diff options
author | Ismaël Bouya <ismael.bouya@normalesup.org> | 2020-04-18 16:10:56 +0200 |
---|---|---|
committer | Ismaël Bouya <ismael.bouya@normalesup.org> | 2020-04-20 01:51:48 +0200 |
commit | d3452fc59b9839846225fd254926c64a9c71f071 (patch) | |
tree | a98a0958b826ac4b2ab137720edf0195c65dd958 /modules/private/websites/chloe/integration.nix | |
parent | 514f9ec3beec470c4445be690673a0ceab9115b4 (diff) | |
download | Nix-d3452fc59b9839846225fd254926c64a9c71f071.tar.gz Nix-d3452fc59b9839846225fd254926c64a9c71f071.tar.zst Nix-d3452fc59b9839846225fd254926c64a9c71f071.zip |
Refactor websites
Diffstat (limited to 'modules/private/websites/chloe/integration.nix')
-rw-r--r-- | modules/private/websites/chloe/integration.nix | 110 |
1 files changed, 91 insertions, 19 deletions
diff --git a/modules/private/websites/chloe/integration.nix b/modules/private/websites/chloe/integration.nix index caf6548..6d16a86 100644 --- a/modules/private/websites/chloe/integration.nix +++ b/modules/private/websites/chloe/integration.nix | |||
@@ -1,43 +1,115 @@ | |||
1 | { lib, pkgs, config, ... }: | 1 | { lib, pkgs, config, ... }: |
2 | let | 2 | let |
3 | chloe = pkgs.callPackage ./builder.nix { | 3 | apacheUser = config.services.httpd.Inte.user; |
4 | inherit (pkgs.webapps) chloe; | 4 | apacheGroup = config.services.httpd.Inte.group; |
5 | config = config.myEnv.websites.chloe.integration; | 5 | ccfg = config.myEnv.websites.chloe.integration; |
6 | apacheUser = config.services.httpd.Inte.user; | 6 | app = pkgs.callPackage ./app { |
7 | apacheGroup = config.services.httpd.Inte.group; | 7 | inherit (ccfg) environment; |
8 | inherit (pkgs.webapps) spip; | ||
9 | varDir = "/var/lib/chloe_integration"; | ||
8 | }; | 10 | }; |
9 | |||
10 | cfg = config.myServices.websites.chloe.integration; | 11 | cfg = config.myServices.websites.chloe.integration; |
12 | webappdir = config.services.websites.webappDirsPaths.chloe_integration; | ||
11 | in { | 13 | in { |
12 | options.myServices.websites.chloe.integration.enable = lib.mkEnableOption "enable Chloe's website in integration"; | 14 | options.myServices.websites.chloe.integration.enable = lib.mkEnableOption "enable Chloe's website in integration"; |
13 | 15 | ||
14 | config = lib.mkIf cfg.enable { | 16 | config = lib.mkIf cfg.enable { |
15 | services.duplyBackup.profiles.chloe_dev.rootDir = chloe.app.varDir; | 17 | services.duplyBackup.profiles.chloe_integration.rootDir = app.varDir; |
16 | secrets.keys = chloe.keys; | 18 | secrets.keys = [ |
17 | systemd.services.phpfpm-chloe_dev.after = lib.mkAfter chloe.phpFpm.serviceDeps; | 19 | { |
18 | systemd.services.phpfpm-chloe_dev.wants = chloe.phpFpm.serviceDeps; | 20 | dest = "websites/chloe/integration"; |
19 | services.phpfpm.pools.chloe_dev = { | 21 | user = apacheUser; |
22 | group = apacheGroup; | ||
23 | permissions = "0400"; | ||
24 | text = '' | ||
25 | SetEnv SPIP_CONFIG_DIR "${./config}" | ||
26 | SetEnv SPIP_VAR_DIR "${app.varDir}" | ||
27 | SetEnv SPIP_SITE "chloe-${app.environment}" | ||
28 | SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu" | ||
29 | SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu" | ||
30 | SetEnv SPIP_LDAP_SEARCH_DN "${ccfg.ldap.dn}" | ||
31 | SetEnv SPIP_LDAP_SEARCH_PW "${ccfg.ldap.password}" | ||
32 | SetEnv SPIP_LDAP_SEARCH "${ccfg.ldap.filter}" | ||
33 | SetEnv SPIP_MYSQL_HOST "${ccfg.mysql.host}" | ||
34 | SetEnv SPIP_MYSQL_PORT "${ccfg.mysql.port}" | ||
35 | SetEnv SPIP_MYSQL_DB "${ccfg.mysql.database}" | ||
36 | SetEnv SPIP_MYSQL_USER "${ccfg.mysql.user}" | ||
37 | SetEnv SPIP_MYSQL_PASSWORD "${ccfg.mysql.password}" | ||
38 | ''; | ||
39 | } | ||
40 | ]; | ||
41 | systemd.services.phpfpm-chloe_integration.after = lib.mkAfter [ "mysql.service" ]; | ||
42 | systemd.services.phpfpm-chloe_integration.wants = [ "mysql.service" ]; | ||
43 | services.phpfpm.pools.chloe_integration = { | ||
20 | user = config.services.httpd.Inte.user; | 44 | user = config.services.httpd.Inte.user; |
21 | group = config.services.httpd.Inte.group; | 45 | group = config.services.httpd.Inte.group; |
22 | settings = chloe.phpFpm.pool; | 46 | settings = { |
47 | "listen.owner" = apacheUser; | ||
48 | "listen.group" = apacheGroup; | ||
49 | "php_admin_value[upload_max_filesize]" = "20M"; | ||
50 | "php_admin_value[post_max_size]" = "20M"; | ||
51 | # "php_admin_flag[log_errors]" = "on"; | ||
52 | "php_admin_value[open_basedir]" = "${app.spipConfig}:${./config}:${app}:${app.varDir}:/tmp"; | ||
53 | "php_admin_value[session.save_path]" = "${app.varDir}/phpSessions"; | ||
54 | "pm" = "ondemand"; | ||
55 | "pm.max_children" = "5"; | ||
56 | "pm.process_idle_timeout" = "60"; | ||
57 | }; | ||
23 | phpOptions = config.services.phpfpm.phpOptions + '' | 58 | phpOptions = config.services.phpfpm.phpOptions + '' |
24 | extension=${pkgs.php}/lib/php/extensions/mysqli.so | 59 | extension=${pkgs.php}/lib/php/extensions/mysqli.so |
25 | ''; | 60 | ''; |
26 | }; | 61 | }; |
27 | system.activationScripts.chloe_dev = chloe.activationScript; | 62 | system.activationScripts.chloe_integration = { |
28 | myServices.websites.webappDirs."${chloe.apache.webappName}" = chloe.app.webRoot; | 63 | deps = [ "wrappers" ]; |
29 | services.websites.env.integration.modules = chloe.apache.modules; | 64 | text = '' |
30 | services.websites.env.integration.vhostConfs.chloe = { | 65 | install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local |
66 | install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions | ||
67 | ''; | ||
68 | }; | ||
69 | services.websites.webappDirs.chloe_integration = app.webRoot; | ||
70 | services.websites.env.integration.modules = [ "proxy_fcgi" ]; | ||
71 | services.websites.env.integration.vhostConfs.chloe_integration = { | ||
31 | certName = "integration"; | 72 | certName = "integration"; |
32 | addToCerts = true; | 73 | addToCerts = true; |
33 | hosts = ["chloe.immae.eu" ]; | 74 | hosts = ["chloe.immae.eu" ]; |
34 | root = chloe.apache.root; | 75 | root = webappdir; |
35 | extraConfig = [ | 76 | extraConfig = [ |
36 | (chloe.apache.vhostConf config.services.phpfpm.pools.chloe_dev.socket) | 77 | '' |
78 | Include ${config.secrets.fullPaths."websites/chloe/integration"} | ||
79 | |||
80 | RewriteEngine On | ||
81 | |||
82 | <FilesMatch "\.php$"> | ||
83 | SetHandler "proxy:unix:${config.services.phpfpm.pools.chloe_integration.socket}|fcgi://localhost" | ||
84 | </FilesMatch> | ||
85 | |||
86 | <Directory ${webappdir}> | ||
87 | DirectoryIndex index.php index.htm index.html | ||
88 | Options -Indexes +FollowSymLinks +MultiViews +Includes | ||
89 | Include ${webappdir}/htaccess.txt | ||
90 | |||
91 | AllowOverride AuthConfig FileInfo Limit | ||
92 | Require all granted | ||
93 | </Directory> | ||
94 | |||
95 | <DirectoryMatch "${webappdir}/squelettes"> | ||
96 | Require all denied | ||
97 | </DirectoryMatch> | ||
98 | |||
99 | <FilesMatch "(.htaccess|rewrite-rules|.gitignore)$"> | ||
100 | Require all denied | ||
101 | </FilesMatch> | ||
102 | |||
103 | <Location /> | ||
104 | Use LDAPConnect | ||
105 | Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu | ||
106 | ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://osteopathe-cc.fr\"></html>" | ||
107 | </Location> | ||
108 | '' | ||
37 | ]; | 109 | ]; |
38 | }; | 110 | }; |
39 | services.websites.env.integration.watchPaths = [ | 111 | services.websites.env.integration.watchPaths = [ |
40 | "/var/secrets/webapps/${chloe.app.environment}-chloe" | 112 | config.secrets.fullPaths."websites/chloe/integration" |
41 | ]; | 113 | ]; |
42 | }; | 114 | }; |
43 | } | 115 | } |