Add Connexionswing

diff --git a/libs.nix b/libs.nix
index cef85869d513fba5227907955abe20eef49d60d0..c85808bbada8be51bf884495e2d8495f2eca95b4 100644 (file)
--- a/libs.nix
+++ b/libs.nix
@@ -27,5 +27,14 @@ in
       src = fetchgit json.git;
     };
 
+  fetchedGitPrivate = path:
+    let
+      json = lib.importJSON path;
+    in rec {
+      version = json.tag;
+      name = "${json.meta.name}-${version}";
+      src = fetchgitPrivate json.git;
+    };
+
   checkEnv = var: builtins.stringLength (builtins.getEnv var) > 0;
 }

diff --git a/virtual/connexionswing_master.json b/virtual/connexionswing_master.json
new file mode 100644 (file)
index 0000000..30c0c96
--- /dev/null
+++ b/virtual/connexionswing_master.json
@@ -0,0 +1,14 @@
+{
+  "tag": "0c9458f-master",
+  "meta": {
+    "name": "connexionswing_master",
+    "url": "gitolite@git.immae.eu:perso/Immae/Projets/Connexionswing",
+    "branch": "master"
+  },
+  "git": {
+    "url": "gitolite@git.immae.eu:perso/Immae/Projets/Connexionswing",
+    "rev": "0c9458fadbda05e1ffc54956162ee92ad4dd6aef",
+    "sha256": "04blmpfpb6j57m032vpddcn1775bwx537zvv7fi25ip2yg507fjv",
+    "fetchSubmodules": true
+  }
+}

diff --git a/virtual/eldiron.nix b/virtual/eldiron.nix
index fb366b7dffe0ed3826a8e72a2ce3b983d1961fd5..56c6afd318141de368caf4e371675ae067bb6a7e 100644 (file)
--- a/virtual/eldiron.nix
+++ b/virtual/eldiron.nix
@@ -49,6 +49,8 @@
         extraDomains = {
           "db-1.immae.eu" = null;
           "tools.immae.eu" = null;
+          "connexionswing.immae.eu" = null;
+          "sandetludo.immae.eu" = null;
         };
       };
     };
@@ -62,6 +64,7 @@
         '';
       poolConfigs = {
         adminer = mypkgs.adminer.phpFpm.pool;
+        connexionswing_dev = mypkgs.connexionswing_dev.phpFpm.pool;
         www = ''
           listen = /var/run/phpfpm/www.sock
           user = wwwrun
@@ -77,6 +80,10 @@
       };
     };
 
+    system.activationScripts = {
+      connexionswing_dev  = mypkgs.connexionswing_dev.activationScript;
+    };
+
     services.httpd = let
       withSSL = domain: {
         enableSSL = true;
@@ -92,6 +99,7 @@
       # FIXME: http2
       extraModules = pkgs.lib.lists.unique (
         mypkgs.adminer.apache.modules ++
+        mypkgs.connexionswing_dev.apache.modules ++
         [
           "macro"
           "ldap"
@@ -141,6 +149,15 @@
             mypkgs.ympd.apache.vhostConf
           ];
         })
+        (withSSL "eldiron" // {
+          listen = [ { ip = "*"; port = 443; } ];
+          hostName = "connexionswing.immae.eu";
+          serverAliases = [ "sandetludo.immae.eu" ];
+          documentRoot = mypkgs.connexionswing_dev.webRoot;
+          extraConfig = builtins.concatStringsSep "\n" [
+            mypkgs.connexionswing_dev.apache.vhostConf
+          ];
+        })
         { # Should go last, default fallback
           listen = [ { ip = "*"; port = 80; } ];
           hostName = "redirectSSL";

diff --git a/virtual/packages.nix b/virtual/packages.nix
index 05b0e88f3e89b2aa3b2f76ed42671b513cce3d51..cd98b79c3a6caebaa683084dd623987e8c9e1ec8 100644 (file)
--- a/virtual/packages.nix
+++ b/virtual/packages.nix
@@ -1,6 +1,159 @@
 with import ../libs.nix;
 with nixpkgs_unstable;
 let
+  connexionswing = { environment ? "dev" }: rec {
+    varDir = "/var/lib/connexionswing_${environment}";
+    envName= lib.strings.toUpper environment;
+    configRoot =
+      # FIXME: spool emails in prod for when immae.eu is down?
+      assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_PASSWORD";
+      assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_USER";
+      assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_NAME";
+      assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_SECRET";
+      assert checkEnv "NIXOPS_CONNEXIONSWING_${envName}_EMAIL";
+      pkgs.writeText "parameters.yml" ''
+        # This file is auto-generated during the composer install
+        parameters:
+            database_host: db-1.immae.eu
+            database_port: null
+            database_name: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_NAME"}
+            database_user: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_USER"}
+            database_password: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_MYSQL_PASSWORD"}
+            mailer_transport: smtp
+            mailer_host: mail.immae.eu
+            mailer_user: null
+            mailer_password: null
+            subscription_email: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_EMAIL"}
+            allow_robots: true
+            secret: ${builtins.getEnv "NIXOPS_CONNEXIONSWING_${envName}_SECRET"}
+      '';
+    phpFpm = rec {
+      socket = "/var/run/phpfpm/connexionswing-${environment}.sock";
+      pool = ''
+        listen = ${socket}
+        user = ${apache.user}
+        group = ${apache.group}
+        listen.owner = ${apache.user}
+        listen.group = ${apache.group}
+        php_admin_value[upload_max_filesize] = 20M
+        php_admin_value[post_max_size] = 20M
+        ;php_admin_flag[log_errors] = on
+        php_admin_value[open_basedir] = "${configRoot}:${webappDir}:${varDir}:/tmp"
+        ${if environment == "dev" then ''
+        pm = ondemand
+        pm.max_children = 5
+        pm.process_idle_timeout = 60
+        env[SYMFONY_DEBUG_MODE] = "yes"
+        '' else ''
+        pm = dynamic
+        pm.max_children = 20
+        pm.start_servers = 2
+        pm.min_spare_servers = 1
+        pm.max_spare_servers = 3
+        ''}'';
+    };
+    apache = {
+      user = "wwwrun";
+      group = "wwwrun";
+      modules = [ "proxy_fcgi" ];
+      vhostConf = ''
+      <FilesMatch "\.php$">
+        SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+      </FilesMatch>
+
+      ${if environment == "dev" then ''
+      <Location />
+        Use LDAPConnect
+        Require ldap-group   cn=connexionswing.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
+        ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://connexionswing.com\"></html>"
+      </Location>
+
+      <Directory ${webRoot}>
+        Options Indexes FollowSymLinks MultiViews Includes
+        AllowOverride None
+        Require all granted
+
+        DirectoryIndex app_dev.php
+
+        <IfModule mod_negotiation.c>
+        Options -MultiViews
+        </IfModule>
+
+        <IfModule mod_rewrite.c>
+          RewriteEngine On
+
+          RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
+          RewriteRule ^(.*) - [E=BASE:%1]
+
+          # Maintenance script
+          RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
+          RewriteCond %{SCRIPT_FILENAME} !maintenance.php
+          RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
+          ErrorDocument 503 /maintenance.php
+
+          # Sets the HTTP_AUTHORIZATION header removed by Apache
+          RewriteCond %{HTTP:Authorization} .
+          RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
+
+          RewriteCond %{ENV:REDIRECT_STATUS} ^$
+          RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
+
+          # If the requested filename exists, simply serve it.
+          # We only want to let Apache serve files and not directories.
+          RewriteCond %{REQUEST_FILENAME} -f
+          RewriteRule ^ - [L]
+
+          # Rewrite all other queries to the front controller.
+          RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
+        </IfModule>
+
+      </Directory>
+      '' else ""}
+      '';
+    };
+    activationScript = {
+      deps = [ "wrappers" ];
+      text = ''
+      install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir} \
+        ${varDir}/medias \
+        ${varDir}/uploads \
+        ${varDir}/var
+      if [ ! -f "${varDir}/currentWebappDir" -o \
+          "${webappDir}" != "$(cat ${varDir}/currentWebappDir 2>/dev/null)" ]; then
+        pushd ${webappDir} > /dev/null
+        $wrapperDir/sudo -u wwwrun ./bin/console --env=${environment} cache:clear --no-warmup
+        popd > /dev/null
+        echo -n "${webappDir}" > ${varDir}/currentWebappDir
+      fi
+      '';
+    };
+    webappDir = pkgs.stdenv.mkDerivation (fetchedGitPrivate ./connexionswing_master.json // rec {
+      # FIXME: can we do better than symlink?
+      # FIXME: imagick optional
+      # FIXME: initial sync
+      buildPhase = ''
+        export GIT_SSL_CAINFO=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+        export SSL_CERT_FILE=${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt
+
+        ln -sf ../../../../../${varDir}/{medias,uploads} web/images/
+        ln -sf ${configRoot} app/config/parameters.yml
+        ${if environment == "dev" then "php bin/composer install" else ''
+        SYMFONY_ENV=prod php bin/composer install --no-dev
+        ./bin/console assetic:dump --env=prod --no-debug
+        ''}
+        rm -rf var
+        ln -sf ../../../../../${varDir}/var var
+        '';
+      installPhase = ''
+        cp -a . $out
+        '';
+      buildInputs = [
+        pkgs.php pkgs.git pkgs.cacert
+      ];
+    });
+    webRoot = "${webappDir}/web";
+  };
+
   adminer = rec {
     webRoot = pkgs.stdenv.mkDerivation rec {
       version = "4.7.0";
@@ -91,4 +244,6 @@ in
   {
     inherit adminer;
     inherit ympd;
+    connexionswing_dev  = connexionswing { environment = "dev"; };
+    connexionswing_prod = connexionswing { environment = "prod"; };
   }