Fix secret permissions

[perso/Immae/Config/Nix.git] / nixops / modules / websites / connexionswing / connexionswing.nix
diff --git a/nixops/modules/websites/connexionswing/connexionswing.nix b/nixops/modules/websites/connexionswing/connexionswing.nix

index 307def0ad5b619d057aef27aaa21e9d27b96d5b6..2960c6a84e282d87ad8a3537d3c1cf7f76644d54 100644 (file)
--- a/nixops/modules/websites/connexionswing/connexionswing.nix
+++ b/nixops/modules/websites/connexionswing/connexionswing.nix
@@ -3,8 +3,12 @@ let
    connexionswing = { config }: rec {
      environment = config.environment;
      varDir = "/var/lib/connexionswing_${environment}";
-    configRoot =
-      writeText "parameters.yml" ''
+    keys."${environment}-connexionswing" = {
+      destDir = "/run/keys/webapps";
+      user = apache.user;
+      group = apache.group;
+      permissions = "0400";
+      text = ''
          # This file is auto-generated during the composer install
          parameters:
              database_host: ${config.mysql.host}
@@ -27,7 +31,9 @@ let
                arguments: ['/run/wrappers/bin/sendmail -bs']
          '' else ""}
        '';
+    };
      phpFpm = rec {
+      serviceDeps = [ "mysql.service" "${environment}-connexionswing-key.service" ];
        socket = "/var/run/phpfpm/connexionswing-${environment}.sock";
        phpConfig = ''
          extension=${phpPackages.imagick}/lib/php/extensions/imagick.so
@@ -41,7 +47,7 @@ let
          php_admin_value[upload_max_filesize] = 20M
          php_admin_value[post_max_size] = 20M
          ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:${configRoot}:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/run/keys/webapps/${environment}-connexionswing:${webappDir}:${varDir}:/tmp"
          php_admin_value[session.save_path] = "${varDir}/phpSessions"
          ${if environment == "dev" then ''
          pm = ondemand
@@ -56,10 +62,12 @@ let
          pm.max_spare_servers = 3
          ''}'';
      };
-    apache = {
+    apache = rec {
        user = "wwwrun";
        group = "wwwrun";
        modules = [ "proxy_fcgi" ];
+      webappName = "connexionswing_${environment}";
+      root = "/run/current-system/webapps/${webappName}";
        vhostConf = ''
        <FilesMatch "\.php$">
          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
@@ -84,7 +92,7 @@ let
          ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://connexionswing.com\"></html>"
        </Location>
  
-      <Directory ${webRoot}>
+      <Directory ${root}>
          Options Indexes FollowSymLinks MultiViews Includes
          AllowOverride None
          Require all granted
@@ -127,7 +135,7 @@ let
        '' else ''
        Use Stats connexionswing.com
  
-      <Directory ${webRoot}>
+      <Directory ${root}>
          Options Indexes FollowSymLinks MultiViews Includes
          AllowOverride All
          Require all granted
@@ -164,10 +172,10 @@ let
            cd $out
            ${if environment == "prod" then "php ./bin/console assetic:dump --env=prod --no-debug" else ""}
            rm app/config/parameters.yml
-          ln -sf ${configRoot} app/config/parameters.yml
+          ln -sf /run/keys/webapps/${environment}-connexionswing app/config/parameters.yml
            rm -rf var/{logs,cache}
-          ln -sf ../../../../../../${varDir}/var/{logs,cache} var/
-          ln -sf ../../../../../${varDir}/{medias,uploads} web/images/
+          ln -sf ${varDir}/var/{logs,cache} var/
+          ln -sf ${varDir}/{medias,uploads} web/images/
            '';
        });
      webRoot = "${webappDir}/web";