nixops/modules/websites/tellesflorian/tellesflorian.nix

   1 { lib, writeText, fetchedGitPrivate, fetchurl, stdenv, composerEnv }:
   2 let
   3   tellesflorian = { config }: rec {
   4     environment = config.environment;
   5     varDir = "/var/lib/tellesflorian_${environment}";
   6     keys = [
   7       {
   8         dest = "webapps/${environment}-tellesflorian-passwords";
   9         user = apache.user;
  10         group = apache.group;
  11         permissions = "0400";
  12         text = ''
  13           invite:${config.invite_passwords}
  14         '';
  15       }
  16       {
  17         dest = "webapps/${environment}-tellesflorian";
  18         user = apache.user;
  19         group = apache.group;
  20         permissions = "0400";
  21         text = ''
  22           # This file is auto-generated during the composer install
  23           parameters:
  24             database_host: ${config.mysql.host}
  25             database_port: ${config.mysql.port}
  26             database_name: ${config.mysql.name}
  27             database_user: ${config.mysql.user}
  28             database_password: ${config.mysql.password}
  29             mailer_transport: smtp
  30             mailer_host: 127.0.0.1
  31             mailer_user: null
  32             mailer_password: null
  33             secret: ${config.secret}
  34         '';
  35       }
  36     ];
  37     phpFpm = rec {
  38       preStart = ''
  39         if [ ! -f "${varDir}/currentWebappDir" -o \
  40             ! -f "${varDir}/currentKey" -o \
  41             "${webappDir}" != "$(cat ${varDir}/currentWebappDir 2>/dev/null)" ] \
  42             || ! sha512sum -c --status ${varDir}/currentKey; then
  43           pushd ${webappDir} > /dev/null
  44           /run/wrappers/bin/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
  45           popd > /dev/null
  46           echo -n "${webappDir}" > ${varDir}/currentWebappDir
  47           sha512sum /var/secrets/webapps/${environment}-tellesflorian > ${varDir}/currentKey
  48         fi
  49         '';
  50       serviceDeps = [ "mysql.service" ];
  51       socket = "/var/run/phpfpm/floriantelles-${environment}.sock";
  52       pool = ''
  53         listen = ${socket}
  54         user = ${apache.user}
  55         group = ${apache.group}
  56         listen.owner = ${apache.user}
  57         listen.group = ${apache.group}
  58         php_admin_value[upload_max_filesize] = 20M
  59         php_admin_value[post_max_size] = 20M
  60         ;php_admin_flag[log_errors] = on
  61         php_admin_value[open_basedir] = "/var/secrets/webapps/${environment}-tellesflorian:${webappDir}:${varDir}:/tmp"
  62         php_admin_value[session.save_path] = "${varDir}/phpSessions"
  63         ${if environment == "dev" then ''
  64         pm = ondemand
  65         pm.max_children = 5
  66         pm.process_idle_timeout = 60
  67         env[SYMFONY_DEBUG_MODE] = "yes"
  68         '' else ''
  69         pm = dynamic
  70         pm.max_children = 20
  71         pm.start_servers = 2
  72         pm.min_spare_servers = 1
  73         pm.max_spare_servers = 3
  74         ''}'';
  75     };
  76     apache = rec {
  77       user = "wwwrun";
  78       group = "wwwrun";
  79       modules = [ "proxy_fcgi" ];
  80       webappName = "florian_${environment}";
  81       root = "/run/current-system/webapps/${webappName}";
  82       vhostConf = ''
  83       <FilesMatch "\.php$">
  84         SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
  85       </FilesMatch>
  86
  87       ${if environment == "dev" then ''
  88       <Location />
  89         AuthBasicProvider file ldap
  90         Use LDAPConnect
  91         Require ldap-group   cn=app.tellesflorian.com,cn=httpd,ou=services,dc=immae,dc=eu
  92
  93         AuthUserFile "/var/secrets/webapps/${environment}-tellesflorian-passwords"
  94         Require user "invite"
  95
  96         ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://tellesflorian.com\"></html>"
  97       </Location>
  98
  99       <Directory ${root}>
 100         Options Indexes FollowSymLinks MultiViews Includes
 101         AllowOverride None
 102         Require all granted
 103
 104         DirectoryIndex app_dev.php
 105
 106         <IfModule mod_negotiation.c>
 107         Options -MultiViews
 108         </IfModule>
 109
 110         <IfModule mod_rewrite.c>
 111           RewriteEngine On
 112
 113           RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
 114           RewriteRule ^(.*) - [E=BASE:%1]
 115
 116           # Maintenance script
 117           RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
 118           RewriteCond %{SCRIPT_FILENAME} !maintenance.php
 119           RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
 120           ErrorDocument 503 /maintenance.php
 121
 122           # Sets the HTTP_AUTHORIZATION header removed by Apache
 123           RewriteCond %{HTTP:Authorization} .
 124           RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
 125
 126           RewriteCond %{ENV:REDIRECT_STATUS} ^$
 127           RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 128
 129           # If the requested filename exists, simply serve it.
 130           # We only want to let Apache serve files and not directories.
 131           RewriteCond %{REQUEST_FILENAME} -f
 132           RewriteRule ^ - [L]
 133
 134           # Rewrite all other queries to the front controller.
 135           RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
 136         </IfModule>
 137
 138       </Directory>
 139       '' else ''
 140       <Directory ${root}>
 141         Options Indexes FollowSymLinks MultiViews Includes
 142         AllowOverride All
 143         Require all granted
 144       </Directory>
 145       ''}
 146       '';
 147     };
 148     activationScript = {
 149       deps = [ "wrappers" ];
 150       text = ''
 151       install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir} \
 152         ${varDir}/var
 153       install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
 154       '';
 155     };
 156     webappDir = composerEnv.buildPackage (
 157       import ./php-packages.nix { inherit composerEnv fetchurl; } //
 158       fetchedGitPrivate ./tellesflorian.json //
 159       rec {
 160         noDev = (environment == "prod");
 161         preInstall = ''
 162           export SYMFONY_ENV="${environment}"
 163           '';
 164         postInstall = ''
 165           cd $out
 166           rm app/config/parameters.yml
 167           ln -sf /var/secrets/webapps/${environment}-tellesflorian app/config/parameters.yml
 168           rm -rf var/{logs,cache}
 169           ln -sf ${varDir}/var/{logs,cache,sessions} var/
 170           '';
 171       });
 172     webRoot = "${webappDir}/web";
 173   };
 174 in
 175   tellesflorian