Add Florian's website

diff --git a/virtual/modules/certificates.nix b/virtual/modules/certificates.nix
index 1a630350b0d7b34b301ecbd3c18b3b7fc03f9cc3..78665a7488ad5bacabe1a7fa38603c37f89508c0 100644 (file)
--- a/virtual/modules/certificates.nix
+++ b/virtual/modules/certificates.nix
@@ -6,7 +6,7 @@
         webroot = "/var/lib/acme/acme-challenge";
         email = "ismael@bouya.org";
         postRun = ''
-          systemctl reload httpd.service
+          systemctl reload httpd.service httpdInte.service httpdProd.service
         '';
         plugins = [ "cert.pem" "chain.pem" "fullchain.pem" "full.pem" "key.pem" "account_key.json" ];
       };

diff --git a/virtual/modules/websites/default.nix b/virtual/modules/websites/default.nix
index d88f57149f138c18e6ba47e89ccb14c711336b2e..0ea7029ad24377d29842530efbe92b3934814090 100644 (file)
--- a/virtual/modules/websites/default.nix
+++ b/virtual/modules/websites/default.nix
@@ -91,6 +91,7 @@ in
     ./aten
     ./piedsjaloux
     ./connexionswing
+    ./tellesflorian
     ./tools/db
     ./tools/tools
     ./tools/dav
@@ -181,6 +182,7 @@ in
     services.myWebsites.Aten.integration.enable = cfg.integration.enable;
     services.myWebsites.PiedsJaloux.integration.enable = cfg.integration.enable;
     services.myWebsites.Connexionswing.integration.enable = cfg.integration.enable;
+    services.myWebsites.TellesFlorian.integration.enable = true;
 
     services.myWebsites.apacheConfig = {
       gzip = {

diff --git a/virtual/modules/websites/tellesflorian/default.nix b/virtual/modules/websites/tellesflorian/default.nix
new file mode 100644 (file)
index 0000000..8f8c35a
--- /dev/null
+++ b/virtual/modules/websites/tellesflorian/default.nix
@@ -0,0 +1,31 @@
+{ lib, pkgs, config, mylibs, ... }:
+let
+    adminer = pkgs.callPackage ../commons/adminer.nix {};
+
+    tellesflorian = pkgs.callPackage ./tellesflorian.nix { inherit (mylibs) checkEnv fetchedGitPrivate; };
+    tellesflorian_dev  = tellesflorian { environment = "dev"; };
+
+    cfg = config.services.myWebsites.TellesFlorian;
+in {
+  options.services.myWebsites.TellesFlorian = {
+    integration = {
+      enable = lib.mkEnableOption "enable Florian Telles's website in integration";
+    };
+  };
+
+  config = lib.mkIf cfg.integration.enable {
+    security.acme.certs."eldiron".extraDomains."app.tellesflorian.com" = null;
+    services.myPhpfpm.poolConfigs.tellesflorian_dev = tellesflorian_dev.phpFpm.pool;
+    system.activationScripts.tellesflorian_dev = tellesflorian_dev.activationScript;
+    services.myWebsites.integration.modules = adminer.apache.modules ++ tellesflorian_dev.apache.modules;
+    services.myWebsites.integration.vhostConfs.tellesflorian = {
+      certName    = "eldiron";
+      hosts       = ["app.tellesflorian.com" ];
+      root        = tellesflorian_dev.webRoot;
+      extraConfig = [
+        tellesflorian_dev.apache.vhostConf
+        adminer.apache.vhostConf
+      ];
+    };
+  };
+}

diff --git a/virtual/modules/websites/tellesflorian/tellesflorian.json b/virtual/modules/websites/tellesflorian/tellesflorian.json
new file mode 100644 (file)
index 0000000..81b42af
--- /dev/null
+++ b/virtual/modules/websites/tellesflorian/tellesflorian.json
@@ -0,0 +1,14 @@
+{
+  "tag": "1793d5c-master",
+  "meta": {
+    "name": "tellesflorian",
+    "url": "gitolite@git.immae.eu:perso/florian_telles/stabilo",
+    "branch": "master"
+  },
+  "git": {
+    "url": "gitolite@git.immae.eu:perso/florian_telles/stabilo",
+    "rev": "1793d5c7912d1b20ad1df1ac59be9d7f1220e919",
+    "sha256": "1zhxcrbglbjb6xfr8sfm4m2miabbkkb0a7543va3b5akrn6yk0cb",
+    "fetchSubmodules": true
+  }
+}

diff --git a/virtual/modules/websites/tellesflorian/tellesflorian.nix b/virtual/modules/websites/tellesflorian/tellesflorian.nix
new file mode 100644 (file)
index 0000000..b6b9d4e
--- /dev/null
+++ b/virtual/modules/websites/tellesflorian/tellesflorian.nix
@@ -0,0 +1,171 @@
+{ lib, checkEnv, writeText, fetchedGitPrivate, stdenv, php, git, cacert, phpPackages }:
+let
+  tellesflorian = { environment ? "dev" }: rec {
+    varPrefix = "TELLESFLORIAN";
+    varDir = "/var/lib/tellesflorian_${environment}";
+    envName= lib.strings.toUpper environment;
+    configRoot =
+      # FIXME: spool emails in prod for when immae.eu is down?
+      assert checkEnv "NIXOPS_${varPrefix}_${envName}_MYSQL_PASSWORD";
+      assert checkEnv "NIXOPS_${varPrefix}_${envName}_MYSQL_USER";
+      assert checkEnv "NIXOPS_${varPrefix}_${envName}_MYSQL_NAME";
+      assert checkEnv "NIXOPS_${varPrefix}_${envName}_SECRET";
+      writeText "parameters.yml" ''
+        # This file is auto-generated during the composer install
+        parameters:
+            database_host: db-1.immae.eu
+            database_port: null
+            database_name: ${builtins.getEnv "NIXOPS_${varPrefix}_${envName}_MYSQL_NAME"}
+            database_user: ${builtins.getEnv "NIXOPS_${varPrefix}_${envName}_MYSQL_USER"}
+            database_password: ${builtins.getEnv "NIXOPS_${varPrefix}_${envName}_MYSQL_PASSWORD"}
+            mailer_transport: smtp
+            mailer_host: mail.immae.eu
+            mailer_user: null
+            mailer_password: null
+            secret: ${builtins.getEnv "NIXOPS_${varPrefix}_${envName}_SECRET"}
+      '';
+    phpFpm = rec {
+      socket = "/var/run/phpfpm/floriantelles-${environment}.sock";
+      pool = ''
+        listen = ${socket}
+        user = ${apache.user}
+        group = ${apache.group}
+        listen.owner = ${apache.user}
+        listen.group = ${apache.group}
+        php_admin_value[upload_max_filesize] = 20M
+        php_admin_value[post_max_size] = 20M
+        ;php_admin_flag[log_errors] = on
+        php_admin_value[open_basedir] = "${configRoot}:${webappDir}:${varDir}:/tmp"
+        php_admin_value[session.save_path] = "${varDir}/phpSessions"
+        ${if environment == "dev" then ''
+        pm = ondemand
+        pm.max_children = 5
+        pm.process_idle_timeout = 60
+        env[SYMFONY_DEBUG_MODE] = "yes"
+        '' else ''
+        pm = dynamic
+        pm.max_children = 20
+        pm.start_servers = 2
+        pm.min_spare_servers = 1
+        pm.max_spare_servers = 3
+        ''}'';
+    };
+    passwords =
+      assert checkEnv "NIXOPS_${varPrefix}_${envName}_INVITE_PASSWORDS";
+      writeText "tellesflorian_passwords" ''
+      invite:${builtins.getEnv "NIXOPS_${varPrefix}_${envName}_INVITE_PASSWORDS"}
+      '';
+    apache = {
+      user = "wwwrun";
+      group = "wwwrun";
+      modules = [ "proxy_fcgi" ];
+      vhostConf = ''
+      <FilesMatch "\.php$">
+        SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+      </FilesMatch>
+
+      ${if environment == "dev" then ''
+      <Location />
+        AuthBasicProvider file ldap
+        Use LDAPConnect
+        Require ldap-group   cn=app.tellesflorian.com,cn=httpd,ou=services,dc=immae,dc=eu
+
+        AuthUserFile "${passwords}"
+        Require user "invite"
+
+        ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://tellesflorian.com\"></html>"
+      </Location>
+
+      <Directory ${webRoot}>
+        Options Indexes FollowSymLinks MultiViews Includes
+        AllowOverride None
+        Require all granted
+
+        DirectoryIndex app_dev.php
+
+        <IfModule mod_negotiation.c>
+        Options -MultiViews
+        </IfModule>
+
+        <IfModule mod_rewrite.c>
+          RewriteEngine On
+
+          RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
+          RewriteRule ^(.*) - [E=BASE:%1]
+
+          # Maintenance script
+          RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
+          RewriteCond %{SCRIPT_FILENAME} !maintenance.php
+          RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
+          ErrorDocument 503 /maintenance.php
+
+          # Sets the HTTP_AUTHORIZATION header removed by Apache
+          RewriteCond %{HTTP:Authorization} .
+          RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
+
+          RewriteCond %{ENV:REDIRECT_STATUS} ^$
+          RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
+
+          # If the requested filename exists, simply serve it.
+          # We only want to let Apache serve files and not directories.
+          RewriteCond %{REQUEST_FILENAME} -f
+          RewriteRule ^ - [L]
+
+          # Rewrite all other queries to the front controller.
+          RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
+        </IfModule>
+
+      </Directory>
+      '' else ''
+      <Directory ${webRoot}>
+        Options Indexes FollowSymLinks MultiViews Includes
+        AllowOverride All
+        Require all granted
+      </Directory>
+      ''}
+      '';
+    };
+    activationScript = {
+      deps = [ "wrappers" ];
+      text = ''
+      install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir} \
+        ${varDir}/var
+      install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
+      if [ ! -f "${varDir}/currentWebappDir" -o \
+          "${webappDir}" != "$(cat ${varDir}/currentWebappDir 2>/dev/null)" ]; then
+        pushd ${webappDir} > /dev/null
+        $wrapperDir/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
+        popd > /dev/null
+        echo -n "${webappDir}" > ${varDir}/currentWebappDir
+      fi
+      '';
+    };
+    webappDir = stdenv.mkDerivation (fetchedGitPrivate ./tellesflorian.json // rec {
+      # FIXME: can we do better than symlink?
+      # FIXME: initial sync
+      # FIXME: backup
+      buildPhase = ''
+        export GIT_SSL_CAINFO=${cacert}/etc/ssl/certs/ca-bundle.crt
+        export SSL_CERT_FILE=${cacert}/etc/ssl/certs/ca-bundle.crt
+
+        ln -sf ${configRoot} app/config/parameters.yml
+        sed -i -e "/Incenteev..ParameterHandler..ScriptHandler::buildParameters/d" composer.json
+        ${if environment == "dev" then ''
+          composer install
+        '' else ''
+          SYMFONY_ENV=prod composer install --no-dev
+        ''}
+        rm -rf var
+        ln -sf ../../../../../${varDir}/var var
+        '';
+      installPhase = ''
+        cp -a . $out
+        '';
+      buildInputs = [
+        php git cacert phpPackages.composer
+      ];
+    });
+    webRoot = "${webappDir}/web";
+  };
+in
+  tellesflorian