Move personal websites to modules

4 files changed, 258 insertions, 0 deletions

diff --git a/modules/private/websites/florian/app.nix b/modules/private/websites/florian/app.nix
new file mode 100644
index 0000000..08506e1
--- /dev/null
+++ b/modules/private/websites/florian/app.nix
@@ -0,0 +1,38 @@
+{ lib, pkgs, config, myconfig,  ... }:
+let
+  adminer = pkgs.callPackage ../commons/adminer.nix {};
+
+  tellesflorian  = pkgs.callPackage ./builder_app.nix {
+    inherit (pkgs.webapps) tellesflorian;
+    config = myconfig.env.websites.tellesflorian.integration;
+    apacheUser = config.services.httpd.Inte.user;
+    apacheGroup = config.services.httpd.Inte.group;
+  };
+
+  cfg = config.myServices.websites.florian.app;
+in {
+  options.myServices.websites.florian.app.enable = lib.mkEnableOption "enable Florian's app in integration";
+
+  config = lib.mkIf cfg.enable {
+    secrets.keys = tellesflorian.keys;
+    services.myPhpfpm.preStart.tellesflorian_dev = tellesflorian.phpFpm.preStart;
+    services.myPhpfpm.serviceDependencies.tellesflorian_dev = tellesflorian.phpFpm.serviceDeps;
+    services.myPhpfpm.poolConfigs.tellesflorian_dev = tellesflorian.phpFpm.pool;
+    system.activationScripts.tellesflorian_dev = tellesflorian.activationScript;
+    system.extraSystemBuilderCmds = ''
+      mkdir -p $out/webapps
+      ln -s ${tellesflorian.app.webRoot} $out/webapps/${tellesflorian.apache.webappName}
+      '';
+    services.websites.integration.modules = adminer.apache.modules ++ tellesflorian.apache.modules;
+    services.websites.integration.vhostConfs.tellesflorian = {
+      certName    = "eldiron";
+      addToCerts  = true;
+      hosts       = ["app.tellesflorian.com" ];
+      root        = tellesflorian.apache.root;
+      extraConfig = [
+        tellesflorian.apache.vhostConf
+        adminer.apache.vhostConf
+      ];
+    };
+  };
+}
diff --git a/modules/private/websites/florian/builder_app.nix b/modules/private/websites/florian/builder_app.nix
new file mode 100644
index 0000000..e521f6e
--- /dev/null
+++ b/modules/private/websites/florian/builder_app.nix
@@ -0,0 +1,152 @@
+{ apacheUser, apacheGroup, tellesflorian, config }:
+rec {
+  app = tellesflorian.override { inherit (config) environment; };
+  keys = [
+    {
+      dest = "webapps/${app.environment}-tellesflorian-passwords";
+      user = apacheUser;
+      group = apacheGroup;
+      permissions = "0400";
+      text = ''
+        invite:${config.invite_passwords}
+      '';
+    }
+    {
+      dest = "webapps/${app.environment}-tellesflorian";
+      user = apacheUser;
+      group = apacheGroup;
+      permissions = "0400";
+      text = ''
+        # This file is auto-generated during the composer install
+        parameters:
+          database_host: ${config.mysql.host}
+          database_port: ${config.mysql.port}
+          database_name: ${config.mysql.name}
+          database_user: ${config.mysql.user}
+          database_password: ${config.mysql.password}
+          mailer_transport: smtp
+          mailer_host: 127.0.0.1
+          mailer_user: null
+          mailer_password: null
+          secret: ${config.secret}
+      '';
+    }
+  ];
+  phpFpm = rec {
+    preStart = ''
+      if [ ! -f "${app.varDir}/currentWebappDir" -o \
+          ! -f "${app.varDir}/currentKey" -o \
+          "${app}" != "$(cat ${app.varDir}/currentWebappDir 2>/dev/null)" ] \
+          || ! sha512sum -c --status ${app.varDir}/currentKey; then
+        pushd ${app} > /dev/null
+        /run/wrappers/bin/sudo -u wwwrun ./bin/console --env=${app.environment} cache:clear --no-warmup
+        popd > /dev/null
+        echo -n "${app}" > ${app.varDir}/currentWebappDir
+        sha512sum /var/secrets/webapps/${app.environment}-tellesflorian > ${app.varDir}/currentKey
+      fi
+      '';
+    serviceDeps = [ "mysql.service" ];
+    socket = "/var/run/phpfpm/floriantelles-${app.environment}.sock";
+    pool = ''
+      listen = ${socket}
+      user = ${apacheUser}
+      group = ${apacheGroup}
+      listen.owner = ${apacheUser}
+      listen.group = ${apacheGroup}
+      php_admin_value[upload_max_filesize] = 20M
+      php_admin_value[post_max_size] = 20M
+      ;php_admin_flag[log_errors] = on
+      php_admin_value[open_basedir] = "/var/secrets/webapps/${app.environment}-tellesflorian:${app}:${app.varDir}:/tmp"
+      php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
+      ${if app.environment == "dev" then ''
+      pm = ondemand
+      pm.max_children = 5
+      pm.process_idle_timeout = 60
+      env[SYMFONY_DEBUG_MODE] = "yes"
+      '' else ''
+      pm = dynamic
+      pm.max_children = 20
+      pm.start_servers = 2
+      pm.min_spare_servers = 1
+      pm.max_spare_servers = 3
+      ''}'';
+  };
+  apache = rec {
+    modules = [ "proxy_fcgi" ];
+    webappName = "florian_${app.environment}";
+    root = "/run/current-system/webapps/${webappName}";
+    vhostConf = ''
+    <FilesMatch "\.php$">
+      SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+    </FilesMatch>
+
+    ${if app.environment == "dev" then ''
+    <Location />
+      AuthBasicProvider file ldap
+      Use LDAPConnect
+      Require ldap-group   cn=app.tellesflorian.com,cn=httpd,ou=services,dc=immae,dc=eu
+
+      AuthUserFile "/var/secrets/webapps/${app.environment}-tellesflorian-passwords"
+      Require user "invite"
+
+      ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://tellesflorian.com\"></html>"
+    </Location>
+
+    <Directory ${root}>
+      Options Indexes FollowSymLinks MultiViews Includes
+      AllowOverride None
+      Require all granted
+
+      DirectoryIndex app_dev.php
+
+      <IfModule mod_negotiation.c>
+      Options -MultiViews
+      </IfModule>
+
+      <IfModule mod_rewrite.c>
+        RewriteEngine On
+
+        RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
+        RewriteRule ^(.*) - [E=BASE:%1]
+
+        # Maintenance script
+        RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
+        RewriteCond %{SCRIPT_FILENAME} !maintenance.php
+        RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
+        ErrorDocument 503 /maintenance.php
+
+        # Sets the HTTP_AUTHORIZATION header removed by Apache
+        RewriteCond %{HTTP:Authorization} .
+        RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
+
+        RewriteCond %{ENV:REDIRECT_STATUS} ^$
+        RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
+
+        # If the requested filename exists, simply serve it.
+        # We only want to let Apache serve files and not directories.
+        RewriteCond %{REQUEST_FILENAME} -f
+        RewriteRule ^ - [L]
+
+        # Rewrite all other queries to the front controller.
+        RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
+      </IfModule>
+
+    </Directory>
+    '' else ''
+    <Directory ${root}>
+      Options Indexes FollowSymLinks MultiViews Includes
+      AllowOverride All
+      Require all granted
+    </Directory>
+    ''}
+    '';
+  };
+  activationScript = {
+    deps = [ "wrappers" ];
+    text = ''
+    install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} \
+      ${app.varDir}/var
+    install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
+    '';
+  };
+}
diff --git a/modules/private/websites/florian/integration.nix b/modules/private/websites/florian/integration.nix
new file mode 100644
index 0000000..424ebd4
--- /dev/null
+++ b/modules/private/websites/florian/integration.nix
@@ -0,0 +1,34 @@
+{ lib, pkgs, config, myconfig,  ... }:
+let
+    adminer = pkgs.callPackage ../commons/adminer.nix {};
+    cfg = config.myServices.websites.florian.integration;
+    varDir = "/var/lib/ftp/florian";
+    env = myconfig.env.websites.florian;
+in {
+  options.myServices.websites.florian.integration.enable = lib.mkEnableOption "enable Florian's website integration";
+
+  config = lib.mkIf cfg.enable {
+    security.acme.certs."ftp".extraDomains."florian.immae.eu" = null;
+
+    services.websites.integration.modules = adminer.apache.modules;
+    services.websites.integration.vhostConfs.florian = {
+      certName    = "eldiron";
+      addToCerts  = true;
+      hosts       = [ "florian.immae.eu" ];
+      root        = "${varDir}/florian.immae.eu";
+      extraConfig = [
+        adminer.apache.vhostConf
+        ''
+        ServerAdmin ${env.server_admin}
+
+        <Directory ${varDir}/florian.immae.eu>
+          DirectoryIndex index.php index.htm index.html
+          Options Indexes FollowSymLinks MultiViews Includes
+          AllowOverride None
+          Require all granted
+        </Directory>
+          ''
+      ];
+    };
+  };
+}
diff --git a/modules/private/websites/florian/production.nix b/modules/private/websites/florian/production.nix
new file mode 100644
index 0000000..9b310b8
--- /dev/null
+++ b/modules/private/websites/florian/production.nix
@@ -0,0 +1,34 @@
+{ lib, pkgs, config, myconfig,  ... }:
+let
+    adminer = pkgs.callPackage ../commons/adminer.nix {};
+    cfg = config.myServices.websites.florian.production;
+    varDir = "/var/lib/ftp/florian";
+    env = myconfig.env.websites.florian;
+in {
+  options.myServices.websites.florian.production.enable = lib.mkEnableOption "enable Florian's website production";
+
+  config = lib.mkIf cfg.enable {
+    security.acme.certs."ftp".extraDomains."tellesflorian.com" = null;
+
+    services.websites.production.modules = adminer.apache.modules;
+    services.websites.production.vhostConfs.florian = {
+      certName     = "florian";
+      certMainHost = "tellesflorian.com";
+      hosts        = [ "tellesflorian.com" "www.tellesflorian.com" ];
+      root         = "${varDir}/tellesflorian.com";
+      extraConfig  = [
+        adminer.apache.vhostConf
+        ''
+        ServerAdmin ${env.server_admin}
+
+        <Directory ${varDir}/tellesflorian.com>
+          DirectoryIndex index.php index.htm index.html
+          Options Indexes FollowSymLinks MultiViews Includes
+          AllowOverride None
+          Require all granted
+        </Directory>
+          ''
+      ];
+    };
+  };
+}