modules/private/websites/richie/production.nix

   1 { lib, config, pkgs, ... }:
   2 let
   3   cfg = config.myServices.websites.richie.production;
   4   vardir = "/var/lib/richie_production";
   5   richieSrc = pkgs.stdenv.mkDerivation rec {
   6     version = pkgs.sources.websites-richie-app.version;
   7     pname = "richie";
   8     name = "${pname}-${version}";
   9     src = pkgs.sources.websites-richie-app;
  10     phases = "installPhase";
  11     installPhase = ''
  12       cp -a $src $out
  13       chmod -R u+w $out
  14       ln -sf ${vardir}/files $out/
  15       ln -sf ${vardir}/drapeaux $out/images/
  16       ln -sf ${vardir}/photos $out/
  17       sed -i "s@localedef --list-archive@localedef --list-archive /run/current-system/sw/lib/locale/locale-archive@" $out/admin/parametres.php
  18       '';
  19   };
  20   secretPath = config.secrets.fullPaths."websites/richie/production";
  21   apacheUser = config.services.httpd.Prod.user;
  22   apacheGroup = config.services.httpd.Prod.group;
  23 in
  24 {
  25   options.myServices.websites.richie.production.enable = lib.mkEnableOption "enable Richie's website";
  26   config = lib.mkIf cfg.enable {
  27     services.webstats.sites = [ { name = "europe-richie.org"; } ];
  28
  29     secrets.keys."websites/richie/production" = {
  30       user = apacheUser;
  31       group = apacheGroup;
  32       permissions = "0400";
  33       text = with config.myEnv.websites.richie; ''
  34         <?php
  35
  36         $hote_sql = '${mysql.host}';
  37         $login_sql = '${mysql.user}';
  38         $bdd_sql = '${mysql.database}';
  39         $mdp_sql = '${mysql.password}';
  40
  41         $db = mysqli_connect($hote_sql,$login_sql,$mdp_sql);
  42         unset($mdp_sql);
  43
  44         $smtp_mailer->Auth('${smtp_mailer.user}', '${smtp_mailer.password}');
  45         ?>
  46         '';
  47     };
  48     system.activationScripts.richie_production = {
  49       deps = [ "httpd" ];
  50       text = ''
  51         install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${vardir}
  52         '';
  53     };
  54     services.phpfpm.pools.richie_production = {
  55       user = apacheUser;
  56       group = apacheGroup;
  57       settings = {
  58         "listen.owner" = apacheUser;
  59         "listen.group" = apacheGroup;
  60
  61         "pm" = "dynamic";
  62         "pm.max_children" = "20";
  63         "pm.start_servers" = "2";
  64         "pm.min_spare_servers" = "1";
  65         "pm.max_spare_servers" = "3";
  66
  67         "php_admin_value[open_basedir]" = "${vardir}:${secretPath}:${richieSrc}:/tmp";
  68         "php_admin_value[session.save_handler]" = "redis";
  69         "php_admin_value[session.save_path]" = "'unix:///run/redis-php-sessions/redis.sock?persistent=1&prefix=Richie:Production:'";
  70       };
  71       phpEnv = {
  72         PATH = "/run/current-system/sw/bin:${lib.makeBinPath [ pkgs.imagemagick ]}";
  73         BDD_CONNECT = secretPath;
  74       };
  75       phpOptions = config.services.phpfpm.phpOptions + ''
  76         date.timezone = 'Europe/Paris'
  77         '';
  78       phpPackage = pkgs.php72.withExtensions({ enabled, all }: enabled ++ [all.redis]);
  79     };
  80     services.websites.env.production.modules = [ "proxy_fcgi" ];
  81     services.websites.env.production.vhostConfs.richie_production = {
  82       certName    = "richie";
  83       addToCerts  = true;
  84       certMainHost = "europe-richie.org";
  85       hosts       = [ "europe-richie.org" "www.europe-richie.org" ];
  86       root        = richieSrc;
  87       extraConfig = [
  88         ''
  89         Use Stats europe-richie.org
  90         ErrorDocument 404 /404.html
  91         <LocationMatch "^/files/.*/admin/">
  92           Require all denied
  93         </LocationMatch>
  94         <Directory ${richieSrc}>
  95           DirectoryIndex index.php index.htm index.html
  96           Options Indexes FollowSymLinks MultiViews Includes
  97           AllowOverride None
  98           Require all granted
  99
 100           <FilesMatch "\.php$">
 101             SetHandler "proxy:unix:${config.services.phpfpm.pools.richie_production.socket}|fcgi://localhost"
 102           </FilesMatch>
 103         </Directory>
 104           ''
 105       ];
 106     };
 107   };
 108 }