feat(wordpress): Complete the bridge between the host and the container

machines/web01/wordpress/lavoixduntexte.nix

@@ -1,23 +0,0 @@
-{ pkgs, lib, ... }:
-
-let
-  host = "lavoixduntexte.normalesup.eu";
-
-  addons = import ./addons { inherit pkgs lib; };
-in {
-  services.wordpress.sites.${host} = {
-    themes = { inherit (addons.themes) avant; };
-    plugins = { inherit (addons.plugins) wordpress-importer; };
-
-    languages = [ pkgs.wordpressPackages.languages.fr_FR ];
-
-    database.tablePrefix = "wp_lvdt_";
-
-    settings = { };
-  };
-
-  services.nginx.virtualHosts.${host} = {
-    enableACME = true;
-    forceSSL = true;
-  };
-}

machines/web01/wordpress/module.nix

@@ -1,30 +1,61 @@
-{ config, lib, options, ... }:
+{ config, lib, ... }:
 
 let
   inherit (lib) mkEnableOption mkIf mkOption;
   inherit (lib.types) anything attrsOf port;
 
+  inherit (config.security.acme) certs;
+
   cfg = config.services.wp-containers;
 
+  mkName = builtins.replaceStrings [ "." ] [ "-" ];
+
   mkConfig = { name, value }: {
     services.wordpress = {
       webserver = "nginx";
       sites.${name} = value;
     };
 
-    networking.hostName = builtins.replaceStrings [ "." ] [ "-" ] name;
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = "acme@dgnum.eu";
+    };
+
+    services.nginx.virtualHosts.${name} = {
+      onlySSL = true;
+      sslCertificate = "${certs.${name}.directory}/fullchain.pem";
+      sslCertificateKey = "${certs.${name}.directory}/key.pem";
+      sslTrustedCertificate = "${certs.${name}.directory}/chain.pem";
+    };
+
+    networking.hostName = mkName name;
+
+    networking.firewall.allowedTCPPorts = [ 443 ];
+
+    system.stateVersion = "23.11";
   };
 
   mkContainer = i: site: {
-    inherit (site) name;
+    name = mkName site.name;
 
     value = {
       privateNetwork = true;
+
       forwardPorts = [{
-        containerPort = 80;
+        containerPort = 443;
         hostPort = cfg.basePort + i;
       }];
 
+      bindMounts.certs = {
+        hostPath = certs.${site.name}.directory;
+        mountPoint = certs.${site.name}.directory;
+      };
+
+      hostAddress = "10.31.41.${builtins.toString i}";
+      localAddress = "10.0.0.1";
+
+      autoStart = true;
+
       config = mkConfig site;
     };
   };
@@ -35,8 +66,9 @@ let
       enableACME = true;
       forceSSL = true;
 
-      locations."/".proxyPass =
+      locations."/".proxyPass = "https://10.31.41.${builtins.toString i}:${
-        "http://127.0.0.1:${builtins.toString (cfg.basePort + i)}";
+          builtins.toString (cfg.basePort + i)
+        }";
     };
   };
 
@@ -59,6 +91,7 @@ in {
   config = mkIf cfg.enable {
     containers = builtins.listToAttrs (lib.imap0 mkContainer siteList);
 
-    services.nginx.virtualHosts = builtins.listToAttrs (lib.imap0 mkVhost siteList);
+    services.nginx.virtualHosts =
+      builtins.listToAttrs (lib.imap0 mkVhost siteList);
   };
 }