]> git.immae.eu Git - perso/Immae/Config/Nix.git/blame_incremental - modules/private/websites/aten/production.nix
Add backup module
[perso/Immae/Config/Nix.git] / modules / private / websites / aten / production.nix
... / ...
CommitLineData
1{ lib, pkgs, config, myconfig, ... }:
2let
3 secrets = myconfig.env.websites.aten.production;
4 app = pkgs.webapps.aten.override { environment = secrets.environment; };
5 cfg = config.myServices.websites.aten.production;
6 pcfg = config.services.phpApplication;
7in {
8 options.myServices.websites.aten.production.enable = lib.mkEnableOption "enable Aten's website in production";
9
10 config = lib.mkIf cfg.enable {
11 services.backup.profiles.aten_prod.rootDir = app.varDir;
12 services.webstats.sites = [ { name = "aten.pro"; } ];
13 services.phpApplication.apps.aten_prod = {
14 websiteEnv = "production";
15 httpdUser = config.services.httpd.Prod.user;
16 httpdGroup = config.services.httpd.Prod.group;
17 httpdWatchFiles = [
18 config.secrets.fullPaths."webapps/${app.environment}-aten"
19 ];
20 inherit (app) webRoot varDir;
21 inherit app;
22 serviceDeps = [ "postgresql.service" ];
23 preStartActions = [
24 "APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup"
25 ];
26 phpOpenbasedir = [ "/tmp" ];
27 phpPool = ''
28 php_admin_value[upload_max_filesize] = 20M
29 php_admin_value[post_max_size] = 20M
30 ;php_admin_flag[log_errors] = on
31 pm = dynamic
32 pm.max_children = 20
33 pm.start_servers = 2
34 pm.min_spare_servers = 1
35 pm.max_spare_servers = 3
36 '';
37 };
38
39 secrets.keys = [{
40 dest = "webapps/${app.environment}-aten";
41 user = config.services.httpd.Prod.user;
42 group = config.services.httpd.Prod.group;
43 permissions = "0400";
44 text = ''
45 SetEnv APP_ENV "${app.environment}"
46 SetEnv APP_SECRET "${secrets.secret}"
47 SetEnv DATABASE_URL "${secrets.psql_url}"
48 '';
49 }];
50 services.websites.env.production.vhostConfs.aten_prod = {
51 certName = "aten";
52 certMainHost = "aten.pro";
53 hosts = [ "aten.pro" "www.aten.pro" ];
54 root = pcfg.webappDirs.aten_prod;
55 extraConfig = [
56 ''
57 <FilesMatch "\.php$">
58 SetHandler "proxy:unix:${pcfg.phpListenPaths.aten_prod}|fcgi://localhost"
59 </FilesMatch>
60
61 Include ${config.secrets.fullPaths."webapps/${app.environment}-aten"}
62
63 Use Stats aten.pro
64
65 <Location /backend>
66 Use LDAPConnect
67 Require ldap-group cn=aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
68 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
69 </Location>
70
71 <Directory ${pcfg.webappDirs.aten_prod}>
72 Options Indexes FollowSymLinks MultiViews Includes
73 AllowOverride All
74 Require all granted
75 DirectoryIndex index.php
76 FallbackResource /index.php
77 </Directory>
78 ''
79 ];
80 };
81 };
82}