Move websites to new secrets

[perso/Immae/Config/Nix.git] / nixops / modules / websites / ludivine / ludivinecassal.nix

diff --git a/nixops/modules/websites/ludivine/ludivinecassal.nix b/nixops/modules/websites/ludivine/ludivinecassal.nix
index b5450e61ea6526fdcb2cd07b08511f1c3f87b134..c12d89ca4ac4183d81fd63edf8d11c7747e884bc 100644 (file)
--- a/nixops/modules/websites/ludivine/ludivinecassal.nix
+++ b/nixops/modules/websites/ludivine/ludivinecassal.nix
@@ -3,11 +3,11 @@ let
   ludivinecassal = { config }: rec {
     environment = config.environment;
     varDir = "/var/lib/ludivinecassal_${environment}";
-    keys."${environment}-ludivinecassal" = {
-      destDir = "/run/keys/webapps";
+    keys = [{
+      dest = "webapps/${environment}-ludivinecassal";
       user = apache.user;
       group = apache.group;
-      permissions = "0700";
+      permissions = "0400";
       text = ''
         # This file is auto-generated during the composer install
         parameters:
@@ -38,9 +38,21 @@ let
             sass: ${sass}/bin/sass
             ruby: ${ruby}/bin/ruby
       '';
-    };
+    }];
     phpFpm = rec {
-      serviceDeps = [ "mysql.service" "${environment}-ludivinecassal-key.service" ];
+      preStart = ''
+        if [ ! -f "${varDir}/currentWebappDir" -o \
+            ! -f "${varDir}/currentKey" -o \
+            "${webappDir}" != "$(cat ${varDir}/currentWebappDir 2>/dev/null)" ] \
+            || ! sha512sum -c --status ${varDir}/currentKey; then
+          pushd ${webappDir} > /dev/null
+          /run/wrappers/bin/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
+          popd > /dev/null
+          echo -n "${webappDir}" > ${varDir}/currentWebappDir
+          sha512sum /var/secrets/webapps/${environment}-ludivinecassal > ${varDir}/currentKey
+        fi
+        '';
+      serviceDeps = [ "mysql.service" ];
       socket = "/var/run/phpfpm/ludivinecassal-${environment}.sock";
       pool = ''
         listen = ${socket}
@@ -51,7 +63,7 @@ let
         php_admin_value[upload_max_filesize] = 20M
         php_admin_value[post_max_size] = 20M
         ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "/run/keys/webapps/${environment}-ludivinecassal:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/var/secrets/webapps/${environment}-ludivinecassal:${webappDir}:${varDir}:/tmp"
         php_admin_value[session.save_path] = "${varDir}/phpSessions"
         ${if environment == "dev" then ''
         pm = ondemand
@@ -141,13 +153,6 @@ let
       install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir}
       install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir}/tmp
       install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
-      if [ ! -f "${varDir}/currentWebappDir" -o \
-          "${webappDir}" != "$(cat ${varDir}/currentWebappDir 2>/dev/null)" ]; then
-        pushd ${webappDir} > /dev/null
-        $wrapperDir/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
-        popd > /dev/null
-        echo -n "${webappDir}" > ${varDir}/currentWebappDir
-      fi
       '';
     };
     webappDir = composerEnv.buildPackage (
@@ -172,7 +177,7 @@ let
         postInstall = ''
           rm -rf var/{logs,cache,data,miniatures,tmp}
           ln -sf ${varDir}/{logs,cache,data,miniatures,tmp} var/
-          ln -sf /run/keys/webapps/${environment}-ludivinecassal app/config/parameters.yml
+          ln -sf /var/secrets/webapps/${environment}-ludivinecassal app/config/parameters.yml
           '';
         buildInputs = [ sass ];
       });