modules/private/websites/richie/production.nix

   1 { lib, config, pkgs, ... }:
   2 let
   3   cfg = config.myServices.websites.richie.production;
   4   vardir = "/var/lib/richie_production";
   5   richieSrc = pkgs.stdenv.mkDerivation rec {
   6     version = pkgs.sources.websites-richie-app.version;
   7     pname = "richie";
   8     name = "${pname}-${version}";
   9     src = pkgs.sources.websites-richie-app;
  10     phases = "installPhase";
  11     installPhase = ''
  12       cp -a $src $out
  13       chmod -R u+w $out
  14       ln -sf ${vardir}/files $out/
  15       ln -sf ${vardir}/drapeaux $out/images/
  16       ln -sf ${vardir}/photos $out/
  17       sed -i "s@localedef --list-archive@localedef --list-archive /run/current-system/sw/lib/locale/locale-archive@" $out/admin/parametres.php
  18       '';
  19   };
  20   secretPath = config.secrets.fullPaths."websites/richie/production";
  21   apacheUser = config.services.httpd.Prod.user;
  22   apacheGroup = config.services.httpd.Prod.group;
  23 in
  24 {
  25   options.myServices.websites.richie.production.enable = lib.mkEnableOption "enable Richie's website";
  26   config = lib.mkIf cfg.enable {
  27     services.duplyBackup.profiles.richie_production.rootDir = vardir;
  28     services.duplyBackup.profiles.richie_production.remotes = ["eriomem" "ovh"];
  29     services.webstats.sites = [ { name = "europe-richie.org"; } ];
  30
  31     secrets.keys."websites/richie/production" = {
  32       user = apacheUser;
  33       group = apacheGroup;
  34       permissions = "0400";
  35       text = with config.myEnv.websites.richie; ''
  36         <?php
  37
  38         $hote_sql = '${mysql.host}';
  39         $login_sql = '${mysql.user}';
  40         $bdd_sql = '${mysql.database}';
  41         $mdp_sql = '${mysql.password}';
  42
  43         $db = mysqli_connect($hote_sql,$login_sql,$mdp_sql);
  44         unset($mdp_sql);
  45
  46         $smtp_mailer->Auth('${smtp_mailer.user}', '${smtp_mailer.password}');
  47         ?>
  48         '';
  49     };
  50     system.activationScripts.richie_production = {
  51       deps = [ "httpd" ];
  52       text = ''
  53         install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d /var/lib/php/sessions/richie_production
  54         install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${vardir}
  55         '';
  56     };
  57     services.phpfpm.pools.richie_production = {
  58       user = apacheUser;
  59       group = apacheGroup;
  60       settings = {
  61         "listen.owner" = apacheUser;
  62         "listen.group" = apacheGroup;
  63
  64         "pm" = "ondemand";
  65         "pm.max_children" = "5";
  66         "pm.process_idle_timeout" = "60";
  67
  68         "php_admin_value[open_basedir]" = "${vardir}:/var/lib/php/sessions/richie_production:${secretPath}:${richieSrc}:/tmp";
  69         "php_admin_value[session.save_path]" = "/var/lib/php/sessions/richie_production";
  70       };
  71       phpEnv = {
  72         PATH = "/run/current-system/sw/bin:${lib.makeBinPath [ pkgs.imagemagick ]}";
  73         BDD_CONNECT = secretPath;
  74       };
  75       phpOptions = config.services.phpfpm.phpOptions + ''
  76         date.timezone = 'Europe/Paris'
  77         '';
  78       phpPackage = pkgs.php72;
  79     };
  80     services.websites.env.production.modules = [ "proxy_fcgi" ];
  81     services.websites.env.production.vhostConfs.richie_production = {
  82       certName    = "richie";
  83       addToCerts  = true;
  84       certMainHost = "europe-richie.org";
  85       hosts       = [ "europe-richie.org" "www.europe-richie.org" ];
  86       root        = richieSrc;
  87       extraConfig = [
  88         ''
  89         Use Stats europe-richie.org
  90         ErrorDocument 404 /404.html
  91         <LocationMatch "^/files/.*/admin/">
  92           Require all denied
  93         </LocationMatch>
  94         <Directory ${richieSrc}>
  95           DirectoryIndex index.php index.htm index.html
  96           Options Indexes FollowSymLinks MultiViews Includes
  97           AllowOverride None
  98           Require all granted
  99
 100           <FilesMatch "\.php$">
 101             SetHandler "proxy:unix:${config.services.phpfpm.pools.richie_production.socket}|fcgi://localhost"
 102           </FilesMatch>
 103         </Directory>
 104           ''
 105       ];
 106     };
 107   };
 108 }