virtual/packages.nix

   1 with import ../libs.nix;
   2 with nixpkgs_unstable;
   3 let
   4   connexionswing = { environment ? "dev" }: rec {
   5     varDir = "/var/lib/connexionswing_${environment}";
   6     envName= lib.strings.toUpper environment;
   7     configRoot =
   8       # FIXME: spool emails in prod for when immae.eu is down?
   9       assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_PASSWORD";
  10       assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_USER";
  11       assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_NAME";
  12       assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_SECRET";
  13       assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_EMAIL";
  14       pkgs.writeText "parameters.yml" ''
  15         # This file is auto-generated during the composer install
  16         parameters:
  17             database_host: db-1.immae.eu
  18             database_port: null
  19             database_name: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_NAME"}
  20             database_user: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_USER"}
  21             database_password: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_PASSWORD"}
  22             mailer_transport: smtp
  23             mailer_host: mail.immae.eu
  24             mailer_user: null
  25             mailer_password: null
  26             subscription_email: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_EMAIL"}
  27             allow_robots: true
  28             secret: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_SECRET"}
  29       '';
  30     phpFpm = rec {
  31       socket = "/var/run/phpfpm/connexionswing-${environment}.sock";
  32       pool = ''
  33         listen = ${socket}
  34         user = ${apache.user}
  35         group = ${apache.group}
  36         listen.owner = ${apache.user}
  37         listen.group = ${apache.group}
  38         php_admin_value[upload_max_filesize] = 20M
  39         php_admin_value[post_max_size] = 20M
  40         ;php_admin_flag[log_errors] = on
  41         php_admin_value[open_basedir] = "${configRoot}:${webappDir}:${varDir}:/tmp"
  42         ${if environment == "dev" then ''
  43         pm = ondemand
  44         pm.max_children = 5
  45         pm.process_idle_timeout = 60
  46         env[SYMFONY_DEBUG_MODE] = "yes"
  47         '' else ''
  48         pm = dynamic
  49         pm.max_children = 20
  50         pm.start_servers = 2
  51         pm.min_spare_servers = 1
  52         pm.max_spare_servers = 3
  53         ''}'';
  54     };
  55     apache = {
  56       user = "wwwrun";
  57       group = "wwwrun";
  58       modules = [ "proxy_fcgi" ];
  59       vhostConf = ''
  60       <FilesMatch "\.php$">
  61         SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
  62       </FilesMatch>
  63
  64       ${if environment == "dev" then ''
  65       <Location />
  66         Use LDAPConnect
  67         Require ldap-group   cn=connexionswing.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
  68         ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://connexionswing.com\"></html>"
  69       </Location>
  70
  71       <Directory ${webRoot}>
  72         Options Indexes FollowSymLinks MultiViews Includes
  73         AllowOverride None
  74         Require all granted
  75
  76         DirectoryIndex app_dev.php
  77
  78         <IfModule mod_negotiation.c>
  79         Options -MultiViews
  80         </IfModule>
  81
  82         <IfModule mod_rewrite.c>
  83           RewriteEngine On
  84
  85           RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
  86           RewriteRule ^(.*) - [E=BASE:%1]
  87
  88           # Maintenance script
  89           RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
  90           RewriteCond %{SCRIPT_FILENAME} !maintenance.php
  91           RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
  92           ErrorDocument 503 /maintenance.php
  93
  94           # Sets the HTTP_AUTHORIZATION header removed by Apache
  95           RewriteCond %{HTTP:Authorization} .
  96           RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
  97
  98           RewriteCond %{ENV:REDIRECT_STATUS} ^$
  99           RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 100
 101           # If the requested filename exists, simply serve it.
 102           # We only want to let Apache serve files and not directories.
 103           RewriteCond %{REQUEST_FILENAME} -f
 104           RewriteRule ^ - [L]
 105
 106           # Rewrite all other queries to the front controller.
 107           RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
 108         </IfModule>
 109
 110       </Directory>
 111       '' else ""}
 112       '';
 113     };
 114     activationScript = {
 115       deps = [ "wrappers" ];
 116       text = ''
 117       install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir} \
 118         ${varDir}/medias \
 119         ${varDir}/uploads \
 120         ${varDir}/var
 121       if [ ! -f "${varDir}/currentWebappDir" -o \
 122           "${webappDir}" != "$(cat ${varDir}/currentWebappDir 2>/dev/null)" ]; then
 123         pushd ${webappDir} > /dev/null
 124         $wrapperDir/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
 125         popd > /dev/null
 126         echo -n "${webappDir}" > ${varDir}/currentWebappDir
 127       fi
 128       '';
 129     };
 130     webappDir = pkgs.stdenv.mkDerivation (fetchedGitPrivate ./connexionswing_master.json // rec {
 131       # FIXME: can we do better than symlink?
 132       # FIXME: imagick optional
 133       # FIXME: initial sync
 134       buildPhase = ''
 135         export GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
 136         export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
 137
 138         ln -sf ../../../../../${varDir}/{medias,uploads} web/images/
 139         ln -sf ${configRoot} app/config/parameters.yml
 140         ${if environment == "dev" then "php bin/composer install" else ''
 141         SYMFONY_ENV=prod php bin/composer install --no-dev
 142         ./bin/console assetic:dump --env=prod --no-debug
 143         ''}
 144         rm -rf var
 145         ln -sf ../../../../../${varDir}/var var
 146         '';
 147       installPhase = ''
 148         cp -a . $out
 149         '';
 150       buildInputs = [
 151         pkgs.php pkgs.git pkgs.cacert
 152       ];
 153     });
 154     webRoot = "${webappDir}/web";
 155   };
 156
 157   adminer = rec {
 158     webRoot = pkgs.stdenv.mkDerivation rec {
 159       version = "4.7.0";
 160       name = "adminer-${version}";
 161       src = pkgs.fetchurl {
 162         url = "https://www.adminer.org/static/download/${version}/${name}.php";
 163         sha256 = "1qq2g7rbfh2vrqfm3g0bz0qs057b049n0mhabnsbd1sgnpvnc5z7";
 164       };
 165       phases = "installPhase";
 166       installPhase = ''
 167         mkdir -p $out
 168         cp $src $out/index.php
 169       '';
 170     };
 171     phpFpm = rec {
 172       socket = "/var/run/phpfpm/adminer.sock";
 173       pool = ''
 174         listen = ${socket}
 175         user = ${apache.user}
 176         group = ${apache.group}
 177         listen.owner = ${apache.user}
 178         listen.group = ${apache.group}
 179         pm = ondemand
 180         pm.max_children = 5
 181         pm.process_idle_timeout = 60
 182         ;php_admin_flag[log_errors] = on
 183         php_admin_value[open_basedir] = "${webRoot}:/tmp"
 184         '';
 185     };
 186     apache = {
 187       user = "wwwrun";
 188       group = "wwwrun";
 189       modules = [ "proxy_fcgi" ];
 190       vhostConf = ''
 191         Alias /adminer ${webRoot}
 192         <Directory ${webRoot}>
 193           DirectoryIndex = index.php
 194           <FilesMatch "\.php$">
 195             SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
 196           </FilesMatch>
 197         </Directory>
 198         '';
 199     };
 200     nginxConf = {
 201       alias = webRoot;
 202       index = "index.php";
 203       extraConfig = ''
 204         include ${pkgs.nginx}/conf/fastcgi.conf;
 205         fastcgi_split_path_info ^(.+?\.php)(/.*)$;
 206         fastcgi_param HTTP_PROXY "";
 207         fastcgi_param SCRIPT_FILENAME ${webRoot}/index.php;
 208         fastcgi_pass unix:${phpFpm.socket};
 209         fastcgi_index index.php;
 210         fastcgi_intercept_errors on;
 211         '';
 212     };
 213   };
 214
 215   ympd = rec {
 216     config = {
 217       webPort = "localhost:18001";
 218       mpd = {
 219         host = "malige.home.immae.eu";
 220         port = 6600;
 221       };
 222     };
 223     apache = {
 224       vhostConf = ''
 225         <LocationMatch "^/mpd">
 226           Use LDAPConnect
 227           Require ldap-group   cn=users,cn=mpd,ou=services,dc=immae,dc=eu
 228           Require local
 229         </LocationMatch>
 230
 231         RedirectMatch permanent "^/mpd$" "/mpd/"
 232         <Location "/mpd/">
 233           ProxyPass http://${config.webPort}/
 234           ProxyPassReverse http://${config.webPort}/
 235           ProxyPreserveHost on
 236         </Location>
 237         <Location "/mpd/ws">
 238           ProxyPass ws://${config.webPort}/ws
 239         </Location>
 240       '';
 241     };
 242   };
 243 in
 244   {
 245     inherit adminer;
 246     inherit ympd;
 247     connexionswing_dev  = connexionswing { environment = "dev"; };
 248     connexionswing_prod = connexionswing { environment = "prod"; };
 249   }