X-Git-Url: https://git.immae.eu/?a=blobdiff_plain;f=nixops%2Fmodules%2Fwebsites%2Ftellesflorian%2Ftellesflorian.nix;h=a8e741e85dcd3e88755218867be5e31f3ffb6f3d;hb=85f5ed68104de9edd8f8e532dc0c2de931e3ca1b;hp=47142c8d46e33757252d975e639daef94368326e;hpb=e5073addbe397afd596613af469f3308a07c1801;p=perso%2FImmae%2FConfig%2FNix.git diff --git a/nixops/modules/websites/tellesflorian/tellesflorian.nix b/nixops/modules/websites/tellesflorian/tellesflorian.nix index 47142c8..a8e741e 100644 --- a/nixops/modules/websites/tellesflorian/tellesflorian.nix +++ b/nixops/modules/websites/tellesflorian/tellesflorian.nix @@ -3,8 +3,12 @@ let tellesflorian = { config }: rec { environment = config.environment; varDir = "/var/lib/tellesflorian_${environment}"; - configRoot = - writeText "parameters.yml" '' + keys."${environment}-tellesflorian" = { + destDir = "/run/keys/webapps"; + user = apache.user; + group = apache.group; + permissions = "0400"; + text = '' # This file is auto-generated during the composer install parameters: database_host: ${config.mysql.host} @@ -18,7 +22,13 @@ let mailer_password: null secret: ${config.secret} ''; + }; phpFpm = rec { + serviceDeps = [ + "mysql.service" + "${environment}-tellesflorian-passwords-key.service" + "${environment}-tellesflorian-key.service" + ]; socket = "/var/run/phpfpm/floriantelles-${environment}.sock"; pool = '' listen = ${socket} @@ -29,7 +39,7 @@ let php_admin_value[upload_max_filesize] = 20M php_admin_value[post_max_size] = 20M ;php_admin_flag[log_errors] = on - php_admin_value[open_basedir] = "${configRoot}:${webappDir}:${varDir}:/tmp" + php_admin_value[open_basedir] = "/run/keys/webapps/${environment}-tellesflorian:${webappDir}:${varDir}:/tmp" php_admin_value[session.save_path] = "${varDir}/phpSessions" ${if environment == "dev" then '' pm = ondemand @@ -44,9 +54,15 @@ let pm.max_spare_servers = 3 ''}''; }; - passwords = writeText "tellesflorian_passwords" '' - invite:${config.invite_passwords} + keys."${environment}-tellesflorian-passwords" = { + destDir = "/run/keys/webapps"; + user = apache.user; + group = apache.group; + permissions = "0400"; + text = '' + invite:${config.invite_passwords} ''; + }; apache = rec { user = "wwwrun"; group = "wwwrun"; @@ -64,7 +80,7 @@ let Use LDAPConnect Require ldap-group cn=app.tellesflorian.com,cn=httpd,ou=services,dc=immae,dc=eu - AuthUserFile "${passwords}" + AuthUserFile "/run/keys/webapps/${environment}-tellesflorian-passwords" Require user "invite" ErrorDocument 401 "" @@ -145,9 +161,9 @@ let postInstall = '' cd $out rm app/config/parameters.yml - ln -sf ${configRoot} app/config/parameters.yml + ln -sf /run/keys/webapps/${environment}-tellesflorian app/config/parameters.yml rm -rf var/{logs,cache} - ln -sf ../../../../../../${varDir}/var/{logs,cache,sessions} var/ + ln -sf ${varDir}/var/{logs,cache,sessions} var/ ''; }); webRoot = "${webappDir}/web";