modules/private/websites/richie/production.nix

   1 { lib, config, pkgs, ... }:
   2 let
   3   cfg = config.myServices.websites.richie.production;
   4   vardir = "/var/lib/richie_production";
   5   richieSrc = pkgs.stdenv.mkDerivation (pkgs.mylibs.fetchedGitPrivate ./richie.json // {
   6     phases = "installPhase";
   7     installPhase = ''
   8       cp -a $src $out
   9       chmod -R u+w $out
  10       ln -sf ${vardir}/files $out/
  11       ln -sf ${vardir}/drapeaux $out/images/
  12       ln -sf ${vardir}/photos $out/
  13       sed -i "s@localedef --list-archive@localedef --list-archive /run/current-system/sw/lib/locale/locale-archive@" $out/admin/parametres.php
  14       '';
  15   });
  16   webappdir = config.services.websites.webappDirsPaths.richie_production;
  17   secretPath = config.secrets.fullPaths."websites/richie/production";
  18   apacheUser = config.services.httpd.Prod.user;
  19   apacheGroup = config.services.httpd.Prod.group;
  20 in
  21 {
  22   options.myServices.websites.richie.production.enable = lib.mkEnableOption "enable Richie's website";
  23   config = lib.mkIf cfg.enable {
  24     services.duplyBackup.profiles.richie_production.rootDir = vardir;
  25     services.webstats.sites = [ { name = "europe-richie.org"; } ];
  26
  27     secrets.keys = [{
  28       dest = "websites/richie/production";
  29       user = apacheUser;
  30       group = apacheGroup;
  31       permissions = "0400";
  32       text = with config.myEnv.websites.richie; ''
  33         <?php
  34
  35         $hote_sql = '${mysql.host}';
  36         $login_sql = '${mysql.user}';
  37         $bdd_sql = '${mysql.database}';
  38         $mdp_sql = '${mysql.password}';
  39
  40         $db = mysqli_connect($hote_sql,$login_sql,$mdp_sql);
  41         unset($mdp_sql);
  42
  43         $smtp_mailer->Auth('${smtp_mailer.user}', '${smtp_mailer.password}');
  44         ?>
  45         '';
  46     }];
  47     services.websites.webappDirs.richie_production = richieSrc;
  48     system.activationScripts.richie_production = {
  49       deps = [ "httpd" ];
  50       text = ''
  51         install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d /var/lib/php/sessions/richie_production
  52         install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${vardir}
  53         '';
  54     };
  55     services.phpfpm.pools.richie_production = {
  56       user = apacheUser;
  57       group = apacheGroup;
  58       settings = {
  59         "listen.owner" = apacheUser;
  60         "listen.group" = apacheGroup;
  61
  62         "pm" = "ondemand";
  63         "pm.max_children" = "5";
  64         "pm.process_idle_timeout" = "60";
  65
  66         "php_admin_value[open_basedir]" = "${vardir}:/var/lib/php/sessions/richie_production:${secretPath}:${richieSrc}:/tmp";
  67         "php_admin_value[session.save_path]" = "/var/lib/php/sessions/richie_production";
  68       };
  69       phpEnv = {
  70         PATH = "/run/current-system/sw/bin:${lib.makeBinPath [ pkgs.imagemagick ]}";
  71         BDD_CONNECT = secretPath;
  72       };
  73       phpOptions = config.services.phpfpm.phpOptions + ''
  74         date.timezone = 'Europe/Paris'
  75         '';
  76       phpPackage = pkgs.php72;
  77     };
  78     services.websites.env.production.modules = [ "proxy_fcgi" ];
  79     services.websites.env.production.vhostConfs.richie_production = {
  80       certName    = "richie";
  81       addToCerts  = true;
  82       certMainHost = "europe-richie.org";
  83       hosts       = [ "europe-richie.org" "www.europe-richie.org" ];
  84       root        = webappdir;
  85       extraConfig = [
  86         ''
  87         Use Stats europe-richie.org
  88         ErrorDocument 404 /404.html
  89         <LocationMatch "^/files/.*/admin/">
  90           Require all denied
  91         </LocationMatch>
  92         <Directory ${webappdir}>
  93           DirectoryIndex index.php index.htm index.html
  94           Options Indexes FollowSymLinks MultiViews Includes
  95           AllowOverride None
  96           Require all granted
  97
  98           <FilesMatch "\.php$">
  99             SetHandler "proxy:unix:${config.services.phpfpm.pools.richie_production.socket}|fcgi://localhost"
 100           </FilesMatch>
 101         </Directory>
 102           ''
 103       ];
 104     };
 105   };
 106 }