X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=nixops%2Fmodules%2Fwebsites%2Faten%2Faten.nix;h=c35af6f098ee3dc1ea936ee397c7f8549486a1ee;hb=9eae2b47b7b315b05a0e010f3003bd875685e260;hp=d9286c3fa7bd402ccfadd2f6e0d3d9100cfaf5c1;hpb=33aa7e5c92daffce2f09639eb57cb995754fbd6b;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/nixops/modules/websites/aten/aten.nix b/nixops/modules/websites/aten/aten.nix
index d9286c3..c35af6f 100644
--- a/nixops/modules/websites/aten/aten.nix
+++ b/nixops/modules/websites/aten/aten.nix
@@ -4,6 +4,19 @@ let
     environment = config.environment;
     varDir = "/var/lib/aten_${environment}";
     phpFpm = rec {
+      preStart = ''
+        if [ ! -f "${varDir}/currentWebappDir" -o \
+            ! -f "${varDir}/currentKey" -o \
+            "${webappDir}" != "$(cat ${varDir}/currentWebappDir 2>/dev/null)" ] \
+            || ! sha512sum -c --status ${varDir}/currentKey; then
+          pushd ${webappDir} > /dev/null
+          /run/wrappers/bin/sudo -u wwwrun APP_ENV=${environment} ./bin/console --env=${environment} cache:clear --no-warmup
+          popd > /dev/null
+          echo -n "${webappDir}" > ${varDir}/currentWebappDir
+          sha512sum /var/secrets/webapps/${environment}-aten > ${varDir}/currentKey
+        fi
+        '';
+      serviceDeps = [ "postgresql.service" ];
       socket = "/var/run/phpfpm/aten-${environment}.sock";
       pool = ''
         listen = ${socket}
@@ -29,6 +42,17 @@ let
         pm.max_spare_servers = 3
         ''}'';
     };
+    keys = [{
+      dest = "webapps/${environment}-aten";
+      user = apache.user;
+      group = apache.group;
+      permissions = "0400";
+      text = ''
+        SetEnv APP_ENV      "${environment}"
+        SetEnv APP_SECRET   "${config.secret}"
+        SetEnv DATABASE_URL "${config.psql_url}"
+        '';
+    }];
     apache = rec {
       user = "wwwrun";
       group = "wwwrun";
@@ -40,9 +64,7 @@ let
         SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
       </FilesMatch>
 
-      SetEnv APP_ENV      "${environment}"
-      SetEnv APP_SECRET   "${config.secret}"
-      SetEnv DATABASE_URL "${config.psql_url}"
+      Include /var/secrets/webapps/${environment}-aten
 
       ${if environment == "dev" then ''
       <Location />
@@ -80,13 +102,6 @@ let
       text = ''
       install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir}
       install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
-      if [ ! -f "${varDir}/currentWebappDir" -o \
-          "${webappDir}" != "$(cat ${varDir}/currentWebappDir 2>/dev/null)" ]; then
-        pushd ${webappDir} > /dev/null
-        $wrapperDir/sudo -u wwwrun APP_ENV=${environment} ./bin/console --env=${environment} cache:clear --no-warmup
-        popd > /dev/null
-        echo -n "${webappDir}" > ${varDir}/currentWebappDir
-      fi
       '';
     };
     yarnModules = let
@@ -102,6 +117,9 @@ let
           packageJSON = packagejson;
           yarnLock = "${info.src}/yarn.lock";
           pkgConfig = {
+            all = {
+              buildInputs = [ yarn2nixPackage.src ];
+            };
             node-sass = {
               buildInputs = [ libsass python ];
               postInstall = let
@@ -124,8 +142,6 @@ let
         preInstall = ''
           export SYMFONY_ENV="${environment}"
           export APP_ENV="${environment}"
-          export DATABASE_URL="${config.psql_url}"
-          export APP_SECRET="${config.secret}"
           '';
         postInstall = ''
           ln -sf ${yarnModules}/node_modules .