From 423c3f1caefdf5f125a2acf7456b5ca0273cee4b Mon Sep 17 00:00:00 2001 From: =?utf8?q?Isma=C3=ABl=20Bouya?= Date: Sat, 11 Jan 2020 15:34:31 +0100 Subject: [PATCH] Add iridologie via spip --- modules/private/environment.nix | 12 ++- .../websites/isabelle/config/chmod.php | 4 + .../websites/isabelle/config/connect.php | 15 +++ .../private/websites/isabelle/config/ldap.php | 9 ++ .../private/websites/isabelle/iridologie.nix | 76 +++++++------- .../websites/isabelle/spip_builder.nix | 99 +++++++++++++++++++ pkgs/private/webapps/default.nix | 1 + pkgs/private/webapps/iridologie/default.nix | 15 +++ .../webapps/iridologie/iridologie.json | 13 +++ pkgs/webapps/spip/default.nix | 4 +- 10 files changed, 202 insertions(+), 46 deletions(-) create mode 100644 modules/private/websites/isabelle/config/chmod.php create mode 100644 modules/private/websites/isabelle/config/connect.php create mode 100644 modules/private/websites/isabelle/config/ldap.php create mode 100644 modules/private/websites/isabelle/spip_builder.nix create mode 100644 pkgs/private/webapps/iridologie/default.nix create mode 100644 pkgs/private/webapps/iridologie/iridologie.json diff --git a/modules/private/environment.nix b/modules/private/environment.nix index 98d50b1..50f153a 100644 --- a/modules/private/environment.nix +++ b/modules/private/environment.nix @@ -1005,6 +1005,16 @@ in options = { aten_production = atenSubmodule; aten_integration = atenSubmodule; + iridologie = mkOption { + description = "environment configuration"; + type = submodule { + options = { + environment = mkOption { type = str; description = "SPIP environment"; }; + mysql = mkMysqlOptions "Iridologie" {}; + ldap = mkLdapOptions "Iridologie" {}; + }; + }; + }; }; }; }; @@ -1016,7 +1026,7 @@ in description = "environment configuration"; type = submodule { options = { - environment = mkOption { type = str; description = "Symfony environment"; }; + environment = mkOption { type = str; description = "SPIP environment"; }; mysql = mkMysqlOptions "Chloe" {}; ldap = mkLdapOptions "Chloe" {}; }; diff --git a/modules/private/websites/isabelle/config/chmod.php b/modules/private/websites/isabelle/config/chmod.php new file mode 100644 index 0000000..aae16cd --- /dev/null +++ b/modules/private/websites/isabelle/config/chmod.php @@ -0,0 +1,4 @@ + \ No newline at end of file diff --git a/modules/private/websites/isabelle/config/connect.php b/modules/private/websites/isabelle/config/connect.php new file mode 100644 index 0000000..18b0933 --- /dev/null +++ b/modules/private/websites/isabelle/config/connect.php @@ -0,0 +1,15 @@ + diff --git a/modules/private/websites/isabelle/config/ldap.php b/modules/private/websites/isabelle/config/ldap.php new file mode 100644 index 0000000..825b7ed --- /dev/null +++ b/modules/private/websites/isabelle/config/ldap.php @@ -0,0 +1,9 @@ + array('sAMAccountName','uid','login','userid','cn','sn'),'nom' => 'cn','email' => 'mail','bio' => 'description',); +$GLOBALS['ldap_search'] = getenv("SPIP_LDAP_SEARCH"); +?> diff --git a/modules/private/websites/isabelle/iridologie.nix b/modules/private/websites/isabelle/iridologie.nix index cb4e300..460bd2a 100644 --- a/modules/private/websites/isabelle/iridologie.nix +++ b/modules/private/websites/isabelle/iridologie.nix @@ -1,59 +1,49 @@ -{ lib, config, ... }: +{ lib, pkgs, config, ... }: let + iridologie = pkgs.callPackage ./spip_builder.nix { + inherit (pkgs.webapps) iridologie; + config = config.myEnv.websites.isabelle.iridologie; + apacheUser = config.services.httpd.Prod.user; + apacheGroup = config.services.httpd.Prod.group; + }; + cfg = config.myServices.websites.isabelle.iridologie; - varDir = "/var/lib/ftp/isabelle"; in { options.myServices.websites.isabelle.iridologie.enable = lib.mkEnableOption "enable Iridologie's website"; config = lib.mkIf cfg.enable { + services.duplyBackup.profiles.iridologie_prod.rootDir = iridologie.app.varDir; + secrets.keys = iridologie.keys; services.webstats.sites = [ { name = "iridologie.icommandeur.org"; } ]; - system.activationScripts.iridologie = { - deps = [ "httpd" ]; - text = '' - install -m 0755 -o wwwrun -g wwwrun -d /var/lib/php/sessions/iridologie - ''; - }; - services.phpfpm.pools.iridologie = { - listen = "/run/phpfpm/iridologie.sock"; - extraConfig = '' - user = wwwrun - group = wwwrun - listen.owner = wwwrun - listen.group = wwwrun - - pm = ondemand - pm.max_children = 5 - pm.process_idle_timeout = 60 - php_admin_value[open_basedir] = "/var/lib/php/sessions/iridologie:${varDir}:/tmp" - php_admin_value[session.save_path] = "/var/lib/php/sessions/iridologie" - ''; + systemd.services.phpfpm-iridologie.after = lib.mkAfter iridologie.phpFpm.serviceDeps; + systemd.services.phpfpm-iridologie.wants = iridologie.phpFpm.serviceDeps; + services.phpfpm.pools.iridologie = { + listen = iridologie.phpFpm.socket; + extraConfig = iridologie.phpFpm.pool; + phpOptions = config.services.phpfpm.phpOptions + '' + extension=${pkgs.php}/lib/php/extensions/mysqli.so + ''; }; - services.websites.env.production.modules = [ "proxy_fcgi" ]; + system.activationScripts.iridologie = iridologie.activationScript; + myServices.websites.webappDirs."${iridologie.apache.webappName}" = iridologie.app.webRoot; + services.websites.env.production.modules = iridologie.apache.modules; services.websites.env.production.vhostConfs.iridologie = { - certName = "aten"; - addToCerts = true; - hosts = [ "iridologie.icommandeur.org" "icommandeur.org" "www.icommandeur.org" ]; - root = varDir; - extraConfig = [ + certName = "aten"; + addToCerts = true; + hosts = [ "iridologie.icommandeur.org" "icommandeur.org" "www.icommandeur.org" ]; + root = iridologie.apache.root; + extraConfig = [ '' - Use Stats iridologie.icommandeur.org - RewriteEngine On - RewriteCond "%{HTTP_HOST}" "!^iridologie\.icommandeur\.org$" [NC] - RewriteRule ^(.+)$ https://iridologie.icommandeur.org$1 [R=302,L] - - - SetHandler "proxy:unix:/run/phpfpm/iridologie.sock|fcgi://localhost" - - - - DirectoryIndex index.php index.htm index.html - AllowOverride All - Require all granted - + RewriteEngine On + RewriteCond "%{HTTP_HOST}" "!^iridologie\.icommandeur\.org$" [NC] + RewriteRule ^(.+)$ https://iridologie.icommandeur.org$1 [R=302,L] '' + iridologie.apache.vhostConf ]; }; + services.websites.env.production.watchPaths = [ + "/var/secrets/webapps/${iridologie.app.environment}-iridologie" + ]; }; } - diff --git a/modules/private/websites/isabelle/spip_builder.nix b/modules/private/websites/isabelle/spip_builder.nix new file mode 100644 index 0000000..2ab5394 --- /dev/null +++ b/modules/private/websites/isabelle/spip_builder.nix @@ -0,0 +1,99 @@ +{ apacheUser, apacheGroup, iridologie, config }: +rec { + app = iridologie.override { inherit (config) environment; }; + phpFpm = rec { + serviceDeps = [ "mysql.service" ]; + socket = "/var/run/phpfpm/iridologie-${app.environment}.sock"; + pool = '' + user = ${apacheUser} + group = ${apacheGroup} + listen.owner = ${apacheUser} + listen.group = ${apacheGroup} + php_admin_value[upload_max_filesize] = 20M + php_admin_value[post_max_size] = 20M + ;php_admin_flag[log_errors] = on + php_admin_value[open_basedir] = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp" + php_admin_value[session.save_path] = "${app.varDir}/phpSessions" + ${if app.environment == "dev" then '' + pm = ondemand + pm.max_children = 5 + pm.process_idle_timeout = 60 + '' else '' + pm = dynamic + pm.max_children = 20 + pm.start_servers = 2 + pm.min_spare_servers = 1 + pm.max_spare_servers = 3 + ''}''; + }; + keys = [{ + dest = "webapps/${app.environment}-iridologie"; + user = apacheUser; + group = apacheGroup; + permissions = "0400"; + text = '' + SetEnv SPIP_CONFIG_DIR "${configDir}" + SetEnv SPIP_VAR_DIR "${app.varDir}" + SetEnv SPIP_SITE "iridologie-${app.environment}" + SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu" + SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu" + SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}" + SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}" + SetEnv SPIP_LDAP_SEARCH "${config.ldap.filter}" + SetEnv SPIP_MYSQL_HOST "${config.mysql.host}" + SetEnv SPIP_MYSQL_PORT "${config.mysql.port}" + SetEnv SPIP_MYSQL_DB "${config.mysql.database}" + SetEnv SPIP_MYSQL_USER "${config.mysql.user}" + SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}" + ''; + }]; + apache = rec { + modules = [ "proxy_fcgi" ]; + webappName = "iridologie_${app.environment}"; + root = "/run/current-system/webapps/${webappName}"; + vhostConf = '' + Include /var/secrets/webapps/${app.environment}-iridologie + + RewriteEngine On + + + SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost" + + + + DirectoryIndex index.php index.htm index.html + Options -Indexes +FollowSymLinks +MultiViews +Includes + Include ${root}/htaccess.txt + + AllowOverride AuthConfig FileInfo Limit + Require all granted + + + + Require all denied + + + + Require all denied + + + ${if app.environment == "dev" then '' + + Use LDAPConnect + Require ldap-group cn=isabelle.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu + ErrorDocument 401 "" + + '' else '' + Use Stats iridologie.icommandeur.org + ''} + ''; + }; + activationScript = { + deps = [ "wrappers" ]; + text = '' + install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local + install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions + ''; + }; + configDir = ./config; +} diff --git a/pkgs/private/webapps/default.nix b/pkgs/private/webapps/default.nix index e9aa13c..12b690b 100644 --- a/pkgs/private/webapps/default.nix +++ b/pkgs/private/webapps/default.nix @@ -4,6 +4,7 @@ rec { aten = callPackage ./aten { inherit composerEnv mylibs; }; chloe = callPackage ./chloe { inherit mylibs spip; }; + iridologie = callPackage ./iridologie { inherit mylibs spip; }; connexionswing = callPackage ./connexionswing { inherit composerEnv mylibs;}; ludivinecassal = callPackage ./ludivinecassal { inherit composerEnv mylibs; }; piedsjaloux = callPackage ./piedsjaloux { inherit composerEnv mylibs; }; diff --git a/pkgs/private/webapps/iridologie/default.nix b/pkgs/private/webapps/iridologie/default.nix new file mode 100644 index 0000000..8e05736 --- /dev/null +++ b/pkgs/private/webapps/iridologie/default.nix @@ -0,0 +1,15 @@ +{ environment ? "prod" +, varDir ? "/var/lib/iridologie_${environment}" +, spip, stdenv, mylibs, sassc }: +let + siteDir = stdenv.mkDerivation (mylibs.fetchedGitPrivate ./iridologie.json // rec { + installPhase = '' + cp -a . $out + ''; + }); +in +spip.override { + ldap = true; + siteName = "iridologie"; + inherit environment siteDir; +} diff --git a/pkgs/private/webapps/iridologie/iridologie.json b/pkgs/private/webapps/iridologie/iridologie.json new file mode 100644 index 0000000..cf3b0aa --- /dev/null +++ b/pkgs/private/webapps/iridologie/iridologie.json @@ -0,0 +1,13 @@ +{ + "tag": "01bd963-master", + "meta": { + "name": "iridologie", + "url": "ssh://gitolite@git.immae.eu/perso/Immae/Sites/Iridologie", + "branch": "master" + }, + "git": { + "url": "ssh://gitolite@git.immae.eu/perso/Immae/Sites/Iridologie", + "rev": "01bd96345b523e4e6469fdbbb675abd3e7f4662f", + "fetchSubmodules": true + } +} diff --git a/pkgs/webapps/spip/default.nix b/pkgs/webapps/spip/default.nix index 8099f53..20d5c8c 100644 --- a/pkgs/webapps/spip/default.nix +++ b/pkgs/webapps/spip/default.nix @@ -7,10 +7,10 @@ let app = stdenv.mkDerivation rec { name = "${siteName}-${environment}-spip-${version}"; - version = "3.2.3"; + version = "3.2.7"; src = fetchzip { url = "https://files.spip.net/spip/archives/SPIP-v${version}.zip"; - sha256 = "1r1mjvsnrp6mvkgjakvi3x4ms8m8k5mp93micbbg8r99fj7qlfkq"; + sha256 = "0n4kc95nhn524zbb11bpfjs965pm4v026s3m3q44pl8nyms91r33"; }; paches = lib.optionals ldap [ ./spip_ldap_patch.patch ]; buildPhase = '' -- 2.41.0