From 1b3154e40a568a296c74759d68827366b5f26da9 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Isma=C3=ABl=20Bouya?= <ismael.bouya@normalesup.org>
Date: Thu, 25 Apr 2019 01:37:42 +0200
Subject: [PATCH] Move websites to new secrets

---
 nixops/modules/websites/aten/aten.nix         | 12 ++---
 nixops/modules/websites/aten/default.nix      |  4 +-
 nixops/modules/websites/chloe/chloe.nix       | 10 ++--
 nixops/modules/websites/chloe/default.nix     |  4 +-
 .../connexionswing/connexionswing.nix         | 14 ++---
 .../websites/connexionswing/default.nix       |  4 +-
 nixops/modules/websites/ftp/jerome.nix        | 12 ++---
 nixops/modules/websites/ludivine/default.nix  |  4 +-
 .../websites/ludivine/ludivinecassal.nix      | 14 ++---
 .../modules/websites/piedsjaloux/default.nix  |  4 +-
 .../websites/piedsjaloux/piedsjaloux.nix      | 14 ++---
 .../websites/tellesflorian/default.nix        |  2 +-
 .../websites/tellesflorian/tellesflorian.nix  | 54 +++++++++----------
 13 files changed, 75 insertions(+), 77 deletions(-)

diff --git a/nixops/modules/websites/aten/aten.nix b/nixops/modules/websites/aten/aten.nix
index 567dcd1..46a7361 100644
--- a/nixops/modules/websites/aten/aten.nix
+++ b/nixops/modules/websites/aten/aten.nix
@@ -13,10 +13,10 @@ let
           /run/wrappers/bin/sudo -u wwwrun APP_ENV=${environment} ./bin/console --env=${environment} cache:clear --no-warmup
           popd > /dev/null
           echo -n "${webappDir}" > ${varDir}/currentWebappDir
-          sha512sum /run/keys/webapps/${environment}-aten > ${varDir}/currentKey
+          sha512sum /var/secrets/webapps/${environment}-aten > ${varDir}/currentKey
         fi
         '';
-      serviceDeps = [ "postgresql.service" "${environment}-aten-key.service" ];
+      serviceDeps = [ "postgresql.service" ];
       socket = "/var/run/phpfpm/aten-${environment}.sock";
       pool = ''
         listen = ${socket}
@@ -42,8 +42,8 @@ let
         pm.max_spare_servers = 3
         ''}'';
     };
-    keys."${environment}-aten" = {
-      destDir = "/run/keys/webapps";
+    keys = [{
+      dest = "webapps/${environment}-aten";
       user = apache.user;
       group = apache.group;
       permissions = "0400";
@@ -52,7 +52,7 @@ let
         SetEnv APP_SECRET   "${config.secret}"
         SetEnv DATABASE_URL "${config.psql_url}"
         '';
-    };
+    }];
     apache = rec {
       user = "wwwrun";
       group = "wwwrun";
@@ -64,7 +64,7 @@ let
         SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
       </FilesMatch>
 
-      Include /run/keys/webapps/${environment}-aten
+      Include /var/secrets/webapps/${environment}-aten
 
       ${if environment == "dev" then ''
       <Location />
diff --git a/nixops/modules/websites/aten/default.nix b/nixops/modules/websites/aten/default.nix
index b0f7fdb..6f58d3c 100644
--- a/nixops/modules/websites/aten/default.nix
+++ b/nixops/modules/websites/aten/default.nix
@@ -25,7 +25,7 @@ in {
 
   config = lib.mkMerge [
     (lib.mkIf cfg.production.enable {
-      deployment.keys = aten_prod.keys;
+      mySecrets.keys = aten_prod.keys;
       services.myWebsites.commons.stats.enable = true;
       services.myWebsites.commons.stats.sites = [
         {
@@ -59,7 +59,7 @@ in {
       };
     })
     (lib.mkIf cfg.integration.enable {
-      deployment.keys = aten_dev.keys;
+      mySecrets.keys = aten_dev.keys;
       security.acme.certs."eldiron".extraDomains."dev.aten.pro" = null;
       services.myPhpfpm.preStart.aten_dev = aten_dev.phpFpm.preStart;
       services.myPhpfpm.serviceDependencies.aten_dev = aten_dev.phpFpm.serviceDeps;
diff --git a/nixops/modules/websites/chloe/chloe.nix b/nixops/modules/websites/chloe/chloe.nix
index 0861cdf..e2381d8 100644
--- a/nixops/modules/websites/chloe/chloe.nix
+++ b/nixops/modules/websites/chloe/chloe.nix
@@ -3,7 +3,7 @@ let
   chloe = { config }: rec {
     environment = config.environment;
     phpFpm = rec {
-      serviceDeps = [ "mysql.service" "${environment}-chloe-key.service" ];
+      serviceDeps = [ "mysql.service" ];
       socket = "/var/run/phpfpm/chloe-${environment}.sock";
       pool = ''
         listen = ${socket}
@@ -28,8 +28,8 @@ let
         pm.max_spare_servers = 3
         ''}'';
     };
-    keys."${environment}-chloe" = {
-      destDir = "/run/keys/webapps";
+    keys = [{
+      dest = "webapps/${environment}-chloe";
       user = apache.user;
       group = apache.group;
       permissions = "0400";
@@ -48,7 +48,7 @@ let
         SetEnv SPIP_MYSQL_USER     "${config.mysql.user}"
         SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}"
       '';
-    };
+    }];
     apache = rec {
       user = "wwwrun";
       group = "wwwrun";
@@ -56,7 +56,7 @@ let
       webappName = "chloe_${environment}";
       root = "/run/current-system/webapps/${webappName}";
       vhostConf = ''
-        Include /run/keys/webapps/${environment}-chloe
+        Include /var/secrets/webapps/${environment}-chloe
 
         RewriteEngine On
         ${if environment == "prod" then ''
diff --git a/nixops/modules/websites/chloe/default.nix b/nixops/modules/websites/chloe/default.nix
index 451a248..33ced2e 100644
--- a/nixops/modules/websites/chloe/default.nix
+++ b/nixops/modules/websites/chloe/default.nix
@@ -25,7 +25,7 @@ in {
 
   config = lib.mkMerge [
     (lib.mkIf cfg.production.enable {
-      deployment.keys = chloe_prod.keys;
+      mySecrets.keys = chloe_prod.keys;
       services.myWebsites.commons.stats.enable = true;
       services.myWebsites.commons.stats.sites = [
         {
@@ -60,7 +60,7 @@ in {
       };
     })
     (lib.mkIf cfg.integration.enable {
-      deployment.keys = chloe_dev.keys;
+      mySecrets.keys = chloe_dev.keys;
       security.acme.certs."eldiron".extraDomains."chloe.immae.eu" = null;
       services.myPhpfpm.serviceDependencies.chloe_dev = chloe_dev.phpFpm.serviceDeps;
       services.myPhpfpm.poolConfigs.chloe_dev = chloe_dev.phpFpm.pool;
diff --git a/nixops/modules/websites/connexionswing/connexionswing.nix b/nixops/modules/websites/connexionswing/connexionswing.nix
index 13d4fba..60ddb63 100644
--- a/nixops/modules/websites/connexionswing/connexionswing.nix
+++ b/nixops/modules/websites/connexionswing/connexionswing.nix
@@ -3,8 +3,8 @@ let
   connexionswing = { config }: rec {
     environment = config.environment;
     varDir = "/var/lib/connexionswing_${environment}";
-    keys."${environment}-connexionswing" = {
-      destDir = "/run/keys/webapps";
+    keys = [{
+      dest = "webapps/${environment}-connexionswing";
       user = apache.user;
       group = apache.group;
       permissions = "0400";
@@ -31,7 +31,7 @@ let
               arguments: ['/run/wrappers/bin/sendmail -bs']
         '' else ""}
       '';
-    };
+    }];
     phpFpm = rec {
       preStart = ''
         if [ ! -f "${varDir}/currentWebappDir" -o \
@@ -42,10 +42,10 @@ let
           /run/wrappers/bin/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
           popd > /dev/null
           echo -n "${webappDir}" > ${varDir}/currentWebappDir
-          sha512sum /run/keys/webapps/${environment}-connexionswing > ${varDir}/currentKey
+          sha512sum /var/secrets/webapps/${environment}-connexionswing > ${varDir}/currentKey
         fi
         '';
-      serviceDeps = [ "mysql.service" "${environment}-connexionswing-key.service" ];
+      serviceDeps = [ "mysql.service" ];
       socket = "/var/run/phpfpm/connexionswing-${environment}.sock";
       phpConfig = ''
         extension=${phpPackages.imagick}/lib/php/extensions/imagick.so
@@ -59,7 +59,7 @@ let
         php_admin_value[upload_max_filesize] = 20M
         php_admin_value[post_max_size] = 20M
         ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/run/keys/webapps/${environment}-connexionswing:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/secrets/webapps/${environment}-connexionswing:${webappDir}:${varDir}:/tmp"
         php_admin_value[session.save_path] = "${varDir}/phpSessions"
         ${if environment == "dev" then ''
         pm = ondemand
@@ -177,7 +177,7 @@ let
           cd $out
           ${if environment == "prod" then "php ./bin/console assetic:dump --env=prod --no-debug" else ""}
           rm app/config/parameters.yml
-          ln -sf /run/keys/webapps/${environment}-connexionswing app/config/parameters.yml
+          ln -sf /var/secrets/webapps/${environment}-connexionswing app/config/parameters.yml
           rm -rf var/{logs,cache}
           ln -sf ${varDir}/var/{logs,cache} var/
           ln -sf ${varDir}/{medias,uploads} web/images/
diff --git a/nixops/modules/websites/connexionswing/default.nix b/nixops/modules/websites/connexionswing/default.nix
index ccbaa02..c0036d8 100644
--- a/nixops/modules/websites/connexionswing/default.nix
+++ b/nixops/modules/websites/connexionswing/default.nix
@@ -25,7 +25,7 @@ in {
 
   config = lib.mkMerge [
     (lib.mkIf cfg.production.enable {
-      deployment.keys = connexionswing_prod.keys;
+      mySecrets.keys = connexionswing_prod.keys;
       services.myWebsites.commons.stats.enable = true;
       services.myWebsites.commons.stats.sites = [
         {
@@ -61,7 +61,7 @@ in {
       };
     })
     (lib.mkIf cfg.integration.enable {
-      deployment.keys = connexionswing_dev.keys;
+      mySecrets.keys = connexionswing_dev.keys;
       security.acme.certs."eldiron".extraDomains."sandetludo.immae.eu" = null;
       security.acme.certs."eldiron".extraDomains."connexionswing.immae.eu" = null;
       services.myPhpfpm.preStart.connexionswing_dev = connexionswing_dev.phpFpm.preStart;
diff --git a/nixops/modules/websites/ftp/jerome.nix b/nixops/modules/websites/ftp/jerome.nix
index 6c0decd..18d16a1 100644
--- a/nixops/modules/websites/ftp/jerome.nix
+++ b/nixops/modules/websites/ftp/jerome.nix
@@ -29,8 +29,8 @@ in {
       domain = "naturaloutil.immae.eu";
     };
 
-    deployment.keys."prod-naturaloutil" = {
-      destDir = "/run/keys/webapps";
+    mySecrets.keys = [{
+      dest = "webapps/prod-naturaloutil";
       user = "wwwrun";
       group = "wwwrun";
       permissions = "0400";
@@ -49,8 +49,8 @@ in {
         $database = connect_db($db, $mysql_server, $mysql_base, $mysql_user, $mysql_password);
         ?>
       '';
-    };
-    services.myPhpfpm.serviceDependencies.jerome = [ "mysql.service" "prod-naturaloutil-key.service" ];
+    }];
+    services.myPhpfpm.serviceDependencies.jerome = [ "mysql.service" ];
     services.myPhpfpm.poolConfigs.jerome = ''
       listen = /run/phpfpm/naturaloutil.sock
       user = wwwrun
@@ -62,8 +62,8 @@ in {
       pm.max_children = 5
       pm.process_idle_timeout = 60
 
-      env[BDD_CONNECT] = "/run/keys/webapps/prod-naturaloutil"
-      php_admin_value[open_basedir] = "/run/keys/webapps/prod-naturaloutil:${varDir}:/tmp"
+      env[BDD_CONNECT] = "/var/secrets/webapps/prod-naturaloutil"
+      php_admin_value[open_basedir] = "/var/secrets/webapps/prod-naturaloutil:${varDir}:/tmp"
       '';
     services.myPhpfpm.poolPhpConfigs.jerome = ''
       extension=${pkgs.php}/lib/php/extensions/mysqli.so
diff --git a/nixops/modules/websites/ludivine/default.nix b/nixops/modules/websites/ludivine/default.nix
index 814764f..a3d3922 100644
--- a/nixops/modules/websites/ludivine/default.nix
+++ b/nixops/modules/websites/ludivine/default.nix
@@ -21,7 +21,7 @@ in {
 
   config = lib.mkMerge [
     (lib.mkIf cfg.production.enable {
-      deployment.keys = ludivinecassal_prod.keys;
+      mySecrets.keys = ludivinecassal_prod.keys;
       services.myWebsites.commons.stats.enable = true;
       services.myWebsites.commons.stats.sites = [
         {
@@ -54,7 +54,7 @@ in {
       };
     })
     (lib.mkIf cfg.integration.enable {
-      deployment.keys = ludivinecassal_dev.keys;
+      mySecrets.keys = ludivinecassal_dev.keys;
       security.acme.certs."eldiron".extraDomains."ludivine.immae.eu" = null;
 
       services.myPhpfpm.preStart.ludivinecassal_dev = ludivinecassal_dev.phpFpm.preStart;
diff --git a/nixops/modules/websites/ludivine/ludivinecassal.nix b/nixops/modules/websites/ludivine/ludivinecassal.nix
index 439d3c9..c12d89c 100644
--- a/nixops/modules/websites/ludivine/ludivinecassal.nix
+++ b/nixops/modules/websites/ludivine/ludivinecassal.nix
@@ -3,8 +3,8 @@ let
   ludivinecassal = { config }: rec {
     environment = config.environment;
     varDir = "/var/lib/ludivinecassal_${environment}";
-    keys."${environment}-ludivinecassal" = {
-      destDir = "/run/keys/webapps";
+    keys = [{
+      dest = "webapps/${environment}-ludivinecassal";
       user = apache.user;
       group = apache.group;
       permissions = "0400";
@@ -38,7 +38,7 @@ let
             sass: ${sass}/bin/sass
             ruby: ${ruby}/bin/ruby
       '';
-    };
+    }];
     phpFpm = rec {
       preStart = ''
         if [ ! -f "${varDir}/currentWebappDir" -o \
@@ -49,10 +49,10 @@ let
           /run/wrappers/bin/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
           popd > /dev/null
           echo -n "${webappDir}" > ${varDir}/currentWebappDir
-          sha512sum /run/keys/webapps/${environment}-ludivinecassal > ${varDir}/currentKey
+          sha512sum /var/secrets/webapps/${environment}-ludivinecassal > ${varDir}/currentKey
         fi
         '';
-      serviceDeps = [ "mysql.service" "${environment}-ludivinecassal-key.service" ];
+      serviceDeps = [ "mysql.service" ];
       socket = "/var/run/phpfpm/ludivinecassal-${environment}.sock";
       pool = ''
         listen = ${socket}
@@ -63,7 +63,7 @@ let
         php_admin_value[upload_max_filesize] = 20M
         php_admin_value[post_max_size] = 20M
         ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "/run/keys/webapps/${environment}-ludivinecassal:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/var/secrets/webapps/${environment}-ludivinecassal:${webappDir}:${varDir}:/tmp"
         php_admin_value[session.save_path] = "${varDir}/phpSessions"
         ${if environment == "dev" then ''
         pm = ondemand
@@ -177,7 +177,7 @@ let
         postInstall = ''
           rm -rf var/{logs,cache,data,miniatures,tmp}
           ln -sf ${varDir}/{logs,cache,data,miniatures,tmp} var/
-          ln -sf /run/keys/webapps/${environment}-ludivinecassal app/config/parameters.yml
+          ln -sf /var/secrets/webapps/${environment}-ludivinecassal app/config/parameters.yml
           '';
         buildInputs = [ sass ];
       });
diff --git a/nixops/modules/websites/piedsjaloux/default.nix b/nixops/modules/websites/piedsjaloux/default.nix
index 57849a3..b2bd2fd 100644
--- a/nixops/modules/websites/piedsjaloux/default.nix
+++ b/nixops/modules/websites/piedsjaloux/default.nix
@@ -25,7 +25,7 @@ in {
 
   config = lib.mkMerge [
     (lib.mkIf cfg.production.enable {
-      deployment.keys = piedsjaloux_prod.keys;
+      mySecrets.keys = piedsjaloux_prod.keys;
       services.myWebsites.commons.stats.enable = true;
       services.myWebsites.commons.stats.sites = [
         {
@@ -58,7 +58,7 @@ in {
       };
     })
     (lib.mkIf cfg.integration.enable {
-      deployment.keys = piedsjaloux_dev.keys;
+      mySecrets.keys = piedsjaloux_dev.keys;
       security.acme.certs."eldiron".extraDomains."piedsjaloux.immae.eu" = null;
       services.myPhpfpm.preStart.piedsjaloux_dev = piedsjaloux_dev.phpFpm.preStart;
       services.myPhpfpm.serviceDependencies.piedsjaloux_dev = piedsjaloux_dev.phpFpm.serviceDeps;
diff --git a/nixops/modules/websites/piedsjaloux/piedsjaloux.nix b/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
index 87699db..5461e5d 100644
--- a/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
+++ b/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
@@ -3,8 +3,8 @@ let
   piedsjaloux = { config }: rec {
     environment = config.environment;
     varDir = "/var/lib/piedsjaloux_${environment}";
-    keys."${environment}-piedsjaloux" = {
-      destDir = "/run/keys/webapps";
+    keys = [{
+      dest = "webapps/${environment}-piedsjaloux";
       user = apache.user;
       group = apache.group;
       permissions = "0400";
@@ -26,7 +26,7 @@ let
         leapt_im:
             binary_path: ${imagemagick}/bin
       '';
-    };
+    }];
     phpFpm = rec {
       preStart = ''
         if [ ! -f "${varDir}/currentWebappDir" -o \
@@ -37,10 +37,10 @@ let
           /run/wrappers/bin/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
           popd > /dev/null
           echo -n "${webappDir}" > ${varDir}/currentWebappDir
-          sha512sum /run/keys/webapps/${environment}-piedsjaloux > ${varDir}/currentKey
+          sha512sum /var/secrets/webapps/${environment}-piedsjaloux > ${varDir}/currentKey
         fi
         '';
-      serviceDeps = [ "mysql.service" "${environment}-piedsjaloux-key.service" ];
+      serviceDeps = [ "mysql.service" ];
       socket = "/var/run/phpfpm/piedsjaloux-${environment}.sock";
       pool = ''
         listen = ${socket}
@@ -51,7 +51,7 @@ let
         php_admin_value[upload_max_filesize] = 20M
         php_admin_value[post_max_size] = 20M
         ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "/run/keys/webapps/${environment}-piedsjaloux:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/var/secrets/webapps/${environment}-piedsjaloux:${webappDir}:${varDir}:/tmp"
         php_admin_value[session.save_path] = "${varDir}/phpSessions"
         env[PATH] = ${lib.makeBinPath [ pkgs.apg pkgs.unzip ]}
         ${if environment == "dev" then ''
@@ -157,7 +157,7 @@ let
         postInstall = ''
           cd $out
           rm app/config/parameters.yml
-          ln -sf /run/keys/webapps/${environment}-piedsjaloux app/config/parameters.yml
+          ln -sf /var/secrets/webapps/${environment}-piedsjaloux app/config/parameters.yml
           rm -rf var/{logs,cache,data,miniatures,tmp}
           ln -sf ${varDir}/{logs,cache,data,miniatures,tmp} var/
           '';
diff --git a/nixops/modules/websites/tellesflorian/default.nix b/nixops/modules/websites/tellesflorian/default.nix
index 9bf4a48..16d788f 100644
--- a/nixops/modules/websites/tellesflorian/default.nix
+++ b/nixops/modules/websites/tellesflorian/default.nix
@@ -16,7 +16,7 @@ in {
   };
 
   config = lib.mkIf cfg.integration.enable {
-    deployment.keys = tellesflorian_dev.keys;
+    mySecrets.keys = tellesflorian_dev.keys;
     security.acme.certs."eldiron".extraDomains."app.tellesflorian.com" = null;
     services.myPhpfpm.preStart.tellesflorian_dev = tellesflorian_dev.phpFpm.preStart;
     services.myPhpfpm.serviceDependencies.tellesflorian_dev = tellesflorian_dev.phpFpm.serviceDeps;
diff --git a/nixops/modules/websites/tellesflorian/tellesflorian.nix b/nixops/modules/websites/tellesflorian/tellesflorian.nix
index ba46c0c..afd723c 100644
--- a/nixops/modules/websites/tellesflorian/tellesflorian.nix
+++ b/nixops/modules/websites/tellesflorian/tellesflorian.nix
@@ -3,14 +3,24 @@ let
   tellesflorian = { config }: rec {
     environment = config.environment;
     varDir = "/var/lib/tellesflorian_${environment}";
-    keys."${environment}-tellesflorian" = {
-      destDir = "/run/keys/webapps";
-      user = apache.user;
-      group = apache.group;
-      permissions = "0400";
-      text = ''
-        # This file is auto-generated during the composer install
-        parameters:
+    keys = [
+      {
+        dest = "webapps/${environment}-tellesflorian-passwords";
+        user = apache.user;
+        group = apache.group;
+        permissions = "0400";
+        text = ''
+          invite:${config.invite_passwords}
+        '';
+      }
+      {
+        dest = "webapps/${environment}-tellesflorian";
+        user = apache.user;
+        group = apache.group;
+        permissions = "0400";
+        text = ''
+          # This file is auto-generated during the composer install
+          parameters:
             database_host: ${config.mysql.host}
             database_port: ${config.mysql.port}
             database_name: ${config.mysql.name}
@@ -21,8 +31,9 @@ let
             mailer_user: null
             mailer_password: null
             secret: ${config.secret}
-      '';
-    };
+        '';
+      }
+    ];
     phpFpm = rec {
       preStart = ''
         if [ ! -f "${varDir}/currentWebappDir" -o \
@@ -33,14 +44,10 @@ let
           /run/wrappers/bin/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
           popd > /dev/null
           echo -n "${webappDir}" > ${varDir}/currentWebappDir
-          sha512sum /run/keys/webapps/${environment}-tellesflorian > ${varDir}/currentKey
+          sha512sum /var/secrets/webapps/${environment}-tellesflorian > ${varDir}/currentKey
         fi
         '';
-      serviceDeps = [
-        "mysql.service"
-        "${environment}-tellesflorian-passwords-key.service"
-        "${environment}-tellesflorian-key.service"
-      ];
+      serviceDeps = [ "mysql.service" ];
       socket = "/var/run/phpfpm/floriantelles-${environment}.sock";
       pool = ''
         listen = ${socket}
@@ -51,7 +58,7 @@ let
         php_admin_value[upload_max_filesize] = 20M
         php_admin_value[post_max_size] = 20M
         ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "/run/keys/webapps/${environment}-tellesflorian:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/var/secrets/webapps/${environment}-tellesflorian:${webappDir}:${varDir}:/tmp"
         php_admin_value[session.save_path] = "${varDir}/phpSessions"
         ${if environment == "dev" then ''
         pm = ondemand
@@ -66,15 +73,6 @@ let
         pm.max_spare_servers = 3
         ''}'';
     };
-    keys."${environment}-tellesflorian-passwords" = {
-      destDir = "/run/keys/webapps";
-      user = apache.user;
-      group = apache.group;
-      permissions = "0400";
-      text = ''
-        invite:${config.invite_passwords}
-      '';
-    };
     apache = rec {
       user = "wwwrun";
       group = "wwwrun";
@@ -92,7 +90,7 @@ let
         Use LDAPConnect
         Require ldap-group   cn=app.tellesflorian.com,cn=httpd,ou=services,dc=immae,dc=eu
 
-        AuthUserFile "/run/keys/webapps/${environment}-tellesflorian-passwords"
+        AuthUserFile "/var/secrets/webapps/${environment}-tellesflorian-passwords"
         Require user "invite"
 
         ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://tellesflorian.com\"></html>"
@@ -166,7 +164,7 @@ let
         postInstall = ''
           cd $out
           rm app/config/parameters.yml
-          ln -sf /run/keys/webapps/${environment}-tellesflorian app/config/parameters.yml
+          ln -sf /var/secrets/webapps/${environment}-tellesflorian app/config/parameters.yml
           rm -rf var/{logs,cache}
           ln -sf ${varDir}/var/{logs,cache,sessions} var/
           '';
-- 
2.41.0