Move secrets module outside of nixops

[perso/Immae/Config/Nix.git] / nixops / modules / websites / tellesflorian / tellesflorian.nix
diff --git a/nixops/modules/websites/tellesflorian/tellesflorian.nix b/nixops/modules/websites/tellesflorian/tellesflorian.nix

index e42158199b003008bae19b774ef445add7c0e8cd..afd723c0936f8b0c388b1f72f634c2a760bd791c 100644 (file)
--- a/nixops/modules/websites/tellesflorian/tellesflorian.nix
+++ b/nixops/modules/websites/tellesflorian/tellesflorian.nix
@@ -3,10 +3,24 @@ let
    tellesflorian = { config }: rec {
      environment = config.environment;
      varDir = "/var/lib/tellesflorian_${environment}";
-    configRoot =
-      writeText "parameters.yml" ''
-        # This file is auto-generated during the composer install
-        parameters:
+    keys = [
+      {
+        dest = "webapps/${environment}-tellesflorian-passwords";
+        user = apache.user;
+        group = apache.group;
+        permissions = "0400";
+        text = ''
+          invite:${config.invite_passwords}
+        '';
+      }
+      {
+        dest = "webapps/${environment}-tellesflorian";
+        user = apache.user;
+        group = apache.group;
+        permissions = "0400";
+        text = ''
+          # This file is auto-generated during the composer install
+          parameters:
              database_host: ${config.mysql.host}
              database_port: ${config.mysql.port}
              database_name: ${config.mysql.name}
@@ -17,8 +31,23 @@ let
              mailer_user: null
              mailer_password: null
              secret: ${config.secret}
-      '';
+        '';
+      }
+    ];
      phpFpm = rec {
+      preStart = ''
+        if [ ! -f "${varDir}/currentWebappDir" -o \
+            ! -f "${varDir}/currentKey" -o \
+            "${webappDir}" != "$(cat ${varDir}/currentWebappDir 2>/dev/null)" ] \
+            || ! sha512sum -c --status ${varDir}/currentKey; then
+          pushd ${webappDir} > /dev/null
+          /run/wrappers/bin/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
+          popd > /dev/null
+          echo -n "${webappDir}" > ${varDir}/currentWebappDir
+          sha512sum /var/secrets/webapps/${environment}-tellesflorian > ${varDir}/currentKey
+        fi
+        '';
+      serviceDeps = [ "mysql.service" ];
        socket = "/var/run/phpfpm/floriantelles-${environment}.sock";
        pool = ''
          listen = ${socket}
@@ -29,7 +58,7 @@ let
          php_admin_value[upload_max_filesize] = 20M
          php_admin_value[post_max_size] = 20M
          ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "${configRoot}:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/var/secrets/webapps/${environment}-tellesflorian:${webappDir}:${varDir}:/tmp"
          php_admin_value[session.save_path] = "${varDir}/phpSessions"
          ${if environment == "dev" then ''
          pm = ondemand
@@ -44,9 +73,6 @@ let
          pm.max_spare_servers = 3
          ''}'';
      };
-    passwords = writeText "tellesflorian_passwords" ''
-      invite:${config.invite_passwords}
-      '';
      apache = rec {
        user = "wwwrun";
        group = "wwwrun";
@@ -64,7 +90,7 @@ let
          Use LDAPConnect
          Require ldap-group   cn=app.tellesflorian.com,cn=httpd,ou=services,dc=immae,dc=eu
  
-        AuthUserFile "${passwords}"
+        AuthUserFile "/var/secrets/webapps/${environment}-tellesflorian-passwords"
          Require user "invite"
  
          ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://tellesflorian.com\"></html>"
@@ -125,13 +151,6 @@ let
        install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir} \
          ${varDir}/var
        install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
-      if [ ! -f "${varDir}/currentWebappDir" -o \
-          "${webappDir}" != "$(cat ${varDir}/currentWebappDir 2>/dev/null)" ]; then
-        pushd ${webappDir} > /dev/null
-        $wrapperDir/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
-        popd > /dev/null
-        echo -n "${webappDir}" > ${varDir}/currentWebappDir
-      fi
        '';
      };
      webappDir = composerEnv.buildPackage (
@@ -145,7 +164,7 @@ let
          postInstall = ''
            cd $out
            rm app/config/parameters.yml
-          ln -sf ${configRoot} app/config/parameters.yml
+          ln -sf /var/secrets/webapps/${environment}-tellesflorian app/config/parameters.yml
            rm -rf var/{logs,cache}
            ln -sf ${varDir}/var/{logs,cache,sessions} var/
            '';