machines/fanny/configuration.nix

@@ -148,6 +148,7 @@ in
     "pretalx"
     "antamap" 
     "ns1"
+    "wordpress"
   ];
 
   networking = {
@@ -313,6 +314,21 @@ in
         '';
       };
     };
+
+    virtualHosts."www.rm16bleibt.org" = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://${hosts.malobeo.hosts.wordpress.network.address}:80";
+        recommendedProxySettings = true;
+        extraConfig = ''
+          proxy_set_header Host $host;
+          proxy_set_header X-Forwarded-Port 443;
+          proxy_set_header X-Forwarded-Proto https;
+        '';
+      };
+    };
+
     virtualHosts."cache.malobeo.org" = {
       forceSSL = true;
       enableACME = true;

machines/fanny/dyndns.nix

@@ -8,9 +8,11 @@
       KEYCLOUD=$(cat /run/secrets/njalacloud)
       KEYZINES=$(cat /run/secrets/njalazines)
       KEYANATAMAP=$(cat /run/secrets/njalaantamap)
+      KEYRM16=$(cat /run/secrets/njalarm16)
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=cloud.malobeo.org&k="$KEYCLOUD"&auto"
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=zines.malobeo.org&k="$KEYZINES"&auto"
       ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=antamap.malobeo.org&k="$KEYANATAMAP"&auto"
+      ${pkgs.curl}/bin/curl --fail --silent --show-error "https://njal.la/update/?h=www.rm16bleibt.org&k="$KEYRM16"&auto"
     '';
     serviceConfig = {
       Type = "oneshot";

machines/hosts.nix

@@ -133,7 +133,12 @@ in
         network = createMaloNet "20" "52:DA:0D:F9:EF:F6";
       };
 
-      # last host id: 20
+      wordpress = {
+        type = "microvm";
+        network = createMaloNet "21" "52:DA:0D:F9:EF:F6";
+      };
+
+      # last host id: 21
     };
   };
 }

machines/wordpress/configuration.nix

@@ -0,0 +1,139 @@
+{ config, lib, pkgs, inputs, ... }:
+
+# 1. copy wp folder to host
+# 2. chown nginx:nginx wordpress.bak/rm16bleibt.org/* -R
+# 3. create user through webinterface
+# 4. delete hello world post
+# 5. run importer
+
+with lib;
+
+let
+
+  user = "wordpress";
+  stateDir = "/var/lib/wordpress/rm16bleibt.org";
+  webserver = config.services.nginx;
+  uploadsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/uploads";
+  fontsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/fonts";
+
+in {
+  networking = {
+    hostName = mkDefault "wordpress";
+    useDHCP = false;
+  };
+
+  imports = [
+    inputs.self.nixosModules.malobeo.users
+    ../modules/sshd.nix
+  ];
+
+  malobeo.users = {
+    malobeo = false;
+    admin = true;
+  };
+
+  users.users.wordpress = {
+    group = webserver.group;
+    isSystemUser = true;
+  };
+
+  systemd.tmpfiles.rules = [
+    "d '${stateDir}' 0750 ${user} ${webserver.group} - -"
+    "d '${stateDir}/wp-content' 0750 ${user} ${webserver.group} - -"
+    "d '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
+    "Z '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
+    "d '${fontsDir}' 0750 ${user} ${webserver.group} - -"
+    "Z '${fontsDir}' 0750 ${user} ${webserver.group} - -"
+  ];
+
+  services.phpfpm.pools = {
+    "wordpress-rm16bleibt.org" = {
+      user = user;
+      group = webserver.group;
+      settings = {
+        "pm" = "dynamic";
+        "pm.max_children" = 32;
+        "pm.start_servers" = 2;
+        "pm.min_spare_servers" = 2;
+        "pm.max_spare_servers" = 4;
+        "pm.max_requests" = 500;
+        "listen.owner" = webserver.user;
+        "listen.group" = webserver.group;
+      };
+    };
+  };
+
+  services.mysql = {
+    enable = true;
+    #package = mkDefault pkgs.mariadb;
+    package = pkgs.mysql84;
+    ensureDatabases = ["wordpress"];
+    ensureUsers = [
+      {
+        name = "wordpress";
+        ensurePermissions = {
+          "wordpress.*" = "ALL PRIVILEGES";
+        };
+      }
+    ];
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."rm16bleibt.org" = {
+      #serverName = "rm16bleibt.org";
+      root = "/var/lib/wordpress/rm16bleibt.org";
+      extraConfig = ''
+        index index.php;
+      '';
+      locations = {
+        "/" = {
+          priority = 200;
+          extraConfig = ''
+            try_files $uri $uri/ /index.php$is_args$args;
+          '';
+        };
+        "~ \\.php$" = {
+          priority = 500;
+          extraConfig = ''
+            fastcgi_split_path_info ^(.+\.php)(/.+)$;
+            fastcgi_pass unix:${config.services.phpfpm.pools."wordpress-rm16bleibt.org".socket};
+            fastcgi_index index.php;
+            include "${config.services.nginx.package}/conf/fastcgi.conf";
+            fastcgi_param PATH_INFO $fastcgi_path_info;
+            fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
+
+            # Mitigate https://httpoxy.org/ vulnerabilities
+            fastcgi_param HTTP_PROXY "";
+            fastcgi_intercept_errors off;
+            fastcgi_buffer_size 16k;
+            fastcgi_buffers 4 16k;
+            fastcgi_connect_timeout 300;
+            fastcgi_send_timeout 300;
+            fastcgi_read_timeout 300;
+          '';
+        };
+        "~ /\\." = {
+          priority = 800;
+          extraConfig = "deny all;";
+        };
+        "~* /(?:uploads|files)/.*\\.php$" = {
+          priority = 900;
+          extraConfig = "deny all;";
+        };
+        "~* \\.(js|css|png|jpg|jpeg|gif|ico)$" = {
+          priority = 1000;
+          extraConfig = ''
+            expires max;
+            log_not_found off;
+          '';
+        };
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 ];
+
+  system.stateVersion = "22.11"; # Did you read the comment?
+}
+