Move websites/tools to modules

[perso/Immae/Config/Nix.git] / modules / private / websites / tools / git / mantisbt.nix

diff --git a/modules/private/websites/tools/git/mantisbt.nix b/modules/private/websites/tools/git/mantisbt.nix
new file mode 100644 (file)
index 0000000..a1b830e
--- /dev/null
+++ b/modules/private/websites/tools/git/mantisbt.nix
@@ -0,0 +1,96 @@
+{ env, mantisbt_2, mantisbt_2-plugins }:
+rec {
+  activationScript = {
+    deps = [ "httpd" ];
+    text = ''
+      install -m 0755 -o ${apache.user} -g ${apache.group} -d /var/lib/php/sessions/mantisbt
+    '';
+  };
+  keys = [{
+    dest = "webapps/tools-mantisbt";
+    user = apache.user;
+    group = apache.group;
+    permissions = "0400";
+    text = ''
+      <?php
+      $g_hostname              = '${env.postgresql.socket}';
+      $g_db_username           = '${env.postgresql.user}';
+      $g_db_password           = '${env.postgresql.password}';
+      $g_database_name         = '${env.postgresql.database}';
+      $g_db_type               = 'pgsql';
+      $g_crypto_master_salt    = '${env.master_salt}';
+      $g_allow_signup          = OFF;
+      $g_allow_anonymous_login = ON;
+      $g_anonymous_account     = 'anonymous';
+
+      $g_phpMailer_method      = PHPMAILER_METHOD_SENDMAIL;
+      $g_smtp_host             = 'localhost';
+      $g_smtp_username         = ''';
+      $g_smtp_password         = ''';
+      $g_webmaster_email       = 'mantisbt@tools.immae.eu';
+      $g_from_email            = 'mantisbt@tools.immae.eu';
+      $g_return_path_email     = 'mantisbt@tools.immae.eu';
+      $g_from_name             = 'Mantis Bug Tracker at git.immae.eu';
+      $g_email_receive_own     = OFF;
+      # --- LDAP ---
+      $g_login_method = LDAP;
+      $g_ldap_protocol_version = 3;
+      $g_ldap_server = 'ldaps://ldap.immae.eu:636';
+      $g_ldap_root_dn = 'ou=users,dc=immae,dc=eu';
+      $g_ldap_bind_dn = 'cn=mantisbt,ou=services,dc=immae,dc=eu';
+      $g_ldap_bind_passwd = '${env.ldap.password}';
+      $g_use_ldap_email = ON;
+      $g_use_ldap_realname = ON;
+      $g_ldap_uid_field = 'uid';
+      $g_ldap_realname_field = 'cn';
+      $g_ldap_organization = '(memberOf=cn=users,cn=mantisbt,ou=services,dc=immae,dc=eu)';
+    '';
+  }];
+  webRoot = (mantisbt_2.override { mantis_config = "/var/secrets/webapps/tools-mantisbt"; }).withPlugins (builtins.attrValues mantisbt_2-plugins);
+  apache = rec {
+    user = "wwwrun";
+    group = "wwwrun";
+    modules = [ "proxy_fcgi" ];
+    webappName = "tools_mantisbt";
+    root = "/run/current-system/webapps/${webappName}";
+    vhostConf = ''
+      Alias /mantisbt "${root}"
+      <Directory "${root}">
+        DirectoryIndex index.php
+        <FilesMatch "\.php$">
+          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+        </FilesMatch>
+
+        AllowOverride All
+        Options FollowSymlinks
+        Require all granted
+      </Directory>
+      <Directory "${root}/admin">
+        #Reenable during upgrade
+        Require all denied
+      </Directory>
+      '';
+  };
+  phpFpm = rec {
+    serviceDeps = [ "postgresql.service" "openldap.service" ];
+    basedir = builtins.concatStringsSep ":" (
+      [ webRoot "/var/secrets/webapps/tools-mantisbt" ]
+      ++ webRoot.plugins);
+    socket = "/var/run/phpfpm/mantisbt.sock";
+    pool = ''
+      listen = ${socket}
+      user = ${apache.user}
+      group = ${apache.group}
+      listen.owner = ${apache.user}
+      listen.group = ${apache.group}
+      pm = ondemand
+      pm.max_children = 60
+      pm.process_idle_timeout = 60
+
+      php_admin_value[upload_max_filesize] = 5000000
+
+      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/mantisbt"
+      php_admin_value[session.save_path] = "/var/lib/php/sessions/mantisbt"
+      '';
+  };
+}