documentation/Machines virtuelles/www.md

## Machine virtuelle WWW

Cette machine est destinée à accueillir le site web de l'association

### Matériel virtuel

CPU : 1  
RAM : 1000 Mio
Stockage de masse : 50 Gio

### Logiciel

Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)  
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)  
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `git`, `tig`, `screen`  
Mail Transfer Agent : `postfix`  
Serveur http : `nginx`
Gestionnaire FastCGI : `php-fpm` version 7.4

### Caractéristiques notables

Domaine : www.a-lec.org  
Adresse ipv4 publique : 80.67.179.96  
Adresse ipv4 interne : 192.169.100.188  
Adresse ipv6 publique : 2001:910:1360::1ca

#### Configuration réseau

##### /etc/network/interfaces

    # The loopback network interface
    auto lo
    iface lo inet loopback

    # The primary network interface
    allow-hotplug enp1s0
    iface enp1s0 inet dhcp
    iface enp1s0 inet6 static
        address 2001:910:1360::1ca/128
        gateway 2001:910:1360::

##### /etc/host.allow
    
    sshd: 192.169.1.0/24, [2001:910:1360::]/48

##### /etc/host/deny
    
    sshd: ALL

### Configuration MTA

#### /etc/postfix/transport

    a-lec.org    :
    *              discard:

#### /etc/postfix/virtual

    @localhost admin@a-lec.org
    @www.a-lec.org admin@a-lec.org

### Configuration du serveur web (nginx)

    server {
            set_real_ip_from  192.169.1.1;
            real_ip_header proxy_protocol;

        # SSL configuration
        #
        listen 443 ssl proxy_protocol default_server;
        listen [::]:443 ssl default_server;

        root /var/www/html;

            ssl_certificate /etc/letsencrypt/live/www.a-lec.org/fullchain.pem; # managed by Certbot
            ssl_certificate_key /etc/letsencrypt/live/www.a-lec.org/privkey.pem; # managed by Certbot
            include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
            ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot


        # Add index.php to the list if you are using PHP
        index index.html index.htm index.php;

        server_name www.a-lec.org;

        location /.well-known/host-meta {
            default_type 'application/xrd+xml';
            add_header Access-Control-Allow-Origin '*' always;
        }    

        location /.well-known/host-meta.json {
            default_type 'application/jrd+json';
            add_header Access-Control-Allow-Origin '*' always;
        }

        location / {
            # First attempt to serve request as file, then
            # as directory, then fall back to displaying a 404.
            try_files $uri $uri/ $uri.html $uri/index.php?q=$uri&$args =404;
        }

        ssi on;
        ssi_last_modified on;

        # pass PHP scripts to FastCGI server
        
        location ~ \.php$ {
            include snippets/fastcgi-php.conf;
            # With php-fpm (or other unix sockets):
            fastcgi_pass unix:/run/php/php7.4-fpm.sock;
            # With php-cgi (or other tcp sockets):
            # fastcgi_pass 127.0.0.1:9000;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            include fastcgi_params;
        }

    }

    server {
        listen 80;
        listen [::]:80;

        server_name www.a-lec.org; 

        return 302 https://www.a-lec.org$request_uri;
    }

    server {
            listen 80;
            listen [::]:80;

            server_name a-lec.org;

            return 302 https://www.a-lec.org$request_uri;
    }

    server {
            listen 443 ssl proxy_protocol;
            listen [::]:443 ssl;

            server_name a-lec.org;

            return 302 https://www.a-lec.org$request_uri;

            ssl_certificate /etc/letsencrypt/live/a-lec.org-0001/fullchain.pem; # managed by Certbot
            ssl_certificate_key /etc/letsencrypt/live/a-lec.org-0001/privkey.pem; # managed by Certbot
            include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
            ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
    }