]> git.immae.eu Git - perso/Immae/Config/Nix.git/blob - nixops/modules/websites/chloe/chloe.nix
2847b9d9baffd1b38c8b21040414379daf466737
[perso/Immae/Config/Nix.git] / nixops / modules / websites / chloe / chloe.nix
1 { chloe, config }:
2 rec {
3 app = chloe.override { inherit (config) environment; };
4 phpFpm = rec {
5 serviceDeps = [ "mysql.service" ];
6 socket = "/var/run/phpfpm/chloe-${app.environment}.sock";
7 pool = ''
8 listen = ${socket}
9 user = ${apache.user}
10 group = ${apache.group}
11 listen.owner = ${apache.user}
12 listen.group = ${apache.group}
13 php_admin_value[upload_max_filesize] = 20M
14 php_admin_value[post_max_size] = 20M
15 ;php_admin_flag[log_errors] = on
16 php_admin_value[open_basedir] = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp"
17 php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
18 ${if app.environment == "dev" then ''
19 pm = ondemand
20 pm.max_children = 5
21 pm.process_idle_timeout = 60
22 '' else ''
23 pm = dynamic
24 pm.max_children = 20
25 pm.start_servers = 2
26 pm.min_spare_servers = 1
27 pm.max_spare_servers = 3
28 ''}'';
29 };
30 keys = [{
31 dest = "webapps/${app.environment}-chloe";
32 user = apache.user;
33 group = apache.group;
34 permissions = "0400";
35 text = ''
36 SetEnv SPIP_CONFIG_DIR "${configDir}"
37 SetEnv SPIP_VAR_DIR "${app.varDir}"
38 SetEnv SPIP_SITE "chloe-${app.environment}"
39 SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu"
40 SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu"
41 SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}"
42 SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}"
43 SetEnv SPIP_LDAP_SEARCH "${config.ldap.search}"
44 SetEnv SPIP_MYSQL_HOST "${config.mysql.host}"
45 SetEnv SPIP_MYSQL_PORT "${config.mysql.port}"
46 SetEnv SPIP_MYSQL_DB "${config.mysql.name}"
47 SetEnv SPIP_MYSQL_USER "${config.mysql.user}"
48 SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}"
49 '';
50 }];
51 apache = rec {
52 user = "wwwrun";
53 group = "wwwrun";
54 modules = [ "proxy_fcgi" ];
55 webappName = "chloe_${app.environment}";
56 root = "/run/current-system/webapps/${webappName}";
57 vhostConf = ''
58 Include /var/secrets/webapps/${app.environment}-chloe
59
60 RewriteEngine On
61 ${if app.environment == "prod" then ''
62 RewriteRule ^/news.rss /spip.php?page=backend&id_rubrique=1
63 '' else ""}
64
65 <FilesMatch "\.php$">
66 SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
67 </FilesMatch>
68
69 <Directory ${root}>
70 DirectoryIndex index.php index.htm index.html
71 Options -Indexes +FollowSymLinks +MultiViews +Includes
72 Include ${root}/htaccess.txt
73
74 AllowOverride AuthConfig FileInfo Limit
75 Require all granted
76 </Directory>
77
78 <DirectoryMatch "${root}/squelettes">
79 Require all denied
80 </DirectoryMatch>
81
82 <FilesMatch "(.htaccess|rewrite-rules|.gitignore)$">
83 Require all denied
84 </FilesMatch>
85
86 ${if app.environment == "dev" then ''
87 <Location />
88 Use LDAPConnect
89 Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
90 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://osteopathe-cc.fr\"></html>"
91 </Location>
92 '' else ''
93 Use Stats osteopathe-cc.fr
94 ''}
95 '';
96 };
97 activationScript = {
98 deps = [ "wrappers" ];
99 text = ''
100 install -m 0755 -o ${apache.user} -g ${apache.group} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local
101 install -m 0750 -o ${apache.user} -g ${apache.group} -d ${app.varDir}/phpSessions
102 '';
103 };
104 configDir = ./chloe_config_ + app.environment;
105 }