WIP: bekkalokk: init mediawiki

flake.nix

@@ -80,6 +80,7 @@
           (final: prev: {
             heimdal = final.callPackage ./packages/heimdal { };
             mediawiki-extensions = final.callPackage ./packages/mediawiki-extensions { };
+            simplesamlphp = final.callPackage ./packages/simplesamlphp { };
           })
         ];
       };

hosts/bekkalokk/configuration.nix

@@ -15,6 +15,7 @@
     ./services/kerberos
     ./services/webmail
     ./services/mediawiki
+    ./services/idp-simplesamlphp
   ];
 
   sops.defaultSopsFile = ../../secrets/bekkalokk/bekkalokk.yaml;

hosts/bekkalokk/services/idp-simplesamlphp/authsources.php

@@ -0,0 +1,11 @@
+<?php
+$config = array(
+
+    /* This is the name of this authentication source, and will be used to access it later. */
+    'default-sp' => array(
+        'saml:SP',
+        # 'entityID' => 'https://wiki.pvv.ntnu.no/',
+        'entityID' => 'https://bekkalokk.pvv.ntnu.no/',
+        'idp' => 'https://idp.pvv.ntnu.no/',
+    ),
+);

hosts/bekkalokk/services/idp-simplesamlphp/default.nix

@@ -0,0 +1,58 @@
+{ config, pkgs, lib, ... }:
+let
+  package = pkgs.simplesamlphp.override {
+    authsourcesFile = ./authsources.php;
+    saml20-idp-remoteFile = ./saml20-idp-remote.php;
+    configFile = pkgs.runCommandLocal "simplesamlphp-config.php" { } ''
+      cp ${./config.php} "$out"
+
+      substituteInPlace "$out" \
+        --replace '$SAML_COOKIE_SECURE' 'true' \
+        --replace '$SAML_COOKIE_SALT' '"asdfasdfasjdf"' \
+        --replace '$SAML_ADMIN_PASSWORD' '"asdfasdfasdf"' \
+        --replace '$SAML_TRUSTED_DOMAINS' 'array( "bekkalokk.pvv.ntnu.no" )'
+    '';
+  };
+in
+{
+  services.phpfpm.pools.idp = {
+    user = "root";
+    group = "root";
+    settings = let
+      listenUser = config.services.nginx.user;
+      listenGroup = config.services.nginx.group;
+    in {
+      "pm" = "dynamic";
+      "pm.max_children" = 32;
+      "pm.max_requests" = 500;
+      "pm.start_servers" = 2;
+      "pm.min_spare_servers" = 2;
+      "pm.max_spare_servers" = 4;
+      "listen.owner" = listenUser;
+      "listen.group" = listenGroup;
+
+      "catch_workers_output" = true;
+      "php_admin_flag[log_errors]" = true;
+      # "php_admin_value[error_log]" = "stderr";
+    };
+  };
+
+  services.nginx.virtualHosts."idp2.pvv.ntnu.no" = {
+    forceSSL = true;
+    enableACME = true;
+    root = "${package}/share/php/simplesamlphp";
+    locations =  {
+      "/".index = "index.php";
+
+      "~ /(.+\\.php)" = {
+        extraConfig = ''
+          fastcgi_split_path_info ^(.+\.php)(/.+)$;
+          fastcgi_index index.php;
+          fastcgi_pass unix:${config.services.phpfpm.pools.idp.socket};
+          include ${pkgs.nginx}/conf/fastcgi_params;
+          include ${pkgs.nginx}/conf/fastcgi.conf;
+        '';
+      };
+    };
+  };
+}

hosts/bekkalokk/services/idp-simplesamlphp/saml20-idp-remote.php

@@ -0,0 +1,23 @@
+<?php
+$metadata['https://idp.pvv.ntnu.no/'] = array (
+  'metadata-set' => 'saml20-idp-remote',
+  'entityid' => 'https://idp.pvv.ntnu.no/',
+  'SingleSignOnService' => 
+  array (
+    0 => 
+    array (
+      'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
+      'Location' => 'https://idp.pvv.ntnu.no/simplesaml/saml2/idp/SSOService.php',
+    ),
+  ),
+  'SingleLogoutService' => 
+  array (
+    0 => 
+    array (
+      'Binding' => 'urn:oasis:names:tc:SAML:2.0:bindings:HTTP-Redirect',
+      'Location' => 'https://idp.pvv.ntnu.no/simplesaml/saml2/idp/SingleLogoutService.php',
+    ),
+  ),
+  'certData' => 'MIIDpTCCAo2gAwIBAgIJAJIgibrB7NvsMA0GCSqGSIb3DQEBCwUAMGkxCzAJBgNVBAYTAk5PMR4wHAYDVQQKDBVQcm9ncmFtdmFyZXZlcmtzdGVkZXQxGDAWBgNVBAMMD2lkcC5wdnYubnRudS5ubzEgMB4GCSqGSIb3DQEJARYRZHJpZnRAcHZ2Lm50bnUubm8wHhcNMTcxMTEzMjI0NTQyWhcNMjcxMTEzMjI0NTQyWjBpMQswCQYDVQQGEwJOTzEeMBwGA1UECgwVUHJvZ3JhbXZhcmV2ZXJrc3RlZGV0MRgwFgYDVQQDDA9pZHAucHZ2Lm50bnUubm8xIDAeBgkqhkiG9w0BCQEWEWRyaWZ0QHB2di5udG51Lm5vMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAveLujCsgVCRA360y5yezy8FcSPhaqodggDqY12UTkYOMQLBFaph6uUL4oCUlXZqxScrAYVRt9yw+7BYpcm0p51VZzVCsfMxRVkn+O1eUvsaXq3f13f87QHKYP2f0uqkGf5PvnKIdSaI/ix8WJhD8XT+h0OkHEcaBvUtSG7zbEhvG21WPHwgw2rvZSneArQ8tOitZC0u8VXSfdhtf6ynRseo0xC95634UwQAZivhQ2v4A6Tp57QG5DCXIJ9/z3PkINx3KB/hOeh0EP6Dpbp+7V0/t9778E3whpm4llrH144kzROhA7EgUgkZOjAVjxGCYlcj3xQPnnItihVOZ5B5qLwIDAQABo1AwTjAdBgNVHQ4EFgQUPLhrB+Qb/Kzz7Car9GJkKmEkz6swHwYDVR0jBBgwFoAUPLhrB+Qb/Kzz7Car9GJkKmEkz6swDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAd+4E6t0j8/p8rbZE8y/gZ9GsiRhxkR4l6JbMRUfEpqHKi415qstChRcP2Lo3Yd5qdmj9tLDWoPsqet1QgyTTmQTgUmPhhMOQDqSh90LuqEJseKWafXGS/SfWLH6MWVmzDV5YofJEw2ThPiU58GiS06OLS2poq1eAesa2LQ22J8yYisXM4sxImIFte+LYQ1+1evfBWcvU1vrGsQ0VLJHdef9WoXp1swUFhq4Zk0c7gjHiB1CFVlExAAlk9L6W3CVXmKIYlf4eUnEBGkC061Ir42+uhAMWO9Y/L1NEuboTyd2KAI/6JdKdzpmfk7zPVxWlNxNCZ7OPNuvOKp6VlpB2EA==',
+  'NameIDFormat' => 'urn:oasis:names:tc:SAML:2.0:nameid-format:transient',
+);

hosts/bekkalokk/services/mediawiki/default.nix

@@ -7,40 +7,18 @@
   # "mediawiki"
   group = config.users.users.${user}.group;
 
-  SimpleSAMLphpRepo = pkgs.php.buildComposerProject rec {
-    pname = "configuredSimpleSAML";
-    version = "2.2.1";
-    src = pkgs.fetchFromGitHub {
-      owner = "simplesamlphp";
-      repo = "simplesamlphp";
-      # name = "simple-saml-php-source";
-      # url = "https://github.com/simplesamlphp/simplesamlphp/releases/download/v${version}/simplesamlphp-${version}.tar.gz";
-      rev = "v${version}";
-      hash = "sha256-jo7xma60M4VZgeDgyFumvJp1Sm+RP4XaugDkttQVB+k=";
-    };
+  simplesamlphp = pkgs.simplesamlphp.override {
+    authsourcesFile = ./simplesamlphp/authsources.php;
+    saml20-idp-remoteFile = ./simplesamlphp/saml20-idp-remote.php;
+    configFile = pkgs.runCommandLocal "mediawiki-simplesamlphp-config.php" { } ''
+      cp ${./simplesamlphp/config.php} "$out"
 
-    composerStrictValidation = false;
-
-    vendorHash = "sha256-n6lJ/Fb6xI124PkKJMbJBDiuISlukWQcHl043uHoBb4=";
-
-    # TODO: metadata could be fetched automagically with these:
-    #   - https://simplesamlphp.org/docs/contrib_modules/metarefresh/simplesamlphp-automated_metadata.html
-    #   - https://idp.pvv.ntnu.no/simplesaml/saml2/idp/metadata.php
-    postPatch = ''
-      install -Dm444 "${./simplesamlphp/authsources.php}" "config/authsources.php"
-      install -Dm444 "${./simplesamlphp/saml20-idp-remote.php}" "metadata/saml20-idp-remote.php"
-      install -Dm444 "${./simplesamlphp/config.php}" "config/config.php"
-
-      substituteInPlace config/config.php \
+      substituteInPlace "$out" \
         --replace '$SAML_COOKIE_SECURE' 'true' \
         --replace '$SAML_COOKIE_SALT' '"asdfasdfasjdf"' \
         --replace '$SAML_ADMIN_PASSWORD' '"asdfasdfasdf"' \
         --replace '$SAML_TRUSTED_DOMAINS' 'array( "bekkalokk.pvv.ntnu.no" )'
     '';
-
-    postInstall = ''
-      ln -sr $out/share/php/configuredSimpleSAML/vendor/simplesamlphp/simplesamlphp-assets-base $out/share/php/configuredSimpleSAML/public/assets/base
-    '';
   };
 in {
   sops.secrets = {
@@ -127,7 +105,7 @@ in {
       $wgLocalInterwiki = $wgSitename;
 
       # SimpleSAML
-      $wgSimpleSAMLphp_InstallDir = "${SimpleSAMLphpRepo}/share/php/configuredSimpleSAML/";
+      $wgSimpleSAMLphp_InstallDir = "${simplesamlphp}/share/php/simplesamlphp/";
       $wgSimpleSAMLphp_AuthSourceId = "default-sp";
       $wgSimpleSAMLphp_RealNameAttribute = "cn";
       $wgSimpleSAMLphp_EmailAttribute = "mail";
@@ -209,14 +187,14 @@ in {
 
       # based on https://simplesamlphp.org/docs/stable/simplesamlphp-install.html#configuring-nginx
       "^~ /simplesaml/" = {
-        alias = "${SimpleSAMLphpRepo}/share/php/configuredSimpleSAML/public/";
+        alias = "${simplesamlphp}/share/php/simplesamlphp/public/";
         index = "index.php";
 
         extraConfig = ''
           location ~ ^/simplesaml/(?<phpfile>.+?\.php)(?<pathinfo>/.*)?$ {
             include ${pkgs.nginx}/conf/fastcgi_params;
             fastcgi_pass unix:${config.services.phpfpm.pools.mediawiki.socket}; 
-            fastcgi_param SCRIPT_FILENAME ${SimpleSAMLphpRepo}/share/php/configuredSimpleSAML/public/$phpfile;
+            fastcgi_param SCRIPT_FILENAME ${simplesamlphp}/share/php/simplesamlphp/public/$phpfile;
 
             # Must be prepended with the baseurlpath
             fastcgi_param SCRIPT_NAME /simplesaml/$phpfile;