modules/private/websites/chloe/builder.nix

   1 { apacheUser, apacheGroup, chloe, config }:
   2 rec {
   3   app = chloe.override { inherit (config) environment; };
   4   phpFpm = rec {
   5     serviceDeps = [ "mysql.service" ];
   6     pool = {
   7       "listen.owner" = apacheUser;
   8       "listen.group" = apacheGroup;
   9       "php_admin_value[upload_max_filesize]" = "20M";
  10       "php_admin_value[post_max_size]" = "20M";
  11       # "php_admin_flag[log_errors]" = "on";
  12       "php_admin_value[open_basedir]" = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp";
  13       "php_admin_value[session.save_path]" = "${app.varDir}/phpSessions";
  14     } // (if app.environment == "dev" then {
  15       "pm" = "ondemand";
  16       "pm.max_children" = "5";
  17       "pm.process_idle_timeout" = "60";
  18     } else {
  19       "pm" = "dynamic";
  20       "pm.max_children" = "20";
  21       "pm.start_servers" = "2";
  22       "pm.min_spare_servers" = "1";
  23       "pm.max_spare_servers" = "3";
  24     });
  25   };
  26   keys = [{
  27     dest = "webapps/${app.environment}-chloe";
  28     user = apacheUser;
  29     group = apacheGroup;
  30     permissions = "0400";
  31     text = ''
  32       SetEnv SPIP_CONFIG_DIR     "${configDir}"
  33       SetEnv SPIP_VAR_DIR        "${app.varDir}"
  34       SetEnv SPIP_SITE           "chloe-${app.environment}"
  35       SetEnv SPIP_LDAP_BASE      "dc=immae,dc=eu"
  36       SetEnv SPIP_LDAP_HOST      "ldaps://ldap.immae.eu"
  37       SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}"
  38       SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}"
  39       SetEnv SPIP_LDAP_SEARCH    "${config.ldap.filter}"
  40       SetEnv SPIP_MYSQL_HOST     "${config.mysql.host}"
  41       SetEnv SPIP_MYSQL_PORT     "${config.mysql.port}"
  42       SetEnv SPIP_MYSQL_DB       "${config.mysql.database}"
  43       SetEnv SPIP_MYSQL_USER     "${config.mysql.user}"
  44       SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}"
  45     '';
  46   }];
  47   apache = rec {
  48     modules = [ "proxy_fcgi" ];
  49     webappName = "chloe_${app.environment}";
  50     root = "/run/current-system/webapps/${webappName}";
  51     vhostConf = socket: ''
  52       Include /var/secrets/webapps/${app.environment}-chloe
  53
  54       RewriteEngine On
  55       ${if app.environment == "prod" then ''
  56       RewriteRule ^/news.rss  /spip.php?page=backend&id_rubrique=1
  57       '' else ""}
  58
  59       <FilesMatch "\.php$">
  60         SetHandler "proxy:unix:${socket}|fcgi://localhost"
  61       </FilesMatch>
  62
  63       <Directory ${root}>
  64         DirectoryIndex index.php index.htm index.html
  65         Options -Indexes +FollowSymLinks +MultiViews +Includes
  66         Include ${root}/htaccess.txt
  67
  68         AllowOverride AuthConfig FileInfo Limit
  69         Require all granted
  70       </Directory>
  71
  72       <DirectoryMatch "${root}/squelettes">
  73         Require all denied
  74       </DirectoryMatch>
  75
  76       <FilesMatch "(.htaccess|rewrite-rules|.gitignore)$">
  77         Require all denied
  78       </FilesMatch>
  79
  80       ${if app.environment == "dev" then ''
  81       <Location />
  82         Use LDAPConnect
  83         Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
  84         ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://osteopathe-cc.fr\"></html>"
  85       </Location>
  86       '' else ''
  87       Use Stats osteopathe-cc.fr
  88       ''}
  89       '';
  90   };
  91   activationScript = {
  92     deps = [ "wrappers" ];
  93     text = ''
  94       install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local
  95       install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
  96     '';
  97   };
  98   configDir = ./config;
  99 }