Upgrade nixos

author: Ismaël Bouya <ismael.bouya@normalesup.org> 2020-03-25 11:57:48 +0100
committer: Ismaël Bouya <ismael.bouya@normalesup.org> 2020-04-03 16:25:07 +0200
commit: 5400b9b6f65451d41a9106fae6fc00f97d83f4ef (patch)
tree: 6ed072da7b1f17ac3994ffea052aa0c0822f8446 /modules/private/websites
parent: 441da8aac378f401625e82caf281fa0e26128310 (diff)
download: Nix-5400b9b6f65451d41a9106fae6fc00f97d83f4ef.tar.gz
Nix-5400b9b6f65451d41a9106fae6fc00f97d83f4ef.tar.zst
Nix-5400b9b6f65451d41a9106fae6fc00f97d83f4ef.zip
46 files changed, 607 insertions, 638 deletions
diff --git a/modules/private/websites/chloe/builder.nix b/modules/private/websites/chloe/builder.nix
index f21caeb..bce2b4d 100644
--- a/modules/private/websites/chloe/builder.nix
+++ b/modules/private/websites/chloe/builder.nix
@@ -3,28 +3,25 @@ rec {
  app = chloe.override { inherit (config) environment; };
  phpFpm = rec {
    serviceDeps = [ "mysql.service" ];
-    socket = "/var/run/phpfpm/chloe-${app.environment}.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = apacheUser;
-      user = ${apacheUser}
+      "listen.group" = apacheGroup;
-      group = ${apacheGroup}
+      "php_admin_value[upload_max_filesize]" = "20M";
-      listen.owner = ${apacheUser}
+      "php_admin_value[post_max_size]" = "20M";
-      listen.group = ${apacheGroup}
+      # "php_admin_flag[log_errors]" = "on";
-      php_admin_value[upload_max_filesize] = 20M
+      "php_admin_value[open_basedir]" = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp";
-      php_admin_value[post_max_size] = 20M
+      "php_admin_value[session.save_path]" = "${app.varDir}/phpSessions";
-      ;php_admin_flag[log_errors] = on
+    } // (if app.environment == "dev" then {
-      php_admin_value[open_basedir] = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp"
+      "pm" = "ondemand";
-      php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
+      "pm.max_children" = "5";
-      ${if app.environment == "dev" then ''
+      "pm.process_idle_timeout" = "60";
-      pm = ondemand
+    } else {
-      pm.max_children = 5
+      "pm" = "dynamic";
-      pm.process_idle_timeout = 60
+      "pm.max_children" = "20";
-      '' else ''
+      "pm.start_servers" = "2";
-      pm = dynamic
+      "pm.min_spare_servers" = "1";
-      pm.max_children = 20
+      "pm.max_spare_servers" = "3";
-      pm.start_servers = 2
+    });
-      pm.min_spare_servers = 1
-      pm.max_spare_servers = 3
-      ''}'';
  };
  keys = [{
    dest = "webapps/${app.environment}-chloe";
@@ -51,7 +48,7 @@ rec {
    modules = [ "proxy_fcgi" ];
    webappName = "chloe_${app.environment}";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
      Include /var/secrets/webapps/${app.environment}-chloe
      RewriteEngine On
@@ -60,7 +57,7 @@ rec {
      '' else ""}
      <FilesMatch "\.php$">
-        SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+        SetHandler "proxy:unix:${socket}|fcgi://localhost"
      </FilesMatch>
      <Directory ${root}>
diff --git a/modules/private/websites/chloe/integration.nix b/modules/private/websites/chloe/integration.nix
index 6276eb7..caf6548 100644
--- a/modules/private/websites/chloe/integration.nix
+++ b/modules/private/websites/chloe/integration.nix
@@ -17,8 +17,9 @@ in {
    systemd.services.phpfpm-chloe_dev.after = lib.mkAfter chloe.phpFpm.serviceDeps;
    systemd.services.phpfpm-chloe_dev.wants = chloe.phpFpm.serviceDeps;
    services.phpfpm.pools.chloe_dev = {
-      listen = chloe.phpFpm.socket;
+      user = config.services.httpd.Inte.user;
-      extraConfig = chloe.phpFpm.pool;
+      group = config.services.httpd.Inte.group;
+      settings = chloe.phpFpm.pool;
      phpOptions = config.services.phpfpm.phpOptions + ''
        extension=${pkgs.php}/lib/php/extensions/mysqli.so
      '';
@@ -31,7 +32,9 @@ in {
      addToCerts  = true;
      hosts       = ["chloe.immae.eu" ];
      root        = chloe.apache.root;
-      extraConfig = [ chloe.apache.vhostConf ];
+      extraConfig = [
+        (chloe.apache.vhostConf config.services.phpfpm.pools.chloe_dev.socket)
+      ];
    };
    services.websites.env.integration.watchPaths = [
      "/var/secrets/webapps/${chloe.app.environment}-chloe"
diff --git a/modules/private/websites/chloe/production.nix b/modules/private/websites/chloe/production.nix
index 578bf91..83f6c9b 100644
--- a/modules/private/websites/chloe/production.nix
+++ b/modules/private/websites/chloe/production.nix
@@ -19,8 +19,9 @@ in {
    systemd.services.phpfpm-chloe_prod.after = lib.mkAfter chloe.phpFpm.serviceDeps;
    systemd.services.phpfpm-chloe_prod.wants = chloe.phpFpm.serviceDeps;
    services.phpfpm.pools.chloe_prod = {
-      listen = chloe.phpFpm.socket;
+      user = config.services.httpd.Prod.user;
-      extraConfig = chloe.phpFpm.pool;
+      group = config.services.httpd.Prod.group;
+      settings = chloe.phpFpm.pool;
      phpOptions = config.services.phpfpm.phpOptions + ''
        extension=${pkgs.php}/lib/php/extensions/mysqli.so
      '';
@@ -39,7 +40,7 @@ in {
          RewriteCond "%{HTTP_HOST}" "!^www\.osteopathe-cc\.fr$" [NC]
          RewriteRule ^(.+)$ https://www.osteopathe-cc.fr$1 [R=302,L]
          ''
-        chloe.apache.vhostConf
+        (chloe.apache.vhostConf config.services.phpfpm.pools.chloe_prod.socket)
      ];
    };
    services.websites.env.production.watchPaths = [
diff --git a/modules/private/websites/commons/adminer.nix b/modules/private/websites/commons/adminer.nix
index d591c90..1803468 100644
--- a/modules/private/websites/commons/adminer.nix
+++ b/modules/private/websites/commons/adminer.nix
@@ -1,24 +1,5 @@
-{}:
+{ config, callPackage }:
-rec {
+callPackage ../tools/tools/adminer.nix {
-  phpFpm = {
+  adminer = null;
-    socket = "/var/run/phpfpm/adminer.sock";
+  forcePhpSocket = config.services.phpfpm.pools.adminer.socket;
-  };
-  apache = rec {
-    modules = [ "proxy_fcgi" ];
-    webappName = "_adminer";
-    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
-      Alias /adminer ${root}
-      <Directory ${root}>
-        DirectoryIndex index.php
-        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
-        </FilesMatch>
-        Use LDAPConnect
-        Require ldap-group cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
-        Require ldap-group cn=users,cn=postgresql,cn=pam,ou=services,dc=immae,dc=eu
-      </Directory>
-      '';
-  };
 }
diff --git a/modules/private/websites/connexionswing/integration.nix b/modules/private/websites/connexionswing/integration.nix
index 81cff8f..4f7b72d 100644
--- a/modules/private/websites/connexionswing/integration.nix
+++ b/modules/private/websites/connexionswing/integration.nix
@@ -25,15 +25,17 @@ in {
        "./bin/console --env=${app.environment} cache:clear --no-warmup"
      ];
      phpOpenbasedir = [ "/tmp" "/run/wrappers/bin/sendmail" ];
-      phpPool = ''
+      phpPool = {
-        php_admin_value[upload_max_filesize] = 20M
+        "php_admin_value[upload_max_filesize]" = "20M";
-        php_admin_value[post_max_size] = 20M
+        "php_admin_value[post_max_size]" = "20M";
-        ;php_admin_flag[log_errors] = on
+        #"php_admin_flag[log_errors]" = "on";
-        pm = ondemand
+        "pm" = "ondemand";
-        pm.max_children = 5
+        "pm.max_children" = "5";
-        pm.process_idle_timeout = 60
+        "pm.process_idle_timeout" = "60";
-        env[SYMFONY_DEBUG_MODE] = "yes"
+        };
-      '';
+      phpEnv = {
+        SYMFONY_DEBUG_MODE = "yes";
+      };
      phpWatchFiles = [
        config.secrets.fullPaths."webapps/${app.environment}-connexionswing"
      ];
diff --git a/modules/private/websites/connexionswing/production.nix b/modules/private/websites/connexionswing/production.nix
index fa31931..0b52af1 100644
--- a/modules/private/websites/connexionswing/production.nix
+++ b/modules/private/websites/connexionswing/production.nix
@@ -26,16 +26,16 @@ in {
        "./bin/console --env=${app.environment} cache:clear --no-warmup"
      ];
      phpOpenbasedir = [ "/tmp" "/run/wrappers/bin/sendmail" ];
-      phpPool = ''
+      phpPool = {
-        php_admin_value[upload_max_filesize] = 20M
+        "php_admin_value[upload_max_filesize]" = "20M";
-        php_admin_value[post_max_size] = 20M
+        "php_admin_value[post_max_size]" = "20M";
-        ;php_admin_flag[log_errors] = on
+        #"php_admin_flag[log_errors]" = "on";
-        pm = dynamic
+        "pm" = "dynamic";
-        pm.max_children = 20
+        "pm.max_children" = "20";
-        pm.start_servers = 2
+        "pm.start_servers" = "2";
-        pm.min_spare_servers = 1
+        "pm.min_spare_servers" = "1";
-        pm.max_spare_servers = 3
+        "pm.max_spare_servers" = "3";
-      '';
+      };
      phpWatchFiles = [
        config.secrets.fullPaths."webapps/${app.environment}-connexionswing"
      ];
diff --git a/modules/private/websites/default.nix b/modules/private/websites/default.nix
index 5c0e655..529ec5c 100644
--- a/modules/private/websites/default.nix
+++ b/modules/private/websites/default.nix
@@ -87,9 +87,9 @@ in
      #openssl = self.openssl_1_1;
      php = php72;
      php72 = (super.php72.override {
-        mysql.connector-c = self.mariadb;
+        config.php.mysqlnd = true;
-        config.php.mysqlnd = false;
        config.php.mysqli = false;
+        config.php.mhash = true; # Is it needed?
      }).overrideAttrs(old: rec {
        # Didn't manage to build with mysqli + mysql_config connector
        configureFlags = old.configureFlags ++ [
@@ -140,9 +140,9 @@ in
        ; 30 days (minutes)
        session.cache_expire = 43200
        '';
-      extraConfig = ''
+      settings = {
-        log_level = notice
+        log_level = "notice";
-        '';
+      };
    };
    services.filesWatcher.httpdProd.paths = [ "/var/secrets/apache-ldap" ];
diff --git a/modules/private/websites/emilia/richie.nix b/modules/private/websites/emilia/richie.nix
index f7b4f8d..98ab1cd 100644
--- a/modules/private/websites/emilia/richie.nix
+++ b/modules/private/websites/emilia/richie.nix
@@ -49,22 +49,23 @@ in
        '';
    };
    services.phpfpm.pools.richie_production = {
-      listen = "/run/phpfpm/richie_production.sock";
+      user = "wwwrun";
-      extraConfig = ''
+      group = "wwwrun";
-        user = wwwrun
+      settings = {
-        group = wwwrun
+        "listen.owner" = "wwwrun";
-        listen.owner = wwwrun
+        "listen.group" = "wwwrun";
-        listen.group = wwwrun
-        pm = ondemand
+        "pm" = "ondemand";
-        pm.max_children = 5
+        "pm.max_children" = "5";
-        pm.process_idle_timeout = 60
+        "pm.process_idle_timeout" = "60";
-        env[PATH] = /run/current-system/sw/bin:${lib.makeBinPath [ pkgs.imagemagick ]}
+        "php_admin_value[open_basedir]" = "${vardir}:/var/lib/php/sessions/richie_production:/var/secrets/webapps/prod-richie:${richieSrc}:/tmp";
-        env[BDD_CONNECT] = "/var/secrets/webapps/prod-richie"
+        "php_admin_value[session.save_path]" = "/var/lib/php/sessions/richie_production";
-        php_admin_value[open_basedir] = "${vardir}:/var/lib/php/sessions/richie_production:/var/secrets/webapps/prod-richie:${richieSrc}:/tmp"
+      };
-        php_admin_value[session.save_path] = "/var/lib/php/sessions/richie_production"
+      phpEnv = {
-        '';
+        PATH = "/run/current-system/sw/bin:${lib.makeBinPath [ pkgs.imagemagick ]}";
+        BDD_CONNECT = "/var/secrets/webapps/prod-richie";
+      };
      phpOptions = config.services.phpfpm.phpOptions + ''
        date.timezone = 'Europe/Paris'
        extension=${pkgs.php}/lib/php/extensions/mysqli.so
@@ -91,7 +92,7 @@ in
          Require all granted
          <FilesMatch "\.php$">
-            SetHandler "proxy:unix:/run/phpfpm/richie_production.sock|fcgi://localhost"
+            SetHandler "proxy:unix:${config.services.phpfpm.pools.richie_production.socket}|fcgi://localhost"
          </FilesMatch>
        </Directory>
          ''
diff --git a/modules/private/websites/evariste/production.nix b/modules/private/websites/evariste/production.nix
index 00e6fe1..43b26c8 100644
--- a/modules/private/websites/evariste/production.nix
+++ b/modules/private/websites/evariste/production.nix
@@ -21,20 +21,19 @@ in {
        '';
    };
    services.phpfpm.pools.nsievariste = {
-      listen = "/run/phpfpm/nsievariste.sock";
+      user = "wwwrun";
-      extraConfig = ''
+      group = "wwwrun";
-        user = wwwrun
+      settings = {
-        group = wwwrun
+        "listen.owner" = "wwwrun";
-        listen.owner = wwwrun
+        "listen.group" = "wwwrun";
-        listen.group = wwwrun
-        pm = ondemand
+        "pm" = "ondemand";
-        pm.max_children = 5
+        "pm.max_children" = "5";
-        pm.process_idle_timeout = 60
+        "pm.process_idle_timeout" = "60";
-        php_admin_value[open_basedir] = "/var/lib/php/sessions/nsievariste:${nsiVarDir}:/tmp"
+        "php_admin_value[open_basedir]" = "/var/lib/php/sessions/nsievariste:${nsiVarDir}:/tmp";
-        php_admin_value[session.save_path] = "/var/lib/php/sessions/nsievariste"
+        "php_admin_value[session.save_path]" = "/var/lib/php/sessions/nsievariste";
-        '';
+      };
    };
    services.websites.env.production.vhostConfs.nsievariste = {
      certName     = "eldiron";
@@ -46,7 +45,7 @@ in {
        Use Stats nsievariste.immae.eu
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:/run/phpfpm/nsievariste.sock|fcgi://localhost"
+          SetHandler "proxy:unix:${config.services.phpfpm.pools.nsievariste.socket}|fcgi://localhost"
        </FilesMatch>
        <Directory ${nsiVarDir}>
@@ -60,20 +59,19 @@ in {
    };
    services.phpfpm.pools.stmgevariste = {
-      listen = "/run/phpfpm/stmgevariste.sock";
+      user = "wwwrun";
-      extraConfig = ''
+      group = "wwwrun";
-        user = wwwrun
+      settings = {
-        group = wwwrun
+        "listen.owner" = "wwwrun";
-        listen.owner = wwwrun
+        "listen.group" = "wwwrun";
-        listen.group = wwwrun
-        pm = ondemand
+        "pm" = "ondemand";
-        pm.max_children = 5
+        "pm.max_children" = "5";
-        pm.process_idle_timeout = 60
+        "pm.process_idle_timeout" = "60";
-        php_admin_value[open_basedir] = "/var/lib/php/sessions/stmgevariste:${stmgVarDir}:/tmp"
+        "php_admin_value[open_basedir]" = "/var/lib/php/sessions/stmgevariste:${stmgVarDir}:/tmp";
-        php_admin_value[session.save_path] = "/var/lib/php/sessions/stmgevariste"
+        "php_admin_value[session.save_path]" = "/var/lib/php/sessions/stmgevariste";
-        '';
+      };
    };
    services.websites.env.production.vhostConfs.stmgevariste = {
      certName     = "eldiron";
@@ -85,7 +83,7 @@ in {
        Use Stats stmgevariste.immae.eu
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:/run/phpfpm/stmgevariste.sock|fcgi://localhost"
+          SetHandler "proxy:unix:${config.services.phpfpm.pools.stmgevariste.socket}|fcgi://localhost"
        </FilesMatch>
        <Directory ${stmgVarDir}>
diff --git a/modules/private/websites/florian/app.nix b/modules/private/websites/florian/app.nix
index e262c59..c65c26f 100644
--- a/modules/private/websites/florian/app.nix
+++ b/modules/private/websites/florian/app.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, config,  ... }:
 let
-  adminer = pkgs.callPackage ../commons/adminer.nix {};
+  adminer = pkgs.callPackage ../commons/adminer.nix { inherit config; };
  secrets = config.myEnv.websites.tellesflorian.integration;
  app = pkgs.webapps.tellesflorian.override { environment = secrets.environment; };
  cfg = config.myServices.websites.florian.app;
@@ -24,15 +24,17 @@ in {
        "./bin/console --env=${app.environment} cache:clear --no-warmup"
      ];
      phpOpenbasedir = [ "/tmp" ];
-      phpPool = ''
+      phpPool = {
-        php_admin_value[upload_max_filesize] = 20M
+        "php_admin_value[upload_max_filesize]" = "20M";
-        php_admin_value[post_max_size] = 20M
+        "php_admin_value[post_max_size]" = "20M";
-        ;php_admin_flag[log_errors] = on
+        #"php_admin_flag[log_errors]" = "on";
-        pm = ondemand
+        "pm" = "ondemand";
-        pm.max_children = 5
+        "pm.max_children" = "5";
-        pm.process_idle_timeout = 60
+        "pm.process_idle_timeout" = "60";
-        env[SYMFONY_DEBUG_MODE] = "yes"
+      };
-      '';
+      phpEnv = {
+        SYMFONY_DEBUG_MODE = "yes";
+      };
      phpWatchFiles = [
        config.secrets.fullPaths."webapps/${app.environment}-tellesflorian"
      ];
@@ -134,7 +136,7 @@ in {
        </Directory>
        ''
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf null)
      ];
    };
  };
diff --git a/modules/private/websites/florian/integration.nix b/modules/private/websites/florian/integration.nix
index 57c4006..4ee160a 100644
--- a/modules/private/websites/florian/integration.nix
+++ b/modules/private/websites/florian/integration.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, config,  ... }:
 let
-    adminer = pkgs.callPackage ../commons/adminer.nix {};
+    adminer = pkgs.callPackage ../commons/adminer.nix { inherit config; };
    cfg = config.myServices.websites.florian.integration;
    varDir = "/var/lib/ftp/florian";
    env = config.myEnv.websites.florian;
@@ -8,7 +8,7 @@ in {
  options.myServices.websites.florian.integration.enable = lib.mkEnableOption "enable Florian's website integration";
  config = lib.mkIf cfg.enable {
-    security.acme2.certs."ftp".extraDomains."florian.immae.eu" = null;
+    security.acme.certs."ftp".extraDomains."florian.immae.eu" = null;
    services.websites.env.integration.modules = adminer.apache.modules;
    services.websites.env.integration.vhostConfs.florian = {
@@ -17,7 +17,7 @@ in {
      hosts       = [ "florian.immae.eu" ];
      root        = "${varDir}/florian.immae.eu";
      extraConfig = [
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf null)
        ''
        ServerAdmin ${env.server_admin}
diff --git a/modules/private/websites/florian/production.nix b/modules/private/websites/florian/production.nix
index 1abc715..16c6022 100644
--- a/modules/private/websites/florian/production.nix
+++ b/modules/private/websites/florian/production.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, config,  ... }:
 let
-    adminer = pkgs.callPackage ../commons/adminer.nix {};
+    adminer = pkgs.callPackage ../commons/adminer.nix { inherit config; };
    cfg = config.myServices.websites.florian.production;
    varDir = "/var/lib/ftp/florian";
    env = config.myEnv.websites.florian;
@@ -8,7 +8,7 @@ in {
  options.myServices.websites.florian.production.enable = lib.mkEnableOption "enable Florian's website production";
  config = lib.mkIf cfg.enable {
-    security.acme2.certs."ftp".extraDomains."tellesflorian.com" = null;
+    security.acme.certs."ftp".extraDomains."tellesflorian.com" = null;
    services.websites.env.production.modules = adminer.apache.modules;
    services.websites.env.production.vhostConfs.florian = {
@@ -17,7 +17,7 @@ in {
      hosts        = [ "tellesflorian.com" "www.tellesflorian.com" ];
      root         = "${varDir}/tellesflorian.com";
      extraConfig  = [
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf null)
        ''
        ServerAdmin ${env.server_admin}
diff --git a/modules/private/websites/isabelle/aten_integration.nix b/modules/private/websites/isabelle/aten_integration.nix
index a2a087c..fb6eda9 100644
--- a/modules/private/websites/isabelle/aten_integration.nix
+++ b/modules/private/websites/isabelle/aten_integration.nix
@@ -23,15 +23,17 @@ in {
        "APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup"
      ];
      phpOpenbasedir = [ "/tmp" ];
-      phpPool = ''
+      phpPool = {
-        php_admin_value[upload_max_filesize] = 20M
+        "php_admin_value[upload_max_filesize]" = "20M";
-        php_admin_value[post_max_size] = 20M
+        "php_admin_value[post_max_size]" = "20M";
-        ;php_admin_flag[log_errors] = on
+        #"php_admin_flag[log_errors]" = "on";
-        pm = ondemand
+        "pm" = "ondemand";
-        pm.max_children = 5
+        "pm.max_children" = "5";
-        pm.process_idle_timeout = 60
+        "pm.process_idle_timeout" = "60";
-        env[SYMFONY_DEBUG_MODE] = "yes"
+      };
-      '';
+      phpEnv = {
+        SYMFONY_DEBUG_MODE = "yes";
+      };
    };
    secrets.keys = [{
diff --git a/modules/private/websites/isabelle/aten_production.nix b/modules/private/websites/isabelle/aten_production.nix
index 8e33f0f..cf7e4a2 100644
--- a/modules/private/websites/isabelle/aten_production.nix
+++ b/modules/private/websites/isabelle/aten_production.nix
@@ -24,16 +24,16 @@ in {
        "APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup"
      ];
      phpOpenbasedir = [ "/tmp" ];
-      phpPool = ''
+      phpPool = {
-        php_admin_value[upload_max_filesize] = 20M
+        "php_admin_value[upload_max_filesize]" = "20M";
-        php_admin_value[post_max_size] = 20M
+        "php_admin_value[post_max_size]" = "20M";
-        ;php_admin_flag[log_errors] = on
+        #"php_admin_flag[log_errors]" = "on";
-        pm = dynamic
+        "pm" = "dynamic";
-        pm.max_children = 20
+        "pm.max_children" = "20";
-        pm.start_servers = 2
+        "pm.start_servers" = "2";
-        pm.min_spare_servers = 1
+        "pm.min_spare_servers" = "1";
-        pm.max_spare_servers = 3
+        "pm.max_spare_servers" = "3";
-      '';
+      };
    };
    secrets.keys = [{
diff --git a/modules/private/websites/isabelle/iridologie.nix b/modules/private/websites/isabelle/iridologie.nix
index 460bd2a..ffbf259 100644
--- a/modules/private/websites/isabelle/iridologie.nix
+++ b/modules/private/websites/isabelle/iridologie.nix
@@ -19,8 +19,9 @@ in {
    systemd.services.phpfpm-iridologie.after = lib.mkAfter iridologie.phpFpm.serviceDeps;
    systemd.services.phpfpm-iridologie.wants = iridologie.phpFpm.serviceDeps;
    services.phpfpm.pools.iridologie = {
-      listen = iridologie.phpFpm.socket;
+      user = config.services.httpd.Prod.user;
-      extraConfig = iridologie.phpFpm.pool;
+      group = config.services.httpd.Prod.group;
+      settings = iridologie.phpFpm.pool;
      phpOptions = config.services.phpfpm.phpOptions + ''
        extension=${pkgs.php}/lib/php/extensions/mysqli.so
      '';
@@ -39,7 +40,7 @@ in {
          RewriteCond "%{HTTP_HOST}" "!^iridologie\.icommandeur\.org$" [NC]
          RewriteRule ^(.+)$ https://iridologie.icommandeur.org$1 [R=302,L]
          ''
-        iridologie.apache.vhostConf
+        (iridologie.apache.vhostConf config.services.phpfpm.pools.iridologie.socket)
      ];
    };
    services.websites.env.production.watchPaths = [
diff --git a/modules/private/websites/isabelle/spip_builder.nix b/modules/private/websites/isabelle/spip_builder.nix
index 2ab5394..e1130d1 100644
--- a/modules/private/websites/isabelle/spip_builder.nix
+++ b/modules/private/websites/isabelle/spip_builder.nix
@@ -3,28 +3,25 @@ rec {
  app = iridologie.override { inherit (config) environment; };
  phpFpm = rec {
    serviceDeps = [ "mysql.service" ];
-    socket = "/var/run/phpfpm/iridologie-${app.environment}.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = "${apacheUser}";
-      user = ${apacheUser}
+      "listen.group" = "${apacheGroup}";
-      group = ${apacheGroup}
+      "php_admin_value[upload_max_filesize]" = "20M";
-      listen.owner = ${apacheUser}
+      "php_admin_value[post_max_size]" = "20M";
-      listen.group = ${apacheGroup}
+      #"php_admin_flag[log_errors]" = "on";
-      php_admin_value[upload_max_filesize] = 20M
+      "php_admin_value[open_basedir]" = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp";
-      php_admin_value[post_max_size] = 20M
+      "php_admin_value[session.save_path]" = "${app.varDir}/phpSessions";
-      ;php_admin_flag[log_errors] = on
+    } // (if app.environment == "dev" then {
-      php_admin_value[open_basedir] = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp"
+      "pm" = "ondemand";
-      php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
+      "pm.max_children" = "5";
-      ${if app.environment == "dev" then ''
+      "pm.process_idle_timeout" = "60";
-      pm = ondemand
+    } else {
-      pm.max_children = 5
+      "pm" = "dynamic";
-      pm.process_idle_timeout = 60
+      "pm.max_children" = "20";
-      '' else ''
+      "pm.start_servers" = "2";
-      pm = dynamic
+      "pm.min_spare_servers" = "1";
-      pm.max_children = 20
+      "pm.max_spare_servers" = "3";
-      pm.start_servers = 2
+    });
-      pm.min_spare_servers = 1
-      pm.max_spare_servers = 3
-      ''}'';
  };
  keys = [{
    dest = "webapps/${app.environment}-iridologie";
@@ -51,13 +48,13 @@ rec {
    modules = [ "proxy_fcgi" ];
    webappName = "iridologie_${app.environment}";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
      Include /var/secrets/webapps/${app.environment}-iridologie
      RewriteEngine On
      <FilesMatch "\.php$">
-        SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+        SetHandler "proxy:unix:${socket}|fcgi://localhost"
      </FilesMatch>
      <Directory ${root}>
diff --git a/modules/private/websites/leila/production.nix b/modules/private/websites/leila/production.nix
index e8591c8..3b289cf 100644
--- a/modules/private/websites/leila/production.nix
+++ b/modules/private/websites/leila/production.nix
@@ -7,19 +7,18 @@ in {
  config = lib.mkIf cfg.enable {
    services.phpfpm.pools.leila = {
-      listen = "/run/phpfpm/leila.sock";
+      user = "wwwrun";
-      extraConfig = ''
+      group = "wwwrun";
-        user = wwwrun
+      settings = {
-        group = wwwrun
+        "listen.owner" = "wwwrun";
-        listen.owner = wwwrun
+        "listen.group" = "wwwrun";
-        listen.group = wwwrun
-        pm = ondemand
+        "pm" = "ondemand";
-        pm.max_children = 5
+        "pm.max_children" = "5";
-        pm.process_idle_timeout = 60
+        "pm.process_idle_timeout" = "60";
-        php_admin_value[open_basedir] = "${varDir}:/tmp"
+        "php_admin_value[open_basedir]" = "${varDir}:/tmp";
-      '';
+      };
    };
    services.webstats.sites = [
@@ -46,7 +45,7 @@ in {
          Require ldap-group cn=chorale.leila.bouya.org,cn=httpd,ou=services,dc=immae,dc=eu
          <FilesMatch "\.php$">
-            SetHandler "proxy:unix:/run/phpfpm/leila.sock|fcgi://localhost"
+            SetHandler "proxy:unix:${config.services.phpfpm.pools.leila.socket}|fcgi://localhost"
          </FilesMatch>
        </Directory>
          ''
@@ -66,7 +65,7 @@ in {
          AllowOverride None
          <FilesMatch "\.php$">
-            SetHandler "proxy:unix:/run/phpfpm/leila.sock|fcgi://localhost"
+            SetHandler "proxy:unix:${config.services.phpfpm.pools.leila.socket}|fcgi://localhost"
          </FilesMatch>
        </Directory>
          ''
@@ -89,7 +88,7 @@ in {
          Require ldap-group cn=chorale.leila.bouya.org,cn=httpd,ou=services,dc=immae,dc=eu
          <FilesMatch "\.php$">
-            SetHandler "proxy:unix:/run/phpfpm/leila.sock|fcgi://localhost"
+            SetHandler "proxy:unix:${config.services.phpfpm.pools.leila.socket}|fcgi://localhost"
          </FilesMatch>
        </Directory>
        <Directory ${varDir}>
diff --git a/modules/private/websites/ludivinecassal/integration.nix b/modules/private/websites/ludivinecassal/integration.nix
index 1cbfd12..d304fdf 100644
--- a/modules/private/websites/ludivinecassal/integration.nix
+++ b/modules/private/websites/ludivinecassal/integration.nix
@@ -23,15 +23,17 @@ in {
        "./bin/console --env=${app.environment} cache:clear --no-warmup"
      ];
      phpOpenbasedir = [ "/tmp" ];
-      phpPool = ''
+      phpPool = {
-        php_admin_value[upload_max_filesize] = 20M
+        "php_admin_value[upload_max_filesize]" = "20M";
-        php_admin_value[post_max_size] = 20M
+        "php_admin_value[post_max_size]" = "20M";
-        ;php_admin_flag[log_errors] = on
+        #"php_admin_flag[log_errors]" = "on";
-        pm = ondemand
+        "pm" = "ondemand";
-        pm.max_children = 5
+        "pm.max_children" = "5";
-        pm.process_idle_timeout = 60
+        "pm.process_idle_timeout" = "60";
-        env[SYMFONY_DEBUG_MODE] = "yes"
+      };
-      '';
+      phpEnv = {
+        SYMFONY_DEBUG_MODE = "yes";
+      };
      phpWatchFiles = [
        config.secrets.fullPaths."webapps/${app.environment}-ludivinecassal"
      ];
diff --git a/modules/private/websites/ludivinecassal/production.nix b/modules/private/websites/ludivinecassal/production.nix
index 7cf00f0..5761be7 100644
--- a/modules/private/websites/ludivinecassal/production.nix
+++ b/modules/private/websites/ludivinecassal/production.nix
@@ -24,16 +24,16 @@ in {
        "./bin/console --env=${app.environment} cache:clear --no-warmup"
      ];
      phpOpenbasedir = [ "/tmp" ];
-      phpPool = ''
+      phpPool = {
-        php_admin_value[upload_max_filesize] = 20M
+        "php_admin_value[upload_max_filesize]" = "20M";
-        php_admin_value[post_max_size] = 20M
+        "php_admin_value[post_max_size]" = "20M";
-        ;php_admin_flag[log_errors] = on
+        #"php_admin_flag[log_errors]" = "on";
-        pm = dynamic
+        "pm" = "dynamic";
-        pm.max_children = 20
+        "pm.max_children" = "20";
-        pm.start_servers = 2
+        "pm.start_servers" = "2";
-        pm.min_spare_servers = 1
+        "pm.min_spare_servers" = "1";
-        pm.max_spare_servers = 3
+        "pm.max_spare_servers" = "3";
-      '';
+      };
      phpWatchFiles = [
        config.secrets.fullPaths."webapps/${app.environment}-ludivinecassal"
      ];
diff --git a/modules/private/websites/nassime/production.nix b/modules/private/websites/nassime/production.nix
index 293519f..f9468f9 100644
--- a/modules/private/websites/nassime/production.nix
+++ b/modules/private/websites/nassime/production.nix
@@ -9,7 +9,7 @@ in {
  config = lib.mkIf cfg.enable {
    services.webstats.sites = [ { name = "nassime.bouya.org"; } ];
-    security.acme2.certs."ftp".extraDomains."nassime.bouya.org" = null;
+    security.acme.certs."ftp".extraDomains."nassime.bouya.org" = null;
    services.websites.env.production.vhostConfs.nassime = {
      certName     = "nassime";
diff --git a/modules/private/websites/naturaloutil/production.nix b/modules/private/websites/naturaloutil/production.nix
index a276c47..1e79141 100644
--- a/modules/private/websites/naturaloutil/production.nix
+++ b/modules/private/websites/naturaloutil/production.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, config,  ... }:
 let
-  adminer = pkgs.callPackage ../commons/adminer.nix {};
+  adminer = pkgs.callPackage ../commons/adminer.nix { inherit config; };
  cfg = config.myServices.websites.naturaloutil.production;
  varDir = "/var/lib/ftp/jerome";
  env = config.myEnv.websites.jerome;
@@ -10,7 +10,7 @@ in {
  config = lib.mkIf cfg.enable {
    services.webstats.sites = [ { name = "naturaloutil.immae.eu"; } ];
-    security.acme2.certs."ftp".extraDomains."naturaloutil.immae.eu" = null;
+    security.acme.certs."ftp".extraDomains."naturaloutil.immae.eu" = null;
    secrets.keys = [{
      dest = "webapps/prod-naturaloutil";
@@ -42,21 +42,22 @@ in {
    systemd.services.phpfpm-jerome.after = lib.mkAfter [ "mysql.service" ];
    systemd.services.phpfpm-jerome.wants = [ "mysql.service" ];
    services.phpfpm.pools.jerome = {
-      listen = "/run/phpfpm/naturaloutil.sock";
+      user = "wwwrun";
-      extraConfig = ''
+      group = "wwwrun";
-        user = wwwrun
+      settings = {
-        group = wwwrun
+        "listen.owner" = "wwwrun";
-        listen.owner = wwwrun
+        "listen.group" = "wwwrun";
-        listen.group = wwwrun
-        pm = ondemand
+        "pm" = "ondemand";
-        pm.max_children = 5
+        "pm.max_children" = "5";
-        pm.process_idle_timeout = 60
+        "pm.process_idle_timeout" = "60";
-        env[BDD_CONNECT] = "/var/secrets/webapps/prod-naturaloutil"
+        "php_admin_value[open_basedir]" = "/var/lib/php/sessions/naturaloutil:/var/secrets/webapps/prod-naturaloutil:${varDir}:/tmp";
-        php_admin_value[open_basedir] = "/var/lib/php/sessions/naturaloutil:/var/secrets/webapps/prod-naturaloutil:${varDir}:/tmp"
+        "php_admin_value[session.save_path]" = "/var/lib/php/sessions/naturaloutil";
-        php_admin_value[session.save_path] = "/var/lib/php/sessions/naturaloutil"
+      };
-        '';
+      phpEnv = {
+        BDD_CONNECT = "/var/secrets/webapps/prod-naturaloutil";
+      };
      phpOptions = config.services.phpfpm.phpOptions + ''
        extension=${pkgs.php}/lib/php/extensions/mysqli.so
        '';
@@ -68,7 +69,7 @@ in {
      hosts        = ["naturaloutil.immae.eu" ];
      root         = varDir;
      extraConfig  = [
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf null)
        ''
        Use Stats naturaloutil.immae.eu
        ServerAdmin ${env.server_admin}
@@ -76,7 +77,7 @@ in {
        CustomLog "${varDir}/logs/access_log" combined
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:/run/phpfpm/naturaloutil.sock|fcgi://localhost"
+          SetHandler "proxy:unix:${config.services.phpfpm.pools.jerome.socket}|fcgi://localhost"
        </FilesMatch>
        <Directory ${varDir}/logs>
diff --git a/modules/private/websites/papa/maison_bbc.nix b/modules/private/websites/papa/maison_bbc.nix
index eb61b6d..11e7937 100644
--- a/modules/private/websites/papa/maison_bbc.nix
+++ b/modules/private/websites/papa/maison_bbc.nix
@@ -9,19 +9,18 @@ in {
    services.duplyBackup.profiles.papa_maison_bbc.rootDir = varDir;
    services.webstats.sites = [ { name = "maison.bbc.bouya.org"; } ];
    services.phpfpm.pools.papa_maison_bbc = {
-      listen = "/run/phpfpm/papa_maison_bbc.sock";
+      user = "wwwrun";
-      extraConfig = ''
+      group = "wwwrun";
-        user = wwwrun
+      settings = {
-        group = wwwrun
+        "listen.owner" = "wwwrun";
-        listen.owner = wwwrun
+        "listen.group" = "wwwrun";
-        listen.group = wwwrun
-        pm = ondemand
+        "pm" = "ondemand";
-        pm.max_children = 5
+        "pm.max_children" = "5";
-        pm.process_idle_timeout = 60
+        "pm.process_idle_timeout" = "60";
-        php_admin_value[open_basedir] = "${varDir}"
+        "php_admin_value[open_basedir]" = varDir;
-        '';
+      };
      phpOptions = config.services.phpfpm.phpOptions + ''
        date.timezone = 'Europe/Paris'
        extension=${pkgs.php}/lib/php/extensions/mysqli.so
@@ -34,17 +33,17 @@ in {
      root         = varDir;
      extraConfig  = [
        ''
-        Alias /.well-known/acme-challenge ${config.security.acme2.certs.papa.webroot}/.well-known/acme-challenge
+        Alias /.well-known/acme-challenge ${config.security.acme.certs.papa.webroot}/.well-known/acme-challenge
        RedirectMatch 301 ^/((?!(\.well-known|add.php).*$).*)$ https://maison.bbc.bouya.org/$1
        <Directory ${varDir}>
          DirectoryIndex index.php index.htm index.html
          AllowOverride None
          Require all granted
          <FilesMatch "\.php$">
-            SetHandler "proxy:unix:/run/phpfpm/papa_maison_bbc.sock|fcgi://localhost"
+            SetHandler "proxy:unix:${config.services.phpfpm.pools.papa_maison_bbc.socket}|fcgi://localhost"
          </FilesMatch>
        </Directory>
-        <Directory "${config.security.acme2.certs.papa.webroot}">
+        <Directory "${config.security.acme.certs.papa.webroot}">
          Options Indexes FollowSymLinks
          AllowOverride None
          Require all granted
@@ -64,7 +63,7 @@ in {
          AllowOverride None
          Require all granted
          <FilesMatch "\.php$">
-            SetHandler "proxy:unix:/run/phpfpm/papa_maison_bbc.sock|fcgi://localhost"
+            SetHandler "proxy:unix:${config.services.phpfpm.pools.papa_maison_bbc.socket}|fcgi://localhost"
          </FilesMatch>
        </Directory>
          ''
diff --git a/modules/private/websites/papa/surveillance.nix b/modules/private/websites/papa/surveillance.nix
index f6e1772..1bb6ac8 100644
--- a/modules/private/websites/papa/surveillance.nix
+++ b/modules/private/websites/papa/surveillance.nix
@@ -6,7 +6,7 @@ in {
  options.myServices.websites.papa.surveillance.enable = lib.mkEnableOption "enable Papa surveillance's website";
  config = lib.mkIf cfg.enable {
-    security.acme2.certs."ftp".extraDomains."surveillance.maison.bbc.bouya.org" = null;
+    security.acme.certs."ftp".extraDomains."surveillance.maison.bbc.bouya.org" = null;
    services.cron = {
      systemCronJobs = let
diff --git a/modules/private/websites/piedsjaloux/integration.nix b/modules/private/websites/piedsjaloux/integration.nix
index 5907bc8..76523ed 100644
--- a/modules/private/websites/piedsjaloux/integration.nix
+++ b/modules/private/websites/piedsjaloux/integration.nix
@@ -23,16 +23,18 @@ in {
        "./bin/console --env=${app.environment} cache:clear --no-warmup"
      ];
      phpOpenbasedir = [ "/tmp" ];
-      phpPool = ''
+      phpPool = {
-        php_admin_value[upload_max_filesize] = 20M
+        "php_admin_value[upload_max_filesize]" = "20M";
-        php_admin_value[post_max_size] = 20M
+        "php_admin_value[post_max_size]" = "20M";
-        ;php_admin_flag[log_errors] = on
+        #"php_admin_flag[log_errors]" = "on";
-        env[PATH] = ${lib.makeBinPath [ pkgs.apg pkgs.unzip ]}
+        "pm" = "ondemand";
-        pm = ondemand
+        "pm.max_children" = "5";
-        pm.max_children = 5
+        "pm.process_idle_timeout" = "60";
-        pm.process_idle_timeout = 60
+      };
-        env[SYMFONY_DEBUG_MODE] = "yes"
+      phpEnv = {
-      '';
+        PATH = lib.makeBinPath [ pkgs.apg pkgs.unzip ];
+        SYMFONY_DEBUG_MODE = "yes";
+      };
      phpWatchFiles = [
        config.secrets.fullPaths."webapps/${app.environment}-piedsjaloux"
      ];
diff --git a/modules/private/websites/piedsjaloux/production.nix b/modules/private/websites/piedsjaloux/production.nix
index e4e29c7..d3e5c2b 100644
--- a/modules/private/websites/piedsjaloux/production.nix
+++ b/modules/private/websites/piedsjaloux/production.nix
@@ -24,17 +24,19 @@ in {
        "./bin/console --env=${app.environment} cache:clear --no-warmup"
      ];
      phpOpenbasedir = [ "/tmp" ];
-      phpPool = ''
+      phpPool = {
-        php_admin_value[upload_max_filesize] = 20M
+        "php_admin_value[upload_max_filesize]" = "20M";
-        php_admin_value[post_max_size] = 20M
+        "php_admin_value[post_max_size]" = "20M";
-        ;php_admin_flag[log_errors] = on
+        #"php_admin_flag[log_errors]" = "on";
-        env[PATH] = ${lib.makeBinPath [ pkgs.apg pkgs.unzip ]}
+        "pm" = "dynamic";
-        pm = dynamic
+        "pm.max_children" = "20";
-        pm.max_children = 20
+        "pm.start_servers" = "2";
-        pm.start_servers = 2
+        "pm.min_spare_servers" = "1";
-        pm.min_spare_servers = 1
+        "pm.max_spare_servers" = "3";
-        pm.max_spare_servers = 3
+      };
-      '';
+      phpEnv = {
+        PATH = lib.makeBinPath [ pkgs.apg pkgs.unzip ];
+      };
      phpWatchFiles = [
        config.secrets.fullPaths."webapps/${app.environment}-piedsjaloux"
      ];
diff --git a/modules/private/websites/teliotortay/production.nix b/modules/private/websites/teliotortay/production.nix
index 2c62d10..62762ec 100644
--- a/modules/private/websites/teliotortay/production.nix
+++ b/modules/private/websites/teliotortay/production.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, config,  ... }:
 let
-  adminer = pkgs.callPackage ../commons/adminer.nix {};
+  adminer = pkgs.callPackage ../commons/adminer.nix { inherit config; };
  cfg = config.myServices.websites.telioTortay.production;
  varDir = "/var/lib/ftp/telio_tortay";
  env = config.myEnv.websites.telioTortay;
@@ -10,7 +10,7 @@ in {
  config = lib.mkIf cfg.enable {
    services.webstats.sites = [ { name = "telio-tortay.immae.eu"; } ];
-    security.acme2.certs."ftp".extraDomains."telio-tortay.immae.eu" = null;
+    security.acme.certs."ftp".extraDomains."telio-tortay.immae.eu" = null;
    system.activationScripts.telio-tortay = {
      deps = [ "httpd" ];
@@ -22,20 +22,19 @@ in {
    systemd.services.phpfpm-telio-tortay.after = lib.mkAfter [ "mysql.service" ];
    systemd.services.phpfpm-telio-tortay.wants = [ "mysql.service" ];
    services.phpfpm.pools.telio-tortay = {
-      listen = "/run/phpfpm/telio-tortay.sock";
+      user = "wwwrun";
-      extraConfig = ''
+      group = "wwwrun";
-        user = wwwrun
+      settings = {
-        group = wwwrun
+        "listen.owner" = "wwwrun";
-        listen.owner = wwwrun
+        "listen.group" = "wwwrun";
-        listen.group = wwwrun
-        pm = ondemand
+        "pm" = "ondemand";
-        pm.max_children = 5
+        "pm.max_children" = "5";
-        pm.process_idle_timeout = 60
+        "pm.process_idle_timeout" = "60";
-        php_admin_value[open_basedir] = "/var/lib/php/sessions/telio-tortay:${varDir}:/tmp"
+        "php_admin_value[open_basedir]" = "/var/lib/php/sessions/telio-tortay:${varDir}:/tmp";
-        php_admin_value[session.save_path] = "/var/lib/php/sessions/telio-tortay"
+        "php_admin_value[session.save_path]" = "/var/lib/php/sessions/telio-tortay";
-        '';
+      };
      phpOptions = config.services.phpfpm.phpOptions + ''
        disable_functions = "mail"
        extension=${pkgs.php}/lib/php/extensions/mysqli.so
@@ -48,7 +47,7 @@ in {
      hosts        = ["telio-tortay.immae.eu" "realistesmedia.fr" "www.realistesmedia.fr" ];
      root         = varDir;
      extraConfig  = [
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf null)
        ''
        Use Stats telio-tortay.immae.eu
        ServerAdmin ${env.server_admin}
@@ -56,7 +55,7 @@ in {
        CustomLog "${varDir}/logs/access_log" combined
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:/run/phpfpm/telio-tortay.sock|fcgi://localhost"
+          SetHandler "proxy:unix:${config.services.phpfpm.pools.telio-tortay.socket}|fcgi://localhost"
        </FilesMatch>
        <Directory ${varDir}/logs>
diff --git a/modules/private/websites/tools/cloud/default.nix b/modules/private/websites/tools/cloud/default.nix
index 4785074..b9bb32f 100644
--- a/modules/private/websites/tools/cloud/default.nix
+++ b/modules/private/websites/tools/cloud/default.nix
@@ -10,37 +10,34 @@ let
    basedir = builtins.concatStringsSep ":" (
      [ nextcloud varDir ]
      ++ builtins.attrValues pkgs.webapps.nextcloud-apps);
-    socket = "/var/run/phpfpm/nextcloud.sock";
    phpConfig = ''
      extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
      extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
      zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
      '';
-    pool = ''
+    pool = {
-      user = wwwrun
+      "listen.owner" = "wwwrun";
-      group = wwwrun
+      "listen.group" = "wwwrun";
-      listen.owner = wwwrun
+      "pm" = "ondemand";
-      listen.group = wwwrun
+      "pm.max_children" = "60";
-      pm = ondemand
+      "pm.process_idle_timeout" = "60";
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
-      php_admin_value[output_buffering] = 0
+      "php_admin_value[output_buffering]" = "0";
-      php_admin_value[max_execution_time] = 1800
+      "php_admin_value[max_execution_time]" = "1800";
-      php_admin_value[zend_extension] = "opcache"
+      "php_admin_value[zend_extension]" = "opcache";
-      ;already enabled by default?
+      #already enabled by default?
-      ;php_value[opcache.enable] = 1
+      #"php_value[opcache.enable]" = "1";
-      php_value[opcache.enable_cli] = 1
+      "php_value[opcache.enable_cli]" = "1";
-      php_value[opcache.interned_strings_buffer] = 8
+      "php_value[opcache.interned_strings_buffer]" = "8";
-      php_value[opcache.max_accelerated_files] = 10000
+      "php_value[opcache.max_accelerated_files]" = "10000";
-      php_value[opcache.memory_consumption] = 128
+      "php_value[opcache.memory_consumption]" = "128";
-      php_value[opcache.save_comments] = 1
+      "php_value[opcache.save_comments]" = "1";
-      php_value[opcache.revalidate_freq] = 1
+      "php_value[opcache.revalidate_freq]" = "1";
-      php_admin_value[memory_limit] = 512M
+      "php_admin_value[memory_limit]" = "512M";
-      php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:${basedir}:/proc/meminfo:/dev/urandom:/proc/self/fd:/tmp"
+      "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:${basedir}:/proc/meminfo:/dev/urandom:/proc/self/fd:/tmp";
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
-      '';
+    };
  };
 in {
  options.myServices.websites.tools.cloud = {
@@ -71,7 +68,7 @@ in {
            </IfModule>
            <FilesMatch "\.php$">
              CGIPassAuth on
-              SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+              SetHandler "proxy:unix:${config.services.phpfpm.pools.nextcloud.socket}|fcgi://localhost"
            </FilesMatch>
          </Directory>
@@ -171,8 +168,9 @@ in {
      '';
    services.phpfpm.pools.nextcloud = {
-      listen = phpFpm.socket;
+      user = "wwwrun";
-      extraConfig = phpFpm.pool;
+      group = "wwwrun";
+      settings = phpFpm.pool;
      phpOptions = config.services.phpfpm.phpOptions + phpFpm.phpConfig;
    };
diff --git a/modules/private/websites/tools/dav/davical.nix b/modules/private/websites/tools/dav/davical.nix
index 5eb3fab..9d6cd21 100644
--- a/modules/private/websites/tools/dav/davical.nix
+++ b/modules/private/websites/tools/dav/davical.nix
@@ -73,7 +73,7 @@ rec {
    modules = [ "proxy_fcgi" ];
    webappName = "tools_davical";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
      Alias /davical "${root}"
      Alias /caldav.php  "${root}/caldav.php"
      <Directory "${root}">
@@ -84,7 +84,7 @@ rec {
        <FilesMatch "\.php$">
          CGIPassAuth on
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
        </FilesMatch>
        RewriteEngine On
@@ -111,28 +111,25 @@ rec {
  phpFpm = rec {
    serviceDeps = [ "postgresql.service" "openldap.service" ];
    basedir = builtins.concatStringsSep ":" [ webapp "/var/secrets/webapps/dav-davical" awl ];
-    socket = "/var/run/phpfpm/davical.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = apache.user;
-      user = ${apache.user}
+      "listen.group" = apache.group;
-      group = ${apache.group}
+      "pm" = "dynamic";
-      listen.owner = ${apache.user}
+      "pm.max_children" = "60";
-      listen.group = ${apache.group}
+      "pm.start_servers" = "2";
-      pm = dynamic
+      "pm.min_spare_servers" = "1";
-      pm.max_children = 60
+      "pm.max_spare_servers" = "10";
-      pm.start_servers = 2
-      pm.min_spare_servers = 1
-      pm.max_spare_servers = 10
-      ; Needed to avoid clashes in browser cookies (same domain)
+      # Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = DavicalPHPSESSID
+      "php_value[session.name]" = "DavicalPHPSESSID";
-      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/davical"
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/davical";
-      php_admin_value[include_path] = "${awl}/inc:${webapp}/inc"
+      "php_admin_value[include_path]" = "${awl}/inc:${webapp}/inc";
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/davical"
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/davical";
-      php_flag[magic_quotes_gpc] = Off
+      "php_flag[magic_quotes_gpc]" = "Off";
-      php_flag[register_globals] = Off
+      "php_flag[register_globals]" = "Off";
-      php_admin_value[error_reporting] = "E_ALL & ~E_NOTICE"
+      "php_admin_value[error_reporting]" = "E_ALL & ~E_NOTICE";
-      php_admin_value[default_charset] = "utf-8"
+      "php_admin_value[default_charset]" = "utf-8";
-      php_flag[magic_quotes_runtime] = Off
+      "php_flag[magic_quotes_runtime]" = "Off";
-      '';
+    };
  };
 }
diff --git a/modules/private/websites/tools/dav/default.nix b/modules/private/websites/tools/dav/default.nix
index 0012965..30a562c 100644
--- a/modules/private/websites/tools/dav/default.nix
+++ b/modules/private/websites/tools/dav/default.nix
@@ -38,14 +38,15 @@ in {
      root        = "/run/current-system/webapps/_dav";
      extraConfig = [
        infcloud.vhostConf
-        davical.apache.vhostConf
+        (davical.apache.vhostConf config.services.phpfpm.pools.davical.socket)
      ];
    };
    services.phpfpm.pools = {
      davical = {
-        listen = davical.phpFpm.socket;
+        user = config.services.httpd.Tools.user;
-        extraConfig = davical.phpFpm.pool;
+        group = config.services.httpd.Tools.group;
+        settings = davical.phpFpm.pool;
      };
    };
diff --git a/modules/private/websites/tools/db/default.nix b/modules/private/websites/tools/db/default.nix
index 60592e5..fc8d989 100644
--- a/modules/private/websites/tools/db/default.nix
+++ b/modules/private/websites/tools/db/default.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, config,  ... }:
 let
-    adminer = pkgs.callPackage ../../commons/adminer.nix {};
+    adminer = pkgs.callPackage ../../commons/adminer.nix { inherit config; };
    cfg = config.myServices.websites.tools.db;
 in {
@@ -15,7 +15,7 @@ in {
      addToCerts  = true;
      hosts       = ["db-1.immae.eu" ];
      root        = null;
-      extraConfig = [ adminer.apache.vhostConf ];
+      extraConfig = [ (adminer.apache.vhostConf null) ];
    };
  };
 }
diff --git a/modules/private/websites/tools/git/default.nix b/modules/private/websites/tools/git/default.nix
index 054e47b..56e4401 100644
--- a/modules/private/websites/tools/git/default.nix
+++ b/modules/private/websites/tools/git/default.nix
@@ -30,7 +30,7 @@ in {
      root        = gitweb.apache.root;
      extraConfig = [
        gitweb.apache.vhostConf
-        mantisbt.apache.vhostConf
+        (mantisbt.apache.vhostConf config.services.phpfpm.pools.mantisbt.socket)
        ''
          RewriteEngine on
          RewriteCond %{REQUEST_URI}       ^/releases
@@ -40,8 +40,9 @@ in {
    };
    services.phpfpm.pools = {
      mantisbt = {
-        listen = mantisbt.phpFpm.socket;
+        user = config.services.httpd.Tools.user;
-        extraConfig = mantisbt.phpFpm.pool;
+        group = config.services.httpd.Tools.group;
+        settings = mantisbt.phpFpm.pool;
      };
    };
  };
diff --git a/modules/private/websites/tools/git/mantisbt.nix b/modules/private/websites/tools/git/mantisbt.nix
index d75b022..50851aa 100644
--- a/modules/private/websites/tools/git/mantisbt.nix
+++ b/modules/private/websites/tools/git/mantisbt.nix
@@ -53,12 +53,12 @@ rec {
    modules = [ "proxy_fcgi" ];
    webappName = "tools_mantisbt";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
      Alias /mantisbt "${root}"
      <Directory "${root}">
        DirectoryIndex index.php
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
        </FilesMatch>
        AllowOverride All
@@ -76,20 +76,17 @@ rec {
    basedir = builtins.concatStringsSep ":" (
      [ webRoot "/var/secrets/webapps/tools-mantisbt" ]
      ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/mantisbt.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = apache.user;
-      user = ${apache.user}
+      "listen.group" = apache.group;
-      group = ${apache.group}
+      "pm" = "ondemand";
-      listen.owner = ${apache.user}
+      "pm.max_children" = "60";
-      listen.group = ${apache.group}
+      "pm.process_idle_timeout" = "60";
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
-      php_admin_value[upload_max_filesize] = 5000000
+      "php_admin_value[upload_max_filesize]" = "5000000";
-      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/mantisbt"
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/mantisbt";
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/mantisbt"
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/mantisbt";
-      '';
+    };
  };
 }
diff --git a/modules/private/websites/tools/mail/default.nix b/modules/private/websites/tools/mail/default.nix
index bb36042..1f7f7bf 100644
--- a/modules/private/websites/tools/mail/default.nix
+++ b/modules/private/websites/tools/mail/default.nix
@@ -6,6 +6,7 @@ let
  };
  rainloop = pkgs.callPackage ./rainloop.nix {};
  cfg = config.myServices.websites.tools.email;
+  pcfg = config.services.phpfpm.pools;
 in
 {
  options.myServices.websites.tools.email = {
@@ -34,8 +35,8 @@ in
      hosts      = ["mail.immae.eu"];
      root       = "/run/current-system/webapps/_mail";
      extraConfig = [
-        rainloop.apache.vhostConf
+        (rainloop.apache.vhostConf pcfg.rainloop.socket)
-        roundcubemail.apache.vhostConf
+        (roundcubemail.apache.vhostConf pcfg.roundcubemail.socket)
        ''
          <Directory /run/current-system/webapps/_mail>
            Require all granted
@@ -56,13 +57,15 @@ in
    };
    services.phpfpm.pools.roundcubemail = {
-      listen = roundcubemail.phpFpm.socket;
+      user = "wwwrun";
-      extraConfig = roundcubemail.phpFpm.pool;
+      group = "wwwrun";
+      settings = roundcubemail.phpFpm.pool;
      phpOptions = config.services.phpfpm.phpOptions + roundcubemail.phpFpm.phpConfig;
    };
    services.phpfpm.pools.rainloop = {
-      listen = rainloop.phpFpm.socket;
+      user = "wwwrun";
-      extraConfig = rainloop.phpFpm.pool;
+      group = "wwwrun";
+      settings = rainloop.phpFpm.pool;
    };
    system.activationScripts = {
      roundcubemail = roundcubemail.activationScript;
diff --git a/modules/private/websites/tools/mail/rainloop.nix b/modules/private/websites/tools/mail/rainloop.nix
index 2dad46e..9b1f0c5 100644
--- a/modules/private/websites/tools/mail/rainloop.nix
+++ b/modules/private/websites/tools/mail/rainloop.nix
@@ -16,7 +16,7 @@ rec {
    modules = [ "proxy_fcgi" ];
    webappName = "tools_rainloop";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
    Alias /rainloop "${root}"
    <Directory "${root}">
      DirectoryIndex index.php
@@ -25,7 +25,7 @@ rec {
      Require all granted
      <FilesMatch "\.php$">
-        SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+        SetHandler "proxy:unix:${socket}|fcgi://localhost"
      </FilesMatch>
    </Directory>
@@ -37,22 +37,19 @@ rec {
  phpFpm = rec {
    serviceDeps = [ "postgresql.service" ];
    basedir = builtins.concatStringsSep ":" [ webRoot varDir ];
-    socket = "/var/run/phpfpm/rainloop.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = apache.user;
-      user = ${apache.user}
+      "listen.group" = apache.group;
-      group = ${apache.group}
+      "pm" = "ondemand";
-      listen.owner = ${apache.user}
+      "pm.max_children" = "60";
-      listen.group = ${apache.group}
+      "pm.process_idle_timeout" = "60";
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
-      ; Needed to avoid clashes in browser cookies (same domain)
+      # Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = RainloopPHPSESSID
+      "php_value[session.name]" = "RainloopPHPSESSID";
-      php_admin_value[upload_max_filesize] = 200M
+      "php_admin_value[upload_max_filesize]" = "200M";
-      php_admin_value[post_max_size] = 200M
+      "php_admin_value[post_max_size]" = "200M";
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
-      '';
+    };
  };
 }
diff --git a/modules/private/websites/tools/mail/roundcubemail.nix b/modules/private/websites/tools/mail/roundcubemail.nix
index 35de312..0b35d02 100644
--- a/modules/private/websites/tools/mail/roundcubemail.nix
+++ b/modules/private/websites/tools/mail/roundcubemail.nix
@@ -83,7 +83,7 @@ rec {
    modules = [ "proxy_fcgi" ];
    webappName = "tools_roundcubemail";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
    Alias /roundcube "${root}"
    <Directory "${root}">
        DirectoryIndex index.php
@@ -92,7 +92,7 @@ rec {
        Require all granted
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
        </FilesMatch>
      </Directory>
      '';
@@ -107,22 +107,19 @@ rec {
      date.timezone = 'CET'
      extension=${phpPackages.imagick}/lib/php/extensions/imagick.so
      '';
-    socket = "/var/run/phpfpm/roundcubemail.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = apache.user;
-      user = ${apache.user}
+      "listen.group" = apache.group;
-      group = ${apache.group}
+      "pm" = "ondemand";
-      listen.owner = ${apache.user}
+      "pm.max_children" = "60";
-      listen.group = ${apache.group}
+      "pm.process_idle_timeout" = "60";
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
-      ; Needed to avoid clashes in browser cookies (same domain)
+      # Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = RoundcubemailPHPSESSID
+      "php_value[session.name]" = "RoundcubemailPHPSESSID";
-      php_admin_value[upload_max_filesize] = 200M
+      "php_admin_value[upload_max_filesize]" = "200M";
-      php_admin_value[post_max_size] = 200M
+      "php_admin_value[post_max_size]" = "200M";
-      php_admin_value[open_basedir] = "${basedir}:${apacheHttpd}/conf/mime.types:/tmp"
+      "php_admin_value[open_basedir]" = "${basedir}:${apacheHttpd}/conf/mime.types:/tmp";
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
-      '';
+    };
  };
 }
diff --git a/modules/private/websites/tools/tools/adminer.nix b/modules/private/websites/tools/tools/adminer.nix
index 907e37f..52a132c 100644
--- a/modules/private/websites/tools/tools/adminer.nix
+++ b/modules/private/websites/tools/tools/adminer.nix
@@ -1,4 +1,4 @@
-{ adminer }:
+{ adminer, php73, forcePhpSocket ? null }:
 rec {
  activationScript = {
    deps = [ "httpd" ];
@@ -9,22 +9,33 @@ rec {
  };
  webRoot = adminer;
  phpFpm = rec {
-    socket = "/var/run/phpfpm/adminer.sock";
+    user = apache.user;
-    pool = ''
+    group = apache.group;
-      user = ${apache.user}
+    phpPackage = (php73.override {
-      group = ${apache.group}
+      config.php.mysqlnd = true;
-      listen.owner = ${apache.user}
+      config.php.mysqli = false;
-      listen.group = ${apache.group}
+      config.php.pdo-mysql = false;
-      pm = ondemand
+    }).overrideAttrs(old: rec {
-      pm.max_children = 5
+      configureFlags = old.configureFlags ++ [
-      pm.process_idle_timeout = 60
+        "--with-mysqli=shared,mysqlnd"
-      ;php_admin_flag[log_errors] = on
+        ];
-      ; Needed to avoid clashes in browser cookies (same domain)
+    });
-      php_value[session.name] = AdminerPHPSESSID
+    phpOptions = ''
-      php_admin_value[open_basedir] = "${webRoot}:/tmp:/var/lib/php/sessions/adminer:/var/lib/php/tmp/adminer"
+      extension=${phpPackage}/lib/php/extensions/mysqli.so
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/adminer"
+    '';
-      php_admin_value[upload_tmp_dir] = "/var/lib/php/tmp/adminer"
+    settings = {
-      '';
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "5";
+      "pm.process_idle_timeout" = "60";
+      #"php_admin_flag[log_errors]" = "on";
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "AdminerPHPSESSID";
+      "php_admin_value[open_basedir]" = "${webRoot}:/tmp:/var/lib/php/sessions/adminer:/var/lib/php/tmp/adminer";
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/adminer";
+      "php_admin_value[upload_tmp_dir]" = "/var/lib/php/tmp/adminer";
+    };
  };
  apache = rec {
    user = "wwwrun";
@@ -32,12 +43,12 @@ rec {
    modules = [ "proxy_fcgi" ];
    webappName = "_adminer";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
      Alias /adminer ${root}
      <Directory ${root}>
        DirectoryIndex index.php
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${if forcePhpSocket != null then forcePhpSocket else socket}|fcgi://localhost"
        </FilesMatch>
        Use LDAPConnect
diff --git a/modules/private/websites/tools/tools/default.nix b/modules/private/websites/tools/tools/default.nix
index 5dc0981..5e0d446 100644
--- a/modules/private/websites/tools/tools/default.nix
+++ b/modules/private/websites/tools/tools/default.nix
@@ -40,6 +40,7 @@ let
  };
  cfg = config.myServices.websites.tools.tools;
+  pcfg = config.services.phpfpm.pools;
 in {
  options.myServices.websites.tools.tools = {
    enable = lib.mkEnableOption "enable tools website";
@@ -92,7 +93,7 @@ in {
            AllowOverride all
            Require all granted
            <FilesMatch "\.php$">
-              SetHandler "proxy:unix:/var/run/phpfpm/devtools.sock|fcgi://localhost"
+              SetHandler "proxy:unix:${pcfg.devtools.socket}|fcgi://localhost"
            </FilesMatch>
          </Directory>
          ''
@@ -115,21 +116,21 @@ in {
            AllowOverride all
            Require all granted
            <FilesMatch "\.php$">
-              SetHandler "proxy:unix:/var/run/phpfpm/tools.sock|fcgi://localhost"
+              SetHandler "proxy:unix:${pcfg.tools.socket}|fcgi://localhost"
            </FilesMatch>
          </Directory>
          ''
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf pcfg.adminer.socket)
        ympd.apache.vhostConf
-        ttrss.apache.vhostConf
+        (ttrss.apache.vhostConf pcfg.ttrss.socket)
-        wallabag.apache.vhostConf
+        (wallabag.apache.vhostConf pcfg.wallabag.socket)
-        yourls.apache.vhostConf
+        (yourls.apache.vhostConf pcfg.yourls.socket)
-        rompr.apache.vhostConf
+        (rompr.apache.vhostConf pcfg.rompr.socket)
-        shaarli.apache.vhostConf
+        (shaarli.apache.vhostConf pcfg.shaarli.socket)
-        dokuwiki.apache.vhostConf
+        (dokuwiki.apache.vhostConf pcfg.dokuwiki.socket)
-        ldap.apache.vhostConf
+        (ldap.apache.vhostConf pcfg.ldap.socket)
-        kanboard.apache.vhostConf
+        (kanboard.apache.vhostConf pcfg.kanboard.socket)
-        grocy.apache.vhostConf
+        (grocy.apache.vhostConf pcfg.grocy.socket)
      ];
    };
@@ -226,38 +227,36 @@ in {
    services.phpfpm.pools = {
      tools = {
-        listen = "/var/run/phpfpm/tools.sock";
+        user = "wwwrun";
-        extraConfig = ''
+        group = "wwwrun";
-          user = wwwrun
+        settings = {
-          group = wwwrun
+          "listen.owner" = "wwwrun";
-          listen.owner = wwwrun
+          "listen.group" = "wwwrun";
-          listen.group = wwwrun
+          "pm" = "dynamic";
-          pm = dynamic
+          "pm.max_children" = "60";
-          pm.max_children = 60
+          "pm.start_servers" = "2";
-          pm.start_servers = 2
+          "pm.min_spare_servers" = "1";
-          pm.min_spare_servers = 1
+          "pm.max_spare_servers" = "10";
-          pm.max_spare_servers = 10
-          ; Needed to avoid clashes in browser cookies (same domain)
+          # Needed to avoid clashes in browser cookies (same domain)
-          php_value[session.name] = ToolsPHPSESSID
+          "php_value[session.name]" = "ToolsPHPSESSID";
-          php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/tools.immae.eu:/tmp"
+          "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:/var/lib/ftp/tools.immae.eu:/tmp";
-          '';
+        };
      };
      devtools = {
-        listen = "/var/run/phpfpm/devtools.sock";
+        user = "wwwrun";
-        extraConfig = ''
+        group = "wwwrun";
-          user = wwwrun
+        settings = {
-          group = wwwrun
+          "listen.owner" = "wwwrun";
-          listen.owner = wwwrun
+          "listen.group" = "wwwrun";
-          listen.group = wwwrun
+          "pm" = "dynamic";
-          pm = dynamic
+          "pm.max_children" = "60";
-          pm.max_children = 60
+          "pm.start_servers" = "2";
-          pm.start_servers = 2
+          "pm.min_spare_servers" = "1";
-          pm.min_spare_servers = 1
+          "pm.max_spare_servers" = "10";
-          pm.max_spare_servers = 10
-          php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp"
+          "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp";
-          '';
+        };
        phpOptions = config.services.phpfpm.phpOptions + ''
          extension=${pkgs.php}/lib/php/extensions/mysqli.so
          extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
@@ -265,45 +264,51 @@ in {
          zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
          '';
      };
-      adminer = {
+      adminer = adminer.phpFpm;
-        listen = adminer.phpFpm.socket;
-        extraConfig = adminer.phpFpm.pool;
-      };
      ttrss = {
-        listen = ttrss.phpFpm.socket;
+        user = "wwwrun";
-        extraConfig = ttrss.phpFpm.pool;
+        group = "wwwrun";
+        settings = ttrss.phpFpm.pool;
      };
      wallabag = {
-        listen = wallabag.phpFpm.socket;
+        user = "wwwrun";
-        extraConfig = wallabag.phpFpm.pool;
+        group = "wwwrun";
+        settings = wallabag.phpFpm.pool;
      };
      yourls = {
-        listen = yourls.phpFpm.socket;
+        user = "wwwrun";
-        extraConfig = yourls.phpFpm.pool;
+        group = "wwwrun";
+        settings = yourls.phpFpm.pool;
      };
      rompr = {
-        listen = rompr.phpFpm.socket;
+        user = "wwwrun";
-        extraConfig = rompr.phpFpm.pool;
+        group = "wwwrun";
+        settings = rompr.phpFpm.pool;
      };
      shaarli = {
-        listen = shaarli.phpFpm.socket;
+        user = "wwwrun";
-        extraConfig = shaarli.phpFpm.pool;
+        group = "wwwrun";
+        settings = shaarli.phpFpm.pool;
      };
      dokuwiki = {
-        listen = dokuwiki.phpFpm.socket;
+        user = "wwwrun";
-        extraConfig = dokuwiki.phpFpm.pool;
+        group = "wwwrun";
+        settings = dokuwiki.phpFpm.pool;
      };
      ldap = {
-        listen = ldap.phpFpm.socket;
+        user = "wwwrun";
-        extraConfig = ldap.phpFpm.pool;
+        group = "wwwrun";
+        settings = ldap.phpFpm.pool;
      };
      kanboard = {
-        listen = kanboard.phpFpm.socket;
+        user = "wwwrun";
-        extraConfig = kanboard.phpFpm.pool;
+        group = "wwwrun";
+        settings = kanboard.phpFpm.pool;
      };
      grocy = {
-        listen = grocy.phpFpm.socket;
+        user = "wwwrun";
-        extraConfig = grocy.phpFpm.pool;
+        group = "wwwrun";
+        settings = grocy.phpFpm.pool;
      };
    };
diff --git a/modules/private/websites/tools/tools/dokuwiki.nix b/modules/private/websites/tools/tools/dokuwiki.nix
index d66e85d..26c04b7 100644
--- a/modules/private/websites/tools/tools/dokuwiki.nix
+++ b/modules/private/websites/tools/tools/dokuwiki.nix
@@ -26,12 +26,12 @@ rec {
    modules = [ "proxy_fcgi" ];
    webappName = "tools_dokuwiki";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
      Alias /dokuwiki "${root}"
      <Directory "${root}">
        DirectoryIndex index.php
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
        </FilesMatch>
        AllowOverride All
@@ -44,20 +44,17 @@ rec {
    serviceDeps = [ "openldap.service" ];
    basedir = builtins.concatStringsSep ":" (
      [ webRoot varDir ] ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/dokuwiki.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = apache.user;
-      user = ${apache.user}
+      "listen.group" = apache.group;
-      group = ${apache.group}
+      "pm" = "ondemand";
-      listen.owner = ${apache.user}
+      "pm.max_children" = "60";
-      listen.group = ${apache.group}
+      "pm.process_idle_timeout" = "60";
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
-      ; Needed to avoid clashes in browser cookies (same domain)
+      # Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = DokuwikiPHPSESSID
+      "php_value[session.name]" = "DokuwikiPHPSESSID";
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
-      '';
+    };
  };
 }
diff --git a/modules/private/websites/tools/tools/grocy.nix b/modules/private/websites/tools/tools/grocy.nix
index 1b8da20..a98d8ac 100644
--- a/modules/private/websites/tools/tools/grocy.nix
+++ b/modules/private/websites/tools/tools/grocy.nix
@@ -18,12 +18,12 @@ rec {
    modules = [ "proxy_fcgi" ];
    webappName = "tools_grocy";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
      Alias /grocy "${root}"
      <Directory "${root}">
        DirectoryIndex index.php
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
        </FilesMatch>
        AllowOverride All
@@ -35,21 +35,18 @@ rec {
  phpFpm = rec {
    basedir = builtins.concatStringsSep ":" (
      [ grocy grocy.yarnModules varDir ]);
-    socket = "/var/run/phpfpm/grocy.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = apache.user;
-      user = ${apache.user}
+      "listen.group" = apache.group;
-      group = ${apache.group}
+      "pm" = "ondemand";
-      listen.owner = ${apache.user}
+      "pm.max_children" = "60";
-      listen.group = ${apache.group}
+      "pm.process_idle_timeout" = "60";
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
-      ; Needed to avoid clashes in browser cookies (same domain)
+      # Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = grocyPHPSESSID
+      "php_value[session.name]" = "grocyPHPSESSID";
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
-      '';
+    };
  };
 }
diff --git a/modules/private/websites/tools/tools/kanboard.nix b/modules/private/websites/tools/tools/kanboard.nix
index 1880cbd..0f6fefc 100644
--- a/modules/private/websites/tools/tools/kanboard.nix
+++ b/modules/private/websites/tools/tools/kanboard.nix
@@ -49,7 +49,7 @@ rec {
    modules = [ "proxy_fcgi" ];
    webappName = "tools_kanboard";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
    Alias /kanboard "${root}"
    <Directory "${root}">
      DirectoryIndex index.php
@@ -58,7 +58,7 @@ rec {
      Require all granted
      <FilesMatch "\.php$">
-        SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+        SetHandler "proxy:unix:${socket}|fcgi://localhost"
      </FilesMatch>
    </Directory>
    <DirectoryMatch "${root}/data">
@@ -69,20 +69,17 @@ rec {
  phpFpm = rec {
    serviceDeps = [ "postgresql.service" "openldap.service" ];
    basedir = builtins.concatStringsSep ":" [ webRoot varDir "/var/secrets/webapps/tools-kanboard" ];
-    socket = "/var/run/phpfpm/kanboard.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = apache.user;
-      user = ${apache.user}
+      "listen.group" = apache.group;
-      group = ${apache.group}
+      "pm" = "ondemand";
-      listen.owner = ${apache.user}
+      "pm.max_children" = "60";
-      listen.group = ${apache.group}
+      "pm.process_idle_timeout" = "60";
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
-      ; Needed to avoid clashes in browser cookies (same domain)
+      # Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = KanboardPHPSESSID
+      "php_value[session.name]" = "KanboardPHPSESSID";
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
-      '';
+    };
  };
 }
diff --git a/modules/private/websites/tools/tools/ldap.nix b/modules/private/websites/tools/tools/ldap.nix
index e58a9bd..0c1a21f 100644
--- a/modules/private/websites/tools/tools/ldap.nix
+++ b/modules/private/websites/tools/tools/ldap.nix
@@ -39,12 +39,12 @@ rec {
    modules = [ "proxy_fcgi" ];
    webappName = "tools_ldap";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
      Alias /ldap "${root}"
      <Directory "${root}">
        DirectoryIndex index.php
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
        </FilesMatch>
        AllowOverride None
@@ -55,20 +55,17 @@ rec {
  phpFpm = rec {
    serviceDeps = [ "openldap.service" ];
    basedir = builtins.concatStringsSep ":" [ webRoot "/var/secrets/webapps/tools-ldap" ];
-    socket = "/var/run/phpfpm/ldap.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = apache.user;
-      user = ${apache.user}
+      "listen.group" = apache.group;
-      group = ${apache.group}
+      "pm" = "ondemand";
-      listen.owner = ${apache.user}
+      "pm.max_children" = "60";
-      listen.group = ${apache.group}
+      "pm.process_idle_timeout" = "60";
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
-      ; Needed to avoid clashes in browser cookies (same domain)
+      # Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = LdapPHPSESSID
+      "php_value[session.name]" = "LdapPHPSESSID";
-      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/phpldapadmin"
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/phpldapadmin";
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/phpldapadmin"
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/phpldapadmin";
-      '';
+    };
  };
 }
diff --git a/modules/private/websites/tools/tools/rompr.nix b/modules/private/websites/tools/tools/rompr.nix
index 75adabe..106164c 100644
--- a/modules/private/websites/tools/tools/rompr.nix
+++ b/modules/private/websites/tools/tools/rompr.nix
@@ -15,7 +15,7 @@ rec {
    modules = [ "headers" "mime" "proxy_fcgi" ];
    webappName = "tools_rompr";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
      Alias /rompr ${root}
      <Directory ${root}>
@@ -29,7 +29,7 @@ rec {
        AddType image/x-icon .ico
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
        </FilesMatch>
      </Directory>
@@ -51,29 +51,26 @@ rec {
  };
  phpFpm = rec {
    basedir = builtins.concatStringsSep ":" [ webRoot varDir ];
-    socket = "/var/run/phpfpm/rompr.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = apache.user;
-      user = ${apache.user}
+      "listen.group" = apache.group;
-      group = ${apache.group}
+      "pm" = "ondemand";
-      listen.owner = ${apache.user}
+      "pm.max_children" = "60";
-      listen.group = ${apache.group}
+      "pm.process_idle_timeout" = "60";
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
-      ; Needed to avoid clashes in browser cookies (same domain)
+      # Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = RomprPHPSESSID
+      "php_value[session.name]" = "RomprPHPSESSID";
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
-      php_flag[magic_quotes_gpc] = Off
+      "php_flag[magic_quotes_gpc]" = "Off";
-      php_flag[track_vars] = On
+      "php_flag[track_vars]" = "On";
-      php_flag[register_globals] = Off
+      "php_flag[register_globals]" = "Off";
-      php_admin_flag[allow_url_fopen] = On
+      "php_admin_flag[allow_url_fopen]" = "On";
-      php_value[include_path] = ${webRoot}
+      "php_value[include_path]" = "${webRoot}";
-      php_admin_value[upload_tmp_dir] = "${varDir}/prefs"
+      "php_admin_value[upload_tmp_dir]" = "${varDir}/prefs";
-      php_admin_value[post_max_size] = 32M
+      "php_admin_value[post_max_size]" = "32M";
-      php_admin_value[upload_max_filesize] = 32M
+      "php_admin_value[upload_max_filesize]" = "32M";
-      php_admin_value[memory_limit] = 256M
+      "php_admin_value[memory_limit]" = "256M";
-      '';
+    };
  };
 }
diff --git a/modules/private/websites/tools/tools/shaarli.nix b/modules/private/websites/tools/tools/shaarli.nix
index 0a75755..950d296 100644
--- a/modules/private/websites/tools/tools/shaarli.nix
+++ b/modules/private/websites/tools/tools/shaarli.nix
@@ -17,7 +17,7 @@ in rec {
    modules =  [ "proxy_fcgi" "rewrite" "env" ];
    webappName = "tools_shaarli";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
      Alias /Shaarli "${root}"
      Include /var/secrets/webapps/tools-shaarli
@@ -27,7 +27,7 @@ in rec {
        AllowOverride All
        Require all granted
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
        </FilesMatch>
      </Directory>
      '';
@@ -48,20 +48,17 @@ in rec {
  phpFpm = rec {
    serviceDeps = [ "openldap.service" ];
    basedir = builtins.concatStringsSep ":" [ webRoot varDir ];
-    socket = "/var/run/phpfpm/shaarli.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = apache.user;
-        user = ${apache.user}
+      "listen.group" = apache.group;
-        group = ${apache.group}
+      "pm" = "ondemand";
-        listen.owner = ${apache.user}
+      "pm.max_children" = "60";
-        listen.group = ${apache.group}
+      "pm.process_idle_timeout" = "60";
-        pm = ondemand
-        pm.max_children = 60
-        pm.process_idle_timeout = 60
-        ; Needed to avoid clashes in browser cookies (same domain)
+      # Needed to avoid clashes in browser cookies (same domain)
-        php_value[session.name] = ShaarliPHPSESSID
+      "php_value[session.name]" = "ShaarliPHPSESSID";
-        php_admin_value[open_basedir] = "${basedir}:/tmp"
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
-        php_admin_value[session.save_path] = "${varDir}/phpSessions"
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
-    '';
+    };
  };
 }
diff --git a/modules/private/websites/tools/tools/ttrss.nix b/modules/private/websites/tools/tools/ttrss.nix
index a8b2a93..48876d3 100644
--- a/modules/private/websites/tools/tools/ttrss.nix
+++ b/modules/private/websites/tools/tools/ttrss.nix
@@ -95,12 +95,12 @@ rec {
    modules = [ "proxy_fcgi" ];
    webappName = "tools_ttrss";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
      Alias /ttrss "${root}"
      <Directory "${root}">
        DirectoryIndex index.php
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
        </FilesMatch>
        AllowOverride All
@@ -114,20 +114,17 @@ rec {
    basedir = builtins.concatStringsSep ":" (
      [ webRoot "/var/secrets/webapps/tools-ttrss" varDir ]
      ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/ttrss.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = apache.user;
-      user = ${apache.user}
+      "listen.group" = apache.group;
-      group = ${apache.group}
+      "pm" = "ondemand";
-      listen.owner = ${apache.user}
+      "pm.max_children" = "60";
-      listen.group = ${apache.group}
+      "pm.process_idle_timeout" = "60";
-      pm = ondemand
-      pm.max_children = 60
+      # Needed to avoid clashes in browser cookies (same domain)
-      pm.process_idle_timeout = 60
+      "php_value[session.name]" = "TtrssPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
-      ; Needed to avoid clashes in browser cookies (same domain)
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
-      php_value[session.name] = TtrssPHPSESSID
+    };
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
  };
 }
diff --git a/modules/private/websites/tools/tools/wallabag.nix b/modules/private/websites/tools/tools/wallabag.nix
index 014d8a1..00e2dc9 100644
--- a/modules/private/websites/tools/tools/wallabag.nix
+++ b/modules/private/websites/tools/tools/wallabag.nix
@@ -82,7 +82,7 @@ rec {
    modules = [ "proxy_fcgi" ];
    webappName = "tools_wallabag";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
      Alias /wallabag "${root}"
      <Directory "${root}">
        AllowOverride None
@@ -91,7 +91,7 @@ rec {
        CGIPassAuth On
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
        </FilesMatch>
        <IfModule mod_rewrite.c>
@@ -129,22 +129,19 @@ rec {
    '';
    serviceDeps = [ "postgresql.service" "openldap.service" ];
    basedir = builtins.concatStringsSep ":" [ webappDir "/var/secrets/webapps/tools-wallabag" varDir ];
-    socket = "/var/run/phpfpm/wallabag.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = apache.user;
-      user = ${apache.user}
+      "listen.group" = apache.group;
-      group = ${apache.group}
+      "pm" = "dynamic";
-      listen.owner = ${apache.user}
+      "pm.max_children" = "60";
-      listen.group = ${apache.group}
+      "pm.start_servers" = "2";
-      pm = dynamic
+      "pm.min_spare_servers" = "1";
-      pm.max_children = 60
+      "pm.max_spare_servers" = "10";
-      pm.start_servers = 2
-      pm.min_spare_servers = 1
-      pm.max_spare_servers = 10
-      ; Needed to avoid clashes in browser cookies (same domain)
+      # Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = WallabagPHPSESSID
+      "php_value[session.name]" = "WallabagPHPSESSID";
-      php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:${basedir}:/tmp"
+      "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:${basedir}:/tmp";
-      php_value[max_execution_time] = 300
+      "php_value[max_execution_time]" = "300";
-      '';
+    };
  };
 }
diff --git a/modules/private/websites/tools/tools/yourls.nix b/modules/private/websites/tools/tools/yourls.nix
index 466ceae..cb03b6c 100644
--- a/modules/private/websites/tools/tools/yourls.nix
+++ b/modules/private/websites/tools/tools/yourls.nix
@@ -48,11 +48,11 @@ rec {
    modules = [ "proxy_fcgi" ];
    webappName = "tools_yourls";
    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
      Alias /url "${root}"
      <Directory "${root}">
        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
        </FilesMatch>
        AllowOverride None
@@ -73,20 +73,17 @@ rec {
    basedir = builtins.concatStringsSep ":" (
      [ webRoot "/var/secrets/webapps/tools-yourls" ]
      ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/yourls.sock";
+    pool = {
-    pool = ''
+      "listen.owner" = apache.user;
-      user = ${apache.user}
+      "listen.group" = apache.group;
-      group = ${apache.group}
+      "pm" = "ondemand";
-      listen.owner = ${apache.user}
+      "pm.max_children" = "60";
-      listen.group = ${apache.group}
+      "pm.process_idle_timeout" = "60";
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
-      ; Needed to avoid clashes in browser cookies (same domain)
+      # Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = YourlsPHPSESSID
+      "php_value[session.name]" = "YourlsPHPSESSID";
-      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/yourls"
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/yourls";
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/yourls"
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/yourls";
-      '';
+    };
  };
 }
author	Ismaël Bouya <ismael.bouya@normalesup.org>	2020-03-25 11:57:48 +0100
committer	Ismaël Bouya <ismael.bouya@normalesup.org>	2020-04-03 16:25:07 +0200
commit	5400b9b6f65451d41a9106fae6fc00f97d83f4ef (patch)
tree	6ed072da7b1f17ac3994ffea052aa0c0822f8446 /modules/private/websites
parent	441da8aac378f401625e82caf281fa0e26128310 (diff)
download	Nix-5400b9b6f65451d41a9106fae6fc00f97d83f4ef.tar.gz Nix-5400b9b6f65451d41a9106fae6fc00f97d83f4ef.tar.zst Nix-5400b9b6f65451d41a9106fae6fc00f97d83f4ef.zip