aboutsummaryrefslogtreecommitdiff
path: root/nixops
diff options
context:
space:
mode:
authorIsmaël Bouya <ismael.bouya@normalesup.org>2019-04-16 00:04:34 +0200
committerIsmaël Bouya <ismael.bouya@normalesup.org>2019-04-16 00:04:34 +0200
commita754e9dbf5d6c35398f3c4ec52c3daf5f8ed2dd3 (patch)
tree16164779d0ced7480a0f45d896e9d7d78b531fda /nixops
parentdfb0e6df5ca2e045b45f2dce0a254b7444fb277f (diff)
downloadNix-a754e9dbf5d6c35398f3c4ec52c3daf5f8ed2dd3.tar.gz
Nix-a754e9dbf5d6c35398f3c4ec52c3daf5f8ed2dd3.tar.zst
Nix-a754e9dbf5d6c35398f3c4ec52c3daf5f8ed2dd3.zip
Move Aten and Connexionswing secrets to secure location
Related issue: https://git.immae.eu/mantisbt/view.php?id=122
Diffstat (limited to 'nixops')
-rw-r--r--nixops/modules/websites/aten/aten.nix17
-rw-r--r--nixops/modules/websites/aten/default.nix2
-rw-r--r--nixops/modules/websites/connexionswing/connexionswing.nix13
-rw-r--r--nixops/modules/websites/connexionswing/default.nix2
4 files changed, 25 insertions, 9 deletions
diff --git a/nixops/modules/websites/aten/aten.nix b/nixops/modules/websites/aten/aten.nix
index d9286c3..897b3ba 100644
--- a/nixops/modules/websites/aten/aten.nix
+++ b/nixops/modules/websites/aten/aten.nix
@@ -29,6 +29,17 @@ let
29 pm.max_spare_servers = 3 29 pm.max_spare_servers = 3
30 ''}''; 30 ''}'';
31 }; 31 };
32 keys."${environment}-aten" = {
33 destDir = "/run/keys/webapps";
34 user = apache.user;
35 group = apache.group;
36 permissions = "0700";
37 text = ''
38 SetEnv APP_ENV "${environment}"
39 SetEnv APP_SECRET "${config.secret}"
40 SetEnv DATABASE_URL "${config.psql_url}"
41 '';
42 };
32 apache = rec { 43 apache = rec {
33 user = "wwwrun"; 44 user = "wwwrun";
34 group = "wwwrun"; 45 group = "wwwrun";
@@ -40,9 +51,7 @@ let
40 SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost" 51 SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
41 </FilesMatch> 52 </FilesMatch>
42 53
43 SetEnv APP_ENV "${environment}" 54 Include /run/keys/webapps/${environment}-aten
44 SetEnv APP_SECRET "${config.secret}"
45 SetEnv DATABASE_URL "${config.psql_url}"
46 55
47 ${if environment == "dev" then '' 56 ${if environment == "dev" then ''
48 <Location /> 57 <Location />
@@ -124,8 +133,6 @@ let
124 preInstall = '' 133 preInstall = ''
125 export SYMFONY_ENV="${environment}" 134 export SYMFONY_ENV="${environment}"
126 export APP_ENV="${environment}" 135 export APP_ENV="${environment}"
127 export DATABASE_URL="${config.psql_url}"
128 export APP_SECRET="${config.secret}"
129 ''; 136 '';
130 postInstall = '' 137 postInstall = ''
131 ln -sf ${yarnModules}/node_modules . 138 ln -sf ${yarnModules}/node_modules .
diff --git a/nixops/modules/websites/aten/default.nix b/nixops/modules/websites/aten/default.nix
index 51a36fb..776a02e 100644
--- a/nixops/modules/websites/aten/default.nix
+++ b/nixops/modules/websites/aten/default.nix
@@ -25,6 +25,7 @@ in {
25 25
26 config = lib.mkMerge [ 26 config = lib.mkMerge [
27 (lib.mkIf cfg.production.enable { 27 (lib.mkIf cfg.production.enable {
28 deployment.keys = aten_prod.keys;
28 services.myWebsites.commons.stats.enable = true; 29 services.myWebsites.commons.stats.enable = true;
29 services.myWebsites.commons.stats.sites = [ 30 services.myWebsites.commons.stats.sites = [
30 { 31 {
@@ -56,6 +57,7 @@ in {
56 }; 57 };
57 }) 58 })
58 (lib.mkIf cfg.integration.enable { 59 (lib.mkIf cfg.integration.enable {
60 deployment.keys = aten_dev.keys;
59 security.acme.certs."eldiron".extraDomains."dev.aten.pro" = null; 61 security.acme.certs."eldiron".extraDomains."dev.aten.pro" = null;
60 services.myPhpfpm.poolConfigs.aten_dev = aten_dev.phpFpm.pool; 62 services.myPhpfpm.poolConfigs.aten_dev = aten_dev.phpFpm.pool;
61 system.activationScripts.aten_dev = aten_dev.activationScript; 63 system.activationScripts.aten_dev = aten_dev.activationScript;
diff --git a/nixops/modules/websites/connexionswing/connexionswing.nix b/nixops/modules/websites/connexionswing/connexionswing.nix
index 8fbca2d..c178184 100644
--- a/nixops/modules/websites/connexionswing/connexionswing.nix
+++ b/nixops/modules/websites/connexionswing/connexionswing.nix
@@ -3,8 +3,12 @@ let
3 connexionswing = { config }: rec { 3 connexionswing = { config }: rec {
4 environment = config.environment; 4 environment = config.environment;
5 varDir = "/var/lib/connexionswing_${environment}"; 5 varDir = "/var/lib/connexionswing_${environment}";
6 configRoot = 6 keys."${environment}-connexionswing" = {
7 writeText "parameters.yml" '' 7 destDir = "/run/keys/webapps";
8 user = apache.user;
9 group = apache.group;
10 permissions = "0700";
11 text = ''
8 # This file is auto-generated during the composer install 12 # This file is auto-generated during the composer install
9 parameters: 13 parameters:
10 database_host: ${config.mysql.host} 14 database_host: ${config.mysql.host}
@@ -27,6 +31,7 @@ let
27 arguments: ['/run/wrappers/bin/sendmail -bs'] 31 arguments: ['/run/wrappers/bin/sendmail -bs']
28 '' else ""} 32 '' else ""}
29 ''; 33 '';
34 };
30 phpFpm = rec { 35 phpFpm = rec {
31 socket = "/var/run/phpfpm/connexionswing-${environment}.sock"; 36 socket = "/var/run/phpfpm/connexionswing-${environment}.sock";
32 phpConfig = '' 37 phpConfig = ''
@@ -41,7 +46,7 @@ let
41 php_admin_value[upload_max_filesize] = 20M 46 php_admin_value[upload_max_filesize] = 20M
42 php_admin_value[post_max_size] = 20M 47 php_admin_value[post_max_size] = 20M
43 ;php_admin_flag[log_errors] = on 48 ;php_admin_flag[log_errors] = on
44 php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:${configRoot}:${webappDir}:${varDir}:/tmp" 49 php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/run/keys/webapps/${environment}-connexionswing:${webappDir}:${varDir}:/tmp"
45 php_admin_value[session.save_path] = "${varDir}/phpSessions" 50 php_admin_value[session.save_path] = "${varDir}/phpSessions"
46 ${if environment == "dev" then '' 51 ${if environment == "dev" then ''
47 pm = ondemand 52 pm = ondemand
@@ -166,7 +171,7 @@ let
166 cd $out 171 cd $out
167 ${if environment == "prod" then "php ./bin/console assetic:dump --env=prod --no-debug" else ""} 172 ${if environment == "prod" then "php ./bin/console assetic:dump --env=prod --no-debug" else ""}
168 rm app/config/parameters.yml 173 rm app/config/parameters.yml
169 ln -sf ${configRoot} app/config/parameters.yml 174 ln -sf /run/keys/webapps/${environment}-connexionswing app/config/parameters.yml
170 rm -rf var/{logs,cache} 175 rm -rf var/{logs,cache}
171 ln -sf ${varDir}/var/{logs,cache} var/ 176 ln -sf ${varDir}/var/{logs,cache} var/
172 ln -sf ${varDir}/{medias,uploads} web/images/ 177 ln -sf ${varDir}/{medias,uploads} web/images/
diff --git a/nixops/modules/websites/connexionswing/default.nix b/nixops/modules/websites/connexionswing/default.nix
index f98b349..752382f 100644
--- a/nixops/modules/websites/connexionswing/default.nix
+++ b/nixops/modules/websites/connexionswing/default.nix
@@ -25,6 +25,7 @@ in {
25 25
26 config = lib.mkMerge [ 26 config = lib.mkMerge [
27 (lib.mkIf cfg.production.enable { 27 (lib.mkIf cfg.production.enable {
28 deployment.keys = connexionswing_prod.keys;
28 services.myWebsites.commons.stats.enable = true; 29 services.myWebsites.commons.stats.enable = true;
29 services.myWebsites.commons.stats.sites = [ 30 services.myWebsites.commons.stats.sites = [
30 { 31 {
@@ -58,6 +59,7 @@ in {
58 }; 59 };
59 }) 60 })
60 (lib.mkIf cfg.integration.enable { 61 (lib.mkIf cfg.integration.enable {
62 deployment.keys = connexionswing_dev.keys;
61 security.acme.certs."eldiron".extraDomains."sandetludo.immae.eu" = null; 63 security.acme.certs."eldiron".extraDomains."sandetludo.immae.eu" = null;
62 security.acme.certs."eldiron".extraDomains."connexionswing.immae.eu" = null; 64 security.acme.certs."eldiron".extraDomains."connexionswing.immae.eu" = null;
63 services.myPhpfpm.poolConfigs.connexionswing_dev = connexionswing_dev.phpFpm.pool; 65 services.myPhpfpm.poolConfigs.connexionswing_dev = connexionswing_dev.phpFpm.pool;