aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorIsmaël Bouya <ismael.bouya@normalesup.org>2019-06-02 23:26:23 +0200
committerIsmaël Bouya <ismael.bouya@normalesup.org>2019-06-02 23:40:37 +0200
commit8164ed90c7fdd93fd035bce3dc1b3fc6bde9e30e (patch)
treec8f34a5f7ed6ac78d84c024a6a9e3dc847bbe8e5
parent9f66adf4372a3b1c859dc053489f727aa360077e (diff)
downloadNix-8164ed90c7fdd93fd035bce3dc1b3fc6bde9e30e.tar.gz
Nix-8164ed90c7fdd93fd035bce3dc1b3fc6bde9e30e.tar.zst
Nix-8164ed90c7fdd93fd035bce3dc1b3fc6bde9e30e.zip
Move production php application to dedicated module
Diffstat
-rw-r--r--modules/private/websites/connexionswing/builder.nix161
-rw-r--r--modules/private/websites/connexionswing/production.nix119
-rw-r--r--modules/private/websites/ludivinecassal/builder.nix153
-rw-r--r--modules/private/websites/ludivinecassal/production.nix109
-rw-r--r--modules/private/websites/piedsjaloux/builder.nix142
-rw-r--r--modules/private/websites/piedsjaloux/production.nix95
6 files changed, 255 insertions, 524 deletions
diff --git a/modules/private/websites/connexionswing/builder.nix b/modules/private/websites/connexionswing/builder.nix
deleted file mode 100644
index 004b979..0000000
--- a/modules/private/websites/connexionswing/builder.nix
+++ /dev/null
@@ -1,161 +0,0 @@
1{ apacheUser, apacheGroup, connexionswing, pkgs, phpPackages, mylibs, config }:
2rec {
3 app = connexionswing.override { inherit (config) environment; };
4 keys = [{
5 dest = "webapps/${app.environment}-connexionswing";
6 user = apacheUser;
7 group = apacheGroup;
8 permissions = "0400";
9 text = ''
10 # This file is auto-generated during the composer install
11 parameters:
12 database_host: ${config.mysql.host}
13 database_port: ${config.mysql.port}
14 database_name: ${config.mysql.name}
15 database_user: ${config.mysql.user}
16 database_password: ${config.mysql.password}
17 database_server_version: ${pkgs.mariadb.mysqlVersion}
18 mailer_transport: sendmail
19 mailer_host: null
20 mailer_user: null
21 mailer_password: null
22 subscription_email: ${config.email}
23 allow_robots: true
24 secret: ${config.secret}
25 ${if app.environment == "prod" then ''
26 services:
27 swiftmailer.mailer.default.transport:
28 class: Swift_SendmailTransport
29 arguments: ['/run/wrappers/bin/sendmail -bs']
30 '' else ""}
31 '';
32 }];
33 phpFpm = rec {
34 preStart = mylibs.phpFpmPreStart {
35 inherit app;
36 inherit (app) varDir;
37 keyFiles = [
38 "/var/secrets/webapps/${app.environment}-connexionswing"
39 ];
40 actions = [
41 "/run/wrappers/bin/sudo -u ${apacheUser} ./bin/console --env=${app.environment} cache:clear --no-warmup"
42 ];
43 };
44 serviceDeps = [ "mysql.service" ];
45 socket = "/var/run/phpfpm/connexionswing-${app.environment}.sock";
46 phpConfig = ''
47 extension=${phpPackages.imagick}/lib/php/extensions/imagick.so
48 '';
49 pool = ''
50 user = ${apacheUser}
51 group = ${apacheGroup}
52 listen.owner = ${apacheUser}
53 listen.group = ${apacheGroup}
54 php_admin_value[upload_max_filesize] = 20M
55 php_admin_value[post_max_size] = 20M
56 ;php_admin_flag[log_errors] = on
57 php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/secrets/webapps/${app.environment}-connexionswing:${app}:${app.varDir}:/tmp"
58 php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
59 ${if app.environment == "dev" then ''
60 pm = ondemand
61 pm.max_children = 5
62 pm.process_idle_timeout = 60
63 env[SYMFONY_DEBUG_MODE] = "yes"
64 '' else ''
65 pm = dynamic
66 pm.max_children = 20
67 pm.start_servers = 2
68 pm.min_spare_servers = 1
69 pm.max_spare_servers = 3
70 ''}'';
71 };
72 apache = rec {
73 modules = [ "proxy_fcgi" ];
74 webappName = "connexionswing_${app.environment}";
75 root = "/run/current-system/webapps/${webappName}";
76 vhostConf = ''
77 <FilesMatch "\.php$">
78 SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
79 </FilesMatch>
80
81 <Directory ${app.varDir}/medias>
82 Options FollowSymLinks
83 AllowOverride None
84 Require all granted
85 </Directory>
86
87 <Directory ${app.varDir}/uploads>
88 Options FollowSymLinks
89 AllowOverride None
90 Require all granted
91 </Directory>
92
93 ${if app.environment == "dev" then ''
94 <Location />
95 Use LDAPConnect
96 Require ldap-group cn=connexionswing.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
97 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://connexionswing.com\"></html>"
98 </Location>
99
100 <Directory ${root}>
101 Options Indexes FollowSymLinks MultiViews Includes
102 AllowOverride None
103 Require all granted
104
105 DirectoryIndex app_dev.php
106
107 <IfModule mod_negotiation.c>
108 Options -MultiViews
109 </IfModule>
110
111 <IfModule mod_rewrite.c>
112 RewriteEngine On
113
114 RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
115 RewriteRule ^(.*) - [E=BASE:%1]
116
117 # Maintenance script
118 RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
119 RewriteCond %{SCRIPT_FILENAME} !maintenance.php
120 RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
121 ErrorDocument 503 /maintenance.php
122
123 # Sets the HTTP_AUTHORIZATION header removed by Apache
124 RewriteCond %{HTTP:Authorization} .
125 RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
126
127 RewriteCond %{ENV:REDIRECT_STATUS} ^$
128 RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
129
130 # If the requested filename exists, simply serve it.
131 # We only want to let Apache serve files and not directories.
132 RewriteCond %{REQUEST_FILENAME} -f
133 RewriteRule ^ - [L]
134
135 # Rewrite all other queries to the front controller.
136 RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
137 </IfModule>
138
139 </Directory>
140 '' else ''
141 Use Stats connexionswing.com
142
143 <Directory ${root}>
144 Options Indexes FollowSymLinks MultiViews Includes
145 AllowOverride All
146 Require all granted
147 </Directory>
148 ''}
149 '';
150 };
151 activationScript = {
152 deps = [ "wrappers" ];
153 text = ''
154 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} \
155 ${app.varDir}/medias \
156 ${app.varDir}/uploads \
157 ${app.varDir}/var
158 install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
159 '';
160 };
161}
diff --git a/modules/private/websites/connexionswing/production.nix b/modules/private/websites/connexionswing/production.nix
index 07647da..1427c8d 100644
--- a/modules/private/websites/connexionswing/production.nix
+++ b/modules/private/websites/connexionswing/production.nix
@@ -1,42 +1,107 @@
1{ lib, pkgs, config, myconfig, ... }: 1{ lib, pkgs, config, myconfig, ... }:
2let 2let
3 connexionswing = pkgs.callPackage ./builder.nix { 3 secrets = myconfig.env.websites.connexionswing.production;
4 inherit (pkgs.webapps) connexionswing; 4 app = pkgs.webapps.connexionswing.override { environment = secrets.environment; };
5 config = myconfig.env.websites.connexionswing.production;
6 apacheUser = config.services.httpd.Prod.user;
7 apacheGroup = config.services.httpd.Prod.group;
8 };
9
10 cfg = config.myServices.websites.connexionswing.production; 5 cfg = config.myServices.websites.connexionswing.production;
6 pcfg = config.services.phpApplication;
11in { 7in {
12 options.myServices.websites.connexionswing.production.enable = lib.mkEnableOption "enable Connexionswing's website in production"; 8 options.myServices.websites.connexionswing.production.enable = lib.mkEnableOption "enable Connexionswing's website in production";
13 9
14 config = lib.mkIf cfg.enable { 10 config = lib.mkIf cfg.enable {
15 secrets.keys = connexionswing.keys;
16 services.webstats.sites = [ { name = "connexionswing.com"; } ]; 11 services.webstats.sites = [ { name = "connexionswing.com"; } ];
17 12 services.phpApplication.apps.connexionswing_prod = {
18 systemd.services.phpfpm-connexionswing_prod.after = lib.mkAfter connexionswing.phpFpm.serviceDeps; 13 websiteEnv = "production";
19 systemd.services.phpfpm-connexionswing_prod.wants = connexionswing.phpFpm.serviceDeps; 14 httpdUser = config.services.httpd.Prod.user;
20 systemd.services.phpfpm-connexionswing_prod.preStart = lib.mkAfter connexionswing.phpFpm.preStart; 15 httpdGroup = config.services.httpd.Prod.group;
21 services.phpfpm.pools.connexionswing_prod = { 16 inherit (app) webRoot varDir;
22 listen = connexionswing.phpFpm.socket; 17 varDirPaths = {
23 extraConfig = connexionswing.phpFpm.pool; 18 "medias" = "0700";
24 phpOptions = config.services.phpfpm.phpOptions + connexionswing.phpFpm.phpConfig; 19 "uploads" = "0700";
20 "var" = "0700";
21 };
22 inherit app;
23 serviceDeps = [ "mysql.service" ];
24 preStartActions = [
25 "./bin/console --env=${app.environment} cache:clear --no-warmup"
26 ];
27 phpOpenbasedir = [ "/tmp" "/run/wrappers/bin/sendmail" ];
28 phpPool = ''
29 php_admin_value[upload_max_filesize] = 20M
30 php_admin_value[post_max_size] = 20M
31 ;php_admin_flag[log_errors] = on
32 pm = dynamic
33 pm.max_children = 20
34 pm.start_servers = 2
35 pm.min_spare_servers = 1
36 pm.max_spare_servers = 3
37 '';
38 phpWatchFiles = [
39 config.secrets.fullPaths."webapps/${app.environment}-connexionswing"
40 ];
25 }; 41 };
26 system.activationScripts.connexionswing_prod = connexionswing.activationScript; 42
27 myServices.websites.webappDirs."${connexionswing.apache.webappName}" = connexionswing.app.webRoot; 43 secrets.keys = [
28 services.websites.env.production.modules = connexionswing.apache.modules; 44 {
29 services.websites.env.production.vhostConfs.connexionswing = { 45 dest = "webapps/${app.environment}-connexionswing";
46 user = config.services.httpd.Prod.user;
47 group = config.services.httpd.Prod.group;
48 permissions = "0400";
49 text = ''
50 # This file is auto-generated during the composer install
51 parameters:
52 database_host: ${secrets.mysql.host}
53 database_port: ${secrets.mysql.port}
54 database_name: ${secrets.mysql.name}
55 database_user: ${secrets.mysql.user}
56 database_password: ${secrets.mysql.password}
57 database_server_version: ${pkgs.mariadb.mysqlVersion}
58 mailer_transport: sendmail
59 mailer_host: null
60 mailer_user: null
61 mailer_password: null
62 subscription_email: ${secrets.email}
63 allow_robots: true
64 secret: ${secrets.secret}
65 services:
66 swiftmailer.mailer.default.transport:
67 class: Swift_SendmailTransport
68 arguments: ['/run/wrappers/bin/sendmail -bs']
69 '';
70 }
71 ];
72
73 services.websites.env.production.vhostConfs.connexionswing_prod = {
30 certName = "connexionswing"; 74 certName = "connexionswing";
31 certMainHost = "connexionswing.com"; 75 certMainHost = "connexionswing.com";
32 hosts = ["connexionswing.com" "sandetludo.com" "www.connexionswing.com" "www.sandetludo.com" ]; 76 hosts = ["connexionswing.com" "sandetludo.com" "www.connexionswing.com" "www.sandetludo.com" ];
33 root = connexionswing.apache.root; 77 root = pcfg.webappDirs.connexionswing_prod;
34 extraConfig = [ connexionswing.apache.vhostConf ]; 78 extraConfig = [
35 }; 79 ''
36 services.filesWatcher.phpfpm-connexionswing_prod = { 80 <FilesMatch "\.php$">
37 restart = true; 81 SetHandler "proxy:unix:${pcfg.phpListenPaths.connexionswing_prod}|fcgi://localhost"
38 paths = [ "/var/secrets/webapps/${connexionswing.app.environment}-connexionswing" ]; 82 </FilesMatch>
83
84 <Directory ${app.varDir}/medias>
85 Options FollowSymLinks
86 AllowOverride None
87 Require all granted
88 </Directory>
89
90 <Directory ${app.varDir}/uploads>
91 Options FollowSymLinks
92 AllowOverride None
93 Require all granted
94 </Directory>
95
96 Use Stats connexionswing.com
97
98 <Directory ${pcfg.webappDirs.connexionswing_prod}>
99 Options Indexes FollowSymLinks MultiViews Includes
100 AllowOverride All
101 Require all granted
102 </Directory>
103 ''
104 ];
39 }; 105 };
40 }; 106 };
41} 107}
42
diff --git a/modules/private/websites/ludivinecassal/builder.nix b/modules/private/websites/ludivinecassal/builder.nix
deleted file mode 100644
index e2a0f19..0000000
--- a/modules/private/websites/ludivinecassal/builder.nix
+++ /dev/null
@@ -1,153 +0,0 @@
1{ apacheUser, apacheGroup, config, ludivinecassal, mylibs, pkgs, ruby, sass, imagemagick }:
2rec {
3 app = ludivinecassal.override { inherit (config) environment; };
4 varDir = "/var/lib/ludivinecassal_${app.environment}";
5 keys = [{
6 dest = "webapps/${app.environment}-ludivinecassal";
7 user = apacheUser;
8 group = apacheGroup;
9 permissions = "0400";
10 text = ''
11 # This file is auto-generated during the composer install
12 parameters:
13 database_host: ${config.mysql.host}
14 database_port: ${config.mysql.port}
15 database_name: ${config.mysql.name}
16 database_user: ${config.mysql.user}
17 database_password: ${config.mysql.password}
18 database_server_version: ${pkgs.mariadb.mysqlVersion}
19 mailer_transport: smtp
20 mailer_host: 127.0.0.1
21 mailer_user: null
22 mailer_password: null
23 secret: ${config.secret}
24 ldap_host: ldap.immae.eu
25 ldap_port: 636
26 ldap_version: 3
27 ldap_ssl: true
28 ldap_tls: false
29 ldap_user_bind: 'uid={username},ou=users,dc=immae,dc=eu'
30 ldap_base_dn: 'dc=immae,dc=eu'
31 ldap_search_dn: '${config.ldap.dn}'
32 ldap_search_password: '${config.ldap.password}'
33 ldap_search_filter: '${config.ldap.search}'
34 leapt_im:
35 binary_path: ${imagemagick}/bin
36 assetic:
37 sass: ${sass}/bin/sass
38 ruby: ${ruby}/bin/ruby
39 '';
40 }];
41 phpFpm = rec {
42 preStart = mylibs.phpFpmPreStart {
43 inherit app;
44 inherit (app) varDir;
45 keyFiles = [
46 "/var/secrets/webapps/${app.environment}-ludivinecassal"
47 ];
48 actions = [
49 "/run/wrappers/bin/sudo -u ${apacheUser} ./bin/console --env=${app.environment} cache:clear --no-warmup"
50 ];
51 };
52 serviceDeps = [ "mysql.service" ];
53 socket = "/var/run/phpfpm/ludivinecassal-${app.environment}.sock";
54 pool = ''
55 listen = ${socket}
56 user = ${apacheUser}
57 group = ${apacheGroup}
58 listen.owner = ${apacheUser}
59 listen.group = ${apacheGroup}
60 php_admin_value[upload_max_filesize] = 20M
61 php_admin_value[post_max_size] = 20M
62 ;php_admin_flag[log_errors] = on
63 php_admin_value[open_basedir] = "/var/secrets/webapps/${app.environment}-ludivinecassal:${app}:${app.varDir}:/tmp"
64 php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
65 ${if app.environment == "dev" then ''
66 pm = ondemand
67 pm.max_children = 5
68 pm.process_idle_timeout = 60
69 env[SYMFONY_DEBUG_MODE] = "yes"
70 '' else ''
71 pm = dynamic
72 pm.max_children = 20
73 pm.start_servers = 2
74 pm.min_spare_servers = 1
75 pm.max_spare_servers = 3
76 ''}'';
77 };
78 apache = rec {
79 modules = [ "proxy_fcgi" ];
80 webappName = "ludivine_${app.environment}";
81 root = "/run/current-system/webapps/${webappName}";
82 vhostConf = ''
83 <FilesMatch "\.php$">
84 SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
85 </FilesMatch>
86
87 ${if app.environment == "dev" then ''
88 <Location />
89 Use LDAPConnect
90 Require ldap-group cn=ludivine.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
91 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://ludivinecassal.com\"></html>"
92 </Location>
93
94 <Directory ${root}>
95 Options Indexes FollowSymLinks MultiViews Includes
96 AllowOverride None
97 Require all granted
98
99 DirectoryIndex app_dev.php
100
101 <IfModule mod_negotiation.c>
102 Options -MultiViews
103 </IfModule>
104
105 <IfModule mod_rewrite.c>
106 RewriteEngine On
107
108 RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
109 RewriteRule ^(.*) - [E=BASE:%1]
110
111 # Maintenance script
112 RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
113 RewriteCond %{SCRIPT_FILENAME} !maintenance.php
114 RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
115 ErrorDocument 503 /maintenance.php
116
117 # Sets the HTTP_AUTHORIZATION header removed by Apache
118 RewriteCond %{HTTP:Authorization} .
119 RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
120
121 RewriteCond %{ENV:REDIRECT_STATUS} ^$
122 RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
123
124 # If the requested filename exists, simply serve it.
125 # We only want to let Apache serve files and not directories.
126 RewriteCond %{REQUEST_FILENAME} -f
127 RewriteRule ^ - [L]
128
129 # Rewrite all other queries to the front controller.
130 RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
131 </IfModule>
132
133 </Directory>
134 '' else ''
135 Use Stats ludivinecassal.com
136
137 <Directory ${root}>
138 Options Indexes FollowSymLinks MultiViews Includes
139 AllowOverride All
140 Require all granted
141 </Directory>
142 ''}
143 '';
144 };
145 activationScript = {
146 deps = [ "wrappers" ];
147 text = ''
148 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}
149 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/tmp
150 install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
151 '';
152 };
153}
diff --git a/modules/private/websites/ludivinecassal/production.nix b/modules/private/websites/ludivinecassal/production.nix
index 9d8407d..82f6899 100644
--- a/modules/private/websites/ludivinecassal/production.nix
+++ b/modules/private/websites/ludivinecassal/production.nix
@@ -1,37 +1,102 @@
1{ lib, pkgs, config, myconfig, ... }: 1{ lib, pkgs, config, myconfig, ... }:
2let 2let
3 ludivinecassal = pkgs.callPackage ./builder.nix { 3 secrets = myconfig.env.websites.ludivinecassal.production;
4 inherit (pkgs.webapps) ludivinecassal; 4 app = pkgs.webapps.ludivinecassal.override { environment = secrets.environment; };
5 config = myconfig.env.websites.ludivinecassal.production; 5 pcfg = config.services.phpApplication;
6 apacheUser = config.services.httpd.Prod.user;
7 apacheGroup = config.services.httpd.Prod.group;
8 };
9
10 cfg = config.myServices.websites.ludivinecassal.production; 6 cfg = config.myServices.websites.ludivinecassal.production;
11in { 7in {
12 options.myServices.websites.ludivinecassal.production.enable = lib.mkEnableOption "enable Ludivine's website in production"; 8 options.myServices.websites.ludivinecassal.production.enable = lib.mkEnableOption "enable Ludivine's website in production";
13 9
14 config = lib.mkIf cfg.enable { 10 config = lib.mkIf cfg.enable {
15 secrets.keys = ludivinecassal.keys;
16 services.webstats.sites = [ { name = "ludivinecassal.com"; } ]; 11 services.webstats.sites = [ { name = "ludivinecassal.com"; } ];
12 services.phpApplication.apps.ludivinecassal_prod = {
13 websiteEnv = "production";
14 httpdUser = config.services.httpd.Prod.user;
15 httpdGroup = config.services.httpd.Prod.group;
16 inherit (app) webRoot varDir;
17 varDirPaths = {
18 "tmp" = "0700";
19 };
20 inherit app;
21 serviceDeps = [ "mysql.service" ];
22 preStartActions = [
23 "./bin/console --env=${app.environment} cache:clear --no-warmup"
24 ];
25 phpOpenbasedir = [ "/tmp" ];
26 phpPool = ''
27 php_admin_value[upload_max_filesize] = 20M
28 php_admin_value[post_max_size] = 20M
29 ;php_admin_flag[log_errors] = on
30 pm = dynamic
31 pm.max_children = 20
32 pm.start_servers = 2
33 pm.min_spare_servers = 1
34 pm.max_spare_servers = 3
35 '';
36 phpWatchFiles = [
37 config.secrets.fullPaths."webapps/${app.environment}-ludivinecassal"
38 ];
39 };
40
41 secrets.keys = [
42 {
43 dest = "webapps/${app.environment}-ludivinecassal";
44 user = config.services.httpd.Prod.user;
45 group = config.services.httpd.Prod.group;
46 permissions = "0400";
47 text = ''
48 # This file is auto-generated during the composer install
49 parameters:
50 database_host: ${secrets.mysql.host}
51 database_port: ${secrets.mysql.port}
52 database_name: ${secrets.mysql.name}
53 database_user: ${secrets.mysql.user}
54 database_password: ${secrets.mysql.password}
55 database_server_version: ${pkgs.mariadb.mysqlVersion}
56 mailer_transport: smtp
57 mailer_host: 127.0.0.1
58 mailer_user: null
59 mailer_password: null
60 secret: ${secrets.secret}
61 ldap_host: ldap.immae.eu
62 ldap_port: 636
63 ldap_version: 3
64 ldap_ssl: true
65 ldap_tls: false
66 ldap_user_bind: 'uid={username},ou=users,dc=immae,dc=eu'
67 ldap_base_dn: 'dc=immae,dc=eu'
68 ldap_search_dn: '${secrets.ldap.dn}'
69 ldap_search_password: '${secrets.ldap.password}'
70 ldap_search_filter: '${secrets.ldap.search}'
71 leapt_im:
72 binary_path: ${pkgs.imagemagick}/bin
73 assetic:
74 sass: ${pkgs.sass}/bin/sass
75 ruby: ${pkgs.ruby}/bin/ruby
76 '';
77 }
78 ];
17 79
18 systemd.services.phpfpm-ludivinecassal_prod.after = lib.mkAfter ludivinecassal.phpFpm.serviceDeps; 80 services.websites.env.production.vhostConfs.ludivinecassal_prod = {
19 systemd.services.phpfpm-ludivinecassal_prod.wants = ludivinecassal.phpFpm.serviceDeps;
20 systemd.services.phpfpm-ludivinecassal_prod.preStart = lib.mkAfter ludivinecassal.phpFpm.preStart;
21 services.phpfpm.poolConfigs.ludivinecassal_prod = ludivinecassal.phpFpm.pool;
22 system.activationScripts.ludivinecassal_prod = ludivinecassal.activationScript;
23 myServices.websites.webappDirs."${ludivinecassal.apache.webappName}" = ludivinecassal.app.webRoot;
24 services.websites.env.production.modules = ludivinecassal.apache.modules;
25 services.websites.env.production.vhostConfs.ludivine = {
26 certName = "ludivinecassal"; 81 certName = "ludivinecassal";
27 certMainHost = "ludivinecassal.com"; 82 certMainHost = "ludivinecassal.com";
28 hosts = ["ludivinecassal.com" "www.ludivinecassal.com" ]; 83 hosts = ["ludivinecassal.com" "www.ludivinecassal.com" ];
29 root = ludivinecassal.apache.root; 84 root = pcfg.webappDirs.ludivinecassal_prod;
30 extraConfig = [ ludivinecassal.apache.vhostConf ]; 85 extraConfig = [
31 }; 86 ''
32 services.filesWatcher.phpfpm-ludivinecassal_prod = { 87 <FilesMatch "\.php$">
33 restart = true; 88 SetHandler "proxy:unix:${pcfg.phpListenPaths.ludivinecassal_prod}|fcgi://localhost"
34 paths = [ "/var/secrets/webapps/${ludivinecassal.app.environment}-ludivinecassal" ]; 89 </FilesMatch>
90
91 Use Stats ludivinecassal.com
92
93 <Directory ${pcfg.webappDirs.ludivinecassal_prod}>
94 Options Indexes FollowSymLinks MultiViews Includes
95 AllowOverride All
96 Require all granted
97 </Directory>
98 ''
99 ];
35 }; 100 };
36 }; 101 };
37} 102}
diff --git a/modules/private/websites/piedsjaloux/builder.nix b/modules/private/websites/piedsjaloux/builder.nix
deleted file mode 100644
index d9a78b3..0000000
--- a/modules/private/websites/piedsjaloux/builder.nix
+++ /dev/null
@@ -1,142 +0,0 @@
1{ apacheUser, apacheGroup, piedsjaloux, config, pkgs, lib, mylibs, texlive, imagemagick }:
2rec {
3 app = piedsjaloux.override { inherit (config) environment; };
4 varDir = "/var/lib/piedsjaloux_${app.environment}";
5 keys = [{
6 dest = "webapps/${app.environment}-piedsjaloux";
7 user = apacheUser;
8 group = apacheGroup;
9 permissions = "0400";
10 text = ''
11 # This file is auto-generated during the composer install
12 parameters:
13 database_host: ${config.mysql.host}
14 database_port: ${config.mysql.port}
15 database_name: ${config.mysql.name}
16 database_user: ${config.mysql.user}
17 database_password: ${config.mysql.password}
18 database_server_version: ${pkgs.mariadb.mysqlVersion}
19 mailer_transport: smtp
20 mailer_host: 127.0.0.1
21 mailer_user: null
22 mailer_password: null
23 secret: ${config.secret}
24 pdflatex: "${texlive.combine { inherit (texlive) attachfile preprint scheme-small; }}/bin/pdflatex"
25 leapt_im:
26 binary_path: ${imagemagick}/bin
27 '';
28 }];
29 phpFpm = rec {
30 preStart = mylibs.phpFpmPreStart {
31 inherit app;
32 inherit (app) varDir;
33 keyFiles = [
34 "/var/secrets/webapps/${app.environment}-piedsjaloux"
35 ];
36 actions = [
37 "/run/wrappers/bin/sudo -u ${apacheUser} ./bin/console --env=${app.environment} cache:clear --no-warmup"
38 ];
39 };
40 serviceDeps = [ "mysql.service" ];
41 socket = "/var/run/phpfpm/piedsjaloux-${app.environment}.sock";
42 pool = ''
43 listen = ${socket}
44 user = ${apacheUser}
45 group = ${apacheGroup}
46 listen.owner = ${apacheUser}
47 listen.group = ${apacheGroup}
48 php_admin_value[upload_max_filesize] = 20M
49 php_admin_value[post_max_size] = 20M
50 ;php_admin_flag[log_errors] = on
51 php_admin_value[open_basedir] = "/var/secrets/webapps/${app.environment}-piedsjaloux:${app}:${app.varDir}:/tmp"
52 php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
53 env[PATH] = ${lib.makeBinPath [ pkgs.apg pkgs.unzip ]}
54 ${if app.environment == "dev" then ''
55 pm = ondemand
56 pm.max_children = 5
57 pm.process_idle_timeout = 60
58 env[SYMFONY_DEBUG_MODE] = "yes"
59 '' else ''
60 pm = dynamic
61 pm.max_children = 20
62 pm.start_servers = 2
63 pm.min_spare_servers = 1
64 pm.max_spare_servers = 3
65 ''}'';
66 };
67 apache = rec {
68 modules = [ "proxy_fcgi" ];
69 webappName = "piedsjaloux_${app.environment}";
70 root = "/run/current-system/webapps/${webappName}";
71 vhostConf = ''
72 <FilesMatch "\.php$">
73 SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
74 </FilesMatch>
75
76 ${if app.environment == "dev" then ''
77 <Location />
78 Use LDAPConnect
79 Require ldap-group cn=piedsjaloux.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
80 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://piedsjaloux.fr\"></html>"
81 </Location>
82
83 <Directory ${root}>
84 Options Indexes FollowSymLinks MultiViews Includes
85 AllowOverride None
86 Require all granted
87
88 DirectoryIndex app_dev.php
89
90 <IfModule mod_negotiation.c>
91 Options -MultiViews
92 </IfModule>
93
94 <IfModule mod_rewrite.c>
95 RewriteEngine On
96
97 RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
98 RewriteRule ^(.*) - [E=BASE:%1]
99
100 # Maintenance script
101 RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
102 RewriteCond %{SCRIPT_FILENAME} !maintenance.php
103 RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
104 ErrorDocument 503 /maintenance.php
105
106 # Sets the HTTP_AUTHORIZATION header removed by Apache
107 RewriteCond %{HTTP:Authorization} .
108 RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
109
110 RewriteCond %{ENV:REDIRECT_STATUS} ^$
111 RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
112
113 # If the requested filename exists, simply serve it.
114 # We only want to let Apache serve files and not directories.
115 RewriteCond %{REQUEST_FILENAME} -f
116 RewriteRule ^ - [L]
117
118 # Rewrite all other queries to the front controller.
119 RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
120 </IfModule>
121
122 </Directory>
123 '' else ''
124 Use Stats piedsjaloux.fr
125
126 <Directory ${root}>
127 Options Indexes FollowSymLinks MultiViews Includes
128 AllowOverride All
129 Require all granted
130 </Directory>
131 ''}
132 '';
133 };
134 activationScript = {
135 deps = [ "wrappers" ];
136 text = ''
137 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} \
138 ${app.varDir}/tmp
139 install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
140 '';
141 };
142}
diff --git a/modules/private/websites/piedsjaloux/production.nix b/modules/private/websites/piedsjaloux/production.nix
index 30066a5..9007f19 100644
--- a/modules/private/websites/piedsjaloux/production.nix
+++ b/modules/private/websites/piedsjaloux/production.nix
@@ -1,34 +1,91 @@
1{ lib, pkgs, config, myconfig, ... }: 1{ lib, pkgs, config, myconfig, ... }:
2let 2let
3 piedsjaloux = pkgs.callPackage ./builder.nix { 3 secrets = myconfig.env.websites.piedsjaloux.production;
4 inherit (pkgs.webapps) piedsjaloux; 4 app = pkgs.webapps.piedsjaloux.override { environment = secrets.environment; };
5 config = myconfig.env.websites.piedsjaloux.production;
6 apacheUser = config.services.httpd.Prod.user;
7 apacheGroup = config.services.httpd.Prod.group;
8 };
9
10 cfg = config.myServices.websites.piedsjaloux.production; 5 cfg = config.myServices.websites.piedsjaloux.production;
6 pcfg = config.services.phpApplication;
11in { 7in {
12 options.myServices.websites.piedsjaloux.production.enable = lib.mkEnableOption "enable PiedsJaloux's website in production"; 8 options.myServices.websites.piedsjaloux.production.enable = lib.mkEnableOption "enable PiedsJaloux's website in production";
13 9
14 config = lib.mkIf cfg.enable { 10 config = lib.mkIf cfg.enable {
15 secrets.keys = piedsjaloux.keys;
16 services.webstats.sites = [ { name = "piedsjaloux.fr"; } ]; 11 services.webstats.sites = [ { name = "piedsjaloux.fr"; } ];
12 services.phpApplication.apps.piedsjaloux_prod = {
13 websiteEnv = "production";
14 httpdUser = config.services.httpd.Prod.user;
15 httpdGroup = config.services.httpd.Prod.group;
16 inherit (app) webRoot varDir;
17 varDirPaths = {
18 "tmp" = "0700";
19 };
20 inherit app;
21 serviceDeps = [ "mysql.service" ];
22 preStartActions = [
23 "./bin/console --env=${app.environment} cache:clear --no-warmup"
24 ];
25 phpOpenbasedir = [ "/tmp" ];
26 phpPool = ''
27 php_admin_value[upload_max_filesize] = 20M
28 php_admin_value[post_max_size] = 20M
29 ;php_admin_flag[log_errors] = on
30 env[PATH] = ${lib.makeBinPath [ pkgs.apg pkgs.unzip ]}
31 pm = dynamic
32 pm.max_children = 20
33 pm.start_servers = 2
34 pm.min_spare_servers = 1
35 pm.max_spare_servers = 3
36 '';
37 phpWatchFiles = [
38 config.secrets.fullPaths."webapps/${app.environment}-piedsjaloux"
39 ];
40 };
41
42 secrets.keys = [
43 {
44 dest = "webapps/${app.environment}-piedsjaloux";
45 user = config.services.httpd.Prod.user;
46 group = config.services.httpd.Prod.group;
47 permissions = "0400";
48 text = ''
49 # This file is auto-generated during the composer install
50 parameters:
51 database_host: ${secrets.mysql.host}
52 database_port: ${secrets.mysql.port}
53 database_name: ${secrets.mysql.name}
54 database_user: ${secrets.mysql.user}
55 database_password: ${secrets.mysql.password}
56 database_server_version: ${pkgs.mariadb.mysqlVersion}
57 mailer_transport: smtp
58 mailer_host: 127.0.0.1
59 mailer_user: null
60 mailer_password: null
61 secret: ${secrets.secret}
62 pdflatex: "${pkgs.texlive.combine { inherit (pkgs.texlive) attachfile preprint scheme-small; }}/bin/pdflatex"
63 leapt_im:
64 binary_path: ${pkgs.imagemagick}/bin
65 '';
66 }
67 ];
17 68
18 systemd.services.phpfpm-piedsjaloux_prod.after = lib.mkAfter piedsjaloux.phpFpm.serviceDeps; 69 services.websites.env.production.vhostConfs.piedsjaloux_prod = {
19 systemd.services.phpfpm-piedsjaloux_prod.wants = piedsjaloux.phpFpm.serviceDeps;
20 systemd.services.phpfpm-piedsjaloux_prod.preStart = lib.mkAfter piedsjaloux.phpFpm.preStart;
21 services.phpfpm.poolConfigs.piedsjaloux_prod = piedsjaloux.phpFpm.pool;
22 system.activationScripts.piedsjaloux_prod = piedsjaloux.activationScript;
23 myServices.websites.webappDirs."${piedsjaloux.apache.webappName}" = piedsjaloux.app.webRoot;
24 services.websites.env.production.modules = piedsjaloux.apache.modules;
25 services.websites.env.production.vhostConfs.piedsjaloux = {
26 certName = "piedsjaloux"; 70 certName = "piedsjaloux";
27 certMainHost = "piedsjaloux.fr"; 71 certMainHost = "piedsjaloux.fr";
28 hosts = [ "piedsjaloux.fr" "www.piedsjaloux.fr" ]; 72 hosts = [ "piedsjaloux.fr" "www.piedsjaloux.fr" ];
29 root = piedsjaloux.apache.root; 73 root = pcfg.webappDirs.piedsjaloux_prod;
30 extraConfig = [ piedsjaloux.apache.vhostConf ]; 74 extraConfig = [
75 ''
76 <FilesMatch "\.php$">
77 SetHandler "proxy:unix:${pcfg.phpListenPaths.piedsjaloux_prod}|fcgi://localhost"
78 </FilesMatch>
79
80 Use Stats piedsjaloux.fr
81
82 <Directory ${pcfg.webappDirs.piedsjaloux_prod}>
83 Options Indexes FollowSymLinks MultiViews Includes
84 AllowOverride All
85 Require all granted
86 </Directory>
87 ''
88 ];
31 }; 89 };
32 }; 90 };
33} 91}
34
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-26 09:17:08 +0000