aboutsummaryrefslogtreecommitdiff
path: root/modules/private/websites/chloe
diff options
context:
space:
mode:
authorIsmaël Bouya <ismael.bouya@normalesup.org>2020-04-18 16:10:56 +0200
committerIsmaël Bouya <ismael.bouya@normalesup.org>2020-04-20 01:51:48 +0200
commitd3452fc59b9839846225fd254926c64a9c71f071 (patch)
treea98a0958b826ac4b2ab137720edf0195c65dd958 /modules/private/websites/chloe
parent514f9ec3beec470c4445be690673a0ceab9115b4 (diff)
downloadNix-d3452fc59b9839846225fd254926c64a9c71f071.tar.gz
Nix-d3452fc59b9839846225fd254926c64a9c71f071.tar.zst
Nix-d3452fc59b9839846225fd254926c64a9c71f071.zip
Refactor websites
Diffstat (limited to 'modules/private/websites/chloe')
-rw-r--r--modules/private/websites/chloe/app/chloe.json14
-rw-r--r--modules/private/websites/chloe/app/default.nix19
-rw-r--r--modules/private/websites/chloe/builder.nix99
-rw-r--r--modules/private/websites/chloe/integration.nix110
-rw-r--r--modules/private/websites/chloe/production.nix106
5 files changed, 212 insertions, 136 deletions
diff --git a/modules/private/websites/chloe/app/chloe.json b/modules/private/websites/chloe/app/chloe.json
new file mode 100644
index 0000000..8508c14
--- /dev/null
+++ b/modules/private/websites/chloe/app/chloe.json
@@ -0,0 +1,14 @@
1{
2 "tag": "b971edc-master",
3 "meta": {
4 "name": "chloe",
5 "url": "ssh://gitolite@git.immae.eu/perso/Immae/Sites/Chloe",
6 "branch": "master"
7 },
8 "git": {
9 "url": "ssh://gitolite@git.immae.eu/perso/Immae/Sites/Chloe",
10 "rev": "b971edce80e922e895836ddf7caeb4023a2db973",
11 "sha256": "1igjr0rgp69szrhcl8kz02ng54w8lw6r0c6jibigp8v5a4spp222",
12 "fetchSubmodules": true
13 }
14}
diff --git a/modules/private/websites/chloe/app/default.nix b/modules/private/websites/chloe/app/default.nix
new file mode 100644
index 0000000..92a5e42
--- /dev/null
+++ b/modules/private/websites/chloe/app/default.nix
@@ -0,0 +1,19 @@
1{ environment ? "prod"
2, varDir ? "/var/lib/chloe_${environment}"
3, spip, stdenv, mylibs, sassc }:
4let
5 siteDir = stdenv.mkDerivation (mylibs.fetchedGitPrivate ./chloe.json // rec {
6 buildPhase = ''
7 make
8 '';
9 installPhase = ''
10 cp -a . $out
11 '';
12 buildInputs = [ sassc ];
13 });
14in
15spip.override {
16 ldap = true;
17 siteName = "chloe";
18 inherit environment siteDir varDir;
19}
diff --git a/modules/private/websites/chloe/builder.nix b/modules/private/websites/chloe/builder.nix
deleted file mode 100644
index bce2b4d..0000000
--- a/modules/private/websites/chloe/builder.nix
+++ /dev/null
@@ -1,99 +0,0 @@
1{ apacheUser, apacheGroup, chloe, config }:
2rec {
3 app = chloe.override { inherit (config) environment; };
4 phpFpm = rec {
5 serviceDeps = [ "mysql.service" ];
6 pool = {
7 "listen.owner" = apacheUser;
8 "listen.group" = apacheGroup;
9 "php_admin_value[upload_max_filesize]" = "20M";
10 "php_admin_value[post_max_size]" = "20M";
11 # "php_admin_flag[log_errors]" = "on";
12 "php_admin_value[open_basedir]" = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp";
13 "php_admin_value[session.save_path]" = "${app.varDir}/phpSessions";
14 } // (if app.environment == "dev" then {
15 "pm" = "ondemand";
16 "pm.max_children" = "5";
17 "pm.process_idle_timeout" = "60";
18 } else {
19 "pm" = "dynamic";
20 "pm.max_children" = "20";
21 "pm.start_servers" = "2";
22 "pm.min_spare_servers" = "1";
23 "pm.max_spare_servers" = "3";
24 });
25 };
26 keys = [{
27 dest = "webapps/${app.environment}-chloe";
28 user = apacheUser;
29 group = apacheGroup;
30 permissions = "0400";
31 text = ''
32 SetEnv SPIP_CONFIG_DIR "${configDir}"
33 SetEnv SPIP_VAR_DIR "${app.varDir}"
34 SetEnv SPIP_SITE "chloe-${app.environment}"
35 SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu"
36 SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu"
37 SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}"
38 SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}"
39 SetEnv SPIP_LDAP_SEARCH "${config.ldap.filter}"
40 SetEnv SPIP_MYSQL_HOST "${config.mysql.host}"
41 SetEnv SPIP_MYSQL_PORT "${config.mysql.port}"
42 SetEnv SPIP_MYSQL_DB "${config.mysql.database}"
43 SetEnv SPIP_MYSQL_USER "${config.mysql.user}"
44 SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}"
45 '';
46 }];
47 apache = rec {
48 modules = [ "proxy_fcgi" ];
49 webappName = "chloe_${app.environment}";
50 root = "/run/current-system/webapps/${webappName}";
51 vhostConf = socket: ''
52 Include /var/secrets/webapps/${app.environment}-chloe
53
54 RewriteEngine On
55 ${if app.environment == "prod" then ''
56 RewriteRule ^/news.rss /spip.php?page=backend&id_rubrique=1
57 '' else ""}
58
59 <FilesMatch "\.php$">
60 SetHandler "proxy:unix:${socket}|fcgi://localhost"
61 </FilesMatch>
62
63 <Directory ${root}>
64 DirectoryIndex index.php index.htm index.html
65 Options -Indexes +FollowSymLinks +MultiViews +Includes
66 Include ${root}/htaccess.txt
67
68 AllowOverride AuthConfig FileInfo Limit
69 Require all granted
70 </Directory>
71
72 <DirectoryMatch "${root}/squelettes">
73 Require all denied
74 </DirectoryMatch>
75
76 <FilesMatch "(.htaccess|rewrite-rules|.gitignore)$">
77 Require all denied
78 </FilesMatch>
79
80 ${if app.environment == "dev" then ''
81 <Location />
82 Use LDAPConnect
83 Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
84 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://osteopathe-cc.fr\"></html>"
85 </Location>
86 '' else ''
87 Use Stats osteopathe-cc.fr
88 ''}
89 '';
90 };
91 activationScript = {
92 deps = [ "wrappers" ];
93 text = ''
94 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local
95 install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
96 '';
97 };
98 configDir = ./config;
99}
diff --git a/modules/private/websites/chloe/integration.nix b/modules/private/websites/chloe/integration.nix
index caf6548..6d16a86 100644
--- a/modules/private/websites/chloe/integration.nix
+++ b/modules/private/websites/chloe/integration.nix
@@ -1,43 +1,115 @@
1{ lib, pkgs, config, ... }: 1{ lib, pkgs, config, ... }:
2let 2let
3 chloe = pkgs.callPackage ./builder.nix { 3 apacheUser = config.services.httpd.Inte.user;
4 inherit (pkgs.webapps) chloe; 4 apacheGroup = config.services.httpd.Inte.group;
5 config = config.myEnv.websites.chloe.integration; 5 ccfg = config.myEnv.websites.chloe.integration;
6 apacheUser = config.services.httpd.Inte.user; 6 app = pkgs.callPackage ./app {
7 apacheGroup = config.services.httpd.Inte.group; 7 inherit (ccfg) environment;
8 inherit (pkgs.webapps) spip;
9 varDir = "/var/lib/chloe_integration";
8 }; 10 };
9
10 cfg = config.myServices.websites.chloe.integration; 11 cfg = config.myServices.websites.chloe.integration;
12 webappdir = config.services.websites.webappDirsPaths.chloe_integration;
11in { 13in {
12 options.myServices.websites.chloe.integration.enable = lib.mkEnableOption "enable Chloe's website in integration"; 14 options.myServices.websites.chloe.integration.enable = lib.mkEnableOption "enable Chloe's website in integration";
13 15
14 config = lib.mkIf cfg.enable { 16 config = lib.mkIf cfg.enable {
15 services.duplyBackup.profiles.chloe_dev.rootDir = chloe.app.varDir; 17 services.duplyBackup.profiles.chloe_integration.rootDir = app.varDir;
16 secrets.keys = chloe.keys; 18 secrets.keys = [
17 systemd.services.phpfpm-chloe_dev.after = lib.mkAfter chloe.phpFpm.serviceDeps; 19 {
18 systemd.services.phpfpm-chloe_dev.wants = chloe.phpFpm.serviceDeps; 20 dest = "websites/chloe/integration";
19 services.phpfpm.pools.chloe_dev = { 21 user = apacheUser;
22 group = apacheGroup;
23 permissions = "0400";
24 text = ''
25 SetEnv SPIP_CONFIG_DIR "${./config}"
26 SetEnv SPIP_VAR_DIR "${app.varDir}"
27 SetEnv SPIP_SITE "chloe-${app.environment}"
28 SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu"
29 SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu"
30 SetEnv SPIP_LDAP_SEARCH_DN "${ccfg.ldap.dn}"
31 SetEnv SPIP_LDAP_SEARCH_PW "${ccfg.ldap.password}"
32 SetEnv SPIP_LDAP_SEARCH "${ccfg.ldap.filter}"
33 SetEnv SPIP_MYSQL_HOST "${ccfg.mysql.host}"
34 SetEnv SPIP_MYSQL_PORT "${ccfg.mysql.port}"
35 SetEnv SPIP_MYSQL_DB "${ccfg.mysql.database}"
36 SetEnv SPIP_MYSQL_USER "${ccfg.mysql.user}"
37 SetEnv SPIP_MYSQL_PASSWORD "${ccfg.mysql.password}"
38 '';
39 }
40 ];
41 systemd.services.phpfpm-chloe_integration.after = lib.mkAfter [ "mysql.service" ];
42 systemd.services.phpfpm-chloe_integration.wants = [ "mysql.service" ];
43 services.phpfpm.pools.chloe_integration = {
20 user = config.services.httpd.Inte.user; 44 user = config.services.httpd.Inte.user;
21 group = config.services.httpd.Inte.group; 45 group = config.services.httpd.Inte.group;
22 settings = chloe.phpFpm.pool; 46 settings = {
47 "listen.owner" = apacheUser;
48 "listen.group" = apacheGroup;
49 "php_admin_value[upload_max_filesize]" = "20M";
50 "php_admin_value[post_max_size]" = "20M";
51 # "php_admin_flag[log_errors]" = "on";
52 "php_admin_value[open_basedir]" = "${app.spipConfig}:${./config}:${app}:${app.varDir}:/tmp";
53 "php_admin_value[session.save_path]" = "${app.varDir}/phpSessions";
54 "pm" = "ondemand";
55 "pm.max_children" = "5";
56 "pm.process_idle_timeout" = "60";
57 };
23 phpOptions = config.services.phpfpm.phpOptions + '' 58 phpOptions = config.services.phpfpm.phpOptions + ''
24 extension=${pkgs.php}/lib/php/extensions/mysqli.so 59 extension=${pkgs.php}/lib/php/extensions/mysqli.so
25 ''; 60 '';
26 }; 61 };
27 system.activationScripts.chloe_dev = chloe.activationScript; 62 system.activationScripts.chloe_integration = {
28 myServices.websites.webappDirs."${chloe.apache.webappName}" = chloe.app.webRoot; 63 deps = [ "wrappers" ];
29 services.websites.env.integration.modules = chloe.apache.modules; 64 text = ''
30 services.websites.env.integration.vhostConfs.chloe = { 65 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local
66 install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
67 '';
68 };
69 services.websites.webappDirs.chloe_integration = app.webRoot;
70 services.websites.env.integration.modules = [ "proxy_fcgi" ];
71 services.websites.env.integration.vhostConfs.chloe_integration = {
31 certName = "integration"; 72 certName = "integration";
32 addToCerts = true; 73 addToCerts = true;
33 hosts = ["chloe.immae.eu" ]; 74 hosts = ["chloe.immae.eu" ];
34 root = chloe.apache.root; 75 root = webappdir;
35 extraConfig = [ 76 extraConfig = [
36 (chloe.apache.vhostConf config.services.phpfpm.pools.chloe_dev.socket) 77 ''
78 Include ${config.secrets.fullPaths."websites/chloe/integration"}
79
80 RewriteEngine On
81
82 <FilesMatch "\.php$">
83 SetHandler "proxy:unix:${config.services.phpfpm.pools.chloe_integration.socket}|fcgi://localhost"
84 </FilesMatch>
85
86 <Directory ${webappdir}>
87 DirectoryIndex index.php index.htm index.html
88 Options -Indexes +FollowSymLinks +MultiViews +Includes
89 Include ${webappdir}/htaccess.txt
90
91 AllowOverride AuthConfig FileInfo Limit
92 Require all granted
93 </Directory>
94
95 <DirectoryMatch "${webappdir}/squelettes">
96 Require all denied
97 </DirectoryMatch>
98
99 <FilesMatch "(.htaccess|rewrite-rules|.gitignore)$">
100 Require all denied
101 </FilesMatch>
102
103 <Location />
104 Use LDAPConnect
105 Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
106 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://osteopathe-cc.fr\"></html>"
107 </Location>
108 ''
37 ]; 109 ];
38 }; 110 };
39 services.websites.env.integration.watchPaths = [ 111 services.websites.env.integration.watchPaths = [
40 "/var/secrets/webapps/${chloe.app.environment}-chloe" 112 config.secrets.fullPaths."websites/chloe/integration"
41 ]; 113 ];
42 }; 114 };
43} 115}
diff --git a/modules/private/websites/chloe/production.nix b/modules/private/websites/chloe/production.nix
index 83f6c9b..067e8e7 100644
--- a/modules/private/websites/chloe/production.nix
+++ b/modules/private/websites/chloe/production.nix
@@ -1,50 +1,120 @@
1{ lib, pkgs, config, ... }: 1{ lib, pkgs, config, ... }:
2let 2let
3 chloe = pkgs.callPackage ./builder.nix { 3 apacheUser = config.services.httpd.Prod.user;
4 inherit (pkgs.webapps) chloe; 4 apacheGroup = config.services.httpd.Prod.group;
5 config = config.myEnv.websites.chloe.production; 5 ccfg = config.myEnv.websites.chloe.production;
6 apacheUser = config.services.httpd.Prod.user; 6 app = pkgs.callPackage ./app {
7 apacheGroup = config.services.httpd.Prod.group; 7 inherit (ccfg) environment;
8 inherit (pkgs.webapps) spip;
9 varDir = "/var/lib/chloe_production";
8 }; 10 };
9
10 cfg = config.myServices.websites.chloe.production; 11 cfg = config.myServices.websites.chloe.production;
12 webappdir = config.services.websites.webappDirsPaths.chloe_production;
11in { 13in {
12 options.myServices.websites.chloe.production.enable = lib.mkEnableOption "enable Chloe's website in production"; 14 options.myServices.websites.chloe.production.enable = lib.mkEnableOption "enable Chloe's website in production";
13 15
14 config = lib.mkIf cfg.enable { 16 config = lib.mkIf cfg.enable {
15 services.duplyBackup.profiles.chloe_prod.rootDir = chloe.app.varDir; 17 services.duplyBackup.profiles.chloe_production.rootDir = app.varDir;
16 secrets.keys = chloe.keys; 18 secrets.keys = [
19 {
20 dest = "websites/chloe/production";
21 user = apacheUser;
22 group = apacheGroup;
23 permissions = "0400";
24 text = ''
25 SetEnv SPIP_CONFIG_DIR "${./config}"
26 SetEnv SPIP_VAR_DIR "${app.varDir}"
27 SetEnv SPIP_SITE "chloe-${app.environment}"
28 SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu"
29 SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu"
30 SetEnv SPIP_LDAP_SEARCH_DN "${ccfg.ldap.dn}"
31 SetEnv SPIP_LDAP_SEARCH_PW "${ccfg.ldap.password}"
32 SetEnv SPIP_LDAP_SEARCH "${ccfg.ldap.filter}"
33 SetEnv SPIP_MYSQL_HOST "${ccfg.mysql.host}"
34 SetEnv SPIP_MYSQL_PORT "${ccfg.mysql.port}"
35 SetEnv SPIP_MYSQL_DB "${ccfg.mysql.database}"
36 SetEnv SPIP_MYSQL_USER "${ccfg.mysql.user}"
37 SetEnv SPIP_MYSQL_PASSWORD "${ccfg.mysql.password}"
38 '';
39 }
40 ];
17 services.webstats.sites = [ { name = "osteopathe-cc.fr"; } ]; 41 services.webstats.sites = [ { name = "osteopathe-cc.fr"; } ];
18 42
19 systemd.services.phpfpm-chloe_prod.after = lib.mkAfter chloe.phpFpm.serviceDeps; 43 systemd.services.phpfpm-chloe_production.after = lib.mkAfter [ "mysql.service" ];
20 systemd.services.phpfpm-chloe_prod.wants = chloe.phpFpm.serviceDeps; 44 systemd.services.phpfpm-chloe_production.wants = [ "mysql.service" ];
21 services.phpfpm.pools.chloe_prod = { 45 services.phpfpm.pools.chloe_production = {
22 user = config.services.httpd.Prod.user; 46 user = config.services.httpd.Prod.user;
23 group = config.services.httpd.Prod.group; 47 group = config.services.httpd.Prod.group;
24 settings = chloe.phpFpm.pool; 48 settings = {
49 "listen.owner" = apacheUser;
50 "listen.group" = apacheGroup;
51 "php_admin_value[upload_max_filesize]" = "20M";
52 "php_admin_value[post_max_size]" = "20M";
53 # "php_admin_flag[log_errors]" = "on";
54 "php_admin_value[open_basedir]" = "${app.spipConfig}:${./config}:${app}:${app.varDir}:/tmp";
55 "php_admin_value[session.save_path]" = "${app.varDir}/phpSessions";
56 "pm" = "dynamic";
57 "pm.max_children" = "20";
58 "pm.start_servers" = "2";
59 "pm.min_spare_servers" = "1";
60 "pm.max_spare_servers" = "3";
61 };
25 phpOptions = config.services.phpfpm.phpOptions + '' 62 phpOptions = config.services.phpfpm.phpOptions + ''
26 extension=${pkgs.php}/lib/php/extensions/mysqli.so 63 extension=${pkgs.php}/lib/php/extensions/mysqli.so
27 ''; 64 '';
28 }; 65 };
29 system.activationScripts.chloe_prod = chloe.activationScript; 66 system.activationScripts.chloe_production = {
30 myServices.websites.webappDirs."${chloe.apache.webappName}" = chloe.app.webRoot; 67 deps = [ "wrappers" ];
31 services.websites.env.production.modules = chloe.apache.modules; 68 text = ''
69 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local
70 install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
71 '';
72 };
73 services.websites.webappDirs.chloe_production = app.webRoot;
74 services.websites.env.production.modules = [ "proxy_fcgi" ];
32 services.websites.env.production.vhostConfs.chloe = { 75 services.websites.env.production.vhostConfs.chloe = {
33 certName = "chloe"; 76 certName = "chloe";
34 certMainHost = "osteopathe-cc.fr"; 77 certMainHost = "osteopathe-cc.fr";
35 hosts = ["osteopathe-cc.fr" "www.osteopathe-cc.fr" ]; 78 hosts = ["osteopathe-cc.fr" "www.osteopathe-cc.fr" ];
36 root = chloe.apache.root; 79 root = webappdir;
37 extraConfig = [ 80 extraConfig = [
38 '' 81 ''
82 Use Stats osteopathe-cc.fr
83
39 RewriteEngine On 84 RewriteEngine On
40 RewriteCond "%{HTTP_HOST}" "!^www\.osteopathe-cc\.fr$" [NC] 85 RewriteCond "%{HTTP_HOST}" "!^www\.osteopathe-cc\.fr$" [NC]
41 RewriteRule ^(.+)$ https://www.osteopathe-cc.fr$1 [R=302,L] 86 RewriteRule ^(.+)$ https://www.osteopathe-cc.fr$1 [R=302,L]
87
88 Include ${config.secrets.fullPaths."websites/chloe/production"}
89
90 RewriteEngine On
91 RewriteRule ^/news.rss /spip.php?page=backend&id_rubrique=1
92
93 <FilesMatch "\.php$">
94 SetHandler "proxy:unix:${config.services.phpfpm.pools.chloe_production.socket}|fcgi://localhost"
95 </FilesMatch>
96
97 <Directory ${webappdir}>
98 DirectoryIndex index.php index.htm index.html
99 Options -Indexes +FollowSymLinks +MultiViews +Includes
100 Include ${webappdir}/htaccess.txt
101
102 AllowOverride AuthConfig FileInfo Limit
103 Require all granted
104 </Directory>
105
106 <DirectoryMatch "${webappdir}/squelettes">
107 Require all denied
108 </DirectoryMatch>
109
110 <FilesMatch "(.htaccess|rewrite-rules|.gitignore)$">
111 Require all denied
112 </FilesMatch>
42 '' 113 ''
43 (chloe.apache.vhostConf config.services.phpfpm.pools.chloe_prod.socket)
44 ]; 114 ];
45 }; 115 };
46 services.websites.env.production.watchPaths = [ 116 services.websites.env.production.watchPaths = [
47 "/var/secrets/webapps/${chloe.app.environment}-chloe" 117 config.secrets.fullPaths."websites/chloe/production"
48 ]; 118 ];
49 }; 119 };
50} 120}
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-10 14:53:53 +0000