-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathapache.nix
453 lines (402 loc) · 64 KB
/
apache.nix
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
{ toplevel
, config
, pkgs
, lib
, options
, wsName
, mkUniqueUser
, mkUniqueGroup
, apache
, ...
}:
with lib;
{
options.webserver.apache = {
package = mkOption {
type = types.package;
default = pkgs.apacheHttpd;
defaultText = "pkgs.apacheHttpd";
description = ''
Overridable attribute of the Apache HTTP Server package to use.
'';
};
extraConfig = mkOption {
type = types.lines;
default = "";
description = ''
Cnfiguration lines appended to the generated Apache
configuration file.
'';
};
extraModules = mkOption {
type = types.listOf types.unspecified;
default = [ ];
example = literalExample ''[ "proxy_connect" { name = "php5"; path = "''${pkgs.php}/modules/libphp5.so"; } ]'';
description = ''
Additional Apache modules to be used. These can be
specified as a string in the case of modules distributed
with Apache, or as an attribute set specifying the
<varname>name</varname> and <varname>path</varname> of the
module.
'';
};
logPerVirtualHost = mkOption {
type = types.bool;
default = false;
description = ''
If enabled, each virtual host gets its own
<filename>access_log</filename> and
<filename>error_log</filename>, namely suffixed by the
<option>hostName</option> of the virtual host.
'';
};
logFormat = mkOption {
type = types.str;
default = "agent";
description = ''
Can be set to `combined`, `common`, `referer`, `agent` or `none`.
''; #'
};
enableMellon = mkOption {
type = types.bool;
default = false;
description = "Whether to enable the mod_auth_mellon module.";
};
phpPackage = mkOption {
type = types.package;
default = pkgs.php;
defaultText = "pkgs.php";
description = ''
Overridable attribute of the PHP package to use.
'';
};
enablePHP = lib.mkOption {
type = lib.types.bool;
default = false;
description = "Whether to enable the PHP module.";
};
phpOptions = mkOption {
type = types.lines;
default = "";
example =
''
date.timezone = "CET"
'';
description =
"Options appended to the PHP configuration file <filename>php.ini</filename>.";
};
multiProcessingModule = mkOption {
type = types.str;
default = "prefork";
example = "worker";
description =
''
Multi-processing module to be used by Apache. Available
modules are <literal>prefork</literal> (the default;
handles each request in a separate child process),
<literal>worker</literal> (hybrid approach that starts a
number of child processes each running a number of
threads) and <literal>event</literal> (a recent variant of
<literal>worker</literal> that handles persistent
connections more efficiently).
'';
};
maxClients = mkOption {
type = types.int;
default = 30;
example = 8;
description = "Maximum number of apache processes (prefork)";
};
maxRequestsPerChild = mkOption {
type = types.int;
default = 0;
example = 500;
description =
"Maximum number of apache requests answered per apache child (prefork), 0 means unlimited";
};
adminAddr = mkOption {
default = null;
#type = types.str;
description = "Email address of the admin/person responsible for this service.";
};
robotsEntries = mkOption {
type = types.lines;
default = "";
description = ''
Lines to put into the <filename>robots.txt</filename> file.
'';
};
};
config =
let
httpd = config.webserver.apache.package.out;
version24 = !versionOlder httpd.version "2.4";
in
mkIf (config.webserver.variant == "apache" && config.enable) {
_module.args.apache = {
allDenied =
if version24 then ''
Require all denied
'' else ''
Order deny,allow
Deny from all
'';
allGranted =
if version24 then ''
Require all granted
'' else ''
Order allow,deny
Allow from all
'';
};
directories = lib.genAttrs [ "log" "runtime" ] (lib.const {
permissions.defaultDirectoryMode = "0750";
permissions.others.noAccess = true;
owner = mkUniqueUser config.webserver.user;
group = mkUniqueGroup config.webserver.group;
instance.before = [ "webserver-init.service" "instance-init.target" ];
});
webserver.init = ''
#set -e
#set +o pipefail
# BUG: check if that code makes any sense
# Get rid of old semaphores. These tend to accumulate across
# server restarts, eventually preventing it from restarting
# successfully.
for i in $(${pkgs.utillinux}/bin/ipcs -s | grep ' ${mkUniqueUser config.webserver.user} ' | cut -f2 -d ' '); do
${pkgs.utillinux}/bin/ipcrm -s $i
done
'';
systemd.services.apache =
let
fileName = "${config.uniqueName}.conf";
checkAndFormatApacheConfigfile = (import lib/apache_check_config.nix { inherit lib pkgs; }).checkAndFormatApacheConfigfile {
configFile = apacheConfigFile;
inherit fileName;
};
apacheConfigFile = pkgs.writeText fileName ''
ServerRoot ${httpd}
${optionalString version24 ''
DefaultRuntimeDir ${config.stateDir}/runtime
''}
PidFile ${config.runtimeDir}/apache.pid
${optionalString (config.webserver.apache.multiProcessingModule != "prefork") ''
# mod_cgid requires this.
ScriptSock ${config.runtimeDir}/cgisock
''}
<IfModule prefork.c>
MaxClients ${toString config.webserver.apache.maxClients}
MaxRequestsPerChild ${toString config.webserver.apache.maxRequestsPerChild}
</IfModule>
Listen *:${toString config.proxyOptions.port}
#Listen unix:/var/run/nginx.sock
User ${mkUniqueUser config.webserver.user}
Group ${mkUniqueGroup config.webserver.group}
${let
load = { name, path }: "LoadModule ${name}_module ${path}\n";
allModules = [ ]
++ map (name: { inherit name; path = "${httpd}/modules/mod_${name}.so"; }) apacheModules
++ optional config.webserver.apache.enableMellon { name = "auth_mellon"; path = "${pkgs.apacheHttpdPackages.mod_auth_mellon}/modules/mod_auth_mellon.so"; }
++ optional config.webserver.apache.enablePHP { name = "php${phpMajorVersion}"; path = "${php}/modules/libphp${phpMajorVersion}.so"; }
++ extraForeignModules
++ config.webserver.apache.extraModules;
in
concatMapStrings load allModules
}
AddHandler type-map var
<Files ~ "^\.ht">
${apache.allDenied}
</Files>
${mimeConf}
${loggingConf}
${browserHacks}
Include ${httpd}/conf/extra/httpd-default.conf
Include ${httpd}/conf/extra/httpd-autoindex.conf
Include ${httpd}/conf/extra/httpd-multilang-errordoc.conf
Include ${httpd}/conf/extra/httpd-languages.conf
${if config.webserver.apache.adminAddr != null then ''
ServerAdmin ${config.webserver.apache.adminAddr}
'' else ""}
# Fascist default - deny access to everything.
<Directory />
Options FollowSymLinks
AllowOverride None
${apache.allDenied}
</Directory>
# But do allow access to files in the store so that we don't have
# to generate <Directory> clauses for every generated file that we
# want to serve.
<Directory /nix/store>
${apache.allGranted}
</Directory>
ServerName "${config.uniqueName}"
${optionalString (robotsTxt != "") ''
Alias /robots.txt ${pkgs.writeText "robots.txt" robotsTxt}
''}
${config.webserver.apache.extraConfig}
'';
robotsTxt = config.webserver.apache.robotsEntries;
php = config.webserver.apache.phpPackage.override { apacheHttpd = httpd.dev; /* otherwise it only gets .out */ };
phpMajorVersion = head (splitString "." php.version);
phpOptions = ''
; Needed for PHP's mail() function.
sendmail_path = sendmail -t -i
${optionalString (toplevel.config.time.timeZone != null) ''
date.timezone = "${toplevel.config.time.timeZone}"
''}
'';
# FIXME: assumption is that none of these work, should probably be config.webserver
extraForeignModules = filter isAttrs config.webserver.apache.extraModules;
extraApacheModules = filter isString config.webserver.apache.extraModules;
# !!! should be in lib
writeTextInDir = name: text:
pkgs.runCommand name { inherit text; } "mkdir -p $out; echo -n \"$text\" > $out/$name";
# Names of modules from ${httpd}/modules that we want to load.
apacheModules =
[
# HTTP authentication mechanisms: basic and digest.
"auth_basic"
"auth_digest"
# Authentication: is the user who he claims to be?
"authn_file"
"authn_dbm"
"authn_anon"
(if version24 then "authn_core" else "authn_alias")
# Authorization: is the user allowed access?
"authz_user"
"authz_groupfile"
"authz_host"
# Other modules.
"ext_filter"
"include"
"log_config"
"env"
"mime_magic"
"cern_meta"
"expires"
"headers"
"usertrack" /* "unique_id" */
"setenvif"
"mime"
"dav"
"status"
"autoindex"
"asis"
"info"
"dav_fs"
"vhost_alias"
"negotiation"
"dir"
"imagemap"
"actions"
"speling"
"userdir"
"alias"
"rewrite"
"proxy"
"proxy_http"
]
++ optionals version24 [
"mpm_${config.webserver.apache.multiProcessingModule}"
"authz_core"
"unixd"
"cache"
"cache_disk"
"slotmem_shm"
"socache_shmcb"
# For compatibility with old configurations, the new module mod_access_compat is provided.
"access_compat"
]
++ (if config.webserver.apache.multiProcessingModule == "prefork" then [ "cgi" ] else [ "cgid" ])
++ extraApacheModules;
loggingConf = (if config.webserver.apache.logFormat != "none" then ''
ErrorLog ${config.stateDir}/log/error_log
LogLevel notice
LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common
LogFormat "%{Referer}i -> %U" referer
LogFormat "%{User-agent}i" agent
CustomLog ${config.stateDir}/log/access_log ${config.webserver.apache.logFormat}
'' else ''
ErrorLog /dev/null
'');
browserHacks = ''
BrowserMatch "Mozilla/2" nokeepalive
BrowserMatch "MSIE 4\.0b2;" nokeepalive downgrade-1.0 force-response-1.0
BrowserMatch "RealPlayer 4\.0" force-response-1.0
BrowserMatch "Java/1\.0" force-response-1.0
BrowserMatch "JDK/1\.0" force-response-1.0
BrowserMatch "Microsoft Data Access Internet Publishing Provider" redirect-carefully
BrowserMatch "^WebDrive" redirect-carefully
BrowserMatch "^WebDAVFS/1.[012]" redirect-carefully
BrowserMatch "^gnome-vfs" redirect-carefully
'';
mimeConf = ''
TypesConfig ${httpd}/conf/mime.types
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
AddType application/x-httpd-php .php .phtml
<IfModule mod_mime_magic.c>
MIMEMagicFile ${httpd}/conf/magic
</IfModule>
'';
# Generate the PHP configuration file. Should probably be factored
# out into a separate module.
phpIni =
let
# PHP versions below 7.2 are bundled with PCRE versions below 8.41 and
# thus almost all of the preg_* functions will most likely not match
# when the JIT compiler is enabled.
#
# The reason for this is that PCRE 8.41 has changed the stack layout to
# a top-down stack and for some reason I haven't figured out yet the
# stack gets shared between the Apache SAPI and PHP's bundled module.
disablePcreJit = ''
echo "pcre.jit=0" >> "$out"
'';
contents = ''
cat ${php}/etc/php.ini > $out
echo "$options" >> $out
'' + optionalString (versionOlder php.version "7.2") disablePcreJit;
in
pkgs.runCommand "php.ini"
{
options = concatStringsSep "\n" [
phpOptions
config.webserver.apache.phpOptions
];
}
contents;
in
{
description = "${config.uniqueName} main service (Apache HTTPD)";
wantedBy = [ "multi-user.target" ];
wants = [ "keys.target" ];
after = [ "network.target" "fs.target" "keys.target" ];
instance.after = [ "database.target" "webserver-init.service" ];
path =
[ config.webserver.apache.package.out pkgs.coreutils pkgs.gnugrep ]
++ config.webserver.systemPackages
++ # Needed for PHP's mail() function. !!! Probably the
# ssmtp module should export the path to sendmail in
# some way.
optional toplevel.config.networking.defaultMailServer.directDelivery pkgs.ssmtp;
environment =
optionalAttrs config.webserver.apache.enablePHP { PHPRC = phpIni; }
// optionalAttrs config.webserver.apache.enableMellon { LD_LIBRARY_PATH = "${pkgs.xmlsec}/lib"; };
serviceConfig = {
ExecStart = "@${httpd}/bin/httpd httpd -f ${checkAndFormatApacheConfigfile}/${fileName}";
ExecStop = "${httpd}/bin/httpd -f ${checkAndFormatApacheConfigfile}/${fileName} -k graceful-stop";
ExecReload = "${httpd}/bin/httpd -f ${checkAndFormatApacheConfigfile}/${fileName} -k graceful";
Type = "forking";
PIDFile = "${config.runtimeDir}/apache.pid";
Restart = "always";
RestartSec = "5s";
User = config.webserver.user;
Group = config.webserver.group;
PermissionsStartOnly = true;
PrivateTmp = config.webserver.privateTmp;
};
};
};
}