modules/private/websites/isabelle/aten_integration.nix

   1 { lib, pkgs, config,  ... }:
   2 let
   3   secrets = config.myEnv.websites.isabelle.aten_integration;
   4   cfg = config.myServices.websites.isabelle.aten_integration;
   5   ftpRoot = "/var/lib/isabelle_aten_integration";
   6   phpRoot = "${ftpRoot}/php";
   7   webRoot = "${phpRoot}/public";
   8   varDir = "${ftpRoot}/var";
   9   packagePath = "/var/lib/ftp/release.immae.eu/buildbot/IsabelleAten";
  10   branch = "test";
  11 in {
  12   options.myServices.websites.isabelle.aten_integration.enable = lib.mkEnableOption "enable Aten's website in integration";
  13
  14   config = lib.mkIf cfg.enable {
  15     services.phpfpm.pools.isabelle_aten_integration = {
  16       user = config.services.httpd.Inte.user;
  17       group = config.services.httpd.Inte.group;
  18       settings = {
  19         "listen.owner" = config.services.httpd.Inte.user;
  20         "listen.group" = config.services.httpd.Inte.group;
  21         "php_admin_value[open_basedir]" = builtins.concatStringsSep ":" [
  22           ftpRoot
  23           config.secrets.fullPaths."websites/isabelle/aten_integration"
  24           "/tmp"
  25         ];
  26         "php_admin_value[session.save_handler]" = "redis";
  27         "php_admin_value[session.save_path]" = "'unix:///run/redis-php-sessions/redis.sock?persistent=1&prefix=Isabelle:AtenIntegration:'";
  28         "php_admin_value[upload_max_filesize]" = "20M";
  29         "php_admin_value[post_max_size]" = "20M";
  30         #"php_admin_flag[log_errors]" = "on";
  31         "pm" = "ondemand";
  32         "pm.max_children" = "5";
  33         "pm.process_idle_timeout" = "60";
  34       };
  35       phpEnv = {
  36         SYMFONY_DEBUG_MODE = "\"yes\"";
  37       };
  38       phpPackage = pkgs.php72.withExtensions ({ enabled, all }: enabled ++ [all.redis]);
  39     };
  40     systemd.services."phpfpm-isabelle_aten_integration" = {
  41       after = lib.mkAfter ["postgresql.service"];
  42       wants = ["postgresql.service"];
  43       path = lib.mkAfter [ pkgs.gnutar pkgs.gzip pkgs.php72 ];
  44       preStart = let
  45         script = pkgs.writeScriptBin "isabelle-aten-integration" ''
  46           #! ${pkgs.stdenv.shell}
  47
  48           [ -f ${packagePath}/${branch}.tar.gz ] || exit 1
  49
  50           cd ${ftpRoot}
  51           if ! [ -f .tarball_sum ] || ! sha256sum -c .tarball_sum; then
  52             tar -xf ${packagePath}/${branch}.tar.gz --one-top-level=php_new
  53             if [ -d php ]; then
  54               mv php php_old
  55             fi
  56             mv php_new php
  57           fi
  58           cd php
  59           rm -rf var/{log,cache}
  60           ln -sf ${varDir}/{log,cache} var/
  61           SYMFONY_ENV=dev APP_ENV=dev ./bin/console --env=dev cache:clear --no-warmup
  62           sha256sum ${packagePath}/${branch}.tar.gz > ${ftpRoot}/.tarball_sum
  63         '';
  64       in
  65         "/run/wrappers/bin/sudo -u ${config.services.httpd.Inte.user} ${script}/bin/isabelle-aten-integration";
  66       postStart = let
  67         script = pkgs.writeScriptBin "isabelle-aten-integration-post" ''
  68           #! ${pkgs.stdenv.shell}
  69
  70           cd ${ftpRoot}
  71           if [ -d php_old ]; then
  72             rm -rf php_old
  73           fi
  74         '';
  75       in
  76         "/run/wrappers/bin/sudo -u ${config.services.httpd.Inte.user} ${script}/bin/isabelle-aten-integration-post";
  77       serviceConfig.TimeoutStartSec="infinity";
  78     };
  79     services.filesWatcher.phpfpm-isabelle_aten_integration = {
  80       restart = true;
  81       paths = [ "${packagePath}/${branch}.tar.gz" ];
  82     };
  83
  84     system.activationScripts.isabelle_aten_integration = {
  85       deps = ["users"];
  86       text = ''
  87         install -m 0700 -o ${config.services.httpd.Inte.user} -g ${config.services.httpd.Inte.group} -d ${ftpRoot}
  88       '';
  89     };
  90
  91     secrets.keys."websites/isabelle/aten_integration" = {
  92       user = config.services.httpd.Inte.user;
  93       group = config.services.httpd.Inte.group;
  94       permissions = "0400";
  95       text = let
  96         # cf:
  97         #   https://secure.php.net/manual/fr/function.parse-url.php
  98         #   vendor/doctrine/dbal/lib/Doctrine/DBAL/DriverManager.php#parseDatabaseUrlQuery
  99         psql_url = with secrets.postgresql; "pdo-pgsql://${user}:${password}@invalid:${port}/${database}?host=${socket}";
 100       in ''
 101         SetEnv APP_ENV      "${secrets.environment}"
 102         SetEnv APP_SECRET   "${secrets.secret}"
 103         SetEnv DATABASE_URL "${psql_url}"
 104         '';
 105     };
 106     services.websites.env.integration.vhostConfs.isabelle_aten_integration = {
 107       certName    = "integration";
 108       addToCerts  = true;
 109       hosts       = [ "aten.ic.immae.dev" ];
 110       root        = webRoot;
 111       extraConfig = [
 112         ''
 113         <FilesMatch "\.php$">
 114           SetHandler "proxy:unix:${config.services.phpfpm.pools.isabelle_aten_integration.socket}|fcgi://localhost"
 115         </FilesMatch>
 116
 117         Include ${config.secrets.fullPaths."websites/isabelle/aten_integration"}
 118
 119         <Location />
 120           Use LDAPConnect
 121           Require ldap-group   cn=ic.immae.dev,cn=httpd,ou=services,dc=immae,dc=eu
 122           ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
 123         </Location>
 124
 125         <Location /backend>
 126           Use LDAPConnect
 127           Require ldap-group   cn=ic.immae.dev,cn=httpd,ou=services,dc=immae,dc=eu
 128           ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
 129         </Location>
 130
 131         <Directory ${webRoot}>
 132           Options Indexes FollowSymLinks MultiViews Includes
 133           AllowOverride All
 134           Require all granted
 135           DirectoryIndex index.php
 136           FallbackResource /index.php
 137         </Directory>
 138         ''
 139       ];
 140     };
 141   };
 142 }