aboutsummaryrefslogtreecommitdiff
path: root/nixops/modules
diff options
context:
space:
mode:
authorIsmaël Bouya <ismael.bouya@normalesup.org>2019-05-11 16:55:50 +0200
committerIsmaël Bouya <ismael.bouya@normalesup.org>2019-05-11 17:06:20 +0200
commit7667c367033b15582cf383da62446f78e66a59ef (patch)
tree5349427aa43070dd603802f68963b30c1c544232 /nixops/modules
parentc890321db12036be69ebbece202984874b1e5a57 (diff)
downloadNix-7667c367033b15582cf383da62446f78e66a59ef.tar.gz
Nix-7667c367033b15582cf383da62446f78e66a59ef.tar.zst
Nix-7667c367033b15582cf383da62446f78e66a59ef.zip
Move spip and chloe website to pkgs
Diffstat (limited to 'nixops/modules')
-rw-r--r--nixops/modules/websites/chloe/chloe.json14
-rw-r--r--nixops/modules/websites/chloe/chloe.nix224
-rw-r--r--nixops/modules/websites/chloe/default.nix21
-rw-r--r--nixops/modules/websites/commons/spip/spip_ldap_patch.patch60
-rw-r--r--nixops/modules/websites/commons/spip/spip_mes_options.php18
5 files changed, 107 insertions, 230 deletions
diff --git a/nixops/modules/websites/chloe/chloe.json b/nixops/modules/websites/chloe/chloe.json
deleted file mode 100644
index 686d751..0000000
--- a/nixops/modules/websites/chloe/chloe.json
+++ /dev/null
@@ -1,14 +0,0 @@
1{
2 "tag": "96fc4eb-master",
3 "meta": {
4 "name": "chloe",
5 "url": "gitolite@git.immae.eu:perso/Immae/Sites/Chloe",
6 "branch": "master"
7 },
8 "git": {
9 "url": "gitolite@git.immae.eu:perso/Immae/Sites/Chloe",
10 "rev": "96fc4eb0099a29b0f9a58fb4eaec4bf14ac65f0a",
11 "sha256": "0mf15j6z86j2smm2k360cmm5djhcjbs9949pznwi57kw97vkm1s3",
12 "fetchSubmodules": true
13 }
14}
diff --git a/nixops/modules/websites/chloe/chloe.nix b/nixops/modules/websites/chloe/chloe.nix
index e2381d8..2847b9d 100644
--- a/nixops/modules/websites/chloe/chloe.nix
+++ b/nixops/modules/websites/chloe/chloe.nix
@@ -1,137 +1,105 @@
1{ stdenv, lib, fetchzip, fetchurl, fetchedGitPrivate, sassc }: 1{ chloe, config }:
2let 2rec {
3 chloe = { config }: rec { 3 app = chloe.override { inherit (config) environment; };
4 environment = config.environment; 4 phpFpm = rec {
5 phpFpm = rec { 5 serviceDeps = [ "mysql.service" ];
6 serviceDeps = [ "mysql.service" ]; 6 socket = "/var/run/phpfpm/chloe-${app.environment}.sock";
7 socket = "/var/run/phpfpm/chloe-${environment}.sock"; 7 pool = ''
8 pool = '' 8 listen = ${socket}
9 listen = ${socket} 9 user = ${apache.user}
10 user = ${apache.user} 10 group = ${apache.group}
11 group = ${apache.group} 11 listen.owner = ${apache.user}
12 listen.owner = ${apache.user} 12 listen.group = ${apache.group}
13 listen.group = ${apache.group} 13 php_admin_value[upload_max_filesize] = 20M
14 php_admin_value[upload_max_filesize] = 20M 14 php_admin_value[post_max_size] = 20M
15 php_admin_value[post_max_size] = 20M 15 ;php_admin_flag[log_errors] = on
16 ;php_admin_flag[log_errors] = on 16 php_admin_value[open_basedir] = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp"
17 php_admin_value[open_basedir] = "${../commons/spip/spip_mes_options.php}:${configDir}:${webRoot}:${varDir}:/tmp" 17 php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
18 php_admin_value[session.save_path] = "${varDir}/phpSessions" 18 ${if app.environment == "dev" then ''
19 ${if environment == "dev" then '' 19 pm = ondemand
20 pm = ondemand 20 pm.max_children = 5
21 pm.max_children = 5 21 pm.process_idle_timeout = 60
22 pm.process_idle_timeout = 60 22 '' else ''
23 '' else '' 23 pm = dynamic
24 pm = dynamic 24 pm.max_children = 20
25 pm.max_children = 20 25 pm.start_servers = 2
26 pm.start_servers = 2 26 pm.min_spare_servers = 1
27 pm.min_spare_servers = 1 27 pm.max_spare_servers = 3
28 pm.max_spare_servers = 3 28 ''}'';
29 ''}''; 29 };
30 }; 30 keys = [{
31 keys = [{ 31 dest = "webapps/${app.environment}-chloe";
32 dest = "webapps/${environment}-chloe"; 32 user = apache.user;
33 user = apache.user; 33 group = apache.group;
34 group = apache.group; 34 permissions = "0400";
35 permissions = "0400"; 35 text = ''
36 text = '' 36 SetEnv SPIP_CONFIG_DIR "${configDir}"
37 SetEnv SPIP_CONFIG_DIR "${configDir}" 37 SetEnv SPIP_VAR_DIR "${app.varDir}"
38 SetEnv SPIP_VAR_DIR "${varDir}" 38 SetEnv SPIP_SITE "chloe-${app.environment}"
39 SetEnv SPIP_SITE "chloe-${environment}" 39 SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu"
40 SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu" 40 SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu"
41 SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu" 41 SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}"
42 SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}" 42 SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}"
43 SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}" 43 SetEnv SPIP_LDAP_SEARCH "${config.ldap.search}"
44 SetEnv SPIP_LDAP_SEARCH "${config.ldap.search}" 44 SetEnv SPIP_MYSQL_HOST "${config.mysql.host}"
45 SetEnv SPIP_MYSQL_HOST "${config.mysql.host}" 45 SetEnv SPIP_MYSQL_PORT "${config.mysql.port}"
46 SetEnv SPIP_MYSQL_PORT "${config.mysql.port}" 46 SetEnv SPIP_MYSQL_DB "${config.mysql.name}"
47 SetEnv SPIP_MYSQL_DB "${config.mysql.name}" 47 SetEnv SPIP_MYSQL_USER "${config.mysql.user}"
48 SetEnv SPIP_MYSQL_USER "${config.mysql.user}" 48 SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}"
49 SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}" 49 '';
50 ''; 50 }];
51 }]; 51 apache = rec {
52 apache = rec { 52 user = "wwwrun";
53 user = "wwwrun"; 53 group = "wwwrun";
54 group = "wwwrun"; 54 modules = [ "proxy_fcgi" ];
55 modules = [ "proxy_fcgi" ]; 55 webappName = "chloe_${app.environment}";
56 webappName = "chloe_${environment}"; 56 root = "/run/current-system/webapps/${webappName}";
57 root = "/run/current-system/webapps/${webappName}"; 57 vhostConf = ''
58 vhostConf = '' 58 Include /var/secrets/webapps/${app.environment}-chloe
59 Include /var/secrets/webapps/${environment}-chloe
60 59
61 RewriteEngine On 60 RewriteEngine On
62 ${if environment == "prod" then '' 61 ${if app.environment == "prod" then ''
63 RewriteRule ^/news.rss /spip.php?page=backend&id_rubrique=1 62 RewriteRule ^/news.rss /spip.php?page=backend&id_rubrique=1
64 '' else ""} 63 '' else ""}
65 64
66 <FilesMatch "\.php$"> 65 <FilesMatch "\.php$">
67 SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost" 66 SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
68 </FilesMatch> 67 </FilesMatch>
69 68
70 <Directory ${root}> 69 <Directory ${root}>
71 DirectoryIndex index.php index.htm index.html 70 DirectoryIndex index.php index.htm index.html
72 Options -Indexes +FollowSymLinks +MultiViews +Includes 71 Options -Indexes +FollowSymLinks +MultiViews +Includes
73 Include ${root}/htaccess.txt 72 Include ${root}/htaccess.txt
74 73
75 AllowOverride AuthConfig FileInfo Limit 74 AllowOverride AuthConfig FileInfo Limit
76 Require all granted 75 Require all granted
77 </Directory> 76 </Directory>
78 77
79 <DirectoryMatch "${root}/squelettes"> 78 <DirectoryMatch "${root}/squelettes">
80 Require all denied 79 Require all denied
81 </DirectoryMatch> 80 </DirectoryMatch>
82 81
83 <FilesMatch "(.htaccess|rewrite-rules|.gitignore)$"> 82 <FilesMatch "(.htaccess|rewrite-rules|.gitignore)$">
84 Require all denied 83 Require all denied
85 </FilesMatch> 84 </FilesMatch>
86 85
87 ${if environment == "dev" then '' 86 ${if app.environment == "dev" then ''
88 <Location /> 87 <Location />
89 Use LDAPConnect 88 Use LDAPConnect
90 Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu 89 Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
91 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://osteopathe-cc.fr\"></html>" 90 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://osteopathe-cc.fr\"></html>"
92 </Location> 91 </Location>
93 '' else '' 92 '' else ''
94 Use Stats osteopathe-cc.fr 93 Use Stats osteopathe-cc.fr
95 ''} 94 ''}
96 '';
97 };
98 activationScript = {
99 deps = [ "wrappers" ];
100 text = ''
101 install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir} ${varDir}/IMG ${varDir}/tmp ${varDir}/local
102 install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
103 '';
104 };
105 configDir = ./chloe_config_ + environment;
106 varDir = "/var/lib/chloe_${environment}";
107 siteDir = stdenv.mkDerivation (fetchedGitPrivate ./chloe.json // rec {
108 buildPhase = ''
109 make
110 '';
111 installPhase = ''
112 cp -a . $out
113 '';
114 buildInputs = [ sassc ];
115 });
116 webRoot = stdenv.mkDerivation rec {
117 name = "chloe-${environment}-spip-${version}";
118 version = "3.2.3";
119 src = fetchzip {
120 url = "https://files.spip.net/spip/archives/SPIP-v${version}.zip";
121 sha256 = "1r1mjvsnrp6mvkgjakvi3x4ms8m8k5mp93micbbg8r99fj7qlfkq";
122 };
123 paches = [ ../commons/spip/spip_ldap_patch.patch ];
124 buildPhase = ''
125 rm -rf IMG local tmp config/remove.txt
126 ln -sf ${../commons/spip/spip_mes_options.php} config/mes_options.php
127 echo "Require all denied" > "config/.htaccess"
128 ln -sf ${varDir}/{IMG,local} .
129 ''; 95 '';
130 installPhase = ''
131 cp -a . $out
132 cp -a ${siteDir}/* $out
133 '';
134 };
135 }; 96 };
136in 97 activationScript = {
137 chloe 98 deps = [ "wrappers" ];
99 text = ''
100 install -m 0755 -o ${apache.user} -g ${apache.group} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local
101 install -m 0750 -o ${apache.user} -g ${apache.group} -d ${app.varDir}/phpSessions
102 '';
103 };
104 configDir = ./chloe_config_ + app.environment;
105}
diff --git a/nixops/modules/websites/chloe/default.nix b/nixops/modules/websites/chloe/default.nix
index a542d70..874b81b 100644
--- a/nixops/modules/websites/chloe/default.nix
+++ b/nixops/modules/websites/chloe/default.nix
@@ -1,14 +1,15 @@
1{ lib, pkgs, config, myconfig, mylibs, ... }: 1{ lib, pkgs, config, myconfig, mylibs, ... }:
2let 2let
3 chloe = pkgs.callPackage ./chloe.nix { inherit (mylibs) fetchedGitPrivate; }; 3 chloe_dev = pkgs.callPackage ./chloe.nix {
4 chloe_dev = chloe { 4 inherit (pkgs.private.webapps) chloe;
5 config = myconfig.env.websites.chloe.integration; 5 config = myconfig.env.websites.chloe.integration;
6 }; 6 };
7 chloe_prod = chloe { 7 chloe_prod = pkgs.callPackage ./chloe.nix {
8 config = myconfig.env.websites.chloe.production; 8 inherit (pkgs.private.webapps) chloe;
9 }; 9 config = myconfig.env.websites.chloe.production;
10 };
10 11
11 cfg = config.services.myWebsites.Chloe; 12 cfg = config.services.myWebsites.Chloe;
12in { 13in {
13 options.services.myWebsites.Chloe = { 14 options.services.myWebsites.Chloe = {
14 production = { 15 production = {
@@ -39,7 +40,7 @@ in {
39 system.activationScripts.chloe_prod = chloe_prod.activationScript; 40 system.activationScripts.chloe_prod = chloe_prod.activationScript;
40 system.extraSystemBuilderCmds = '' 41 system.extraSystemBuilderCmds = ''
41 mkdir -p $out/webapps 42 mkdir -p $out/webapps
42 ln -s ${chloe_prod.webRoot} $out/webapps/${chloe_prod.apache.webappName} 43 ln -s ${chloe_prod.app.webRoot} $out/webapps/${chloe_prod.apache.webappName}
43 ''; 44 '';
44 services.myWebsites.production.modules = chloe_prod.apache.modules; 45 services.myWebsites.production.modules = chloe_prod.apache.modules;
45 services.myWebsites.production.vhostConfs.chloe = { 46 services.myWebsites.production.vhostConfs.chloe = {
@@ -60,7 +61,7 @@ in {
60 system.activationScripts.chloe_dev = chloe_dev.activationScript; 61 system.activationScripts.chloe_dev = chloe_dev.activationScript;
61 system.extraSystemBuilderCmds = '' 62 system.extraSystemBuilderCmds = ''
62 mkdir -p $out/webapps 63 mkdir -p $out/webapps
63 ln -s ${chloe_dev.webRoot} $out/webapps/${chloe_dev.apache.webappName} 64 ln -s ${chloe_dev.app.webRoot} $out/webapps/${chloe_dev.apache.webappName}
64 ''; 65 '';
65 services.myWebsites.integration.modules = chloe_dev.apache.modules; 66 services.myWebsites.integration.modules = chloe_dev.apache.modules;
66 services.myWebsites.integration.vhostConfs.chloe = { 67 services.myWebsites.integration.vhostConfs.chloe = {
diff --git a/nixops/modules/websites/commons/spip/spip_ldap_patch.patch b/nixops/modules/websites/commons/spip/spip_ldap_patch.patch
deleted file mode 100644
index 653c909..0000000
--- a/nixops/modules/websites/commons/spip/spip_ldap_patch.patch
+++ /dev/null
@@ -1,60 +0,0 @@
1--- old/ecrire/auth/ldap.php 2017-06-08 21:58:17.000000000 +0200
2+++ new/ecrire/auth/ldap.php 2017-06-10 02:54:02.687954143 +0200
3@@ -171,24 +171,41 @@
4 $desc = isset($ldap['attributes']) && $ldap['attributes'] ? $ldap['attributes'] : $GLOBALS['ldap_attributes'] ;
5
6 $logins = is_array($desc['login']) ? $desc['login'] : array($desc['login']);
7+ if (isset($GLOBALS['ldap_search'])) {
8+ $search_query = str_replace("%user%", $login_search, $GLOBALS['ldap_search']);
9+ $result = @ldap_search($ldap_link, $ldap_base, $search_query, array("dn"));
10+ $info = @ldap_get_entries($ldap_link, $result);
11+ // Ne pas accepter les resultats si plus d'une entree
12+ // (on veut un attribut unique)
13
14- // Tenter une recherche pour essayer de retrouver le DN
15- foreach ($logins as $att) {
16- $result = @ldap_search($ldap_link, $ldap_base, "$att=$login_search", array("dn"));
17- $info = @ldap_get_entries($ldap_link, $result);
18- // Ne pas accepter les resultats si plus d'une entree
19- // (on veut un attribut unique)
20+ if (is_array($info) and $info['count'] == 1) {
21+ $dn = $info[0]['dn'];
22+ if (!$checkpass) {
23+ return $dn;
24+ }
25+ if (@ldap_bind($ldap_link, $dn, $pass)) {
26+ return $dn;
27+ }
28+ }
29+ } else {
30+ // Tenter une recherche pour essayer de retrouver le DN
31+ foreach ($logins as $att) {
32+ $result = @ldap_search($ldap_link, $ldap_base, "$att=$login_search", array("dn"));
33+ $info = @ldap_get_entries($ldap_link, $result);
34+ // Ne pas accepter les resultats si plus d'une entree
35+ // (on veut un attribut unique)
36
37- if (is_array($info) and $info['count'] == 1) {
38- $dn = $info[0]['dn'];
39- if (!$checkpass) {
40- return $dn;
41- }
42- if (@ldap_bind($ldap_link, $dn, $pass)) {
43- return $dn;
44- }
45- }
46- }
47+ if (is_array($info) and $info['count'] == 1) {
48+ $dn = $info[0]['dn'];
49+ if (!$checkpass) {
50+ return $dn;
51+ }
52+ if (@ldap_bind($ldap_link, $dn, $pass)) {
53+ return $dn;
54+ }
55+ }
56+ }
57+ }
58
59 if ($checkpass and !isset($dn)) {
60 // Si echec, essayer de deviner le DN
diff --git a/nixops/modules/websites/commons/spip/spip_mes_options.php b/nixops/modules/websites/commons/spip/spip_mes_options.php
deleted file mode 100644
index 8db8389..0000000
--- a/nixops/modules/websites/commons/spip/spip_mes_options.php
+++ /dev/null
@@ -1,18 +0,0 @@
1<?php // /!\ Important: There must be no blank space before &lt;?php or after ?&gt;
2// This file was inspired from the spip contrib website
3// http://www.spip.net/fr_article3811.html
4
5$config_dir = getenv('SPIP_CONFIG_DIR') . '/';
6$var_dir = getenv('SPIP_VAR_DIR') . '/';
7
8$cookie_prefix = str_replace('.', '_', getenv("SPIP_SITE"));
9$table_prefix = 'spip';
10
11spip_initialisation(
12 $config_dir,
13 _DIR_RACINE . _NOM_PERMANENTS_ACCESSIBLES,
14 $var_dir . _NOM_TEMPORAIRES_INACCESSIBLES,
15 _DIR_RACINE . _NOM_TEMPORAIRES_ACCESSIBLES
16);
17
18?>
generated by cgit v1.2.3 (git 2.25.1) at 2025-01-11 23:37:07 +0000