X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=nixops%2Fmodules%2Fwebsites%2Fdefault.nix;h=f820c83ceb04c5a301ae7fd0522d6a13d998309e;hb=415bcd272a0cbd65494fbb245bd94f0420656044;hp=49dc5f7d0e55a338dff8ea102bb2fe9b79720bbd;hpb=c336bac4e891ad66c9fa110f840b00cf6bbe72bf;p=perso%2FImmae%2FConfig%2FNix.git

diff --git a/nixops/modules/websites/default.nix b/nixops/modules/websites/default.nix
index 49dc5f7..f820c83 100644
--- a/nixops/modules/websites/default.nix
+++ b/nixops/modules/websites/default.nix
@@ -167,9 +167,11 @@ in
   };
 
   config = {
+    users.users.wwwrun.extraGroups = [ "keys" ];
     networking.firewall.allowedTCPPorts = [ 80 443 ];
 
     nixpkgs.overlays = [ (self: super: rec {
+      #openssl = self.openssl_1_1;
       php = php72;
       php72 = (super.php72.override {
         mysql.connector-c = self.mariadb;
@@ -227,6 +229,24 @@ in
     services.myWebsites.TellesFlorian.integration.enable = true;
     services.myWebsites.Florian.integration.enable = true;
 
+    deployment.keys.apache-ldap = {
+      user = "wwwrun";
+      group = "wwwrun";
+      permissions = "0700";
+      text = ''
+        <Macro LDAPConnect>
+          <IfModule authnz_ldap_module>
+            AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
+            AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
+            AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
+            AuthType             Basic
+            AuthName             "Authentification requise (Acces LDAP)"
+            AuthBasicProvider    ldap
+          </IfModule>
+        </Macro>
+        '';
+    };
+
     services.myWebsites.apacheConfig = {
       gzip = {
         modules = [ "deflate" "filter" ];
@@ -264,16 +284,7 @@ in
             LDAPOpCacheTTL 600
           </IfModule>
 
-          <Macro LDAPConnect>
-            <IfModule authnz_ldap_module>
-              AuthLDAPURL          ldap://ldap.immae.eu:389/dc=immae,dc=eu STARTTLS
-              AuthLDAPBindDN       cn=httpd,ou=services,dc=immae,dc=eu
-              AuthLDAPBindPassword "${myconfig.env.httpd.ldap.password}"
-              AuthType             Basic
-              AuthName             "Authentification requise (Acces LDAP)"
-              AuthBasicProvider    ldap
-            </IfModule>
-          </Macro>
+          Include /run/keys/apache-ldap
         '';
       };
       global = {
@@ -414,8 +425,10 @@ in
       phpOptions = ''
         session.save_path = "/var/lib/php/sessions"
         post_max_size = 20M
-        session.gc_maxlifetime = 60*60*24*15
-        session.cache_expire = 60*24*30
+        ; 15 days (seconds)
+        session.gc_maxlifetime = 1296000
+        ; 30 days (minutes)
+        session.cache_expire = 43200
         '';
       extraConfig = ''
         log_level = notice