nixops/modules/websites/tools/tools/yourls.nix

   1 { lib, env, writeText, stdenv, fetchedGithub }:
   2 let
   3   yourls = let
   4     plugins = {
   5       ldap = stdenv.mkDerivation (fetchedGithub ./yourls-ldap-plugin.json // rec {
   6         installPhase = ''
   7           mkdir -p $out
   8           cp plugin.php $out/
   9           '';
  10       });
  11     };
  12   in rec {
  13     activationScript = ''
  14       install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/yourls
  15     '';
  16     keys.tools-yourls = {
  17       destDir = "/run/keys/webapps";
  18       user = apache.user;
  19       group = apache.group;
  20       permissions = "0400";
  21       text = ''
  22         <?php
  23         define( 'YOURLS_DB_USER', '${env.mysql.user}' );
  24         define( 'YOURLS_DB_PASS', '${env.mysql.password}' );
  25         define( 'YOURLS_DB_NAME', '${env.mysql.database}' );
  26         define( 'YOURLS_DB_HOST', '${env.mysql.host}' );
  27         define( 'YOURLS_DB_PREFIX', 'yourls_' );
  28         define( 'YOURLS_SITE', 'https://tools.immae.eu/url' );
  29         define( 'YOURLS_HOURS_OFFSET', 0 );
  30         define( 'YOURLS_LANG', ''' );
  31         define( 'YOURLS_UNIQUE_URLS', true );
  32         define( 'YOURLS_PRIVATE', true );
  33         define( 'YOURLS_COOKIEKEY', '${env.cookieKey}' );
  34         $yourls_user_passwords = array();
  35         define( 'YOURLS_DEBUG', false );
  36         define( 'YOURLS_URL_CONVERT', 36 );
  37         $yourls_reserved_URL = array();
  38         define( 'LDAPAUTH_HOST', 'ldaps://ldap.immae.eu' );
  39         define( 'LDAPAUTH_PORT', '636' );
  40         define( 'LDAPAUTH_BASE', 'dc=immae,dc=eu' );
  41         define( 'LDAPAUTH_SEARCH_USER', 'cn=yourls,ou=services,dc=immae,dc=eu' );
  42         define( 'LDAPAUTH_SEARCH_PASS', '${env.ldap.password}' );
  43
  44         define( 'LDAPAUTH_GROUP_ATTR', 'memberof' );
  45         define( 'LDAPAUTH_GROUP_REQ', 'cn=admin,cn=yourls,ou=services,dc=immae,dc=eu');
  46
  47         define( 'LDAPAUTH_USERCACHE_TYPE', 0);
  48       '';
  49     };
  50     webRoot = stdenv.mkDerivation (fetchedGithub ./yourls.json // rec {
  51       installPhase = ''
  52         mkdir -p $out
  53         cp -a */ *.php $out/
  54         cp sample-robots.txt $out/robots.txt
  55         ln -sf /run/keys/webapps/tools-yourls $out/includes/config.php
  56         ${builtins.concatStringsSep "\n" (
  57           lib.attrsets.mapAttrsToList (name: value: "ln -sf ${value} $out/user/plugins/${name}") plugins
  58         )}
  59       '';
  60     });
  61     apache = rec {
  62       user = "wwwrun";
  63       group = "wwwrun";
  64       modules = [ "proxy_fcgi" ];
  65       webappName = "tools_yourls";
  66       root = "/run/current-system/webapps/${webappName}";
  67       vhostConf = ''
  68         Alias /url "${root}"
  69         <Directory "${root}">
  70           <FilesMatch "\.php$">
  71             SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
  72           </FilesMatch>
  73
  74           AllowOverride None
  75           Require all granted
  76           <IfModule mod_rewrite.c>
  77             RewriteEngine On
  78             RewriteBase /url/
  79             RewriteCond %{REQUEST_FILENAME} !-f
  80             RewriteCond %{REQUEST_FILENAME} !-d
  81             RewriteRule ^.*$ /url/yourls-loader.php [L]
  82           </IfModule>
  83           DirectoryIndex index.php
  84         </Directory>
  85         '';
  86     };
  87     phpFpm = rec {
  88       serviceDeps = [ "mysql.service" "openldap.service" "tools-yourls-key.service" ];
  89       basedir = builtins.concatStringsSep ":" (
  90         [ webRoot "/run/keys/webapps/tools-yourls" ]
  91         ++ lib.attrsets.mapAttrsToList (name: value: value) plugins);
  92       socket = "/var/run/phpfpm/yourls.sock";
  93       pool = ''
  94         listen = ${socket}
  95         user = ${apache.user}
  96         group = ${apache.group}
  97         listen.owner = ${apache.user}
  98         listen.group = ${apache.group}
  99         pm = ondemand
 100         pm.max_children = 60
 101         pm.process_idle_timeout = 60
 102
 103         ; Needed to avoid clashes in browser cookies (same domain)
 104         php_value[session.name] = YourlsPHPSESSID
 105         php_admin_value[open_basedir] = "${basedir}:/tmp"
 106         php_admin_value[session.save_path] = "/var/lib/php/sessions/yourls"
 107         '';
 108     };
 109   };
 110 in
 111   yourls