aboutsummaryrefslogtreecommitdiff
path: root/modules/private/websites/piedsjaloux
diff options
context:
space:
mode:
authorIsmaël Bouya <ismael.bouya@normalesup.org>2019-06-02 23:26:23 +0200
committerIsmaël Bouya <ismael.bouya@normalesup.org>2019-06-02 23:40:37 +0200
commit8164ed90c7fdd93fd035bce3dc1b3fc6bde9e30e (patch)
treec8f34a5f7ed6ac78d84c024a6a9e3dc847bbe8e5 /modules/private/websites/piedsjaloux
parent9f66adf4372a3b1c859dc053489f727aa360077e (diff)
downloadNix-8164ed90c7fdd93fd035bce3dc1b3fc6bde9e30e.tar.gz
Nix-8164ed90c7fdd93fd035bce3dc1b3fc6bde9e30e.tar.zst
Nix-8164ed90c7fdd93fd035bce3dc1b3fc6bde9e30e.zip
Move production php application to dedicated module
Diffstat (limited to 'modules/private/websites/piedsjaloux')
-rw-r--r--modules/private/websites/piedsjaloux/builder.nix142
-rw-r--r--modules/private/websites/piedsjaloux/production.nix95
2 files changed, 76 insertions, 161 deletions
diff --git a/modules/private/websites/piedsjaloux/builder.nix b/modules/private/websites/piedsjaloux/builder.nix
deleted file mode 100644
index d9a78b3..0000000
--- a/modules/private/websites/piedsjaloux/builder.nix
+++ /dev/null
@@ -1,142 +0,0 @@
1{ apacheUser, apacheGroup, piedsjaloux, config, pkgs, lib, mylibs, texlive, imagemagick }:
2rec {
3 app = piedsjaloux.override { inherit (config) environment; };
4 varDir = "/var/lib/piedsjaloux_${app.environment}";
5 keys = [{
6 dest = "webapps/${app.environment}-piedsjaloux";
7 user = apacheUser;
8 group = apacheGroup;
9 permissions = "0400";
10 text = ''
11 # This file is auto-generated during the composer install
12 parameters:
13 database_host: ${config.mysql.host}
14 database_port: ${config.mysql.port}
15 database_name: ${config.mysql.name}
16 database_user: ${config.mysql.user}
17 database_password: ${config.mysql.password}
18 database_server_version: ${pkgs.mariadb.mysqlVersion}
19 mailer_transport: smtp
20 mailer_host: 127.0.0.1
21 mailer_user: null
22 mailer_password: null
23 secret: ${config.secret}
24 pdflatex: "${texlive.combine { inherit (texlive) attachfile preprint scheme-small; }}/bin/pdflatex"
25 leapt_im:
26 binary_path: ${imagemagick}/bin
27 '';
28 }];
29 phpFpm = rec {
30 preStart = mylibs.phpFpmPreStart {
31 inherit app;
32 inherit (app) varDir;
33 keyFiles = [
34 "/var/secrets/webapps/${app.environment}-piedsjaloux"
35 ];
36 actions = [
37 "/run/wrappers/bin/sudo -u ${apacheUser} ./bin/console --env=${app.environment} cache:clear --no-warmup"
38 ];
39 };
40 serviceDeps = [ "mysql.service" ];
41 socket = "/var/run/phpfpm/piedsjaloux-${app.environment}.sock";
42 pool = ''
43 listen = ${socket}
44 user = ${apacheUser}
45 group = ${apacheGroup}
46 listen.owner = ${apacheUser}
47 listen.group = ${apacheGroup}
48 php_admin_value[upload_max_filesize] = 20M
49 php_admin_value[post_max_size] = 20M
50 ;php_admin_flag[log_errors] = on
51 php_admin_value[open_basedir] = "/var/secrets/webapps/${app.environment}-piedsjaloux:${app}:${app.varDir}:/tmp"
52 php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
53 env[PATH] = ${lib.makeBinPath [ pkgs.apg pkgs.unzip ]}
54 ${if app.environment == "dev" then ''
55 pm = ondemand
56 pm.max_children = 5
57 pm.process_idle_timeout = 60
58 env[SYMFONY_DEBUG_MODE] = "yes"
59 '' else ''
60 pm = dynamic
61 pm.max_children = 20
62 pm.start_servers = 2
63 pm.min_spare_servers = 1
64 pm.max_spare_servers = 3
65 ''}'';
66 };
67 apache = rec {
68 modules = [ "proxy_fcgi" ];
69 webappName = "piedsjaloux_${app.environment}";
70 root = "/run/current-system/webapps/${webappName}";
71 vhostConf = ''
72 <FilesMatch "\.php$">
73 SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
74 </FilesMatch>
75
76 ${if app.environment == "dev" then ''
77 <Location />
78 Use LDAPConnect
79 Require ldap-group cn=piedsjaloux.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
80 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://piedsjaloux.fr\"></html>"
81 </Location>
82
83 <Directory ${root}>
84 Options Indexes FollowSymLinks MultiViews Includes
85 AllowOverride None
86 Require all granted
87
88 DirectoryIndex app_dev.php
89
90 <IfModule mod_negotiation.c>
91 Options -MultiViews
92 </IfModule>
93
94 <IfModule mod_rewrite.c>
95 RewriteEngine On
96
97 RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
98 RewriteRule ^(.*) - [E=BASE:%1]
99
100 # Maintenance script
101 RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
102 RewriteCond %{SCRIPT_FILENAME} !maintenance.php
103 RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
104 ErrorDocument 503 /maintenance.php
105
106 # Sets the HTTP_AUTHORIZATION header removed by Apache
107 RewriteCond %{HTTP:Authorization} .
108 RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
109
110 RewriteCond %{ENV:REDIRECT_STATUS} ^$
111 RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
112
113 # If the requested filename exists, simply serve it.
114 # We only want to let Apache serve files and not directories.
115 RewriteCond %{REQUEST_FILENAME} -f
116 RewriteRule ^ - [L]
117
118 # Rewrite all other queries to the front controller.
119 RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
120 </IfModule>
121
122 </Directory>
123 '' else ''
124 Use Stats piedsjaloux.fr
125
126 <Directory ${root}>
127 Options Indexes FollowSymLinks MultiViews Includes
128 AllowOverride All
129 Require all granted
130 </Directory>
131 ''}
132 '';
133 };
134 activationScript = {
135 deps = [ "wrappers" ];
136 text = ''
137 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} \
138 ${app.varDir}/tmp
139 install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
140 '';
141 };
142}
diff --git a/modules/private/websites/piedsjaloux/production.nix b/modules/private/websites/piedsjaloux/production.nix
index 30066a5..9007f19 100644
--- a/modules/private/websites/piedsjaloux/production.nix
+++ b/modules/private/websites/piedsjaloux/production.nix
@@ -1,34 +1,91 @@
1{ lib, pkgs, config, myconfig, ... }: 1{ lib, pkgs, config, myconfig, ... }:
2let 2let
3 piedsjaloux = pkgs.callPackage ./builder.nix { 3 secrets = myconfig.env.websites.piedsjaloux.production;
4 inherit (pkgs.webapps) piedsjaloux; 4 app = pkgs.webapps.piedsjaloux.override { environment = secrets.environment; };
5 config = myconfig.env.websites.piedsjaloux.production;
6 apacheUser = config.services.httpd.Prod.user;
7 apacheGroup = config.services.httpd.Prod.group;
8 };
9
10 cfg = config.myServices.websites.piedsjaloux.production; 5 cfg = config.myServices.websites.piedsjaloux.production;
6 pcfg = config.services.phpApplication;
11in { 7in {
12 options.myServices.websites.piedsjaloux.production.enable = lib.mkEnableOption "enable PiedsJaloux's website in production"; 8 options.myServices.websites.piedsjaloux.production.enable = lib.mkEnableOption "enable PiedsJaloux's website in production";
13 9
14 config = lib.mkIf cfg.enable { 10 config = lib.mkIf cfg.enable {
15 secrets.keys = piedsjaloux.keys;
16 services.webstats.sites = [ { name = "piedsjaloux.fr"; } ]; 11 services.webstats.sites = [ { name = "piedsjaloux.fr"; } ];
12 services.phpApplication.apps.piedsjaloux_prod = {
13 websiteEnv = "production";
14 httpdUser = config.services.httpd.Prod.user;
15 httpdGroup = config.services.httpd.Prod.group;
16 inherit (app) webRoot varDir;
17 varDirPaths = {
18 "tmp" = "0700";
19 };
20 inherit app;
21 serviceDeps = [ "mysql.service" ];
22 preStartActions = [
23 "./bin/console --env=${app.environment} cache:clear --no-warmup"
24 ];
25 phpOpenbasedir = [ "/tmp" ];
26 phpPool = ''
27 php_admin_value[upload_max_filesize] = 20M
28 php_admin_value[post_max_size] = 20M
29 ;php_admin_flag[log_errors] = on
30 env[PATH] = ${lib.makeBinPath [ pkgs.apg pkgs.unzip ]}
31 pm = dynamic
32 pm.max_children = 20
33 pm.start_servers = 2
34 pm.min_spare_servers = 1
35 pm.max_spare_servers = 3
36 '';
37 phpWatchFiles = [
38 config.secrets.fullPaths."webapps/${app.environment}-piedsjaloux"
39 ];
40 };
41
42 secrets.keys = [
43 {
44 dest = "webapps/${app.environment}-piedsjaloux";
45 user = config.services.httpd.Prod.user;
46 group = config.services.httpd.Prod.group;
47 permissions = "0400";
48 text = ''
49 # This file is auto-generated during the composer install
50 parameters:
51 database_host: ${secrets.mysql.host}
52 database_port: ${secrets.mysql.port}
53 database_name: ${secrets.mysql.name}
54 database_user: ${secrets.mysql.user}
55 database_password: ${secrets.mysql.password}
56 database_server_version: ${pkgs.mariadb.mysqlVersion}
57 mailer_transport: smtp
58 mailer_host: 127.0.0.1
59 mailer_user: null
60 mailer_password: null
61 secret: ${secrets.secret}
62 pdflatex: "${pkgs.texlive.combine { inherit (pkgs.texlive) attachfile preprint scheme-small; }}/bin/pdflatex"
63 leapt_im:
64 binary_path: ${pkgs.imagemagick}/bin
65 '';
66 }
67 ];
17 68
18 systemd.services.phpfpm-piedsjaloux_prod.after = lib.mkAfter piedsjaloux.phpFpm.serviceDeps; 69 services.websites.env.production.vhostConfs.piedsjaloux_prod = {
19 systemd.services.phpfpm-piedsjaloux_prod.wants = piedsjaloux.phpFpm.serviceDeps;
20 systemd.services.phpfpm-piedsjaloux_prod.preStart = lib.mkAfter piedsjaloux.phpFpm.preStart;
21 services.phpfpm.poolConfigs.piedsjaloux_prod = piedsjaloux.phpFpm.pool;
22 system.activationScripts.piedsjaloux_prod = piedsjaloux.activationScript;
23 myServices.websites.webappDirs."${piedsjaloux.apache.webappName}" = piedsjaloux.app.webRoot;
24 services.websites.env.production.modules = piedsjaloux.apache.modules;
25 services.websites.env.production.vhostConfs.piedsjaloux = {
26 certName = "piedsjaloux"; 70 certName = "piedsjaloux";
27 certMainHost = "piedsjaloux.fr"; 71 certMainHost = "piedsjaloux.fr";
28 hosts = [ "piedsjaloux.fr" "www.piedsjaloux.fr" ]; 72 hosts = [ "piedsjaloux.fr" "www.piedsjaloux.fr" ];
29 root = piedsjaloux.apache.root; 73 root = pcfg.webappDirs.piedsjaloux_prod;
30 extraConfig = [ piedsjaloux.apache.vhostConf ]; 74 extraConfig = [
75 ''
76 <FilesMatch "\.php$">
77 SetHandler "proxy:unix:${pcfg.phpListenPaths.piedsjaloux_prod}|fcgi://localhost"
78 </FilesMatch>
79
80 Use Stats piedsjaloux.fr
81
82 <Directory ${pcfg.webappDirs.piedsjaloux_prod}>
83 Options Indexes FollowSymLinks MultiViews Includes
84 AllowOverride All
85 Require all granted
86 </Directory>
87 ''
88 ];
31 }; 89 };
32 }; 90 };
33} 91}
34
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-09 19:51:44 +0000