]> git.immae.eu Git - perso/Immae/Config/Nix.git/blob - modules/private/websites/richie/production.nix
Add alternate cloud storage for daily backups
[perso/Immae/Config/Nix.git] / modules / private / websites / richie / production.nix
1 { lib, config, pkgs, ... }:
2 let
3 cfg = config.myServices.websites.richie.production;
4 vardir = "/var/lib/richie_production";
5 richieSrc = pkgs.stdenv.mkDerivation rec {
6 version = pkgs.sources.websites-richie-app.version;
7 pname = "richie";
8 name = "${pname}-${version}";
9 src = pkgs.sources.websites-richie-app;
10 phases = "installPhase";
11 installPhase = ''
12 cp -a $src $out
13 chmod -R u+w $out
14 ln -sf ${vardir}/files $out/
15 ln -sf ${vardir}/drapeaux $out/images/
16 ln -sf ${vardir}/photos $out/
17 sed -i "s@localedef --list-archive@localedef --list-archive /run/current-system/sw/lib/locale/locale-archive@" $out/admin/parametres.php
18 '';
19 };
20 webappdir = config.services.websites.webappDirsPaths.richie_production;
21 secretPath = config.secrets.fullPaths."websites/richie/production";
22 apacheUser = config.services.httpd.Prod.user;
23 apacheGroup = config.services.httpd.Prod.group;
24 in
25 {
26 options.myServices.websites.richie.production.enable = lib.mkEnableOption "enable Richie's website";
27 config = lib.mkIf cfg.enable {
28 services.duplyBackup.profiles.richie_production.rootDir = vardir;
29 services.duplyBackup.profiles.richie_production.remotes = ["eriomem" "ovh"];
30 services.webstats.sites = [ { name = "europe-richie.org"; } ];
31
32 secrets.keys = [{
33 dest = "websites/richie/production";
34 user = apacheUser;
35 group = apacheGroup;
36 permissions = "0400";
37 text = with config.myEnv.websites.richie; ''
38 <?php
39
40 $hote_sql = '${mysql.host}';
41 $login_sql = '${mysql.user}';
42 $bdd_sql = '${mysql.database}';
43 $mdp_sql = '${mysql.password}';
44
45 $db = mysqli_connect($hote_sql,$login_sql,$mdp_sql);
46 unset($mdp_sql);
47
48 $smtp_mailer->Auth('${smtp_mailer.user}', '${smtp_mailer.password}');
49 ?>
50 '';
51 }];
52 services.websites.webappDirs.richie_production = richieSrc;
53 system.activationScripts.richie_production = {
54 deps = [ "httpd" ];
55 text = ''
56 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d /var/lib/php/sessions/richie_production
57 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${vardir}
58 '';
59 };
60 services.phpfpm.pools.richie_production = {
61 user = apacheUser;
62 group = apacheGroup;
63 settings = {
64 "listen.owner" = apacheUser;
65 "listen.group" = apacheGroup;
66
67 "pm" = "ondemand";
68 "pm.max_children" = "5";
69 "pm.process_idle_timeout" = "60";
70
71 "php_admin_value[open_basedir]" = "${vardir}:/var/lib/php/sessions/richie_production:${secretPath}:${richieSrc}:/tmp";
72 "php_admin_value[session.save_path]" = "/var/lib/php/sessions/richie_production";
73 };
74 phpEnv = {
75 PATH = "/run/current-system/sw/bin:${lib.makeBinPath [ pkgs.imagemagick ]}";
76 BDD_CONNECT = secretPath;
77 };
78 phpOptions = config.services.phpfpm.phpOptions + ''
79 date.timezone = 'Europe/Paris'
80 '';
81 phpPackage = pkgs.php72;
82 };
83 services.websites.env.production.modules = [ "proxy_fcgi" ];
84 services.websites.env.production.vhostConfs.richie_production = {
85 certName = "richie";
86 addToCerts = true;
87 certMainHost = "europe-richie.org";
88 hosts = [ "europe-richie.org" "www.europe-richie.org" ];
89 root = webappdir;
90 extraConfig = [
91 ''
92 Use Stats europe-richie.org
93 ErrorDocument 404 /404.html
94 <LocationMatch "^/files/.*/admin/">
95 Require all denied
96 </LocationMatch>
97 <Directory ${webappdir}>
98 DirectoryIndex index.php index.htm index.html
99 Options Indexes FollowSymLinks MultiViews Includes
100 AllowOverride None
101 Require all granted
102
103 <FilesMatch "\.php$">
104 SetHandler "proxy:unix:${config.services.phpfpm.pools.richie_production.socket}|fcgi://localhost"
105 </FilesMatch>
106 </Directory>
107 ''
108 ];
109 };
110 };
111 }