Cleanup php session directories

[perso/Immae/Config/Nix.git] / nixops / modules / websites / tools / dav / davical.nix

diff --git a/nixops/modules/websites/tools/dav/davical.nix b/nixops/modules/websites/tools/dav/davical.nix
index 4d0639f3ed6346384bccc1cc9d906655277bfecc..89ba5683ce630b8649d9ca3c2fcf560e577bc6f5 100644 (file)
--- a/nixops/modules/websites/tools/dav/davical.nix
+++ b/nixops/modules/websites/tools/dav/davical.nix
@@ -16,13 +16,18 @@ let
     '';
   };
   davical = rec {
-    config = writeText "davical_config.php" ''
+    keys."dav-davical" = {
+      destDir = "/run/keys/webapps";
+      user = apache.user;
+      group = apache.group;
+      permissions = "0400";
+      text = ''
         <?php
-        $c->pg_connect[] = "dbname=davical user=davical_app host=db-1.immae.eu password=${env.postgresql.password}";
+        $c->pg_connect[] = "dbname=${env.postgresql.database} user=${env.postgresql.user} host=${env.postgresql.socket} password=${env.postgresql.password}";
 
         $c->readonly_webdav_collections = false;
 
-        $c->admin_email ='davical@immae.eu';
+        $c->admin_email ='davical@tools.immae.eu';
 
         $c->restrict_setup_to_admin = true;
 
@@ -69,6 +74,7 @@ let
         $c->do_not_sync_from_ldap = array('admin' => true);
         include('drivers_ldap.php');
       '';
+    };
     webapp = stdenv.mkDerivation rec {
       version = "1.1.7";
       name = "davical-${version}";
@@ -84,19 +90,21 @@ let
       installPhase = ''
         mkdir -p $out
         cp -ra config dba docs htdocs inc locale po scripts testing zonedb $out
-        ln -s ${config} $out/config/config.php
+        ln -s /run/keys/webapps/dav-davical $out/config/config.php
       '';
       buildInputs = [ gettext ];
     };
     webRoot = "${webapp}/htdocs";
-    apache = {
+    apache = rec {
       user = "wwwrun";
       group = "wwwrun";
       modules = [ "proxy_fcgi" ];
+      webappName = "tools_davical";
+      root = "/run/current-system/webapps/${webappName}";
       vhostConf = ''
-        Alias /davical "${webRoot}"
-        Alias /caldav.php  "${webRoot}/caldav.php"
-        <Directory "${webRoot}">
+        Alias /davical "${root}"
+        Alias /caldav.php  "${root}/caldav.php"
+        <Directory "${root}">
           DirectoryIndex index.php index.html
           AcceptPathInfo On
           AllowOverride None
@@ -129,7 +137,8 @@ let
         '';
     };
     phpFpm = rec {
-      basedir = builtins.concatStringsSep ":" [ webapp config awl ];
+      serviceDeps = [ "postgresql.service" "openldap.service" "dav-davical-key.service" ];
+      basedir = builtins.concatStringsSep ":" [ webapp "/run/keys/webapps/dav-davical" awl ];
       socket = "/var/run/phpfpm/davical.sock";
       pool = ''
         listen = ${socket}
@@ -145,7 +154,7 @@ let
 
         ; Needed to avoid clashes in browser cookies (same domain)
         php_value[session.name] = DavicalPHPSESSID
-        php_admin_value[open_basedir] = "${basedir}:/tmp"
+        php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/davical"
         php_admin_value[include_path] = "${awl}/inc:${webapp}/inc"
         php_admin_value[session.save_path] = "/var/lib/php/sessions/davical"
         php_flag[magic_quotes_gpc] = Off