[perso/Immae/Config/Nix.git] / modules / private / websites / aten / builder.nix

{ apacheUser, apacheGroup, aten, lib, config }: rec {
  app = aten.override { inherit (config) environment; };
  phpFpm = rec {
    preStart = ''
      if [ ! -f "${app.varDir}/currentWebappDir" -o \
          ! -f "${app.varDir}/currentKey" -o \
          "${app}" != "$(cat ${app.varDir}/currentWebappDir 2>/dev/null)" ] \
          || ! sha512sum -c --status ${app.varDir}/currentKey; then
        pushd ${app} > /dev/null
        /run/wrappers/bin/sudo -u ${apacheUser} APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup
        popd > /dev/null
        echo -n "${app}" > ${app.varDir}/currentWebappDir
        sha512sum /var/secrets/webapps/${app.environment}-aten > ${app.varDir}/currentKey
      fi
      '';
    serviceDeps = [ "postgresql.service" ];
    socket = "/var/run/phpfpm/aten-${app.environment}.sock";
    pool = ''
      listen = ${socket}
      user = ${apacheUser}
      group = ${apacheGroup}
      listen.owner = ${apacheUser}
      listen.group = ${apacheGroup}
      php_admin_value[upload_max_filesize] = 20M
      php_admin_value[post_max_size] = 20M
      ;php_admin_flag[log_errors] = on
      php_admin_value[open_basedir] = "${app}:${app.varDir}:/tmp"
      php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
      ${if app.environment == "dev" then ''
      pm = ondemand
      pm.max_children = 5
      pm.process_idle_timeout = 60
      env[SYMFONY_DEBUG_MODE] = "yes"
      '' else ''
      pm = dynamic
      pm.max_children = 20
      pm.start_servers = 2
      pm.min_spare_servers = 1
      pm.max_spare_servers = 3
      ''}'';
  };
  keys = [{
    dest = "webapps/${app.environment}-aten";
    user = apacheUser;
    group = apacheGroup;
    permissions = "0400";
    text = ''
      SetEnv APP_ENV      "${app.environment}"
      SetEnv APP_SECRET   "${config.secret}"
      SetEnv DATABASE_URL "${config.psql_url}"
      '';
  }];
  apache = rec {
    modules = [ "proxy_fcgi" ];
    webappName = "aten_${app.environment}";
    root = "/run/current-system/webapps/${webappName}";
    vhostConf = ''
    <FilesMatch "\.php$">
      SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
    </FilesMatch>

    Include /var/secrets/webapps/${app.environment}-aten

    ${if app.environment == "dev" then ''
    <Location />
      Use LDAPConnect
      Require ldap-group   cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
      ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
    </Location>

    <Location /backend>
      Use LDAPConnect
      Require ldap-group   cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
      ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
    </Location>
    '' else ''
    Use Stats aten.pro

    <Location /backend>
      Use LDAPConnect
      Require ldap-group   cn=aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
      ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
    </Location>
    ''}

    <Directory ${root}>
      Options Indexes FollowSymLinks MultiViews Includes
      AllowOverride All
      Require all granted
      DirectoryIndex index.php
      FallbackResource /index.php
    </Directory>
    '';
  };
  activationScript = {
    deps = [ "wrappers" ];
    text = ''
    install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}
    install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
    '';
  };
}
Commit	Line	Data
f8026b6e	1	{ apacheUser, apacheGroup, aten, lib, config }: rec {
1bd8b03e IB	2	app = aten.override { inherit (config) environment; };
	3	phpFpm = rec {
	4	preStart = ''
	5	if [ ! -f "${app.varDir}/currentWebappDir" -o \
	6	! -f "${app.varDir}/currentKey" -o \
	7	"${app}" != "$(cat ${app.varDir}/currentWebappDir 2>/dev/null)" ] \
	8	\|\| ! sha512sum -c --status ${app.varDir}/currentKey; then
	9	pushd ${app} > /dev/null
f8026b6e	10	/run/wrappers/bin/sudo -u ${apacheUser} APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup
1bd8b03e IB	11	popd > /dev/null
	12	echo -n "${app}" > ${app.varDir}/currentWebappDir
	13	sha512sum /var/secrets/webapps/${app.environment}-aten > ${app.varDir}/currentKey
	14	fi
	15	'';
	16	serviceDeps = [ "postgresql.service" ];
	17	socket = "/var/run/phpfpm/aten-${app.environment}.sock";
	18	pool = ''
	19	listen = ${socket}
f8026b6e IB	20	user = ${apacheUser}
	21	group = ${apacheGroup}
	22	listen.owner = ${apacheUser}
	23	listen.group = ${apacheGroup}
1bd8b03e IB	24	php_admin_value[upload_max_filesize] = 20M
	25	php_admin_value[post_max_size] = 20M
	26	;php_admin_flag[log_errors] = on
	27	php_admin_value[open_basedir] = "${app}:${app.varDir}:/tmp"
	28	php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
	29	${if app.environment == "dev" then ''
	30	pm = ondemand
	31	pm.max_children = 5
	32	pm.process_idle_timeout = 60
	33	env[SYMFONY_DEBUG_MODE] = "yes"
	34	'' else ''
	35	pm = dynamic
	36	pm.max_children = 20
	37	pm.start_servers = 2
	38	pm.min_spare_servers = 1
	39	pm.max_spare_servers = 3
	40	''}'';
	41	};
	42	keys = [{
	43	dest = "webapps/${app.environment}-aten";
f8026b6e IB	44	user = apacheUser;
f8026b6e IB	45	group = apacheGroup;
1bd8b03e IB	46	permissions = "0400";
	47	text = ''
	48	SetEnv APP_ENV "${app.environment}"
	49	SetEnv APP_SECRET "${config.secret}"
	50	SetEnv DATABASE_URL "${config.psql_url}"
	51	'';
	52	}];
	53	apache = rec {
1bd8b03e IB	54	modules = [ "proxy_fcgi" ];
	55	webappName = "aten_${app.environment}";
	56	root = "/run/current-system/webapps/${webappName}";
	57	vhostConf = ''
	58	<FilesMatch "\.php$">
	59	SetHandler "proxy:unix:${phpFpm.socket}\|fcgi://localhost"
	60	</FilesMatch>
6c672f34	61
1bd8b03e	62	Include /var/secrets/webapps/${app.environment}-aten
6c672f34	63
1bd8b03e IB	64	${if app.environment == "dev" then ''
	65	<Location />
	66	Use LDAPConnect
	67	Require ldap-group cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
	68	ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
	69	</Location>
6c672f34	70
1bd8b03e IB	71	<Location /backend>
	72	Use LDAPConnect
	73	Require ldap-group cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
	74	ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
	75	</Location>
	76	'' else ''
	77	Use Stats aten.pro
34e2fd14	78
1bd8b03e IB	79	<Location /backend>
	80	Use LDAPConnect
	81	Require ldap-group cn=aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
	82	ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
	83	</Location>
	84	''}
6c672f34	85
1bd8b03e IB	86	<Directory ${root}>
	87	Options Indexes FollowSymLinks MultiViews Includes
	88	AllowOverride All
	89	Require all granted
	90	DirectoryIndex index.php
	91	FallbackResource /index.php
	92	</Directory>
	93	'';
	94	};
	95	activationScript = {
	96	deps = [ "wrappers" ];
	97	text = ''
f8026b6e IB	98	install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}
f8026b6e IB	99	install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
1bd8b03e	100	'';
6c672f34	101	};
1bd8b03e	102	}