modules/private/websites/isabelle/spip_builder.nix

   1 { apacheUser, apacheGroup, iridologie, config }:
   2 rec {
   3   app = iridologie.override { inherit (config) environment; };
   4   phpFpm = rec {
   5     serviceDeps = [ "mysql.service" ];
   6     socket = "/var/run/phpfpm/iridologie-${app.environment}.sock";
   7     pool = ''
   8       user = ${apacheUser}
   9       group = ${apacheGroup}
  10       listen.owner = ${apacheUser}
  11       listen.group = ${apacheGroup}
  12       php_admin_value[upload_max_filesize] = 20M
  13       php_admin_value[post_max_size] = 20M
  14       ;php_admin_flag[log_errors] = on
  15       php_admin_value[open_basedir] = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp"
  16       php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
  17       ${if app.environment == "dev" then ''
  18       pm = ondemand
  19       pm.max_children = 5
  20       pm.process_idle_timeout = 60
  21       '' else ''
  22       pm = dynamic
  23       pm.max_children = 20
  24       pm.start_servers = 2
  25       pm.min_spare_servers = 1
  26       pm.max_spare_servers = 3
  27       ''}'';
  28   };
  29   keys = [{
  30     dest = "webapps/${app.environment}-iridologie";
  31     user = apacheUser;
  32     group = apacheGroup;
  33     permissions = "0400";
  34     text = ''
  35       SetEnv SPIP_CONFIG_DIR     "${configDir}"
  36       SetEnv SPIP_VAR_DIR        "${app.varDir}"
  37       SetEnv SPIP_SITE           "iridologie-${app.environment}"
  38       SetEnv SPIP_LDAP_BASE      "dc=immae,dc=eu"
  39       SetEnv SPIP_LDAP_HOST      "ldaps://ldap.immae.eu"
  40       SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}"
  41       SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}"
  42       SetEnv SPIP_LDAP_SEARCH    "${config.ldap.filter}"
  43       SetEnv SPIP_MYSQL_HOST     "${config.mysql.host}"
  44       SetEnv SPIP_MYSQL_PORT     "${config.mysql.port}"
  45       SetEnv SPIP_MYSQL_DB       "${config.mysql.database}"
  46       SetEnv SPIP_MYSQL_USER     "${config.mysql.user}"
  47       SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}"
  48     '';
  49   }];
  50   apache = rec {
  51     modules = [ "proxy_fcgi" ];
  52     webappName = "iridologie_${app.environment}";
  53     root = "/run/current-system/webapps/${webappName}";
  54     vhostConf = ''
  55       Include /var/secrets/webapps/${app.environment}-iridologie
  56
  57       RewriteEngine On
  58
  59       <FilesMatch "\.php$">
  60         SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
  61       </FilesMatch>
  62
  63       <Directory ${root}>
  64         DirectoryIndex index.php index.htm index.html
  65         Options -Indexes +FollowSymLinks +MultiViews +Includes
  66         Include ${root}/htaccess.txt
  67
  68         AllowOverride AuthConfig FileInfo Limit
  69         Require all granted
  70       </Directory>
  71
  72       <DirectoryMatch "${root}/squelettes">
  73         Require all denied
  74       </DirectoryMatch>
  75
  76       <FilesMatch "(.htaccess|rewrite-rules|.gitignore)$">
  77         Require all denied
  78       </FilesMatch>
  79
  80       ${if app.environment == "dev" then ''
  81       <Location />
  82         Use LDAPConnect
  83         Require ldap-group cn=isabelle.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
  84         ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://iridologie.icommandeur.org\"></html>"
  85       </Location>
  86       '' else ''
  87       Use Stats iridologie.icommandeur.org
  88       ''}
  89       '';
  90   };
  91   activationScript = {
  92     deps = [ "wrappers" ];
  93     text = ''
  94       install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local
  95       install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
  96     '';
  97   };
  98   configDir = ./config;
  99 }