Move websites to new secrets

diff --git a/nixops/modules/websites/aten/aten.nix b/nixops/modules/websites/aten/aten.nix
index 567dcd13dfc2fe7656f09a8db32d800ad18f3881..46a7361b583899613190e4d0e336e61138b79724 100644 (file)
--- a/nixops/modules/websites/aten/aten.nix
+++ b/nixops/modules/websites/aten/aten.nix
@@ -13,10 +13,10 @@ let
           /run/wrappers/bin/sudo -u wwwrun APP_ENV=${environment} ./bin/console --env=${environment} cache:clear --no-warmup
           popd > /dev/null
           echo -n "${webappDir}" > ${varDir}/currentWebappDir
-          sha512sum /run/keys/webapps/${environment}-aten > ${varDir}/currentKey
+          sha512sum /var/secrets/webapps/${environment}-aten > ${varDir}/currentKey
         fi
         '';
-      serviceDeps = [ "postgresql.service" "${environment}-aten-key.service" ];
+      serviceDeps = [ "postgresql.service" ];
       socket = "/var/run/phpfpm/aten-${environment}.sock";
       pool = ''
         listen = ${socket}
@@ -42,8 +42,8 @@ let
         pm.max_spare_servers = 3
         ''}'';
     };
-    keys."${environment}-aten" = {
-      destDir = "/run/keys/webapps";
+    keys = [{
+      dest = "webapps/${environment}-aten";
       user = apache.user;
       group = apache.group;
       permissions = "0400";
@@ -52,7 +52,7 @@ let
         SetEnv APP_SECRET   "${config.secret}"
         SetEnv DATABASE_URL "${config.psql_url}"
         '';
-    };
+    }];
     apache = rec {
       user = "wwwrun";
       group = "wwwrun";
@@ -64,7 +64,7 @@ let
         SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
       </FilesMatch>
 
-      Include /run/keys/webapps/${environment}-aten
+      Include /var/secrets/webapps/${environment}-aten
 
       ${if environment == "dev" then ''
       <Location />

diff --git a/nixops/modules/websites/aten/default.nix b/nixops/modules/websites/aten/default.nix
index b0f7fdbe483bda47b9843d8bef53347e1b50b90c..6f58d3cab8b5dbcb2523dea287c4aa4395502680 100644 (file)
--- a/nixops/modules/websites/aten/default.nix
+++ b/nixops/modules/websites/aten/default.nix
@@ -25,7 +25,7 @@ in {
 
   config = lib.mkMerge [
     (lib.mkIf cfg.production.enable {
-      deployment.keys = aten_prod.keys;
+      mySecrets.keys = aten_prod.keys;
       services.myWebsites.commons.stats.enable = true;
       services.myWebsites.commons.stats.sites = [
         {
@@ -59,7 +59,7 @@ in {
       };
     })
     (lib.mkIf cfg.integration.enable {
-      deployment.keys = aten_dev.keys;
+      mySecrets.keys = aten_dev.keys;
       security.acme.certs."eldiron".extraDomains."dev.aten.pro" = null;
       services.myPhpfpm.preStart.aten_dev = aten_dev.phpFpm.preStart;
       services.myPhpfpm.serviceDependencies.aten_dev = aten_dev.phpFpm.serviceDeps;

diff --git a/nixops/modules/websites/chloe/chloe.nix b/nixops/modules/websites/chloe/chloe.nix
index 0861cdf69c326b51b176c59c06fed63bcc89b703..e2381d83e92ba44f932b42b81c315c7fc913f2e8 100644 (file)
--- a/nixops/modules/websites/chloe/chloe.nix
+++ b/nixops/modules/websites/chloe/chloe.nix
@@ -3,7 +3,7 @@ let
   chloe = { config }: rec {
     environment = config.environment;
     phpFpm = rec {
-      serviceDeps = [ "mysql.service" "${environment}-chloe-key.service" ];
+      serviceDeps = [ "mysql.service" ];
       socket = "/var/run/phpfpm/chloe-${environment}.sock";
       pool = ''
         listen = ${socket}
@@ -28,8 +28,8 @@ let
         pm.max_spare_servers = 3
         ''}'';
     };
-    keys."${environment}-chloe" = {
-      destDir = "/run/keys/webapps";
+    keys = [{
+      dest = "webapps/${environment}-chloe";
       user = apache.user;
       group = apache.group;
       permissions = "0400";
@@ -48,7 +48,7 @@ let
         SetEnv SPIP_MYSQL_USER     "${config.mysql.user}"
         SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}"
       '';
-    };
+    }];
     apache = rec {
       user = "wwwrun";
       group = "wwwrun";
@@ -56,7 +56,7 @@ let
       webappName = "chloe_${environment}";
       root = "/run/current-system/webapps/${webappName}";
       vhostConf = ''
-        Include /run/keys/webapps/${environment}-chloe
+        Include /var/secrets/webapps/${environment}-chloe
 
         RewriteEngine On
         ${if environment == "prod" then ''

diff --git a/nixops/modules/websites/chloe/default.nix b/nixops/modules/websites/chloe/default.nix
index 451a248e8ddccf267d51e928fe5cbb7ecea3f2b5..33ced2ed7b3bf0f5b0f3876b3cb4314c6ccea7ab 100644 (file)
--- a/nixops/modules/websites/chloe/default.nix
+++ b/nixops/modules/websites/chloe/default.nix
@@ -25,7 +25,7 @@ in {
 
   config = lib.mkMerge [
     (lib.mkIf cfg.production.enable {
-      deployment.keys = chloe_prod.keys;
+      mySecrets.keys = chloe_prod.keys;
       services.myWebsites.commons.stats.enable = true;
       services.myWebsites.commons.stats.sites = [
         {
@@ -60,7 +60,7 @@ in {
       };
     })
     (lib.mkIf cfg.integration.enable {
-      deployment.keys = chloe_dev.keys;
+      mySecrets.keys = chloe_dev.keys;
       security.acme.certs."eldiron".extraDomains."chloe.immae.eu" = null;
       services.myPhpfpm.serviceDependencies.chloe_dev = chloe_dev.phpFpm.serviceDeps;
       services.myPhpfpm.poolConfigs.chloe_dev = chloe_dev.phpFpm.pool;

diff --git a/nixops/modules/websites/connexionswing/connexionswing.nix b/nixops/modules/websites/connexionswing/connexionswing.nix
index 13d4fbabb228a794b5d9d05a98f2553b08b2e383..60ddb6388ba11b29ba6a7dc2d5ea92aea98f7c9f 100644 (file)
--- a/nixops/modules/websites/connexionswing/connexionswing.nix
+++ b/nixops/modules/websites/connexionswing/connexionswing.nix
@@ -3,8 +3,8 @@ let
   connexionswing = { config }: rec {
     environment = config.environment;
     varDir = "/var/lib/connexionswing_${environment}";
-    keys."${environment}-connexionswing" = {
-      destDir = "/run/keys/webapps";
+    keys = [{
+      dest = "webapps/${environment}-connexionswing";
       user = apache.user;
       group = apache.group;
       permissions = "0400";
@@ -31,7 +31,7 @@ let
               arguments: ['/run/wrappers/bin/sendmail -bs']
         '' else ""}
       '';
-    };
+    }];
     phpFpm = rec {
       preStart = ''
         if [ ! -f "${varDir}/currentWebappDir" -o \
@@ -42,10 +42,10 @@ let
           /run/wrappers/bin/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
           popd > /dev/null
           echo -n "${webappDir}" > ${varDir}/currentWebappDir
-          sha512sum /run/keys/webapps/${environment}-connexionswing > ${varDir}/currentKey
+          sha512sum /var/secrets/webapps/${environment}-connexionswing > ${varDir}/currentKey
         fi
         '';
-      serviceDeps = [ "mysql.service" "${environment}-connexionswing-key.service" ];
+      serviceDeps = [ "mysql.service" ];
       socket = "/var/run/phpfpm/connexionswing-${environment}.sock";
       phpConfig = ''
         extension=${phpPackages.imagick}/lib/php/extensions/imagick.so
@@ -59,7 +59,7 @@ let
         php_admin_value[upload_max_filesize] = 20M
         php_admin_value[post_max_size] = 20M
         ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/run/keys/webapps/${environment}-connexionswing:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/secrets/webapps/${environment}-connexionswing:${webappDir}:${varDir}:/tmp"
         php_admin_value[session.save_path] = "${varDir}/phpSessions"
         ${if environment == "dev" then ''
         pm = ondemand
@@ -177,7 +177,7 @@ let
           cd $out
           ${if environment == "prod" then "php ./bin/console assetic:dump --env=prod --no-debug" else ""}
           rm app/config/parameters.yml
-          ln -sf /run/keys/webapps/${environment}-connexionswing app/config/parameters.yml
+          ln -sf /var/secrets/webapps/${environment}-connexionswing app/config/parameters.yml
           rm -rf var/{logs,cache}
           ln -sf ${varDir}/var/{logs,cache} var/
           ln -sf ${varDir}/{medias,uploads} web/images/

diff --git a/nixops/modules/websites/connexionswing/default.nix b/nixops/modules/websites/connexionswing/default.nix
index ccbaa02bb27b92a796dc0a8473b13747dc03129c..c0036d8abcb9759d632ad37091490d86b856f2c2 100644 (file)
--- a/nixops/modules/websites/connexionswing/default.nix
+++ b/nixops/modules/websites/connexionswing/default.nix
@@ -25,7 +25,7 @@ in {
 
   config = lib.mkMerge [
     (lib.mkIf cfg.production.enable {
-      deployment.keys = connexionswing_prod.keys;
+      mySecrets.keys = connexionswing_prod.keys;
       services.myWebsites.commons.stats.enable = true;
       services.myWebsites.commons.stats.sites = [
         {
@@ -61,7 +61,7 @@ in {
       };
     })
     (lib.mkIf cfg.integration.enable {
-      deployment.keys = connexionswing_dev.keys;
+      mySecrets.keys = connexionswing_dev.keys;
       security.acme.certs."eldiron".extraDomains."sandetludo.immae.eu" = null;
       security.acme.certs."eldiron".extraDomains."connexionswing.immae.eu" = null;
       services.myPhpfpm.preStart.connexionswing_dev = connexionswing_dev.phpFpm.preStart;

diff --git a/nixops/modules/websites/ftp/jerome.nix b/nixops/modules/websites/ftp/jerome.nix
index 6c0decd188497594a2b130f9f8c2c84bb7bc73c8..18d16a11757ea69670330b7cb968b0bf34d01558 100644 (file)
--- a/nixops/modules/websites/ftp/jerome.nix
+++ b/nixops/modules/websites/ftp/jerome.nix
@@ -29,8 +29,8 @@ in {
       domain = "naturaloutil.immae.eu";
     };
 
-    deployment.keys."prod-naturaloutil" = {
-      destDir = "/run/keys/webapps";
+    mySecrets.keys = [{
+      dest = "webapps/prod-naturaloutil";
       user = "wwwrun";
       group = "wwwrun";
       permissions = "0400";
@@ -49,8 +49,8 @@ in {
         $database = connect_db($db, $mysql_server, $mysql_base, $mysql_user, $mysql_password);
         ?>
       '';
-    };
-    services.myPhpfpm.serviceDependencies.jerome = [ "mysql.service" "prod-naturaloutil-key.service" ];
+    }];
+    services.myPhpfpm.serviceDependencies.jerome = [ "mysql.service" ];
     services.myPhpfpm.poolConfigs.jerome = ''
       listen = /run/phpfpm/naturaloutil.sock
       user = wwwrun
@@ -62,8 +62,8 @@ in {
       pm.max_children = 5
       pm.process_idle_timeout = 60
 
-      env[BDD_CONNECT] = "/run/keys/webapps/prod-naturaloutil"
-      php_admin_value[open_basedir] = "/run/keys/webapps/prod-naturaloutil:${varDir}:/tmp"
+      env[BDD_CONNECT] = "/var/secrets/webapps/prod-naturaloutil"
+      php_admin_value[open_basedir] = "/var/secrets/webapps/prod-naturaloutil:${varDir}:/tmp"
       '';
     services.myPhpfpm.poolPhpConfigs.jerome = ''
       extension=${pkgs.php}/lib/php/extensions/mysqli.so

diff --git a/nixops/modules/websites/ludivine/default.nix b/nixops/modules/websites/ludivine/default.nix
index 814764f8659a64d4a33707b121fde0bf02704bde..a3d39229ab0755e20b810d30765bad00a0220e05 100644 (file)
--- a/nixops/modules/websites/ludivine/default.nix
+++ b/nixops/modules/websites/ludivine/default.nix
@@ -21,7 +21,7 @@ in {
 
   config = lib.mkMerge [
     (lib.mkIf cfg.production.enable {
-      deployment.keys = ludivinecassal_prod.keys;
+      mySecrets.keys = ludivinecassal_prod.keys;
       services.myWebsites.commons.stats.enable = true;
       services.myWebsites.commons.stats.sites = [
         {
@@ -54,7 +54,7 @@ in {
       };
     })
     (lib.mkIf cfg.integration.enable {
-      deployment.keys = ludivinecassal_dev.keys;
+      mySecrets.keys = ludivinecassal_dev.keys;
       security.acme.certs."eldiron".extraDomains."ludivine.immae.eu" = null;
 
       services.myPhpfpm.preStart.ludivinecassal_dev = ludivinecassal_dev.phpFpm.preStart;

diff --git a/nixops/modules/websites/ludivine/ludivinecassal.nix b/nixops/modules/websites/ludivine/ludivinecassal.nix
index 439d3c98e73737904c4ff10a20c06c0ad51ccadd..c12d89ca4ac4183d81fd63edf8d11c7747e884bc 100644 (file)
--- a/nixops/modules/websites/ludivine/ludivinecassal.nix
+++ b/nixops/modules/websites/ludivine/ludivinecassal.nix
@@ -3,8 +3,8 @@ let
   ludivinecassal = { config }: rec {
     environment = config.environment;
     varDir = "/var/lib/ludivinecassal_${environment}";
-    keys."${environment}-ludivinecassal" = {
-      destDir = "/run/keys/webapps";
+    keys = [{
+      dest = "webapps/${environment}-ludivinecassal";
       user = apache.user;
       group = apache.group;
       permissions = "0400";
@@ -38,7 +38,7 @@ let
             sass: ${sass}/bin/sass
             ruby: ${ruby}/bin/ruby
       '';
-    };
+    }];
     phpFpm = rec {
       preStart = ''
         if [ ! -f "${varDir}/currentWebappDir" -o \
@@ -49,10 +49,10 @@ let
           /run/wrappers/bin/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
           popd > /dev/null
           echo -n "${webappDir}" > ${varDir}/currentWebappDir
-          sha512sum /run/keys/webapps/${environment}-ludivinecassal > ${varDir}/currentKey
+          sha512sum /var/secrets/webapps/${environment}-ludivinecassal > ${varDir}/currentKey
         fi
         '';
-      serviceDeps = [ "mysql.service" "${environment}-ludivinecassal-key.service" ];
+      serviceDeps = [ "mysql.service" ];
       socket = "/var/run/phpfpm/ludivinecassal-${environment}.sock";
       pool = ''
         listen = ${socket}
@@ -63,7 +63,7 @@ let
         php_admin_value[upload_max_filesize] = 20M
         php_admin_value[post_max_size] = 20M
         ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "/run/keys/webapps/${environment}-ludivinecassal:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/var/secrets/webapps/${environment}-ludivinecassal:${webappDir}:${varDir}:/tmp"
         php_admin_value[session.save_path] = "${varDir}/phpSessions"
         ${if environment == "dev" then ''
         pm = ondemand
@@ -177,7 +177,7 @@ let
         postInstall = ''
           rm -rf var/{logs,cache,data,miniatures,tmp}
           ln -sf ${varDir}/{logs,cache,data,miniatures,tmp} var/
-          ln -sf /run/keys/webapps/${environment}-ludivinecassal app/config/parameters.yml
+          ln -sf /var/secrets/webapps/${environment}-ludivinecassal app/config/parameters.yml
           '';
         buildInputs = [ sass ];
       });

diff --git a/nixops/modules/websites/piedsjaloux/default.nix b/nixops/modules/websites/piedsjaloux/default.nix
index 57849a3f2d010ef25495ed6a68dc9d03a6a1d5ad..b2bd2fd4295b7b4623a072ca60d18dab44d90b90 100644 (file)
--- a/nixops/modules/websites/piedsjaloux/default.nix
+++ b/nixops/modules/websites/piedsjaloux/default.nix
@@ -25,7 +25,7 @@ in {
 
   config = lib.mkMerge [
     (lib.mkIf cfg.production.enable {
-      deployment.keys = piedsjaloux_prod.keys;
+      mySecrets.keys = piedsjaloux_prod.keys;
       services.myWebsites.commons.stats.enable = true;
       services.myWebsites.commons.stats.sites = [
         {
@@ -58,7 +58,7 @@ in {
       };
     })
     (lib.mkIf cfg.integration.enable {
-      deployment.keys = piedsjaloux_dev.keys;
+      mySecrets.keys = piedsjaloux_dev.keys;
       security.acme.certs."eldiron".extraDomains."piedsjaloux.immae.eu" = null;
       services.myPhpfpm.preStart.piedsjaloux_dev = piedsjaloux_dev.phpFpm.preStart;
       services.myPhpfpm.serviceDependencies.piedsjaloux_dev = piedsjaloux_dev.phpFpm.serviceDeps;

diff --git a/nixops/modules/websites/piedsjaloux/piedsjaloux.nix b/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
index 87699dbe25b3c51ddad5d8a266fc88c688245472..5461e5dad1c98eef979890b38974b4a9a229b127 100644 (file)
--- a/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
+++ b/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
@@ -3,8 +3,8 @@ let
   piedsjaloux = { config }: rec {
     environment = config.environment;
     varDir = "/var/lib/piedsjaloux_${environment}";
-    keys."${environment}-piedsjaloux" = {
-      destDir = "/run/keys/webapps";
+    keys = [{
+      dest = "webapps/${environment}-piedsjaloux";
       user = apache.user;
       group = apache.group;
       permissions = "0400";
@@ -26,7 +26,7 @@ let
         leapt_im:
             binary_path: ${imagemagick}/bin
       '';
-    };
+    }];
     phpFpm = rec {
       preStart = ''
         if [ ! -f "${varDir}/currentWebappDir" -o \
@@ -37,10 +37,10 @@ let
           /run/wrappers/bin/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
           popd > /dev/null
           echo -n "${webappDir}" > ${varDir}/currentWebappDir
-          sha512sum /run/keys/webapps/${environment}-piedsjaloux > ${varDir}/currentKey
+          sha512sum /var/secrets/webapps/${environment}-piedsjaloux > ${varDir}/currentKey
         fi
         '';
-      serviceDeps = [ "mysql.service" "${environment}-piedsjaloux-key.service" ];
+      serviceDeps = [ "mysql.service" ];
       socket = "/var/run/phpfpm/piedsjaloux-${environment}.sock";
       pool = ''
         listen = ${socket}
@@ -51,7 +51,7 @@ let
         php_admin_value[upload_max_filesize] = 20M
         php_admin_value[post_max_size] = 20M
         ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "/run/keys/webapps/${environment}-piedsjaloux:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/var/secrets/webapps/${environment}-piedsjaloux:${webappDir}:${varDir}:/tmp"
         php_admin_value[session.save_path] = "${varDir}/phpSessions"
         env[PATH] = ${lib.makeBinPath [ pkgs.apg pkgs.unzip ]}
         ${if environment == "dev" then ''
@@ -157,7 +157,7 @@ let
         postInstall = ''
           cd $out
           rm app/config/parameters.yml
-          ln -sf /run/keys/webapps/${environment}-piedsjaloux app/config/parameters.yml
+          ln -sf /var/secrets/webapps/${environment}-piedsjaloux app/config/parameters.yml
           rm -rf var/{logs,cache,data,miniatures,tmp}
           ln -sf ${varDir}/{logs,cache,data,miniatures,tmp} var/
           '';

diff --git a/nixops/modules/websites/tellesflorian/default.nix b/nixops/modules/websites/tellesflorian/default.nix
index 9bf4a48f4cfc3d782ca86fdb5acb5c08b4fadf8c..16d788fc7cfbe93474ab63cf7a9df75079248d80 100644 (file)
--- a/nixops/modules/websites/tellesflorian/default.nix
+++ b/nixops/modules/websites/tellesflorian/default.nix
@@ -16,7 +16,7 @@ in {
   };
 
   config = lib.mkIf cfg.integration.enable {
-    deployment.keys = tellesflorian_dev.keys;
+    mySecrets.keys = tellesflorian_dev.keys;
     security.acme.certs."eldiron".extraDomains."app.tellesflorian.com" = null;
     services.myPhpfpm.preStart.tellesflorian_dev = tellesflorian_dev.phpFpm.preStart;
     services.myPhpfpm.serviceDependencies.tellesflorian_dev = tellesflorian_dev.phpFpm.serviceDeps;

diff --git a/nixops/modules/websites/tellesflorian/tellesflorian.nix b/nixops/modules/websites/tellesflorian/tellesflorian.nix
index ba46c0c99c67f9167d4ab4cc876a89e19215ad3c..afd723c0936f8b0c388b1f72f634c2a760bd791c 100644 (file)
--- a/nixops/modules/websites/tellesflorian/tellesflorian.nix
+++ b/nixops/modules/websites/tellesflorian/tellesflorian.nix
@@ -3,14 +3,24 @@ let
   tellesflorian = { config }: rec {
     environment = config.environment;
     varDir = "/var/lib/tellesflorian_${environment}";
-    keys."${environment}-tellesflorian" = {
-      destDir = "/run/keys/webapps";
-      user = apache.user;
-      group = apache.group;
-      permissions = "0400";
-      text = ''
-        # This file is auto-generated during the composer install
-        parameters:
+    keys = [
+      {
+        dest = "webapps/${environment}-tellesflorian-passwords";
+        user = apache.user;
+        group = apache.group;
+        permissions = "0400";
+        text = ''
+          invite:${config.invite_passwords}
+        '';
+      }
+      {
+        dest = "webapps/${environment}-tellesflorian";
+        user = apache.user;
+        group = apache.group;
+        permissions = "0400";
+        text = ''
+          # This file is auto-generated during the composer install
+          parameters:
             database_host: ${config.mysql.host}
             database_port: ${config.mysql.port}
             database_name: ${config.mysql.name}
@@ -21,8 +31,9 @@ let
             mailer_user: null
             mailer_password: null
             secret: ${config.secret}
-      '';
-    };
+        '';
+      }
+    ];
     phpFpm = rec {
       preStart = ''
         if [ ! -f "${varDir}/currentWebappDir" -o \
@@ -33,14 +44,10 @@ let
           /run/wrappers/bin/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
           popd > /dev/null
           echo -n "${webappDir}" > ${varDir}/currentWebappDir
-          sha512sum /run/keys/webapps/${environment}-tellesflorian > ${varDir}/currentKey
+          sha512sum /var/secrets/webapps/${environment}-tellesflorian > ${varDir}/currentKey
         fi
         '';
-      serviceDeps = [
-        "mysql.service"
-        "${environment}-tellesflorian-passwords-key.service"
-        "${environment}-tellesflorian-key.service"
-      ];
+      serviceDeps = [ "mysql.service" ];
       socket = "/var/run/phpfpm/floriantelles-${environment}.sock";
       pool = ''
         listen = ${socket}
@@ -51,7 +58,7 @@ let
         php_admin_value[upload_max_filesize] = 20M
         php_admin_value[post_max_size] = 20M
         ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "/run/keys/webapps/${environment}-tellesflorian:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/var/secrets/webapps/${environment}-tellesflorian:${webappDir}:${varDir}:/tmp"
         php_admin_value[session.save_path] = "${varDir}/phpSessions"
         ${if environment == "dev" then ''
         pm = ondemand
@@ -66,15 +73,6 @@ let
         pm.max_spare_servers = 3
         ''}'';
     };
-    keys."${environment}-tellesflorian-passwords" = {
-      destDir = "/run/keys/webapps";
-      user = apache.user;
-      group = apache.group;
-      permissions = "0400";
-      text = ''
-        invite:${config.invite_passwords}
-      '';
-    };
     apache = rec {
       user = "wwwrun";
       group = "wwwrun";
@@ -92,7 +90,7 @@ let
         Use LDAPConnect
         Require ldap-group   cn=app.tellesflorian.com,cn=httpd,ou=services,dc=immae,dc=eu
 
-        AuthUserFile "/run/keys/webapps/${environment}-tellesflorian-passwords"
+        AuthUserFile "/var/secrets/webapps/${environment}-tellesflorian-passwords"
         Require user "invite"
 
         ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://tellesflorian.com\"></html>"
@@ -166,7 +164,7 @@ let
         postInstall = ''
           cd $out
           rm app/config/parameters.yml
-          ln -sf /run/keys/webapps/${environment}-tellesflorian app/config/parameters.yml
+          ln -sf /var/secrets/webapps/${environment}-tellesflorian app/config/parameters.yml
           rm -rf var/{logs,cache}
           ln -sf ${varDir}/var/{logs,cache,sessions} var/
           '';