nixops/modules/websites/aten/aten.nix

   1 { aten, lib, config }: rec {
   2   app = aten.override { inherit (config) environment; };
   3   phpFpm = rec {
   4     preStart = ''
   5       if [ ! -f "${app.varDir}/currentWebappDir" -o \
   6           ! -f "${app.varDir}/currentKey" -o \
   7           "${app}" != "$(cat ${app.varDir}/currentWebappDir 2>/dev/null)" ] \
   8           || ! sha512sum -c --status ${app.varDir}/currentKey; then
   9         pushd ${app} > /dev/null
  10         /run/wrappers/bin/sudo -u wwwrun APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup
  11         popd > /dev/null
  12         echo -n "${app}" > ${app.varDir}/currentWebappDir
  13         sha512sum /var/secrets/webapps/${app.environment}-aten > ${app.varDir}/currentKey
  14       fi
  15       '';
  16     serviceDeps = [ "postgresql.service" ];
  17     socket = "/var/run/phpfpm/aten-${app.environment}.sock";
  18     pool = ''
  19       listen = ${socket}
  20       user = ${apache.user}
  21       group = ${apache.group}
  22       listen.owner = ${apache.user}
  23       listen.group = ${apache.group}
  24       php_admin_value[upload_max_filesize] = 20M
  25       php_admin_value[post_max_size] = 20M
  26       ;php_admin_flag[log_errors] = on
  27       php_admin_value[open_basedir] = "${app}:${app.varDir}:/tmp"
  28       php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
  29       ${if app.environment == "dev" then ''
  30       pm = ondemand
  31       pm.max_children = 5
  32       pm.process_idle_timeout = 60
  33       env[SYMFONY_DEBUG_MODE] = "yes"
  34       '' else ''
  35       pm = dynamic
  36       pm.max_children = 20
  37       pm.start_servers = 2
  38       pm.min_spare_servers = 1
  39       pm.max_spare_servers = 3
  40       ''}'';
  41   };
  42   keys = [{
  43     dest = "webapps/${app.environment}-aten";
  44     user = apache.user;
  45     group = apache.group;
  46     permissions = "0400";
  47     text = ''
  48       SetEnv APP_ENV      "${app.environment}"
  49       SetEnv APP_SECRET   "${config.secret}"
  50       SetEnv DATABASE_URL "${config.psql_url}"
  51       '';
  52   }];
  53   apache = rec {
  54     user = "wwwrun";
  55     group = "wwwrun";
  56     modules = [ "proxy_fcgi" ];
  57     webappName = "aten_${app.environment}";
  58     root = "/run/current-system/webapps/${webappName}";
  59     vhostConf = ''
  60     <FilesMatch "\.php$">
  61       SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
  62     </FilesMatch>
  63
  64     Include /var/secrets/webapps/${app.environment}-aten
  65
  66     ${if app.environment == "dev" then ''
  67     <Location />
  68       Use LDAPConnect
  69       Require ldap-group   cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
  70       ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
  71     </Location>
  72
  73     <Location /backend>
  74       Use LDAPConnect
  75       Require ldap-group   cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
  76       ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
  77     </Location>
  78     '' else ''
  79     Use Stats aten.pro
  80
  81     <Location /backend>
  82       Use LDAPConnect
  83       Require ldap-group   cn=aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
  84       ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
  85     </Location>
  86     ''}
  87
  88     <Directory ${root}>
  89       Options Indexes FollowSymLinks MultiViews Includes
  90       AllowOverride All
  91       Require all granted
  92       DirectoryIndex index.php
  93       FallbackResource /index.php
  94     </Directory>
  95     '';
  96   };
  97   activationScript = {
  98     deps = [ "wrappers" ];
  99     text = ''
 100     install -m 0755 -o ${apache.user} -g ${apache.group} -d ${app.varDir}
 101     install -m 0750 -o ${apache.user} -g ${apache.group} -d ${app.varDir}/phpSessions
 102     '';
 103   };
 104 }