aboutsummaryrefslogtreecommitdiff
path: root/modules/private/websites
diff options
context:
space:
mode:
authorIsmaël Bouya <ismael.bouya@normalesup.org>2019-06-02 14:31:25 +0200
committerIsmaël Bouya <ismael.bouya@normalesup.org>2019-06-02 22:08:03 +0200
commit1594c8da6fbb4ffa09ab970fb887cea61c572f60 (patch)
tree12c9bb94173f3d7ba67a70f1846f5cd381f2c985 /modules/private/websites
parent717ccfd957e686d773480df817387aebbe79aa48 (diff)
downloadNix-1594c8da6fbb4ffa09ab970fb887cea61c572f60.tar.gz
Nix-1594c8da6fbb4ffa09ab970fb887cea61c572f60.tar.zst
Nix-1594c8da6fbb4ffa09ab970fb887cea61c572f60.zip
Move florian php configuration to dedicated module
Diffstat (limited to 'modules/private/websites')
-rw-r--r--modules/private/websites/florian/app.nix150
-rw-r--r--modules/private/websites/florian/builder_app.nix150
2 files changed, 125 insertions, 175 deletions
diff --git a/modules/private/websites/florian/app.nix b/modules/private/websites/florian/app.nix
index 00fe644..5ce073a 100644
--- a/modules/private/websites/florian/app.nix
+++ b/modules/private/websites/florian/app.nix
@@ -1,40 +1,140 @@
1{ lib, pkgs, config, myconfig, ... }: 1{ lib, pkgs, config, myconfig, ... }:
2let 2let
3 adminer = pkgs.callPackage ../commons/adminer.nix {}; 3 adminer = pkgs.callPackage ../commons/adminer.nix {};
4 4 secrets = myconfig.env.websites.tellesflorian.integration;
5 tellesflorian = pkgs.callPackage ./builder_app.nix { 5 app = pkgs.webapps.tellesflorian.override { environment = secrets.environment; };
6 inherit (pkgs.webapps) tellesflorian;
7 config = myconfig.env.websites.tellesflorian.integration;
8 apacheUser = config.services.httpd.Inte.user;
9 apacheGroup = config.services.httpd.Inte.group;
10 };
11
12 cfg = config.myServices.websites.florian.app; 6 cfg = config.myServices.websites.florian.app;
7 pcfg = config.services.phpApplication;
13in { 8in {
14 options.myServices.websites.florian.app.enable = lib.mkEnableOption "enable Florian's app in integration"; 9 options.myServices.websites.florian.app.enable = lib.mkEnableOption "enable Florian's app in integration";
15 10
16 config = lib.mkIf cfg.enable { 11 config = lib.mkIf cfg.enable {
17 secrets.keys = tellesflorian.keys; 12 services.phpApplication.apps.florian_dev = {
18 systemd.services.phpfpm-tellesflorian_dev.after = lib.mkAfter tellesflorian.phpFpm.serviceDeps; 13 websiteEnv = "integration";
19 systemd.services.phpfpm-tellesflorian_dev.wants = tellesflorian.phpFpm.serviceDeps; 14 httpdUser = config.services.httpd.Inte.user;
20 systemd.services.phpfpm-tellesflorian_dev.preStart = lib.mkAfter tellesflorian.phpFpm.preStart; 15 httpdGroup = config.services.httpd.Inte.group;
21 services.phpfpm.poolConfigs.tellesflorian_dev = tellesflorian.phpFpm.pool; 16 inherit (app) webRoot varDir;
22 system.activationScripts.tellesflorian_dev = tellesflorian.activationScript; 17 varDirPaths = {
23 myServices.websites.webappDirs."${tellesflorian.apache.webappName}" = tellesflorian.app.webRoot; 18 "var" = "0700";
24 services.websites.env.integration.modules = adminer.apache.modules ++ tellesflorian.apache.modules; 19 };
25 services.websites.env.integration.vhostConfs.tellesflorian = { 20 inherit app;
26 certName = "eldiron"; 21 serviceDeps = [ "mysql.service" ];
22 preStartActions = [
23 "./bin/console --env=${app.environment} cache:clear --no-warmup"
24 ];
25 phpOpenbasedir = [ "/tmp" ];
26 phpPool = ''
27 php_admin_value[upload_max_filesize] = 20M
28 php_admin_value[post_max_size] = 20M
29 ;php_admin_flag[log_errors] = on
30 pm = ondemand
31 pm.max_children = 5
32 pm.process_idle_timeout = 60
33 env[SYMFONY_DEBUG_MODE] = "yes"
34 '';
35 phpWatchFiles = [
36 config.secrets.fullPaths."webapps/${app.environment}-tellesflorian"
37 ];
38 };
39
40 secrets.keys = [
41 {
42 dest = "webapps/${app.environment}-tellesflorian-passwords";
43 user = config.services.httpd.Inte.user;
44 group = config.services.httpd.Inte.user;
45 permissions = "0400";
46 text = ''
47 invite:${secrets.invite_passwords}
48 '';
49 }
50 {
51 dest = "webapps/${app.environment}-tellesflorian";
52 user = config.services.httpd.Inte.user;
53 group = config.services.httpd.Inte.user;
54 permissions = "0400";
55 text = ''
56 # This file is auto-generated during the composer install
57 parameters:
58 database_host: ${secrets.mysql.host}
59 database_port: ${secrets.mysql.port}
60 database_name: ${secrets.mysql.name}
61 database_user: ${secrets.mysql.user}
62 database_password: ${secrets.mysql.password}
63 mailer_transport: smtp
64 mailer_host: 127.0.0.1
65 mailer_user: null
66 mailer_password: null
67 secret: ${secrets.secret}
68 '';
69 }
70 ];
71
72 services.websites.env.integration.modules = adminer.apache.modules;
73 services.websites.env.integration.vhostConfs.florian_dev = {
74 certName = "eldiron";
27 addToCerts = true; 75 addToCerts = true;
28 hosts = ["app.tellesflorian.com" ]; 76 hosts = [ "app.tellesflorian.com" ];
29 root = tellesflorian.apache.root; 77 root = pcfg.webappDirs.florian_dev;
30 extraConfig = [ 78 extraConfig = [
31 tellesflorian.apache.vhostConf 79 ''
80 <FilesMatch "\.php$">
81 SetHandler "proxy:unix:${pcfg.phpListenPaths.florian_dev}|fcgi://localhost"
82 </FilesMatch>
83
84 <Location />
85 AuthBasicProvider file ldap
86 Use LDAPConnect
87 Require ldap-group cn=app.tellesflorian.com,cn=httpd,ou=services,dc=immae,dc=eu
88
89 AuthUserFile "${config.secrets.fullPaths."webapps/${app.environment}-tellesflorian-passwords"}"
90 Require user "invite"
91
92 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://tellesflorian.com\"></html>"
93 </Location>
94
95 <Directory ${pcfg.webappDirs.florian_dev}>
96 Options Indexes FollowSymLinks MultiViews Includes
97 AllowOverride None
98 Require all granted
99
100 DirectoryIndex app_dev.php
101
102 <IfModule mod_negotiation.c>
103 Options -MultiViews
104 </IfModule>
105
106 <IfModule mod_rewrite.c>
107 RewriteEngine On
108
109 RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
110 RewriteRule ^(.*) - [E=BASE:%1]
111
112 # Maintenance script
113 RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
114 RewriteCond %{SCRIPT_FILENAME} !maintenance.php
115 RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
116 ErrorDocument 503 /maintenance.php
117
118 # Sets the HTTP_AUTHORIZATION header removed by Apache
119 RewriteCond %{HTTP:Authorization} .
120 RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
121
122 RewriteCond %{ENV:REDIRECT_STATUS} ^$
123 RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
124
125 # If the requested filename exists, simply serve it.
126 # We only want to let Apache serve files and not directories.
127 RewriteCond %{REQUEST_FILENAME} -f
128 RewriteRule ^ - [L]
129
130 # Rewrite all other queries to the front controller.
131 RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
132 </IfModule>
133
134 </Directory>
135 ''
32 adminer.apache.vhostConf 136 adminer.apache.vhostConf
33 ]; 137 ];
34 }; 138 };
35 services.filesWatcher.phpfpm-tellesflorian_dev = {
36 restart = true;
37 paths = [ "/var/secrets/webapps/${tellesflorian.app.environment}-tellesflorian" ];
38 };
39 }; 139 };
40} 140}
diff --git a/modules/private/websites/florian/builder_app.nix b/modules/private/websites/florian/builder_app.nix
deleted file mode 100644
index c12663a..0000000
--- a/modules/private/websites/florian/builder_app.nix
+++ /dev/null
@@ -1,150 +0,0 @@
1{ apacheUser, apacheGroup, tellesflorian, mylibs, config }:
2rec {
3 app = tellesflorian.override { inherit (config) environment; };
4 keys = [
5 {
6 dest = "webapps/${app.environment}-tellesflorian-passwords";
7 user = apacheUser;
8 group = apacheGroup;
9 permissions = "0400";
10 text = ''
11 invite:${config.invite_passwords}
12 '';
13 }
14 {
15 dest = "webapps/${app.environment}-tellesflorian";
16 user = apacheUser;
17 group = apacheGroup;
18 permissions = "0400";
19 text = ''
20 # This file is auto-generated during the composer install
21 parameters:
22 database_host: ${config.mysql.host}
23 database_port: ${config.mysql.port}
24 database_name: ${config.mysql.name}
25 database_user: ${config.mysql.user}
26 database_password: ${config.mysql.password}
27 mailer_transport: smtp
28 mailer_host: 127.0.0.1
29 mailer_user: null
30 mailer_password: null
31 secret: ${config.secret}
32 '';
33 }
34 ];
35 phpFpm = rec {
36 preStart = mylibs.phpFpmPreStart {
37 inherit app;
38 inherit (app) varDir;
39 keyFiles = [
40 "/var/secrets/webapps/${app.environment}-tellesflorian"
41 ];
42 actions = [
43 "/run/wrappers/bin/sudo -u wwwrun ./bin/console --env=${app.environment} cache:clear --no-warmup"
44 ];
45 };
46 serviceDeps = [ "mysql.service" ];
47 socket = "/var/run/phpfpm/floriantelles-${app.environment}.sock";
48 pool = ''
49 listen = ${socket}
50 user = ${apacheUser}
51 group = ${apacheGroup}
52 listen.owner = ${apacheUser}
53 listen.group = ${apacheGroup}
54 php_admin_value[upload_max_filesize] = 20M
55 php_admin_value[post_max_size] = 20M
56 ;php_admin_flag[log_errors] = on
57 php_admin_value[open_basedir] = "/var/secrets/webapps/${app.environment}-tellesflorian:${app}:${app.varDir}:/tmp"
58 php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
59 ${if app.environment == "dev" then ''
60 pm = ondemand
61 pm.max_children = 5
62 pm.process_idle_timeout = 60
63 env[SYMFONY_DEBUG_MODE] = "yes"
64 '' else ''
65 pm = dynamic
66 pm.max_children = 20
67 pm.start_servers = 2
68 pm.min_spare_servers = 1
69 pm.max_spare_servers = 3
70 ''}'';
71 };
72 apache = rec {
73 modules = [ "proxy_fcgi" ];
74 webappName = "florian_${app.environment}";
75 root = "/run/current-system/webapps/${webappName}";
76 vhostConf = ''
77 <FilesMatch "\.php$">
78 SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
79 </FilesMatch>
80
81 ${if app.environment == "dev" then ''
82 <Location />
83 AuthBasicProvider file ldap
84 Use LDAPConnect
85 Require ldap-group cn=app.tellesflorian.com,cn=httpd,ou=services,dc=immae,dc=eu
86
87 AuthUserFile "/var/secrets/webapps/${app.environment}-tellesflorian-passwords"
88 Require user "invite"
89
90 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://tellesflorian.com\"></html>"
91 </Location>
92
93 <Directory ${root}>
94 Options Indexes FollowSymLinks MultiViews Includes
95 AllowOverride None
96 Require all granted
97
98 DirectoryIndex app_dev.php
99
100 <IfModule mod_negotiation.c>
101 Options -MultiViews
102 </IfModule>
103
104 <IfModule mod_rewrite.c>
105 RewriteEngine On
106
107 RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
108 RewriteRule ^(.*) - [E=BASE:%1]
109
110 # Maintenance script
111 RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
112 RewriteCond %{SCRIPT_FILENAME} !maintenance.php
113 RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
114 ErrorDocument 503 /maintenance.php
115
116 # Sets the HTTP_AUTHORIZATION header removed by Apache
117 RewriteCond %{HTTP:Authorization} .
118 RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
119
120 RewriteCond %{ENV:REDIRECT_STATUS} ^$
121 RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
122
123 # If the requested filename exists, simply serve it.
124 # We only want to let Apache serve files and not directories.
125 RewriteCond %{REQUEST_FILENAME} -f
126 RewriteRule ^ - [L]
127
128 # Rewrite all other queries to the front controller.
129 RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
130 </IfModule>
131
132 </Directory>
133 '' else ''
134 <Directory ${root}>
135 Options Indexes FollowSymLinks MultiViews Includes
136 AllowOverride All
137 Require all granted
138 </Directory>
139 ''}
140 '';
141 };
142 activationScript = {
143 deps = [ "wrappers" ];
144 text = ''
145 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} \
146 ${app.varDir}/var
147 install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
148 '';
149 };
150}