[perso/Immae/Config/Nix.git] / modules / private / websites / piedsjaloux / builder.nix

{ apacheUser, apacheGroup, piedsjaloux, config, pkgs, lib, mylibs, texlive, imagemagick }:
rec {
  app = piedsjaloux.override { inherit (config) environment; };
  varDir = "/var/lib/piedsjaloux_${app.environment}";
  keys = [{
    dest = "webapps/${app.environment}-piedsjaloux";
    user = apacheUser;
    group = apacheGroup;
    permissions = "0400";
    text = ''
      # This file is auto-generated during the composer install
      parameters:
          database_host: ${config.mysql.host}
          database_port: ${config.mysql.port}
          database_name: ${config.mysql.name}
          database_user: ${config.mysql.user}
          database_password: ${config.mysql.password}
          database_server_version: ${pkgs.mariadb.mysqlVersion}
          mailer_transport: smtp
          mailer_host: 127.0.0.1
          mailer_user: null
          mailer_password: null
          secret: ${config.secret}
          pdflatex: "${texlive.combine { inherit (texlive) attachfile preprint scheme-small; }}/bin/pdflatex"
      leapt_im:
          binary_path: ${imagemagick}/bin
    '';
  }];
  phpFpm = rec {
    preStart = mylibs.phpFpmPreStart {
      inherit app;
      inherit (app) varDir;
      keyFiles = [
        "/var/secrets/webapps/${app.environment}-piedsjaloux"
      ];
      actions = [
        "/run/wrappers/bin/sudo -u ${apacheUser} ./bin/console --env=${app.environment} cache:clear --no-warmup"
      ];
    };
    serviceDeps = [ "mysql.service" ];
    socket = "/var/run/phpfpm/piedsjaloux-${app.environment}.sock";
    pool = ''
      listen = ${socket}
      user = ${apacheUser}
      group = ${apacheGroup}
      listen.owner = ${apacheUser}
      listen.group = ${apacheGroup}
      php_admin_value[upload_max_filesize] = 20M
      php_admin_value[post_max_size] = 20M
      ;php_admin_flag[log_errors] = on
      php_admin_value[open_basedir] = "/var/secrets/webapps/${app.environment}-piedsjaloux:${app}:${app.varDir}:/tmp"
      php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
      env[PATH] = ${lib.makeBinPath [ pkgs.apg pkgs.unzip ]}
      ${if app.environment == "dev" then ''
      pm = ondemand
      pm.max_children = 5
      pm.process_idle_timeout = 60
      env[SYMFONY_DEBUG_MODE] = "yes"
      '' else ''
      pm = dynamic
      pm.max_children = 20
      pm.start_servers = 2
      pm.min_spare_servers = 1
      pm.max_spare_servers = 3
      ''}'';
  };
  apache = rec {
    modules = [ "proxy_fcgi" ];
    webappName = "piedsjaloux_${app.environment}";
    root = "/run/current-system/webapps/${webappName}";
    vhostConf = ''
    <FilesMatch "\.php$">
      SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
    </FilesMatch>

    ${if app.environment == "dev" then ''
    <Location />
      Use LDAPConnect
      Require ldap-group   cn=piedsjaloux.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
      ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://piedsjaloux.fr\"></html>"
    </Location>

    <Directory ${root}>
      Options Indexes FollowSymLinks MultiViews Includes
      AllowOverride None
      Require all granted

      DirectoryIndex app_dev.php

      <IfModule mod_negotiation.c>
      Options -MultiViews
      </IfModule>

      <IfModule mod_rewrite.c>
        RewriteEngine On

        RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
        RewriteRule ^(.*) - [E=BASE:%1]

        # Maintenance script
        RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
        RewriteCond %{SCRIPT_FILENAME} !maintenance.php
        RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
        ErrorDocument 503 /maintenance.php

        # Sets the HTTP_AUTHORIZATION header removed by Apache
        RewriteCond %{HTTP:Authorization} .
        RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]

        RewriteCond %{ENV:REDIRECT_STATUS} ^$
        RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]

        # If the requested filename exists, simply serve it.
        # We only want to let Apache serve files and not directories.
        RewriteCond %{REQUEST_FILENAME} -f
        RewriteRule ^ - [L]

        # Rewrite all other queries to the front controller.
        RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
      </IfModule>

    </Directory>
    '' else ''
    Use Stats piedsjaloux.fr

    <Directory ${root}>
      Options Indexes FollowSymLinks MultiViews Includes
      AllowOverride All
      Require all granted
    </Directory>
    ''}
    '';
  };
  activationScript = {
    deps = [ "wrappers" ];
    text = ''
    install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} \
      ${app.varDir}/tmp
    install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
    '';
  };
}
Commit	Line	Data
4360f70d	1	{ apacheUser, apacheGroup, piedsjaloux, config, pkgs, lib, mylibs, texlive, imagemagick }:
313d19ce IB	2	rec {
	3	app = piedsjaloux.override { inherit (config) environment; };
	4	varDir = "/var/lib/piedsjaloux_${app.environment}";
	5	keys = [{
	6	dest = "webapps/${app.environment}-piedsjaloux";
f8026b6e IB	7	user = apacheUser;
f8026b6e IB	8	group = apacheGroup;
313d19ce IB	9	permissions = "0400";
	10	text = ''
	11	# This file is auto-generated during the composer install
	12	parameters:
	13	database_host: ${config.mysql.host}
	14	database_port: ${config.mysql.port}
	15	database_name: ${config.mysql.name}
	16	database_user: ${config.mysql.user}
	17	database_password: ${config.mysql.password}
	18	database_server_version: ${pkgs.mariadb.mysqlVersion}
	19	mailer_transport: smtp
	20	mailer_host: 127.0.0.1
	21	mailer_user: null
	22	mailer_password: null
	23	secret: ${config.secret}
	24	pdflatex: "${texlive.combine { inherit (texlive) attachfile preprint scheme-small; }}/bin/pdflatex"
	25	leapt_im:
	26	binary_path: ${imagemagick}/bin
	27	'';
	28	}];
	29	phpFpm = rec {
4360f70d IB	30	preStart = mylibs.phpFpmPreStart {
	31	inherit app;
	32	inherit (app) varDir;
	33	keyFiles = [
	34	"/var/secrets/webapps/${app.environment}-piedsjaloux"
	35	];
	36	actions = [
	37	"/run/wrappers/bin/sudo -u ${apacheUser} ./bin/console --env=${app.environment} cache:clear --no-warmup"
	38	];
	39	};
313d19ce IB	40	serviceDeps = [ "mysql.service" ];
	41	socket = "/var/run/phpfpm/piedsjaloux-${app.environment}.sock";
	42	pool = ''
	43	listen = ${socket}
f8026b6e IB	44	user = ${apacheUser}
	45	group = ${apacheGroup}
	46	listen.owner = ${apacheUser}
	47	listen.group = ${apacheGroup}
313d19ce IB	48	php_admin_value[upload_max_filesize] = 20M
	49	php_admin_value[post_max_size] = 20M
	50	;php_admin_flag[log_errors] = on
	51	php_admin_value[open_basedir] = "/var/secrets/webapps/${app.environment}-piedsjaloux:${app}:${app.varDir}:/tmp"
	52	php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
	53	env[PATH] = ${lib.makeBinPath [ pkgs.apg pkgs.unzip ]}
	54	${if app.environment == "dev" then ''
	55	pm = ondemand
	56	pm.max_children = 5
	57	pm.process_idle_timeout = 60
	58	env[SYMFONY_DEBUG_MODE] = "yes"
	59	'' else ''
	60	pm = dynamic
	61	pm.max_children = 20
	62	pm.start_servers = 2
	63	pm.min_spare_servers = 1
	64	pm.max_spare_servers = 3
	65	''}'';
	66	};
	67	apache = rec {
313d19ce IB	68	modules = [ "proxy_fcgi" ];
	69	webappName = "piedsjaloux_${app.environment}";
	70	root = "/run/current-system/webapps/${webappName}";
	71	vhostConf = ''
	72	<FilesMatch "\.php$">
	73	SetHandler "proxy:unix:${phpFpm.socket}\|fcgi://localhost"
	74	</FilesMatch>
34e2fd14	75
313d19ce IB	76	${if app.environment == "dev" then ''
	77	<Location />
	78	Use LDAPConnect
	79	Require ldap-group cn=piedsjaloux.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
	80	ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://piedsjaloux.fr\"></html>"
	81	</Location>
34e2fd14	82
313d19ce IB	83	<Directory ${root}>
	84	Options Indexes FollowSymLinks MultiViews Includes
	85	AllowOverride None
	86	Require all granted
34e2fd14	87
313d19ce	88	DirectoryIndex app_dev.php
34e2fd14	89
313d19ce IB	90	<IfModule mod_negotiation.c>
	91	Options -MultiViews
	92	</IfModule>
34e2fd14	93
313d19ce IB	94	<IfModule mod_rewrite.c>
313d19ce IB	95	RewriteEngine On
34e2fd14	96
313d19ce IB	97	RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
313d19ce IB	98	RewriteRule ^(.*) - [E=BASE:%1]
34e2fd14	99
313d19ce IB	100	# Maintenance script
	101	RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
	102	RewriteCond %{SCRIPT_FILENAME} !maintenance.php
	103	RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
	104	ErrorDocument 503 /maintenance.php
34e2fd14	105
313d19ce IB	106	# Sets the HTTP_AUTHORIZATION header removed by Apache
	107	RewriteCond %{HTTP:Authorization} .
	108	RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
34e2fd14	109
313d19ce IB	110	RewriteCond %{ENV:REDIRECT_STATUS} ^$
313d19ce IB	111	RewriteRule ^app_dev\.php(?:/(.*)\|$) %{ENV:BASE}/$1 [R=301,L]
34e2fd14	112
313d19ce IB	113	# If the requested filename exists, simply serve it.
	114	# We only want to let Apache serve files and not directories.
	115	RewriteCond %{REQUEST_FILENAME} -f
	116	RewriteRule ^ - [L]
34e2fd14	117
313d19ce IB	118	# Rewrite all other queries to the front controller.
	119	RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
	120	</IfModule>
34e2fd14	121
313d19ce IB	122	</Directory>
	123	'' else ''
	124	Use Stats piedsjaloux.fr
34e2fd14	125
313d19ce IB	126	<Directory ${root}>
	127	Options Indexes FollowSymLinks MultiViews Includes
	128	AllowOverride All
	129	Require all granted
	130	</Directory>
	131	''}
	132	'';
	133	};
	134	activationScript = {
	135	deps = [ "wrappers" ];
	136	text = ''
f8026b6e	137	install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} \
313d19ce	138	${app.varDir}/tmp
f8026b6e	139	install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
313d19ce	140	'';
34e2fd14	141	};
313d19ce	142	}