[perso/Immae/Config/Nix.git] / nixops / modules / websites / chloe / chloe.nix

{ chloe, config }:
rec {
  app = chloe.override { inherit (config) environment; };
  phpFpm = rec {
    serviceDeps = [ "mysql.service" ];
    socket = "/var/run/phpfpm/chloe-${app.environment}.sock";
    pool = ''
      listen = ${socket}
      user = ${apache.user}
      group = ${apache.group}
      listen.owner = ${apache.user}
      listen.group = ${apache.group}
      php_admin_value[upload_max_filesize] = 20M
      php_admin_value[post_max_size] = 20M
      ;php_admin_flag[log_errors] = on
      php_admin_value[open_basedir] = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp"
      php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
      ${if app.environment == "dev" then ''
      pm = ondemand
      pm.max_children = 5
      pm.process_idle_timeout = 60
      '' else ''
      pm = dynamic
      pm.max_children = 20
      pm.start_servers = 2
      pm.min_spare_servers = 1
      pm.max_spare_servers = 3
      ''}'';
  };
  keys = [{
    dest = "webapps/${app.environment}-chloe";
    user = apache.user;
    group = apache.group;
    permissions = "0400";
    text = ''
      SetEnv SPIP_CONFIG_DIR     "${configDir}"
      SetEnv SPIP_VAR_DIR        "${app.varDir}"
      SetEnv SPIP_SITE           "chloe-${app.environment}"
      SetEnv SPIP_LDAP_BASE      "dc=immae,dc=eu"
      SetEnv SPIP_LDAP_HOST      "ldaps://ldap.immae.eu"
      SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}"
      SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}"
      SetEnv SPIP_LDAP_SEARCH    "${config.ldap.search}"
      SetEnv SPIP_MYSQL_HOST     "${config.mysql.host}"
      SetEnv SPIP_MYSQL_PORT     "${config.mysql.port}"
      SetEnv SPIP_MYSQL_DB       "${config.mysql.name}"
      SetEnv SPIP_MYSQL_USER     "${config.mysql.user}"
      SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}"
    '';
  }];
  apache = rec {
    user = "wwwrun";
    group = "wwwrun";
    modules = [ "proxy_fcgi" ];
    webappName = "chloe_${app.environment}";
    root = "/run/current-system/webapps/${webappName}";
    vhostConf = ''
      Include /var/secrets/webapps/${app.environment}-chloe

      RewriteEngine On
      ${if app.environment == "prod" then ''
      RewriteRule ^/news.rss  /spip.php?page=backend&id_rubrique=1
      '' else ""}

      <FilesMatch "\.php$">
        SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
      </FilesMatch>

      <Directory ${root}>
        DirectoryIndex index.php index.htm index.html
        Options -Indexes +FollowSymLinks +MultiViews +Includes
        Include ${root}/htaccess.txt

        AllowOverride AuthConfig FileInfo Limit
        Require all granted
      </Directory>

      <DirectoryMatch "${root}/squelettes">
        Require all denied
      </DirectoryMatch>

      <FilesMatch "(.htaccess|rewrite-rules|.gitignore)$">
        Require all denied
      </FilesMatch>

      ${if app.environment == "dev" then ''
      <Location />
        Use LDAPConnect
        Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
        ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://osteopathe-cc.fr\"></html>"
      </Location>
      '' else ''
      Use Stats osteopathe-cc.fr
      ''}
      '';
  };
  activationScript = {
    deps = [ "wrappers" ];
    text = ''
      install -m 0755 -o ${apache.user} -g ${apache.group} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local
      install -m 0750 -o ${apache.user} -g ${apache.group} -d ${app.varDir}/phpSessions
    '';
  };
  configDir = ./chloe_config_ + app.environment;
}
Commit	Line	Data
7667c367 IB	1	{ chloe, config }:
	2	rec {
	3	app = chloe.override { inherit (config) environment; };
	4	phpFpm = rec {
	5	serviceDeps = [ "mysql.service" ];
	6	socket = "/var/run/phpfpm/chloe-${app.environment}.sock";
	7	pool = ''
	8	listen = ${socket}
	9	user = ${apache.user}
	10	group = ${apache.group}
	11	listen.owner = ${apache.user}
	12	listen.group = ${apache.group}
	13	php_admin_value[upload_max_filesize] = 20M
	14	php_admin_value[post_max_size] = 20M
	15	;php_admin_flag[log_errors] = on
	16	php_admin_value[open_basedir] = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp"
	17	php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
	18	${if app.environment == "dev" then ''
	19	pm = ondemand
	20	pm.max_children = 5
	21	pm.process_idle_timeout = 60
	22	'' else ''
	23	pm = dynamic
	24	pm.max_children = 20
	25	pm.start_servers = 2
	26	pm.min_spare_servers = 1
	27	pm.max_spare_servers = 3
	28	''}'';
	29	};
	30	keys = [{
	31	dest = "webapps/${app.environment}-chloe";
	32	user = apache.user;
	33	group = apache.group;
	34	permissions = "0400";
	35	text = ''
	36	SetEnv SPIP_CONFIG_DIR "${configDir}"
	37	SetEnv SPIP_VAR_DIR "${app.varDir}"
	38	SetEnv SPIP_SITE "chloe-${app.environment}"
	39	SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu"
	40	SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu"
	41	SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}"
	42	SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}"
	43	SetEnv SPIP_LDAP_SEARCH "${config.ldap.search}"
	44	SetEnv SPIP_MYSQL_HOST "${config.mysql.host}"
	45	SetEnv SPIP_MYSQL_PORT "${config.mysql.port}"
	46	SetEnv SPIP_MYSQL_DB "${config.mysql.name}"
	47	SetEnv SPIP_MYSQL_USER "${config.mysql.user}"
	48	SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}"
	49	'';
	50	}];
	51	apache = rec {
	52	user = "wwwrun";
	53	group = "wwwrun";
	54	modules = [ "proxy_fcgi" ];
	55	webappName = "chloe_${app.environment}";
	56	root = "/run/current-system/webapps/${webappName}";
	57	vhostConf = ''
	58	Include /var/secrets/webapps/${app.environment}-chloe
906065a0	59
7667c367 IB	60	RewriteEngine On
	61	${if app.environment == "prod" then ''
	62	RewriteRule ^/news.rss /spip.php?page=backend&id_rubrique=1
	63	'' else ""}
7d8b50d3	64
7667c367 IB	65	<FilesMatch "\.php$">
	66	SetHandler "proxy:unix:${phpFpm.socket}\|fcgi://localhost"
	67	</FilesMatch>
7d8b50d3	68
7667c367 IB	69	<Directory ${root}>
	70	DirectoryIndex index.php index.htm index.html
	71	Options -Indexes +FollowSymLinks +MultiViews +Includes
	72	Include ${root}/htaccess.txt
7d8b50d3	73
7667c367 IB	74	AllowOverride AuthConfig FileInfo Limit
	75	Require all granted
	76	</Directory>
7d8b50d3	77
7667c367 IB	78	<DirectoryMatch "${root}/squelettes">
	79	Require all denied
	80	</DirectoryMatch>
7d8b50d3	81
7667c367 IB	82	<FilesMatch "(.htaccess\|rewrite-rules\|.gitignore)$">
	83	Require all denied
	84	</FilesMatch>
7d8b50d3	85
7667c367 IB	86	${if app.environment == "dev" then ''
	87	<Location />
	88	Use LDAPConnect
	89	Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
	90	ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://osteopathe-cc.fr\"></html>"
	91	</Location>
	92	'' else ''
	93	Use Stats osteopathe-cc.fr
	94	''}
7d8b50d3	95	'';
7d8b50d3	96	};
7667c367 IB	97	activationScript = {
	98	deps = [ "wrappers" ];
	99	text = ''
	100	install -m 0755 -o ${apache.user} -g ${apache.group} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local
	101	install -m 0750 -o ${apache.user} -g ${apache.group} -d ${app.varDir}/phpSessions
	102	'';
	103	};
	104	configDir = ./chloe_config_ + app.environment;
	105	}