modules/private/websites/chloe/builder.nix

   1 { apacheUser, apacheGroup, chloe, config }:
   2 rec {
   3   app = chloe.override { inherit (config) environment; };
   4   phpFpm = rec {
   5     serviceDeps = [ "mysql.service" ];
   6     socket = "/var/run/phpfpm/chloe-${app.environment}.sock";
   7     pool = ''
   8       user = ${apacheUser}
   9       group = ${apacheGroup}
  10       listen.owner = ${apacheUser}
  11       listen.group = ${apacheGroup}
  12       php_admin_value[upload_max_filesize] = 20M
  13       php_admin_value[post_max_size] = 20M
  14       ;php_admin_flag[log_errors] = on
  15       php_admin_value[open_basedir] = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp"
  16       php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
  17       ${if app.environment == "dev" then ''
  18       pm = ondemand
  19       pm.max_children = 5
  20       pm.process_idle_timeout = 60
  21       '' else ''
  22       pm = dynamic
  23       pm.max_children = 20
  24       pm.start_servers = 2
  25       pm.min_spare_servers = 1
  26       pm.max_spare_servers = 3
  27       ''}'';
  28   };
  29   keys = [{
  30     dest = "webapps/${app.environment}-chloe";
  31     user = apacheUser;
  32     group = apacheGroup;
  33     permissions = "0400";
  34     text = ''
  35       SetEnv SPIP_CONFIG_DIR     "${configDir}"
  36       SetEnv SPIP_VAR_DIR        "${app.varDir}"
  37       SetEnv SPIP_SITE           "chloe-${app.environment}"
  38       SetEnv SPIP_LDAP_BASE      "dc=immae,dc=eu"
  39       SetEnv SPIP_LDAP_HOST      "ldaps://ldap.immae.eu"
  40       SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}"
  41       SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}"
  42       SetEnv SPIP_LDAP_SEARCH    "${config.ldap.filter}"
  43       SetEnv SPIP_MYSQL_HOST     "${config.mysql.host}"
  44       SetEnv SPIP_MYSQL_PORT     "${config.mysql.port}"
  45       SetEnv SPIP_MYSQL_DB       "${config.mysql.database}"
  46       SetEnv SPIP_MYSQL_USER     "${config.mysql.user}"
  47       SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}"
  48     '';
  49   }];
  50   apache = rec {
  51     modules = [ "proxy_fcgi" ];
  52     webappName = "chloe_${app.environment}";
  53     root = "/run/current-system/webapps/${webappName}";
  54     vhostConf = ''
  55       Include /var/secrets/webapps/${app.environment}-chloe
  56
  57       RewriteEngine On
  58       ${if app.environment == "prod" then ''
  59       RewriteRule ^/news.rss  /spip.php?page=backend&id_rubrique=1
  60       '' else ""}
  61
  62       <FilesMatch "\.php$">
  63         SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
  64       </FilesMatch>
  65
  66       <Directory ${root}>
  67         DirectoryIndex index.php index.htm index.html
  68         Options -Indexes +FollowSymLinks +MultiViews +Includes
  69         Include ${root}/htaccess.txt
  70
  71         AllowOverride AuthConfig FileInfo Limit
  72         Require all granted
  73       </Directory>
  74
  75       <DirectoryMatch "${root}/squelettes">
  76         Require all denied
  77       </DirectoryMatch>
  78
  79       <FilesMatch "(.htaccess|rewrite-rules|.gitignore)$">
  80         Require all denied
  81       </FilesMatch>
  82
  83       ${if app.environment == "dev" then ''
  84       <Location />
  85         Use LDAPConnect
  86         Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
  87         ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://osteopathe-cc.fr\"></html>"
  88       </Location>
  89       '' else ''
  90       Use Stats osteopathe-cc.fr
  91       ''}
  92       '';
  93   };
  94   activationScript = {
  95     deps = [ "wrappers" ];
  96     text = ''
  97       install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local
  98       install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
  99     '';
 100   };
 101   configDir = ./config;
 102 }