modules/private/websites/florian/builder_app.nix

   1 { apacheUser, apacheGroup, tellesflorian, mylibs, config }:
   2 rec {
   3   app = tellesflorian.override { inherit (config) environment; };
   4   keys = [
   5     {
   6       dest = "webapps/${app.environment}-tellesflorian-passwords";
   7       user = apacheUser;
   8       group = apacheGroup;
   9       permissions = "0400";
  10       text = ''
  11         invite:${config.invite_passwords}
  12       '';
  13     }
  14     {
  15       dest = "webapps/${app.environment}-tellesflorian";
  16       user = apacheUser;
  17       group = apacheGroup;
  18       permissions = "0400";
  19       text = ''
  20         # This file is auto-generated during the composer install
  21         parameters:
  22           database_host: ${config.mysql.host}
  23           database_port: ${config.mysql.port}
  24           database_name: ${config.mysql.name}
  25           database_user: ${config.mysql.user}
  26           database_password: ${config.mysql.password}
  27           mailer_transport: smtp
  28           mailer_host: 127.0.0.1
  29           mailer_user: null
  30           mailer_password: null
  31           secret: ${config.secret}
  32       '';
  33     }
  34   ];
  35   phpFpm = rec {
  36     preStart = mylibs.phpFpmPreStart {
  37       inherit app;
  38       inherit (app) varDir;
  39       keyFiles = [
  40         "/var/secrets/webapps/${app.environment}-tellesflorian"
  41       ];
  42       actions = [
  43         "/run/wrappers/bin/sudo -u wwwrun ./bin/console --env=${app.environment} cache:clear --no-warmup"
  44       ];
  45     };
  46     serviceDeps = [ "mysql.service" ];
  47     socket = "/var/run/phpfpm/floriantelles-${app.environment}.sock";
  48     pool = ''
  49       listen = ${socket}
  50       user = ${apacheUser}
  51       group = ${apacheGroup}
  52       listen.owner = ${apacheUser}
  53       listen.group = ${apacheGroup}
  54       php_admin_value[upload_max_filesize] = 20M
  55       php_admin_value[post_max_size] = 20M
  56       ;php_admin_flag[log_errors] = on
  57       php_admin_value[open_basedir] = "/var/secrets/webapps/${app.environment}-tellesflorian:${app}:${app.varDir}:/tmp"
  58       php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
  59       ${if app.environment == "dev" then ''
  60       pm = ondemand
  61       pm.max_children = 5
  62       pm.process_idle_timeout = 60
  63       env[SYMFONY_DEBUG_MODE] = "yes"
  64       '' else ''
  65       pm = dynamic
  66       pm.max_children = 20
  67       pm.start_servers = 2
  68       pm.min_spare_servers = 1
  69       pm.max_spare_servers = 3
  70       ''}'';
  71   };
  72   apache = rec {
  73     modules = [ "proxy_fcgi" ];
  74     webappName = "florian_${app.environment}";
  75     root = "/run/current-system/webapps/${webappName}";
  76     vhostConf = ''
  77     <FilesMatch "\.php$">
  78       SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
  79     </FilesMatch>
  80
  81     ${if app.environment == "dev" then ''
  82     <Location />
  83       AuthBasicProvider file ldap
  84       Use LDAPConnect
  85       Require ldap-group   cn=app.tellesflorian.com,cn=httpd,ou=services,dc=immae,dc=eu
  86
  87       AuthUserFile "/var/secrets/webapps/${app.environment}-tellesflorian-passwords"
  88       Require user "invite"
  89
  90       ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://tellesflorian.com\"></html>"
  91     </Location>
  92
  93     <Directory ${root}>
  94       Options Indexes FollowSymLinks MultiViews Includes
  95       AllowOverride None
  96       Require all granted
  97
  98       DirectoryIndex app_dev.php
  99
 100       <IfModule mod_negotiation.c>
 101       Options -MultiViews
 102       </IfModule>
 103
 104       <IfModule mod_rewrite.c>
 105         RewriteEngine On
 106
 107         RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
 108         RewriteRule ^(.*) - [E=BASE:%1]
 109
 110         # Maintenance script
 111         RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
 112         RewriteCond %{SCRIPT_FILENAME} !maintenance.php
 113         RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
 114         ErrorDocument 503 /maintenance.php
 115
 116         # Sets the HTTP_AUTHORIZATION header removed by Apache
 117         RewriteCond %{HTTP:Authorization} .
 118         RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
 119
 120         RewriteCond %{ENV:REDIRECT_STATUS} ^$
 121         RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 122
 123         # If the requested filename exists, simply serve it.
 124         # We only want to let Apache serve files and not directories.
 125         RewriteCond %{REQUEST_FILENAME} -f
 126         RewriteRule ^ - [L]
 127
 128         # Rewrite all other queries to the front controller.
 129         RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
 130       </IfModule>
 131
 132     </Directory>
 133     '' else ''
 134     <Directory ${root}>
 135       Options Indexes FollowSymLinks MultiViews Includes
 136       AllowOverride All
 137       Require all granted
 138     </Directory>
 139     ''}
 140     '';
 141   };
 142   activationScript = {
 143     deps = [ "wrappers" ];
 144     text = ''
 145     install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} \
 146       ${app.varDir}/var
 147     install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
 148     '';
 149   };
 150 }