modules/private/websites/immae/production.nix

   1 { lib, pkgs, config, myconfig,  ... }:
   2 let
   3   cfg = config.myServices.websites.immae.production;
   4   varDir = "/var/lib/ftp/immae";
   5   env = myconfig.env.websites.immae;
   6 in {
   7   options.myServices.websites.immae.production.enable = lib.mkEnableOption "enable Immae's website";
   8
   9   config = lib.mkIf cfg.enable {
  10     services.webstats.sites = [ { name = "www.immae.eu"; } ];
  11
  12     services.phpfpm.poolConfigs.immae = ''
  13       listen = /run/phpfpm/immae.sock
  14       user = wwwrun
  15       group = wwwrun
  16       listen.owner = wwwrun
  17       listen.group = wwwrun
  18
  19       pm = ondemand
  20       pm.max_children = 5
  21       pm.process_idle_timeout = 60
  22
  23       php_admin_value[open_basedir] = "${varDir}:/tmp"
  24       '';
  25     services.websites.env.production.modules = [ "proxy_fcgi" ];
  26     services.websites.env.production.vhostConfs.immae = {
  27       certName    = "eldiron";
  28       addToCerts  = true;
  29       hosts       = [ "www.immae.eu" ];
  30       root        = varDir;
  31       extraConfig = [
  32         ''
  33         Use Stats www.immae.eu
  34
  35         <FilesMatch "\.php$">
  36           SetHandler "proxy:unix:/run/phpfpm/immae.sock|fcgi://localhost"
  37         </FilesMatch>
  38
  39         <Directory ${varDir}>
  40           DirectoryIndex index.php index.htm index.html
  41           Options Indexes FollowSymLinks MultiViews Includes
  42           AllowOverride All
  43           Require all granted
  44         </Directory>
  45
  46         <Location /blog_old/>
  47           Use LDAPConnect
  48           Require ldap-group cn=blog,cn=immae.eu,ou=services,dc=immae,dc=eu
  49         </Location>
  50         ''
  51       ];
  52     };
  53
  54     services.websites.env.production.vhostConfs.bouya = {
  55       certName    = "eldiron";
  56       addToCerts  = true;
  57       hosts       = [ "bouya.org" "www.bouya.org" ];
  58       root        = null;
  59       extraConfig = [ ''
  60         RedirectMatch 301 ^/((?!\.well-known.*$).*)$ https://www.normalesup.org/~bouya/
  61         '' ];
  62     };
  63   };
  64 }