realm LOUTRE if !AuthOK_LOUTRE - ") else "")} - '' - ) haproxy_backends)} - ''; - - services.nginx.enable = true; - services.nginx.virtualHosts = { - "acme" = { - listen = [ { addr = "127.0.0.1"; port = 54321; } ]; - locations = { "/" = { root = "/var/www/challenges"; }; }; - }; - }; - - security.acme.certs = { - ${domaine} = { - extraDomains = mapAttrs' (name: value: - nameValuePair ("${name}.${domaine}") (null) - ) haproxy_backends; - webroot = "/var/www/challenges/"; - email = "paul@nyanlout.re"; - user = "haproxy"; - group = "haproxy"; - postRun = "systemctl reload haproxy"; - }; - }; - security.acme.directory = "/var/lib/acme"; + services.mailserver.enable = true; + services.mailserver.domaine = domaine; services.influxdb.enable = true; services.influxdb.dataDir = "/var/db/influxdb"; @@ -166,9 +93,6 @@ backend ${name}-backend services.murmur.imgMsgLength = 0; services.murmur.textMsgLength = 0; - services.mailserver.enable = true; - services.mailserver.domaine = domaine; - networking.firewall.allowedTCPPorts = [ 80 443 # HAProxy # 111 2049 4000 4001 4002 # NFS