aboutsummaryrefslogtreecommitdiff
path: root/modules/private/websites
diff options
context:
space:
mode:
authorIsmaël Bouya <ismael.bouya@normalesup.org>2019-06-02 09:48:05 +0200
committerIsmaël Bouya <ismael.bouya@normalesup.org>2019-06-02 11:23:54 +0200
commit717ccfd957e686d773480df817387aebbe79aa48 (patch)
treeb2f59c57da32dcafefee9ccc5d7e6d32e498721e /modules/private/websites
parent29f8cb850d74b456d6481a456311bbf5361d328c (diff)
downloadNix-717ccfd957e686d773480df817387aebbe79aa48.tar.gz
Nix-717ccfd957e686d773480df817387aebbe79aa48.tar.zst
Nix-717ccfd957e686d773480df817387aebbe79aa48.zip
Finish moving aten php configuration to dedicated module
Diffstat (limited to 'modules/private/websites')
-rw-r--r--modules/private/websites/aten/builder.nix100
-rw-r--r--modules/private/websites/aten/integration.nix78
-rw-r--r--modules/private/websites/aten/production.nix89
3 files changed, 126 insertions, 141 deletions
diff --git a/modules/private/websites/aten/builder.nix b/modules/private/websites/aten/builder.nix
deleted file mode 100644
index 83a8f70..0000000
--- a/modules/private/websites/aten/builder.nix
+++ /dev/null
@@ -1,100 +0,0 @@
1{ apacheUser, apacheGroup, aten, lib, mylibs, config }: rec {
2 app = aten.override { inherit (config) environment; };
3 phpFpm = rec {
4 preStart = mylibs.phpFpmPreStart {
5 inherit app;
6 inherit (app) varDir;
7 keyFiles = [
8 "/var/secrets/webapps/${app.environment}-aten"
9 ];
10 actions = [
11 "/run/wrappers/bin/sudo -u ${apacheUser} APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup"
12 ];
13 };
14 serviceDeps = [ "postgresql.service" ];
15 socket = "/var/run/phpfpm/aten-${app.environment}.sock";
16 pool = ''
17 listen = ${socket}
18 user = ${apacheUser}
19 group = ${apacheGroup}
20 listen.owner = ${apacheUser}
21 listen.group = ${apacheGroup}
22 php_admin_value[upload_max_filesize] = 20M
23 php_admin_value[post_max_size] = 20M
24 ;php_admin_flag[log_errors] = on
25 php_admin_value[open_basedir] = "${app}:${app.varDir}:/tmp"
26 php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
27 ${if app.environment == "dev" then ''
28 pm = ondemand
29 pm.max_children = 5
30 pm.process_idle_timeout = 60
31 env[SYMFONY_DEBUG_MODE] = "yes"
32 '' else ''
33 pm = dynamic
34 pm.max_children = 20
35 pm.start_servers = 2
36 pm.min_spare_servers = 1
37 pm.max_spare_servers = 3
38 ''}'';
39 };
40 keys = [{
41 dest = "webapps/${app.environment}-aten";
42 user = apacheUser;
43 group = apacheGroup;
44 permissions = "0400";
45 text = ''
46 SetEnv APP_ENV "${app.environment}"
47 SetEnv APP_SECRET "${config.secret}"
48 SetEnv DATABASE_URL "${config.psql_url}"
49 '';
50 }];
51 apache = rec {
52 modules = [ "proxy_fcgi" ];
53 webappName = "aten_${app.environment}";
54 root = "/run/current-system/webapps/${webappName}";
55 vhostConf = ''
56 <FilesMatch "\.php$">
57 SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
58 </FilesMatch>
59
60 Include /var/secrets/webapps/${app.environment}-aten
61
62 ${if app.environment == "dev" then ''
63 <Location />
64 Use LDAPConnect
65 Require ldap-group cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
66 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
67 </Location>
68
69 <Location /backend>
70 Use LDAPConnect
71 Require ldap-group cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
72 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
73 </Location>
74 '' else ''
75 Use Stats aten.pro
76
77 <Location /backend>
78 Use LDAPConnect
79 Require ldap-group cn=aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
80 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
81 </Location>
82 ''}
83
84 <Directory ${root}>
85 Options Indexes FollowSymLinks MultiViews Includes
86 AllowOverride All
87 Require all granted
88 DirectoryIndex index.php
89 FallbackResource /index.php
90 </Directory>
91 '';
92 };
93 activationScript = {
94 deps = [ "wrappers" ];
95 text = ''
96 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}
97 install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
98 '';
99 };
100}
diff --git a/modules/private/websites/aten/integration.nix b/modules/private/websites/aten/integration.nix
index 0dbc4fa..38068a7 100644
--- a/modules/private/websites/aten/integration.nix
+++ b/modules/private/websites/aten/integration.nix
@@ -1,43 +1,83 @@
1{ lib, pkgs, config, myconfig, ... }: 1{ lib, pkgs, config, myconfig, ... }:
2let 2let
3 aten = pkgs.callPackage ./builder.nix { 3 secrets = myconfig.env.websites.aten.integration;
4 inherit (pkgs.webapps) aten; 4 app = pkgs.webapps.aten.override { environment = secrets.environment; };
5 config = myconfig.env.websites.aten.integration;
6 apacheUser = config.services.httpd.Inte.user;
7 apacheGroup = config.services.httpd.Inte.group;
8 };
9
10 cfg = config.myServices.websites.aten.integration; 5 cfg = config.myServices.websites.aten.integration;
6 pcfg = config.services.phpApplication;
11in { 7in {
12 options.myServices.websites.aten.integration.enable = lib.mkEnableOption "enable Aten's website in integration"; 8 options.myServices.websites.aten.integration.enable = lib.mkEnableOption "enable Aten's website in integration";
13 9
14 config = lib.mkIf cfg.enable { 10 config = lib.mkIf cfg.enable {
15 services.phpApplication.aten_dev = let 11 services.phpApplication.apps.aten_dev = {
16 app = pkgs.webapps.aten.override { environment = "dev"; };
17 in {
18 websiteEnv = "integration"; 12 websiteEnv = "integration";
19 httpdUser = config.services.httpd.Inte.user; 13 httpdUser = config.services.httpd.Inte.user;
20 httpdGroup = config.services.httpd.Inte.group; 14 httpdGroup = config.services.httpd.Inte.group;
15 httpdWatchFiles = [
16 config.secrets.fullPaths."webapps/${app.environment}-aten"
17 ];
21 inherit (app) webRoot varDir; 18 inherit (app) webRoot varDir;
22 inherit app; 19 inherit app;
23 serviceDeps = [ "postgresql.service" ]; 20 serviceDeps = [ "postgresql.service" ];
24 preStartActions = [ 21 preStartActions = [
25 "APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup" 22 "APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup"
26 ]; 23 ];
27 watchFiles = [ 24 phpOpenbasedir = [ "/tmp" ];
28 "${config.secrets.location}/webapps/${app.environment}-aten" 25 phpPool = ''
29 ]; 26 php_admin_value[upload_max_filesize] = 20M
30 webappName = "aten_dev"; 27 php_admin_value[post_max_size] = 20M
28 ;php_admin_flag[log_errors] = on
29 pm = ondemand
30 pm.max_children = 5
31 pm.process_idle_timeout = 60
32 env[SYMFONY_DEBUG_MODE] = "yes"
33 '';
31 }; 34 };
32 35
33 secrets.keys = aten.keys; 36 secrets.keys = [{
34 services.phpfpm.poolConfigs.aten_dev = aten.phpFpm.pool; 37 dest = "webapps/${app.environment}-aten";
35 services.websites.env.integration.vhostConfs.aten = { 38 user = config.services.httpd.Inte.user;
39 group = config.services.httpd.Inte.user;
40 permissions = "0400";
41 text = ''
42 SetEnv APP_ENV "${app.environment}"
43 SetEnv APP_SECRET "${secrets.secret}"
44 SetEnv DATABASE_URL "${secrets.psql_url}"
45 '';
46 }];
47 services.websites.env.integration.vhostConfs.aten_dev = {
36 certName = "eldiron"; 48 certName = "eldiron";
37 addToCerts = true; 49 addToCerts = true;
38 hosts = [ "dev.aten.pro" ]; 50 hosts = [ "dev.aten.pro" ];
39 root = aten.apache.root; 51 root = pcfg.webappDirs.aten_dev;
40 extraConfig = [ aten.apache.vhostConf ]; 52 extraConfig = [
53 ''
54 <FilesMatch "\.php$">
55 SetHandler "proxy:unix:${pcfg.phpListenPaths.aten_dev}|fcgi://localhost"
56 </FilesMatch>
57
58 Include ${config.secrets.fullPaths."webapps/${app.environment}-aten"}
59
60 <Location />
61 Use LDAPConnect
62 Require ldap-group cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
63 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
64 </Location>
65
66 <Location /backend>
67 Use LDAPConnect
68 Require ldap-group cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
69 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
70 </Location>
71
72 <Directory ${pcfg.webappDirs.aten_dev}>
73 Options Indexes FollowSymLinks MultiViews Includes
74 AllowOverride All
75 Require all granted
76 DirectoryIndex index.php
77 FallbackResource /index.php
78 </Directory>
79 ''
80 ];
41 }; 81 };
42 }; 82 };
43} 83}
diff --git a/modules/private/websites/aten/production.nix b/modules/private/websites/aten/production.nix
index 0fab309..21ecdcf 100644
--- a/modules/private/websites/aten/production.nix
+++ b/modules/private/websites/aten/production.nix
@@ -1,36 +1,81 @@
1{ lib, pkgs, config, myconfig, ... }: 1{ lib, pkgs, config, myconfig, ... }:
2let 2let
3 aten = pkgs.callPackage ./builder.nix { 3 secrets = myconfig.env.websites.aten.production;
4 inherit (pkgs.webapps) aten; 4 app = pkgs.webapps.aten.override { environment = secrets.environment; };
5 config = myconfig.env.websites.aten.production;
6 apacheUser = config.services.httpd.Prod.user;
7 apacheGroup = config.services.httpd.Prod.group;
8 };
9
10 cfg = config.myServices.websites.aten.production; 5 cfg = config.myServices.websites.aten.production;
6 pcfg = config.services.phpApplication;
11in { 7in {
12 options.myServices.websites.aten.production.enable = lib.mkEnableOption "enable Aten's website in production"; 8 options.myServices.websites.aten.production.enable = lib.mkEnableOption "enable Aten's website in production";
13 9
14 config = lib.mkIf cfg.enable { 10 config = lib.mkIf cfg.enable {
15 secrets.keys = aten.keys;
16 services.webstats.sites = [ { name = "aten.pro"; } ]; 11 services.webstats.sites = [ { name = "aten.pro"; } ];
12 services.phpApplication.apps.aten_prod = {
13 websiteEnv = "production";
14 httpdUser = config.services.httpd.Prod.user;
15 httpdGroup = config.services.httpd.Prod.group;
16 httpdWatchFiles = [
17 config.secrets.fullPaths."webapps/${app.environment}-aten"
18 ];
19 inherit (app) webRoot varDir;
20 inherit app;
21 serviceDeps = [ "postgresql.service" ];
22 preStartActions = [
23 "APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup"
24 ];
25 phpOpenbasedir = [ "/tmp" ];
26 phpPool = ''
27 php_admin_value[upload_max_filesize] = 20M
28 php_admin_value[post_max_size] = 20M
29 ;php_admin_flag[log_errors] = on
30 pm = dynamic
31 pm.max_children = 20
32 pm.start_servers = 2
33 pm.min_spare_servers = 1
34 pm.max_spare_servers = 3
35 '';
36 };
17 37
18 systemd.services.phpfpm-aten_prod.preStart = lib.mkAfter aten.phpFpm.preStart; 38 secrets.keys = [{
19 systemd.services.phpfpm-aten_prod.after = lib.mkAfter aten.phpFpm.serviceDeps; 39 dest = "webapps/${app.environment}-aten";
20 systemd.services.phpfpm-aten_prod.wants = aten.phpFpm.serviceDeps; 40 user = config.services.httpd.Prod.user;
21 services.phpfpm.poolConfigs.aten_prod = aten.phpFpm.pool; 41 group = config.services.httpd.Prod.user;
22 system.activationScripts.aten_prod = aten.activationScript; 42 permissions = "0400";
23 myServices.websites.webappDirs."${aten.apache.webappName}" = aten.app.webRoot; 43 text = ''
24 services.websites.env.production.modules = aten.apache.modules; 44 SetEnv APP_ENV "${app.environment}"
25 services.websites.env.production.vhostConfs.aten = { 45 SetEnv APP_SECRET "${secrets.secret}"
46 SetEnv DATABASE_URL "${secrets.psql_url}"
47 '';
48 }];
49 services.websites.env.production.vhostConfs.aten_prod = {
26 certName = "aten"; 50 certName = "aten";
27 certMainHost = "aten.pro"; 51 certMainHost = "aten.pro";
28 hosts = [ "aten.pro" "www.aten.pro" ]; 52 hosts = [ "aten.pro" "www.aten.pro" ];
29 root = aten.apache.root; 53 root = pcfg.webappDirs.aten_prod;
30 extraConfig = [ aten.apache.vhostConf ]; 54 extraConfig = [
55 ''
56 <FilesMatch "\.php$">
57 SetHandler "proxy:unix:${pcfg.phpListenPaths.aten_prod}|fcgi://localhost"
58 </FilesMatch>
59
60 Include ${config.secrets.fullPaths."webapps/${app.environment}-aten"}
61
62 Use Stats aten.pro
63
64 <Location /backend>
65 Use LDAPConnect
66 Require ldap-group cn=aten.pro,cn=httpd,ou=services,dc=immae,dc=eu
67 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>"
68 </Location>
69
70 <Directory ${pcfg.webappDirs.aten_prod}>
71 Options Indexes FollowSymLinks MultiViews Includes
72 AllowOverride All
73 Require all granted
74 DirectoryIndex index.php
75 FallbackResource /index.php
76 </Directory>
77 ''
78 ];
31 }; 79 };
32 services.websites.env.production.watchPaths = [
33 "/var/secrets/webapps/${aten.app.environment}-aten"
34 ];
35 }; 80 };
36} 81}
generated by cgit v1.2.3 (git 2.25.1) at 2024-05-26 19:00:54 +0000