From 6e23a06b9d5e0bdb21c737285e36dbe76b2d3ac1 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Isma=C3=ABl=20Bouya?= <ismael.bouya@normalesup.org>
Date: Tue, 16 Apr 2019 00:35:59 +0200
Subject: [PATCH] Move Ludivine Piedsjaloux and Florian's websites passwords to
 a secure location

Related issue: https://git.immae.eu/mantisbt/view.php?id=122
---
 nixops/modules/websites/ludivine/default.nix  |  2 ++
 .../websites/ludivine/ludivinecassal.nix      | 21 +++++++++++++---
 .../modules/websites/piedsjaloux/default.nix  |  2 ++
 .../websites/piedsjaloux/piedsjaloux.nix      | 13 +++++++---
 .../websites/tellesflorian/default.nix        |  1 +
 .../websites/tellesflorian/tellesflorian.nix  | 25 +++++++++++++------
 6 files changed, 49 insertions(+), 15 deletions(-)

diff --git a/nixops/modules/websites/ludivine/default.nix b/nixops/modules/websites/ludivine/default.nix
index 3dd0ee7..220f5c2 100644
--- a/nixops/modules/websites/ludivine/default.nix
+++ b/nixops/modules/websites/ludivine/default.nix
@@ -21,6 +21,7 @@ in {
 
   config = lib.mkMerge [
     (lib.mkIf cfg.production.enable {
+      deployment.keys = ludivinecassal_prod.keys;
       services.myWebsites.commons.stats.enable = true;
       services.myWebsites.commons.stats.sites = [
         {
@@ -51,6 +52,7 @@ in {
       };
     })
     (lib.mkIf cfg.integration.enable {
+      deployment.keys = ludivinecassal_dev.keys;
       security.acme.certs."eldiron".extraDomains."ludivine.immae.eu" = null;
 
       services.myPhpfpm.poolConfigs.ludivinecassal_dev = ludivinecassal_dev.phpFpm.pool;
diff --git a/nixops/modules/websites/ludivine/ludivinecassal.nix b/nixops/modules/websites/ludivine/ludivinecassal.nix
index 114c4ac..244b05e 100644
--- a/nixops/modules/websites/ludivine/ludivinecassal.nix
+++ b/nixops/modules/websites/ludivine/ludivinecassal.nix
@@ -3,8 +3,12 @@ let
   ludivinecassal = { config }: rec {
     environment = config.environment;
     varDir = "/var/lib/ludivinecassal_${environment}";
-    configRoot =
-      writeText "parameters.yml" ''
+    keys."${environment}-ludivinecassal" = {
+      destDir = "/run/keys/webapps";
+      user = apache.user;
+      group = apache.group;
+      permissions = "0700";
+      text = ''
         # This file is auto-generated during the composer install
         parameters:
             database_host: ${config.mysql.host}
@@ -34,6 +38,7 @@ let
             sass: ${sass}/bin/sass
             ruby: ${ruby}/bin/ruby
       '';
+    };
     phpFpm = rec {
       socket = "/var/run/phpfpm/ludivinecassal-${environment}.sock";
       pool = ''
@@ -45,7 +50,7 @@ let
         php_admin_value[upload_max_filesize] = 20M
         php_admin_value[post_max_size] = 20M
         ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "${configRoot}:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/run/keys/webapps/${environment}-ludivinecassal:${webappDir}:${varDir}:/tmp"
         php_admin_value[session.save_path] = "${varDir}/phpSessions"
         ${if environment == "dev" then ''
         pm = ondemand
@@ -151,7 +156,14 @@ let
         noDev = (environment == "prod");
         preInstall = ''
           export SYMFONY_ENV="${environment}"
-          ln -sf ${configRoot} app/config/parameters.yml
+          cp app/config/parameters.yml.dist app/config/parameters.yml
+          cat >> app/config/parameters.yml <<EOF
+          leapt_im:
+              binary_path: ${imagemagick}/bin
+          assetic:
+              sass: ${sass}/bin/sass
+              ruby: ${ruby}/bin/ruby
+          EOF
           sed -i -e "/Incenteev..ParameterHandler..ScriptHandler::buildParameters/d" composer.json
           '';
         # /!\ miniatures and data need to be in the same physical dir due to a
@@ -159,6 +171,7 @@ let
         postInstall = ''
           rm -rf var/{logs,cache,data,miniatures,tmp}
           ln -sf ${varDir}/{logs,cache,data,miniatures,tmp} var/
+          ln -sf /run/keys/webapps/${environment}-ludivinecassal app/config/parameters.yml
           '';
         buildInputs = [ sass ];
       });
diff --git a/nixops/modules/websites/piedsjaloux/default.nix b/nixops/modules/websites/piedsjaloux/default.nix
index 54e063d..1c6864c 100644
--- a/nixops/modules/websites/piedsjaloux/default.nix
+++ b/nixops/modules/websites/piedsjaloux/default.nix
@@ -25,6 +25,7 @@ in {
 
   config = lib.mkMerge [
     (lib.mkIf cfg.production.enable {
+      deployment.keys = piedsjaloux_prod.keys;
       services.myWebsites.commons.stats.enable = true;
       services.myWebsites.commons.stats.sites = [
         {
@@ -55,6 +56,7 @@ in {
       };
     })
     (lib.mkIf cfg.integration.enable {
+      deployment.keys = piedsjaloux_dev.keys;
       security.acme.certs."eldiron".extraDomains."piedsjaloux.immae.eu" = null;
       services.myPhpfpm.poolConfigs.piedsjaloux_dev = piedsjaloux_dev.phpFpm.pool;
       system.activationScripts.piedsjaloux_dev = piedsjaloux_dev.activationScript;
diff --git a/nixops/modules/websites/piedsjaloux/piedsjaloux.nix b/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
index bb17262..688b9fd 100644
--- a/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
+++ b/nixops/modules/websites/piedsjaloux/piedsjaloux.nix
@@ -3,8 +3,12 @@ let
   piedsjaloux = { config }: rec {
     environment = config.environment;
     varDir = "/var/lib/piedsjaloux_${environment}";
-    configRoot =
-      writeText "parameters.yml" ''
+    keys."${environment}-piedsjaloux" = {
+      destDir = "/run/keys/webapps";
+      user = apache.user;
+      group = apache.group;
+      permissions = "0700";
+      text = ''
         # This file is auto-generated during the composer install
         parameters:
             database_host: ${config.mysql.host}
@@ -22,6 +26,7 @@ let
         leapt_im:
             binary_path: ${imagemagick}/bin
       '';
+    };
     phpFpm = rec {
       socket = "/var/run/phpfpm/piedsjaloux-${environment}.sock";
       pool = ''
@@ -33,7 +38,7 @@ let
         php_admin_value[upload_max_filesize] = 20M
         php_admin_value[post_max_size] = 20M
         ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "${configRoot}:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/run/keys/webapps/${environment}-piedsjaloux:${webappDir}:${varDir}:/tmp"
         php_admin_value[session.save_path] = "${varDir}/phpSessions"
         env[PATH] = ${lib.makeBinPath [ pkgs.apg pkgs.unzip ]}
         ${if environment == "dev" then ''
@@ -146,7 +151,7 @@ let
         postInstall = ''
           cd $out
           rm app/config/parameters.yml
-          ln -sf ${configRoot} app/config/parameters.yml
+          ln -sf /run/keys/webapps/${environment}-piedsjaloux app/config/parameters.yml
           rm -rf var/{logs,cache,data,miniatures,tmp}
           ln -sf ${varDir}/{logs,cache,data,miniatures,tmp} var/
           '';
diff --git a/nixops/modules/websites/tellesflorian/default.nix b/nixops/modules/websites/tellesflorian/default.nix
index 389c491..97931b9 100644
--- a/nixops/modules/websites/tellesflorian/default.nix
+++ b/nixops/modules/websites/tellesflorian/default.nix
@@ -16,6 +16,7 @@ in {
   };
 
   config = lib.mkIf cfg.integration.enable {
+    deployment.keys = tellesflorian_dev.keys;
     security.acme.certs."eldiron".extraDomains."app.tellesflorian.com" = null;
     services.myPhpfpm.poolConfigs.tellesflorian_dev = tellesflorian_dev.phpFpm.pool;
     system.activationScripts.tellesflorian_dev = tellesflorian_dev.activationScript;
diff --git a/nixops/modules/websites/tellesflorian/tellesflorian.nix b/nixops/modules/websites/tellesflorian/tellesflorian.nix
index e421581..4c76a76 100644
--- a/nixops/modules/websites/tellesflorian/tellesflorian.nix
+++ b/nixops/modules/websites/tellesflorian/tellesflorian.nix
@@ -3,8 +3,12 @@ let
   tellesflorian = { config }: rec {
     environment = config.environment;
     varDir = "/var/lib/tellesflorian_${environment}";
-    configRoot =
-      writeText "parameters.yml" ''
+    keys."${environment}-tellesflorian" = {
+      destDir = "/run/keys/webapps";
+      user = apache.user;
+      group = apache.group;
+      permissions = "0700";
+      text = ''
         # This file is auto-generated during the composer install
         parameters:
             database_host: ${config.mysql.host}
@@ -18,6 +22,7 @@ let
             mailer_password: null
             secret: ${config.secret}
       '';
+    };
     phpFpm = rec {
       socket = "/var/run/phpfpm/floriantelles-${environment}.sock";
       pool = ''
@@ -29,7 +34,7 @@ let
         php_admin_value[upload_max_filesize] = 20M
         php_admin_value[post_max_size] = 20M
         ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "${configRoot}:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/run/keys/webapps/${environment}-tellesflorian:${webappDir}:${varDir}:/tmp"
         php_admin_value[session.save_path] = "${varDir}/phpSessions"
         ${if environment == "dev" then ''
         pm = ondemand
@@ -44,9 +49,15 @@ let
         pm.max_spare_servers = 3
         ''}'';
     };
-    passwords = writeText "tellesflorian_passwords" ''
-      invite:${config.invite_passwords}
+    keys."${environment}-tellesflorian-passwords" = {
+      destDir = "/run/keys/webapps";
+      user = apache.user;
+      group = apache.group;
+      permissions = "0700";
+      text = ''
+        invite:${config.invite_passwords}
       '';
+    };
     apache = rec {
       user = "wwwrun";
       group = "wwwrun";
@@ -64,7 +75,7 @@ let
         Use LDAPConnect
         Require ldap-group   cn=app.tellesflorian.com,cn=httpd,ou=services,dc=immae,dc=eu
 
-        AuthUserFile "${passwords}"
+        AuthUserFile "/run/keys/webapps/${environment}-tellesflorian-passwords"
         Require user "invite"
 
         ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://tellesflorian.com\"></html>"
@@ -145,7 +156,7 @@ let
         postInstall = ''
           cd $out
           rm app/config/parameters.yml
-          ln -sf ${configRoot} app/config/parameters.yml
+          ln -sf /run/keys/webapps/${environment}-tellesflorian app/config/parameters.yml
           rm -rf var/{logs,cache}
           ln -sf ${varDir}/var/{logs,cache,sessions} var/
           '';
-- 
2.41.0