From b7d2d4e3da7da83bc7f133acaa216375890592b1 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Isma=C3=ABl=20Bouya?= <ismael.bouya@normalesup.org>
Date: Wed, 17 Apr 2019 10:23:47 +0200
Subject: [PATCH] Cleanup php session directories

---
 nixops/modules/websites/commons/adminer.nix             | 3 ++-
 nixops/modules/websites/default.nix                     | 2 ++
 nixops/modules/websites/tools/dav/davical.nix           | 2 +-
 nixops/modules/websites/tools/git/mantisbt/mantisbt.nix | 2 +-
 nixops/modules/websites/tools/tools/default.nix         | 4 +++-
 nixops/modules/websites/tools/tools/ldap.nix            | 3 ++-
 nixops/modules/websites/tools/tools/yourls.nix          | 2 +-
 7 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/nixops/modules/websites/commons/adminer.nix b/nixops/modules/websites/commons/adminer.nix
index 9c4e132..ab789b3 100644
--- a/nixops/modules/websites/commons/adminer.nix
+++ b/nixops/modules/websites/commons/adminer.nix
@@ -28,8 +28,9 @@ let
         ;php_admin_flag[log_errors] = on
         ; Needed to avoid clashes in browser cookies (same domain)
         php_value[session.name] = AdminerPHPSESSID
-        php_admin_value[open_basedir] = "${webRoot}:/tmp"
+        php_admin_value[open_basedir] = "${webRoot}:/tmp:/var/lib/php/sessions/adminer:/var/lib/php/tmp/adminer"
         php_admin_value[session.save_path] = "/var/lib/php/sessions/adminer"
+        php_admin_value[upload_tmp_dir] = "/var/lib/php/tmp/adminer"
         '';
     };
     apache = rec {
diff --git a/nixops/modules/websites/default.nix b/nixops/modules/websites/default.nix
index cd2b38a..927243b 100644
--- a/nixops/modules/websites/default.nix
+++ b/nixops/modules/websites/default.nix
@@ -406,8 +406,10 @@ in
         install -d -m 0755 /var/lib/acme/acme-challenge
         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions
         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/adminer
+        install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/tmp/adminer
         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/mantisbt
         install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/davical
+        install -d -m 0750 -o wwwrun -g wwwrun /var/lib/php/sessions/phpldapadmin
         '';
     };
 
diff --git a/nixops/modules/websites/tools/dav/davical.nix b/nixops/modules/websites/tools/dav/davical.nix
index 32f5483..89ba568 100644
--- a/nixops/modules/websites/tools/dav/davical.nix
+++ b/nixops/modules/websites/tools/dav/davical.nix
@@ -154,7 +154,7 @@ let
 
         ; Needed to avoid clashes in browser cookies (same domain)
         php_value[session.name] = DavicalPHPSESSID
-        php_admin_value[open_basedir] = "${basedir}:/tmp"
+        php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/davical"
         php_admin_value[include_path] = "${awl}/inc:${webapp}/inc"
         php_admin_value[session.save_path] = "/var/lib/php/sessions/davical"
         php_flag[magic_quotes_gpc] = Off
diff --git a/nixops/modules/websites/tools/git/mantisbt/mantisbt.nix b/nixops/modules/websites/tools/git/mantisbt/mantisbt.nix
index 2c7422d..b564058 100644
--- a/nixops/modules/websites/tools/git/mantisbt/mantisbt.nix
+++ b/nixops/modules/websites/tools/git/mantisbt/mantisbt.nix
@@ -119,7 +119,7 @@ let
 
         php_admin_value[upload_max_filesize] = 5000000
 
-        php_admin_value[open_basedir] = "${basedir}:/tmp"
+        php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/mantisbt"
         php_admin_value[session.save_path] = "/var/lib/php/sessions/mantisbt"
         '';
     };
diff --git a/nixops/modules/websites/tools/tools/default.nix b/nixops/modules/websites/tools/tools/default.nix
index f51510f..2f34d27 100644
--- a/nixops/modules/websites/tools/tools/default.nix
+++ b/nixops/modules/websites/tools/tools/default.nix
@@ -150,7 +150,9 @@ in {
       yourls = yourls.phpFpm.serviceDeps;
     };
 
-    services.myPhpfpm.poolPhpConfigs.roundcubemail = roundcubemail.phpFpm.phpConfig;
+    services.myPhpfpm.poolPhpConfigs = {
+      roundcubemail = roundcubemail.phpFpm.phpConfig;
+    };
     services.myPhpfpm.poolConfigs = {
       adminer = adminer.phpFpm.pool;
       ttrss = ttrss.phpFpm.pool;
diff --git a/nixops/modules/websites/tools/tools/ldap.nix b/nixops/modules/websites/tools/tools/ldap.nix
index 008dffe..623adb5 100644
--- a/nixops/modules/websites/tools/tools/ldap.nix
+++ b/nixops/modules/websites/tools/tools/ldap.nix
@@ -83,7 +83,8 @@ rec {
 
       ; Needed to avoid clashes in browser cookies (same domain)
       php_value[session.name] = LdapPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
+      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/phpldapadmin"
+      php_admin_value[session.save_path] = "/var/lib/php/sessions/phpldapadmin"
       '';
   };
 }
diff --git a/nixops/modules/websites/tools/tools/yourls.nix b/nixops/modules/websites/tools/tools/yourls.nix
index e82856f..390dabe 100644
--- a/nixops/modules/websites/tools/tools/yourls.nix
+++ b/nixops/modules/websites/tools/tools/yourls.nix
@@ -102,7 +102,7 @@ let
 
         ; Needed to avoid clashes in browser cookies (same domain)
         php_value[session.name] = YourlsPHPSESSID
-        php_admin_value[open_basedir] = "${basedir}:/tmp"
+        php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/yourls"
         php_admin_value[session.save_path] = "/var/lib/php/sessions/yourls"
         '';
     };
-- 
2.41.0