Fix secret permissions

[perso/Immae/Config/Nix.git] / nixops / modules / websites / ludivine / ludivinecassal.nix
diff --git a/nixops/modules/websites/ludivine/ludivinecassal.nix b/nixops/modules/websites/ludivine/ludivinecassal.nix

index eff0bf8f762ed34104fb825e56239df578e6b5d6..423bbda4fa6aa5d69f9950c667ffed42a90933ed 100644 (file)
--- a/nixops/modules/websites/ludivine/ludivinecassal.nix
+++ b/nixops/modules/websites/ludivine/ludivinecassal.nix
@@ -3,18 +3,22 @@ let
    ludivinecassal = { config }: rec {
      environment = config.environment;
      varDir = "/var/lib/ludivinecassal_${environment}";
-    configRoot =
-      writeText "parameters.yml" ''
+    keys."${environment}-ludivinecassal" = {
+      destDir = "/run/keys/webapps";
+      user = apache.user;
+      group = apache.group;
+      permissions = "0400";
+      text = ''
          # This file is auto-generated during the composer install
          parameters:
-            database_host: db-1.immae.eu
-            database_port: null
+            database_host: ${config.mysql.host}
+            database_port: ${config.mysql.port}
              database_name: ${config.mysql.name}
              database_user: ${config.mysql.user}
              database_password: ${config.mysql.password}
              database_server_version: ${pkgs.mariadb.mysqlVersion}
              mailer_transport: smtp
-            mailer_host: mail.immae.eu
+            mailer_host: 127.0.0.1
              mailer_user: null
              mailer_password: null
              secret: ${config.secret}
@@ -34,7 +38,9 @@ let
              sass: ${sass}/bin/sass
              ruby: ${ruby}/bin/ruby
        '';
+    };
      phpFpm = rec {
+      serviceDeps = [ "mysql.service" "${environment}-ludivinecassal-key.service" ];
        socket = "/var/run/phpfpm/ludivinecassal-${environment}.sock";
        pool = ''
          listen = ${socket}
@@ -45,7 +51,7 @@ let
          php_admin_value[upload_max_filesize] = 20M
          php_admin_value[post_max_size] = 20M
          ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "${configRoot}:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/run/keys/webapps/${environment}-ludivinecassal:${webappDir}:${varDir}:/tmp"
          php_admin_value[session.save_path] = "${varDir}/phpSessions"
          ${if environment == "dev" then ''
          pm = ondemand
@@ -60,10 +66,12 @@ let
          pm.max_spare_servers = 3
          ''}'';
      };
-    apache = {
+    apache = rec {
        user = "wwwrun";
        group = "wwwrun";
        modules = [ "proxy_fcgi" ];
+      webappName = "ludivine_${environment}";
+      root = "/run/current-system/webapps/${webappName}";
        vhostConf = ''
        <FilesMatch "\.php$">
          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
@@ -76,7 +84,7 @@ let
          ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://ludivinecassal.com\"></html>"
        </Location>
  
-      <Directory ${webRoot}>
+      <Directory ${root}>
          Options Indexes FollowSymLinks MultiViews Includes
          AllowOverride None
          Require all granted
@@ -119,7 +127,7 @@ let
        '' else ''
        Use Stats ludivinecassal.com
  
-      <Directory ${webRoot}>
+      <Directory ${root}>
          Options Indexes FollowSymLinks MultiViews Includes
          AllowOverride All
          Require all granted
@@ -149,14 +157,22 @@ let
          noDev = (environment == "prod");
          preInstall = ''
            export SYMFONY_ENV="${environment}"
-          ln -sf ${configRoot} app/config/parameters.yml
+          cp app/config/parameters.yml.dist app/config/parameters.yml
+          cat >> app/config/parameters.yml <<EOF
+          leapt_im:
+              binary_path: ${imagemagick}/bin
+          assetic:
+              sass: ${sass}/bin/sass
+              ruby: ${ruby}/bin/ruby
+          EOF
            sed -i -e "/Incenteev..ParameterHandler..ScriptHandler::buildParameters/d" composer.json
            '';
          # /!\ miniatures and data need to be in the same physical dir due to a
          #     bug in leapt.im (searches for data/../miniatures)
          postInstall = ''
            rm -rf var/{logs,cache,data,miniatures,tmp}
-          ln -sf ../../../../../../../${varDir}/{logs,cache,data,miniatures,tmp} var/
+          ln -sf ${varDir}/{logs,cache,data,miniatures,tmp} var/
+          ln -sf /run/keys/webapps/${environment}-ludivinecassal app/config/parameters.yml
            '';
          buildInputs = [ sass ];
        });