modules/private/websites/isabelle/aten_production.nix

   1 { lib, pkgs, config,  ... }:
   2 let
   3   secrets = config.myEnv.websites.isabelle.aten_production;
   4   cfg = config.myServices.websites.isabelle.aten_production;
   5   ftpRoot = "/var/lib/isabelle_aten_production";
   6   phpRoot = "${ftpRoot}/php";
   7   webRoot = "${phpRoot}/public";
   8   varDir = "${ftpRoot}/var";
   9   packagePath = "/var/lib/ftp/release.immae.eu/buildbot/IsabelleAten";
  10   branch = "master";
  11 in {
  12   options.myServices.websites.isabelle.aten_production.enable = lib.mkEnableOption "enable Aten's website in production";
  13
  14   config = lib.mkIf cfg.enable {
  15     services.webstats.sites = [ { name = "aten.pro"; } ];
  16     services.phpfpm.pools.isabelle_aten_production = {
  17       user = config.services.httpd.Prod.user;
  18       group = config.services.httpd.Prod.group;
  19       settings = {
  20         "listen.owner" = config.services.httpd.Prod.user;
  21         "listen.group" = config.services.httpd.Prod.group;
  22         "php_admin_value[open_basedir]" = builtins.concatStringsSep ":" [
  23           ftpRoot
  24           config.secrets.fullPaths."websites/isabelle/aten_production"
  25           "/tmp"
  26         ];
  27         "php_admin_value[session.save_handler]" = "redis";
  28         "php_admin_value[session.save_path]" = "'unix:///run/redis-php-sessions/redis.sock?persistent=1&prefix=Isabelle:AtenProduction:'";
  29         "php_admin_value[upload_max_filesize]" = "20M";
  30         "php_admin_value[post_max_size]" = "20M";
  31         #"php_admin_flag[log_errors]" = "on";
  32         "pm" = "dynamic";
  33         "pm.max_children" = "20";
  34         "pm.start_servers" = "2";
  35         "pm.min_spare_servers" = "1";
  36         "pm.max_spare_servers" = "3";
  37       };
  38       phpPackage = pkgs.php72.withExtensions ({ enabled, all }: enabled ++ [all.redis]);
  39     };
  40     systemd.services."phpfpm-isabelle_aten_production" = {
  41       after = lib.mkAfter ["postgresql.service"];
  42       wants = ["postgresql.service"];
  43       path = lib.mkAfter [ pkgs.gnutar pkgs.gzip pkgs.php72 ];
  44       preStart = let
  45         script = pkgs.writeScriptBin "isabelle-aten-production" ''
  46           #! ${pkgs.stdenv.shell}
  47
  48           [ -f ${packagePath}/${branch}.tar.gz ] || exit 1
  49
  50           cd ${ftpRoot}
  51           if ! [ -f .tarball_sum ] || ! sha256sum -c .tarball_sum; then
  52             tar -xf ${packagePath}/${branch}.tar.gz --one-top-level=php_new
  53             if [ -d php ]; then
  54               mv php php_old
  55             fi
  56             mv php_new php
  57           fi
  58           cd php
  59           rm -rf var/{log,cache}
  60           ln -sf ${varDir}/{log,cache} var/
  61           APP_ENV=${secrets.environment} ./bin/console --env=${secrets.environment} cache:clear --no-warmup
  62           sha256sum ${packagePath}/${branch}.tar.gz > ${ftpRoot}/.tarball_sum
  63         '';
  64       in
  65         "/run/wrappers/bin/sudo -u ${config.services.httpd.Prod.user} ${script}/bin/isabelle-aten-production";
  66       postStart = let
  67         script = pkgs.writeScriptBin "isabelle-aten-production-post" ''
  68           #! ${pkgs.stdenv.shell}
  69
  70           cd ${ftpRoot}
  71           if [ -d php_old ]; then
  72             rm -rf php_old
  73           fi
  74         '';
  75       in
  76         "/run/wrappers/bin/sudo -u ${config.services.httpd.Prod.user} ${script}/bin/isabelle-aten-production-post";
  77       serviceConfig.TimeoutStartSec="infinity";
  78     };
  79     services.filesWatcher.phpfpm-isabelle_aten_production = {
  80       restart = true;
  81       paths = [ "${packagePath}/${branch}.tar.gz" ];
  82     };
  83
  84     system.activationScripts.isabelle_aten_production = {
  85       deps = ["users"];
  86       text = ''
  87         install -m 0700 -o ${config.services.httpd.Prod.user} -g ${config.services.httpd.Prod.group} -d ${ftpRoot}
  88       '';
  89     };
  90
  91     secrets.keys."websites/isabelle/aten_production" = {
  92       user = config.services.httpd.Prod.user;
  93       group = config.services.httpd.Prod.group;
  94       permissions = "0400";
  95       text = let
  96         # cf:
  97         #   https://secure.php.net/manual/fr/function.parse-url.php
  98         #   vendor/doctrine/dbal/lib/Doctrine/DBAL/DriverManager.php#parseDatabaseUrlQuery
  99         psql_url = with secrets.postgresql; "pdo-pgsql://${user}:${password}@invalid:${port}/${database}?host=${socket}";
 100       in ''
 101         SetEnv APP_ENV      "${secrets.environment}"
 102         SetEnv APP_SECRET   "${secrets.secret}"
 103         SetEnv DATABASE_URL "${psql_url}"
 104         '';
 105     };
 106     services.websites.env.production.vhostConfs.isabelle_aten_production = {
 107       certName     = "isabelle";
 108       certMainHost = "aten.pro";
 109       hosts       = [ "aten.pro" "www.aten.pro" ];
 110       root        = webRoot;
 111       extraConfig = [
 112         ''
 113         <FilesMatch "\.php$">
 114           SetHandler "proxy:unix:${config.services.phpfpm.pools.isabelle_aten_production.socket}|fcgi://localhost"
 115         </FilesMatch>
 116
 117         Include ${config.secrets.fullPaths."websites/isabelle/aten_production"}
 118
 119         Use Stats aten.pro
 120
 121         <Location /backend>
 122           Use LDAPConnect
 123           Require ldap-group   cn=aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
 124           ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
 125         </Location>
 126
 127         <Directory ${webRoot}>
 128           Options Indexes FollowSymLinks MultiViews Includes
 129           AllowOverride All
 130           Require all granted
 131           DirectoryIndex index.php
 132           FallbackResource /index.php
 133         </Directory>
 134         ''
 135       ];
 136     };
 137   };
 138 }