X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=modules%2Fprivate%2Fwebsites%2Fpiedsjaloux%2Fproduction.nix;h=bd9e1e2434ee5632fbb274e330f9422b0993cb9d;hb=bc0f9fcf0d366e10c0046390e516e11d5b76b2f8;hp=03b9ec5e3d34784bcd7cdc77bb0a2a9934503f78;hpb=dcac3ec730176549cd52a9a42db2001dc652c30d;p=perso%2FImmae%2FConfig%2FNix.git diff --git a/modules/private/websites/piedsjaloux/production.nix b/modules/private/websites/piedsjaloux/production.nix index 03b9ec5..bd9e1e2 100644 --- a/modules/private/websites/piedsjaloux/production.nix +++ b/modules/private/websites/piedsjaloux/production.nix @@ -1,36 +1,32 @@ { lib, pkgs, config, ... }: let secrets = config.myEnv.websites.piedsjaloux.production; - app = pkgs.callPackage ./app { - composerEnv = pkgs.composerEnv.override { php = pkgs.php72; }; - environment = secrets.environment; - varDir = "/var/lib/piedsjaloux_production"; - secretsPath = config.secrets.fullPaths."websites/piedsjaloux/production"; - }; cfg = config.myServices.websites.piedsjaloux.production; - pcfg = config.services.phpApplication; texlive = pkgs.texlive.combine { inherit (pkgs.texlive) attachfile preprint scheme-small; }; + ftpRoot = "/var/lib/piedsjaloux_production"; + phpRoot = "${ftpRoot}/php"; + webRoot = "${phpRoot}/web"; + varDir = "${ftpRoot}/var"; + sessionDir = "${ftpRoot}/sessions"; + packagePath = "/var/lib/ftp/release.immae.eu/buildbot/Piedsjaloux"; + branch = "master"; in { options.myServices.websites.piedsjaloux.production.enable = lib.mkEnableOption "enable PiedsJaloux's website in production"; config = lib.mkIf cfg.enable { - services.duplyBackup.profiles.piedsjaloux_production.rootDir = app.varDir; services.webstats.sites = [ { name = "piedsjaloux.fr"; } ]; - services.phpApplication.apps.piedsjaloux_production = { - websiteEnv = "production"; - httpdUser = config.services.httpd.Prod.user; - httpdGroup = config.services.httpd.Prod.group; - inherit (app) webRoot varDir; - varDirPaths = { - "tmp" = "0700"; - }; - inherit app; - serviceDeps = [ "mysql.service" ]; - preStartActions = [ - "./bin/console --env=${app.environment} cache:clear --no-warmup" - ]; - phpOpenbasedir = [ "/tmp" ]; - phpPool = { + services.phpfpm.pools.piedsjaloux_production = { + user = config.services.httpd.Prod.user; + group = config.services.httpd.Prod.group; + settings = { + "listen.owner" = config.services.httpd.Prod.user; + "listen.group" = config.services.httpd.Prod.group; + "php_admin_value[open_basedir]" = builtins.concatStringsSep ":" [ + ftpRoot + config.secrets.fullPaths."websites/piedsjaloux/production" + "/tmp" + ]; + "php_admin_value[session.save_path]" = sessionDir; "php_admin_value[upload_max_filesize]" = "20M"; "php_admin_value[post_max_size]" = "20M"; #"php_admin_flag[log_errors]" = "on"; @@ -40,52 +36,89 @@ in { "pm.min_spare_servers" = "1"; "pm.max_spare_servers" = "3"; }; - phpEnv = { - PATH = lib.makeBinPath [ - pkgs.apg pkgs.unzip - # below ones don't need to be in the PATH but they’re used in - # secrets - pkgs.imagemagick texlive - ]; - }; - phpWatchFiles = [ - app.secretsPath - ]; - phpPackage = pkgs.php72; + phpPackage = pkgs.php74; }; + systemd.services."phpfpm-piedsjaloux_production" = { + after = lib.mkAfter ["mysql.service"]; + wants = ["mysql.service"]; + path = lib.mkAfter [ pkgs.gnutar pkgs.gzip pkgs.php74 ]; + preStart = let + script = pkgs.writeScriptBin "piedsjaloux-production-pre" '' + #! ${pkgs.stdenv.shell} + + [ -f ${packagePath}/${branch}.tar.gz ] || exit 1 - secrets.keys = [ - { - dest = "websites/piedsjaloux/production"; - user = config.services.httpd.Prod.user; - group = config.services.httpd.Prod.group; - permissions = "0400"; - text = '' - # This file is auto-generated during the composer install - parameters: - database_host: ${secrets.mysql.host} - database_port: ${secrets.mysql.port} - database_name: ${secrets.mysql.database} - database_user: ${secrets.mysql.user} - database_password: ${secrets.mysql.password} - database_server_version: ${pkgs.mariadb.mysqlVersion} - mailer_transport: smtp - mailer_host: 127.0.0.1 - mailer_user: null - mailer_password: null - secret: ${secrets.secret} - pdflatex: "${texlive}/bin/pdflatex" - leapt_im: - binary_path: ${pkgs.imagemagick}/bin + cd ${ftpRoot} + if ! [ -f .tarball_sum ] || ! sha256sum -c .tarball_sum; then + tar -xf ${packagePath}/${branch}.tar.gz --one-top-level=php_new + if [ -d php ]; then + mv php php_old + fi + mv php_new php + fi + cd php + rm -rf var/{logs,cache,data,miniatures,tmp} + ln -sf ${varDir}/{logs,cache,data,miniatures,tmp} var/ + ln -sf ${config.secrets.fullPaths."websites/piedsjaloux/production"} app/config/parameters.yml + ./bin/console --env=${secrets.environment} cache:clear --no-warmup + sha256sum ${packagePath}/${branch}.tar.gz > ${ftpRoot}/.tarball_sum ''; - } - ]; + in + "/run/wrappers/bin/sudo -u ${config.services.httpd.Prod.user} ${script}/bin/piedsjaloux-production-pre"; + postStart = let + script = pkgs.writeScriptBin "piedsjaloux-production-post" '' + #! ${pkgs.stdenv.shell} + + cd ${ftpRoot} + if [ -d php_old ]; then + rm -rf php_old + fi + ''; + in + "/run/wrappers/bin/sudo -u ${config.services.httpd.Prod.user} ${script}/bin/piedsjaloux-production-post"; + serviceConfig.TimeoutStartSec="infinity"; + }; + services.filesWatcher.phpfpm-piedsjaloux_production = { + restart = true; + paths = [ "${packagePath}/${branch}.tar.gz" ]; + }; + + system.activationScripts.piedsjaloux_production = { + deps = ["users"]; + text = '' + install -m 0700 -o ${config.services.httpd.Prod.user} -g ${config.services.httpd.Prod.group} -d ${ftpRoot} ${sessionDir} + ''; + }; + + secrets.keys."websites/piedsjaloux/production" = { + user = config.services.httpd.Prod.user; + group = config.services.httpd.Prod.group; + permissions = "0400"; + text = '' + # This file is auto-generated during the composer install + parameters: + database_host: ${secrets.mysql.host} + database_port: ${secrets.mysql.port} + database_name: ${secrets.mysql.database} + database_user: ${secrets.mysql.user} + database_password: ${secrets.mysql.password} + database_server_version: ${pkgs.mariadb.mysqlVersion} + mailer_transport: smtp + mailer_host: 127.0.0.1 + mailer_user: null + mailer_password: null + secret: ${secrets.secret} + pdflatex: "${texlive}/bin/pdflatex" + leapt_im: + binary_path: ${pkgs.imagemagick}/bin + ''; + }; services.websites.env.production.vhostConfs.piedsjaloux_production = { certName = "piedsjaloux"; certMainHost = "piedsjaloux.fr"; hosts = [ "piedsjaloux.fr" "www.piedsjaloux.fr" ]; - root = pcfg.webappDirs.piedsjaloux_production; + root = webRoot; extraConfig = [ '' RewriteEngine on @@ -93,12 +126,12 @@ in { RewriteRule ^(.+)$ https://www.piedsjaloux.fr$1 [R=302,L] - SetHandler "proxy:unix:${pcfg.phpListenPaths.piedsjaloux_production}|fcgi://localhost" + SetHandler "proxy:unix:${config.services.phpfpm.pools.piedsjaloux_production.socket}|fcgi://localhost" Use Stats piedsjaloux.fr - + Options Indexes FollowSymLinks MultiViews Includes AllowOverride All Require all granted