<?xml version="1.0" encoding="utf-8"?>

<creole>
    <files>
        <!-- le service nginx est déclaré dans 28_eoleflask.xml -->
        <service_access service='nginx'>
            <port service_accesslist="nginx">80</port>
            <port service_accesslist="nginx">443</port>
            <port service_accesslist="revsso">8443</port>
        </service_access>
        <file name='/etc/nginx/sites-enabled/default' source='nginx.default' rm="True"/>
        <file name='/etc/nginx/eole_proxy_params' source='nginx.proxy-params'/>
        <file name='/usr/share/nginx/html/nginx.html'/>
        <file name='/var/www/index.html' source='nginx.no_proxy.html' mkdir='True'/>
        <file name='/etc/logrotate.d/nginx' source='nginx.logrotate'/>
        <file name='/etc/systemd/system/nginx.service.d/override.conf' source='nginx.override' mkdir='True'/>
        <!--<file name="/etc/nginx/sites-enabled/access_proxy"/>-->
    </files>

    <variables>

        <family name='services'>
            <!-- Nginx fait serveur HTTP même si la fonctionnalité reverse proxy est désactivée -->
            <variable name='test_activer_nginx_web' type='oui/non' description="Vérifier s’il est possible d’activer la publication d’applications web par Nginx" />

            <variable name='test_hide_nginx_family' type='oui/non' description="Vérifier s’il faut cacher la famille Nginx" />

            <variable name='activer_nginx_web' type='oui/non' description='Activer la publication d’applications web par Nginx'>
                <value>oui</value>
            </variable>

            <variable name='activer_revprox' type='oui/non' description='Activer le reverse proxy Nginx'>
                <value>non</value>
            </variable>

            <variable name='activer_apache' type='oui/non' exists='False' hidden='True'>
                <value>non</value>
            </variable>

            <variable name='activer_sso' type='string' exists='False' hidden='True'>
                <value>non</value>
            </variable>
        </family>

        <family name='Nginx' icon='nginx'>

            <variable name='test_nginx_open_port' type="oui/non" description="Ouvrir les ports Nginx" />

            <variable name='revprox_default' type="domain_strict" description="Nom de domaine par défaut" />

            <variable name='nginx_degrade_http' type='oui/non' description='Dégrader la sécurité en HTTP' mode='expert'>
                <value>non</value>
            </variable>

            <variable name='revprox_hash_bucket_size' type='string' description="Longueur maximum pour un nom de domaine" mode="expert">
                <value>128</value>
            </variable>

             <variable name='php_post_max_size' type='number' description="Taille maximale des données reçues par la méthode POST (en Mo)" exists="False" mode='expert'>
                <value>32</value>
            </variable>
       </family>

        <family name='Applications web Nginx' icon='nginx' />

        <family name='Reverse proxy' icon='nginx'>
            <variable name='revprox_sso' type='domain' description="Nom de domaine du serveur SSO" />
            <variable name='revprox_eop' type='domain' description="Nom de domaine du serveur EOP" />
            <variable name='activer_revprox_ead' type='oui/non' description="Activer la redirection de l'EAD Scribe">
                <value>non</value>
            </variable>
            <variable name='revprox_ead' type='ip' description="IP du Scribe pour la redirection EAD" mandatory="True"/>
            <variable name='revprox_ead_port' type='port' description="Port de l'EAD sur le Scribe" mandatory="True">
                <value>4203</value>
            </variable>
            <variable name='revprox_auto_config_local_web' type='oui/non' description='Activer la configuration automatique pour les applications locales'>
                <value>non</value>
            </variable>
            <variable name='revprox_activate_http' type='oui/non' description='Activer le reverse proxy Nginx pour http/https'>
                <value>non</value>
            </variable>

            <variable name='revprox_domainname' type='domain' description="Nom de domaine ou IP à rediriger" multi='True' mandatory='True'/>
            <variable name='revprox_domain_wildcard' type='oui/non' description="Activer la redirection pour tous les sous-domaines">
                <value>non</value>
            </variable>
            <variable name='revprox_le_cert' type='oui/non' description="Demander un certificat à Let's Encrypt pour ce domaine ?">
                <value>oui</value>
            </variable>
            <variable name='revprox_rep' type='string' description="Répertoire ou nom de la page à rediriger">
                <value>/</value>
            </variable>
            <variable name='revprox_http' type='string' description="Reverse proxy HTTP">
                <value>redirige vers https</value>
            </variable>
            <variable name='revprox_https' type='oui/non' description="Reverse proxy HTTPS">
                <value>oui</value>
            </variable>
            <variable name='revprox_url' type='web_address' description="IP ou domaine de destination (avec http:// ou https://) ou URI complète" mandatory='True'/>

            <variable name="activer_revprox_rewrite" type="oui/non" description="Activer la réécriture d'URL" mode="expert">
                <value>non</value>
            </variable>
            <variable name="revprox_rewrite_domaine" type="domain" description="Nom de domaine concerné par la réécriture" mode="expert" multi="True" mandatory='True'/>
            <variable name="revprox_rewrite_proto" type="string" description="Protocole" mode="expert">
                <value>http/https</value>
            </variable>
            <variable name='revprox_rewrite_location' type='string' description="Répertoire de la réécriture" mode="expert" mandatory='True'/>
            <variable name="revprox_rewrite_regex" type="string" description="Regex de la réécriture" mode="expert" mandatory='True'/>
            <variable name="revprox_rewrite_replacement" type="string" description="La valeur de remplacement" mode="expert" mandatory='True'/>
            <variable name='revprox_redirection_http' type='oui/non' description='Activer la redirection des domaines'>
                <value>non</value>
            </variable>
            <variable name='revprox_redirection' type='domain' description="Nom de domaine à rediriger" multi='True' mandatory='True'>
                <value></value>
            </variable>
            <variable name='revprox_redirection_rep' type='string' description="Nom du répertoire du domaine à rediriger" mandatory='True'>
                <value>/</value>
            </variable>
            <variable name='revprox_redirection_destination' type='web_address' description="Nom de domaine de destination" mandatory='True'>
                <value></value>
            </variable>
        </family>
        <family name='applications web' hidden='True'>
            <!-- creer si n'existe pas et cache-->
            <variable name='activer_web_behind_revproxy' type='oui/non' exists='False' hidden='True'>
                <value>non</value>
            </variable>
            <variable name='web_behind_revproxy_ip' type='ip' exists='False' hidden='True'/>
        </family>

        <separators>
            <separator name='revprox_sso' never_hidden='True'>Redirection de services particuliers</separator>
            <separator name='revprox_activate_http'>Redirection HTTP et HTTPS</separator>
        </separators>

    </variables>

    <constraints>

        <!-- Publish web application with Nginx -->
        <auto name='calc_multi_condition' target='test_activer_nginx_web'>
            <param>['non', 'oui']</param>
            <param type='eole' name='condition_1'>mode_conteneur_actif</param>
            <param type='eole' name='condition_2'>activer_apache</param>
            <param name='match'>non</param>
            <param name='mismatch'>oui</param>
        </auto>

        <auto name='calc_multi_condition' target='test_hide_nginx_family'>
            <param>non</param>
            <param type='eole' name='condition_1' hidden='False'>activer_nginx_web</param>
            <param type='eole' name='condition_2'>activer_revprox</param>
            <param name='match'>oui</param>
            <param name='mismatch'>non</param>
        </auto>

        <fill name='calc_val' target='activer_nginx_web'>
            <param type='eole' name='valeur'>test_activer_nginx_web</param>
        </fill>

        <condition name='frozen_if_in' source='test_activer_nginx_web'>
            <param>non</param>
            <target type='variable'>activer_nginx_web</target>
        </condition>

        <condition name='disabled_if_in' source='test_hide_nginx_family'>
            <param>oui</param>
            <target type='family'>Nginx</target>
        </condition>

        <auto name='calc_multi_condition' target='test_nginx_open_port'>
            <param>oui</param>
            <param name="operator">OR</param>
            <param type='eole' name="condition_1" hidden='False'>revprox_activate_http</param>
            <param type='eole' name="condition_2" hidden='False'>revprox_auto_config_local_web</param>
            <param type='eole' name="condition_3" hidden='False'>activer_nginx_web</param>
            <param name='match'>oui</param>
            <param name='mismatch'>non</param>
        </auto>

        <condition name='disabled_if_in' source='test_nginx_open_port'>
            <param>non</param>
            <target type='service_accesslist'>nginx</target>
        </condition>

        <!-- **** Listes deroulantes **** -->
        <check name='valid_enum' target='revprox_http'>
            <param>['oui','non', 'redirige vers https']</param>
        </check>
        <check name='valid_enum' target='revprox_rewrite_proto'>
            <param>['http/https','http', 'https']</param>
        </check>
        <check name='valid_enum' target='revprox_hash_bucket_size'>
            <param>['128', '64', '32']</param>
        </check>
        <!-- **** Conditions **** -->
        <condition name='disabled_if_in' source='activer_revprox'>
            <param>non</param>
            <target type='family'>Reverse proxy</target>
            <target type='filelist'>revprox</target>
        </condition>
        <condition name='disabled_if_in' source='activer_revprox'>
            <param>oui</param>
            <target type='filelist'>ead3_nginx</target>
        </condition>
        <condition name='disabled_if_in' source='activer_sso'>
            <param>local</param>
            <target type='variable'>revprox_sso</target>
        </condition>
        <condition name='disabled_if_in' source='activer_apache'>
            <param>non</param>
            <target type='variable'>revprox_auto_config_local_web</target>
        </condition>
        <condition name='disabled_if_in' source='mode_conteneur_actif'>
            <param>non</param>
            <target type='variable'>revprox_auto_config_local_web</target>
        </condition>
        <condition name='disabled_if_in' source='activer_revprox_rewrite'>
            <param>non</param>
            <target type='variable'>revprox_rewrite_proto</target>
            <target type='variable'>revprox_rewrite_domaine</target>
            <target type='variable'>revprox_rewrite_location</target>
            <target type='variable'>revprox_rewrite_regex</target>
            <target type='variable'>revprox_rewrite_replacement</target>
        </condition>
        <condition name='disabled_if_in' source='activer_revprox_ead'>
            <param>non</param>
            <target type='variable'>revprox_ead</target>
            <target type='variable'>revprox_ead_port</target>
        </condition>
        <group master='revprox_domainname'>
            <slave>revprox_domain_wildcard</slave>
            <slave>revprox_rep</slave>
            <slave>revprox_le_cert</slave>
            <slave>revprox_http</slave>
            <slave>revprox_https</slave>
            <slave>revprox_url</slave>
        </group>
        <group master='revprox_rewrite_domaine'>
            <slave>revprox_rewrite_proto</slave>
            <slave>revprox_rewrite_location</slave>
            <slave>revprox_rewrite_regex</slave>
            <slave>revprox_rewrite_replacement</slave>
        </group>
        <condition name='disabled_if_in' source='cert_type'>
            <param>autosigné</param>
            <target type='variable'>revprox_le_cert</target>
        </condition>
        <condition name='disabled_if_in' source='cert_type'>
            <param>manuel</param>
            <target type='variable'>revprox_le_cert</target>
        </condition>
        <condition name='disabled_if_in' source='revprox_domain_wildcard'>
            <param>oui</param>
            <target type='variable'>revprox_le_cert</target>
        </condition>
        <condition name='disabled_if_in' source='revprox_activate_http'>
            <param>non</param>
            <target type='variable'>revprox_domainname</target>
            <target type='variable'>revprox_domain_wildcard</target>
            <target type='variable'>revprox_le_cert</target>
            <target type='variable'>revprox_rep</target>
            <target type='variable'>revprox_http</target>
            <target type='variable'>revprox_https</target>
            <target type='variable'>revprox_url</target>
        </condition>
        <condition name='disabled_if_in' source='revprox_sso'>
            <param></param>
            <target type='service_accesslist'>revsso</target>
        </condition>
        <condition name='disabled_if_in' source='activer_web_behind_revproxy'>
            <param>non</param>
            <target type='variable'>web_behind_revproxy_ip</target>
        </condition>
        <fill name='calc_val' target='revprox_ead'>
            <param type='eole' name='valeur' optional='True' hidden='False'>ip_serveur_scribe_dmz</param>
        </fill>
        <group master='revprox_redirection'>
            <slave>revprox_redirection_rep</slave>
            <slave>revprox_redirection_destination</slave>
        </group>
        <condition name='disabled_if_in' source='revprox_redirection_http'>
            <param>non</param>
            <target type='variable'>revprox_redirection</target>
            <target type='variable'>revprox_redirection_rep</target>
            <target type='variable'>revprox_redirection_destination</target>
        </condition>

    </constraints>
    <!--************************************************************************************************* -->
    <help>
        <family name='Nginx'>Paramétrage global de Nginx</family>
        <family name='Applications web Nginx'>Paramétrage des applications web publiées par Nginx</family>
        <variable name='test_activer_nginx_web'>Vérifie que le mode conteneur est actif ou qu’apache est désactivé.</variable>
        <variable name='test_hide_nginx_family'>Vérifie que la publication d’application web par Nginx et le reverse proxy sont désactivés.</variable>
        <variable name='test_nginx_open_port'>Vérifie que la publication d’application web par Nginx ou le reverse proxy HTTP ou la configuration automatique des applications locales est actif.</variable>
        <variable name='activer_nginx_web'>Publier les applications web par Nginx</variable>
        <variable name='revprox_default'>Si un client accède au serveur avec un nom de domaine non déclaré, le flux est redirigé vers ce domaine</variable>
        <variable name='nginx_degrade_http'>Désactiver l’utilisation du HTTPS. Certaines applications comme gen_config sont désactivées dans ce cas.</variable>
        <family name='Reverse proxy'>Paramètrage du proxy inverse</family>
        <variable name='revprox_sso'>Pour rediriger vers le SSO de la machine "domainelocal", taper "domainelocal"</variable>
        <variable name='revprox_eop'>Pour rediriger vers EOP de la machine "domainelocal", taper "domainelocal"</variable>
        <variable name='revprox_auto_config_local_web'>Configure automatiquement le reverse proxy afin de faire pointer web_url sur le conteneur web</variable>
        <variable name='revprox_domainname'>Exemple : pour rediriger "http://domaine/" saisir "domaine"</variable>
        <variable name='revprox_domain_wildcard'>Exemple pour "domaine" : tous les sous-domaines de "domaine" seront redirigés</variable>
        <variable name='revprox_le_cert'>Demander un certificat SSL au serveur ACME (Let's Encrypt) pour ce domaine</variable>
        <variable name='revprox_rep'>URL relative (sans le nom de domaine) redirigée pour l'adresse définie dans la variable ci-dessus (exemple "/mail")</variable>
        <variable name='revprox_url'>Nom de domaine ou IP de destination, par exemple "http://domainelocal" ou URI, par exemple "http://domainelocal/dir/"</variable>
        <variable name='activer_revprox'>Le Reverse Proxy permet de relayer des accès extérieurs vers des serveurs situés derrière le pare-feu</variable>
    </help>
</creole>
<!-- vim: ts=4 sw=4 expandtab
-->
