nixops/modules/websites/chloe/chloe.nix

   1 { chloe, config }:
   2 rec {
   3   app = chloe.override { inherit (config) environment; };
   4   phpFpm = rec {
   5     serviceDeps = [ "mysql.service" ];
   6     socket = "/var/run/phpfpm/chloe-${app.environment}.sock";
   7     pool = ''
   8       listen = ${socket}
   9       user = ${apache.user}
  10       group = ${apache.group}
  11       listen.owner = ${apache.user}
  12       listen.group = ${apache.group}
  13       php_admin_value[upload_max_filesize] = 20M
  14       php_admin_value[post_max_size] = 20M
  15       ;php_admin_flag[log_errors] = on
  16       php_admin_value[open_basedir] = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp"
  17       php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
  18       ${if app.environment == "dev" then ''
  19       pm = ondemand
  20       pm.max_children = 5
  21       pm.process_idle_timeout = 60
  22       '' else ''
  23       pm = dynamic
  24       pm.max_children = 20
  25       pm.start_servers = 2
  26       pm.min_spare_servers = 1
  27       pm.max_spare_servers = 3
  28       ''}'';
  29   };
  30   keys = [{
  31     dest = "webapps/${app.environment}-chloe";
  32     user = apache.user;
  33     group = apache.group;
  34     permissions = "0400";
  35     text = ''
  36       SetEnv SPIP_CONFIG_DIR     "${configDir}"
  37       SetEnv SPIP_VAR_DIR        "${app.varDir}"
  38       SetEnv SPIP_SITE           "chloe-${app.environment}"
  39       SetEnv SPIP_LDAP_BASE      "dc=immae,dc=eu"
  40       SetEnv SPIP_LDAP_HOST      "ldaps://ldap.immae.eu"
  41       SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}"
  42       SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}"
  43       SetEnv SPIP_LDAP_SEARCH    "${config.ldap.search}"
  44       SetEnv SPIP_MYSQL_HOST     "${config.mysql.host}"
  45       SetEnv SPIP_MYSQL_PORT     "${config.mysql.port}"
  46       SetEnv SPIP_MYSQL_DB       "${config.mysql.name}"
  47       SetEnv SPIP_MYSQL_USER     "${config.mysql.user}"
  48       SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}"
  49     '';
  50   }];
  51   apache = rec {
  52     user = "wwwrun";
  53     group = "wwwrun";
  54     modules = [ "proxy_fcgi" ];
  55     webappName = "chloe_${app.environment}";
  56     root = "/run/current-system/webapps/${webappName}";
  57     vhostConf = ''
  58       Include /var/secrets/webapps/${app.environment}-chloe
  59
  60       RewriteEngine On
  61       ${if app.environment == "prod" then ''
  62       RewriteRule ^/news.rss  /spip.php?page=backend&id_rubrique=1
  63       '' else ""}
  64
  65       <FilesMatch "\.php$">
  66         SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
  67       </FilesMatch>
  68
  69       <Directory ${root}>
  70         DirectoryIndex index.php index.htm index.html
  71         Options -Indexes +FollowSymLinks +MultiViews +Includes
  72         Include ${root}/htaccess.txt
  73
  74         AllowOverride AuthConfig FileInfo Limit
  75         Require all granted
  76       </Directory>
  77
  78       <DirectoryMatch "${root}/squelettes">
  79         Require all denied
  80       </DirectoryMatch>
  81
  82       <FilesMatch "(.htaccess|rewrite-rules|.gitignore)$">
  83         Require all denied
  84       </FilesMatch>
  85
  86       ${if app.environment == "dev" then ''
  87       <Location />
  88         Use LDAPConnect
  89         Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
  90         ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://osteopathe-cc.fr\"></html>"
  91       </Location>
  92       '' else ''
  93       Use Stats osteopathe-cc.fr
  94       ''}
  95       '';
  96   };
  97   activationScript = {
  98     deps = [ "wrappers" ];
  99     text = ''
 100       install -m 0755 -o ${apache.user} -g ${apache.group} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local
 101       install -m 0750 -o ${apache.user} -g ${apache.group} -d ${app.varDir}/phpSessions
 102     '';
 103   };
 104   configDir = ./chloe_config_ + app.environment;
 105 }