refactor: streamline all websites into one folder

modules/web/userdir.nix

@@ -0,0 +1,84 @@
+{ config, pkgs, ... }:
+let
+  domain = "users.${config.networking.domain}";
+  port = 8083;
+  apacheUser = config.services.httpd.user;
+in
+{
+  # home directory setup
+  systemd.tmpfiles.rules = [
+    "d /etc/skel"
+  ];
+  environment.extraInit = /*sh*/ ''
+    if [[ "$HOME" != "/" && "$UID" != 0 ]]; then
+      umask 002
+
+      # home dir: apache may traverse only, creation mode is rw(x)------
+      setfacl -m u:${apacheUser}:x,d:u::rwx,d:g::-,d:o::- $HOME
+
+      mkdir -p $HOME/public_html
+      # public_html dir: apache and $USER have rwx on everything inside
+      setfacl -m u:${apacheUser}:rwx,d:u:${apacheUser}:rwx,d:u:''${USER}:rwx $HOME/public_html
+    fi
+  '';
+
+  services.httpd = {
+    enable = true;
+    enablePHP = true;
+    maxClients = 10;
+    mpm = "prefork";
+    extraModules = [ "userdir" ];
+
+    virtualHosts.${domain} = {
+      extraConfig = ''
+        UserDir disabled root
+        UserDir /home/users/*/public_html/
+        <Directory "/home/users/*/public_html">
+          Options -Indexes +MultiViews +SymLinksIfOwnerMatch +IncludesNoExec
+          DirectoryIndex index.php index.html
+          AllowOverride FileInfo AuthConfig Limit Indexes Options=Indexes
+          <Limit GET POST OPTIONS>
+            Require all granted
+          </Limit>
+          <LimitExcept GET POST OPTIONS>
+            Require all denied
+          </LimitExcept>
+        </Directory>
+      '';
+      listen = [{
+        ip = "127.0.0.1";
+        inherit port;
+      }];
+    };
+
+    phpPackage = pkgs.php.buildEnv {
+      extraConfig = ''
+        display_errors=0
+        post_max_size = 40M
+        upload_max_filesize = 40M
+      '';
+    };
+  };
+
+  services.nginx.virtualHosts.${domain} = {
+    enableACME = true;
+    forceSSL = true;
+
+    locations."/" = {
+      proxyPass = "http://localhost:${toString port}";
+      extraConfig = ''
+        proxy_intercept_errors on;
+        error_page 403 404 =404 /404.html;
+        client_max_body_size 40M;
+      '';
+    };
+
+    locations."/robots.txt" = {
+      extraConfig = ''
+        add_header  Content-Type  text/plain;
+        return 200 "User-agent: *\nDisallow: /\n";
+      '';
+    };
+
+  };
+}