aboutsummaryrefslogtreecommitdiff
path: root/modules/private/websites/ludivinecassal
diff options
context:
space:
mode:
Diffstat (limited to 'modules/private/websites/ludivinecassal')
-rw-r--r--modules/private/websites/ludivinecassal/builder.nix153
-rw-r--r--modules/private/websites/ludivinecassal/production.nix109
2 files changed, 87 insertions, 175 deletions
diff --git a/modules/private/websites/ludivinecassal/builder.nix b/modules/private/websites/ludivinecassal/builder.nix
deleted file mode 100644
index e2a0f19..0000000
--- a/modules/private/websites/ludivinecassal/builder.nix
+++ /dev/null
@@ -1,153 +0,0 @@
1{ apacheUser, apacheGroup, config, ludivinecassal, mylibs, pkgs, ruby, sass, imagemagick }:
2rec {
3 app = ludivinecassal.override { inherit (config) environment; };
4 varDir = "/var/lib/ludivinecassal_${app.environment}";
5 keys = [{
6 dest = "webapps/${app.environment}-ludivinecassal";
7 user = apacheUser;
8 group = apacheGroup;
9 permissions = "0400";
10 text = ''
11 # This file is auto-generated during the composer install
12 parameters:
13 database_host: ${config.mysql.host}
14 database_port: ${config.mysql.port}
15 database_name: ${config.mysql.name}
16 database_user: ${config.mysql.user}
17 database_password: ${config.mysql.password}
18 database_server_version: ${pkgs.mariadb.mysqlVersion}
19 mailer_transport: smtp
20 mailer_host: 127.0.0.1
21 mailer_user: null
22 mailer_password: null
23 secret: ${config.secret}
24 ldap_host: ldap.immae.eu
25 ldap_port: 636
26 ldap_version: 3
27 ldap_ssl: true
28 ldap_tls: false
29 ldap_user_bind: 'uid={username},ou=users,dc=immae,dc=eu'
30 ldap_base_dn: 'dc=immae,dc=eu'
31 ldap_search_dn: '${config.ldap.dn}'
32 ldap_search_password: '${config.ldap.password}'
33 ldap_search_filter: '${config.ldap.search}'
34 leapt_im:
35 binary_path: ${imagemagick}/bin
36 assetic:
37 sass: ${sass}/bin/sass
38 ruby: ${ruby}/bin/ruby
39 '';
40 }];
41 phpFpm = rec {
42 preStart = mylibs.phpFpmPreStart {
43 inherit app;
44 inherit (app) varDir;
45 keyFiles = [
46 "/var/secrets/webapps/${app.environment}-ludivinecassal"
47 ];
48 actions = [
49 "/run/wrappers/bin/sudo -u ${apacheUser} ./bin/console --env=${app.environment} cache:clear --no-warmup"
50 ];
51 };
52 serviceDeps = [ "mysql.service" ];
53 socket = "/var/run/phpfpm/ludivinecassal-${app.environment}.sock";
54 pool = ''
55 listen = ${socket}
56 user = ${apacheUser}
57 group = ${apacheGroup}
58 listen.owner = ${apacheUser}
59 listen.group = ${apacheGroup}
60 php_admin_value[upload_max_filesize] = 20M
61 php_admin_value[post_max_size] = 20M
62 ;php_admin_flag[log_errors] = on
63 php_admin_value[open_basedir] = "/var/secrets/webapps/${app.environment}-ludivinecassal:${app}:${app.varDir}:/tmp"
64 php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
65 ${if app.environment == "dev" then ''
66 pm = ondemand
67 pm.max_children = 5
68 pm.process_idle_timeout = 60
69 env[SYMFONY_DEBUG_MODE] = "yes"
70 '' else ''
71 pm = dynamic
72 pm.max_children = 20
73 pm.start_servers = 2
74 pm.min_spare_servers = 1
75 pm.max_spare_servers = 3
76 ''}'';
77 };
78 apache = rec {
79 modules = [ "proxy_fcgi" ];
80 webappName = "ludivine_${app.environment}";
81 root = "/run/current-system/webapps/${webappName}";
82 vhostConf = ''
83 <FilesMatch "\.php$">
84 SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
85 </FilesMatch>
86
87 ${if app.environment == "dev" then ''
88 <Location />
89 Use LDAPConnect
90 Require ldap-group cn=ludivine.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
91 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://ludivinecassal.com\"></html>"
92 </Location>
93
94 <Directory ${root}>
95 Options Indexes FollowSymLinks MultiViews Includes
96 AllowOverride None
97 Require all granted
98
99 DirectoryIndex app_dev.php
100
101 <IfModule mod_negotiation.c>
102 Options -MultiViews
103 </IfModule>
104
105 <IfModule mod_rewrite.c>
106 RewriteEngine On
107
108 RewriteCond %{REQUEST_URI}::$1 ^(/.+)/(.*)::\2$
109 RewriteRule ^(.*) - [E=BASE:%1]
110
111 # Maintenance script
112 RewriteCond %{DOCUMENT_ROOT}/maintenance.php -f
113 RewriteCond %{SCRIPT_FILENAME} !maintenance.php
114 RewriteRule ^.*$ %{ENV:BASE}/maintenance.php [R=503,L]
115 ErrorDocument 503 /maintenance.php
116
117 # Sets the HTTP_AUTHORIZATION header removed by Apache
118 RewriteCond %{HTTP:Authorization} .
119 RewriteRule ^ - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
120
121 RewriteCond %{ENV:REDIRECT_STATUS} ^$
122 RewriteRule ^app_dev\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
123
124 # If the requested filename exists, simply serve it.
125 # We only want to let Apache serve files and not directories.
126 RewriteCond %{REQUEST_FILENAME} -f
127 RewriteRule ^ - [L]
128
129 # Rewrite all other queries to the front controller.
130 RewriteRule ^ %{ENV:BASE}/app_dev.php [L]
131 </IfModule>
132
133 </Directory>
134 '' else ''
135 Use Stats ludivinecassal.com
136
137 <Directory ${root}>
138 Options Indexes FollowSymLinks MultiViews Includes
139 AllowOverride All
140 Require all granted
141 </Directory>
142 ''}
143 '';
144 };
145 activationScript = {
146 deps = [ "wrappers" ];
147 text = ''
148 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}
149 install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/tmp
150 install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions
151 '';
152 };
153}
diff --git a/modules/private/websites/ludivinecassal/production.nix b/modules/private/websites/ludivinecassal/production.nix
index 9d8407d..82f6899 100644
--- a/modules/private/websites/ludivinecassal/production.nix
+++ b/modules/private/websites/ludivinecassal/production.nix
@@ -1,37 +1,102 @@
1{ lib, pkgs, config, myconfig, ... }: 1{ lib, pkgs, config, myconfig, ... }:
2let 2let
3 ludivinecassal = pkgs.callPackage ./builder.nix { 3 secrets = myconfig.env.websites.ludivinecassal.production;
4 inherit (pkgs.webapps) ludivinecassal; 4 app = pkgs.webapps.ludivinecassal.override { environment = secrets.environment; };
5 config = myconfig.env.websites.ludivinecassal.production; 5 pcfg = config.services.phpApplication;
6 apacheUser = config.services.httpd.Prod.user;
7 apacheGroup = config.services.httpd.Prod.group;
8 };
9
10 cfg = config.myServices.websites.ludivinecassal.production; 6 cfg = config.myServices.websites.ludivinecassal.production;
11in { 7in {
12 options.myServices.websites.ludivinecassal.production.enable = lib.mkEnableOption "enable Ludivine's website in production"; 8 options.myServices.websites.ludivinecassal.production.enable = lib.mkEnableOption "enable Ludivine's website in production";
13 9
14 config = lib.mkIf cfg.enable { 10 config = lib.mkIf cfg.enable {
15 secrets.keys = ludivinecassal.keys;
16 services.webstats.sites = [ { name = "ludivinecassal.com"; } ]; 11 services.webstats.sites = [ { name = "ludivinecassal.com"; } ];
12 services.phpApplication.apps.ludivinecassal_prod = {
13 websiteEnv = "production";
14 httpdUser = config.services.httpd.Prod.user;
15 httpdGroup = config.services.httpd.Prod.group;
16 inherit (app) webRoot varDir;
17 varDirPaths = {
18 "tmp" = "0700";
19 };
20 inherit app;
21 serviceDeps = [ "mysql.service" ];
22 preStartActions = [
23 "./bin/console --env=${app.environment} cache:clear --no-warmup"
24 ];
25 phpOpenbasedir = [ "/tmp" ];
26 phpPool = ''
27 php_admin_value[upload_max_filesize] = 20M
28 php_admin_value[post_max_size] = 20M
29 ;php_admin_flag[log_errors] = on
30 pm = dynamic
31 pm.max_children = 20
32 pm.start_servers = 2
33 pm.min_spare_servers = 1
34 pm.max_spare_servers = 3
35 '';
36 phpWatchFiles = [
37 config.secrets.fullPaths."webapps/${app.environment}-ludivinecassal"
38 ];
39 };
40
41 secrets.keys = [
42 {
43 dest = "webapps/${app.environment}-ludivinecassal";
44 user = config.services.httpd.Prod.user;
45 group = config.services.httpd.Prod.group;
46 permissions = "0400";
47 text = ''
48 # This file is auto-generated during the composer install
49 parameters:
50 database_host: ${secrets.mysql.host}
51 database_port: ${secrets.mysql.port}
52 database_name: ${secrets.mysql.name}
53 database_user: ${secrets.mysql.user}
54 database_password: ${secrets.mysql.password}
55 database_server_version: ${pkgs.mariadb.mysqlVersion}
56 mailer_transport: smtp
57 mailer_host: 127.0.0.1
58 mailer_user: null
59 mailer_password: null
60 secret: ${secrets.secret}
61 ldap_host: ldap.immae.eu
62 ldap_port: 636
63 ldap_version: 3
64 ldap_ssl: true
65 ldap_tls: false
66 ldap_user_bind: 'uid={username},ou=users,dc=immae,dc=eu'
67 ldap_base_dn: 'dc=immae,dc=eu'
68 ldap_search_dn: '${secrets.ldap.dn}'
69 ldap_search_password: '${secrets.ldap.password}'
70 ldap_search_filter: '${secrets.ldap.search}'
71 leapt_im:
72 binary_path: ${pkgs.imagemagick}/bin
73 assetic:
74 sass: ${pkgs.sass}/bin/sass
75 ruby: ${pkgs.ruby}/bin/ruby
76 '';
77 }
78 ];
17 79
18 systemd.services.phpfpm-ludivinecassal_prod.after = lib.mkAfter ludivinecassal.phpFpm.serviceDeps; 80 services.websites.env.production.vhostConfs.ludivinecassal_prod = {
19 systemd.services.phpfpm-ludivinecassal_prod.wants = ludivinecassal.phpFpm.serviceDeps;
20 systemd.services.phpfpm-ludivinecassal_prod.preStart = lib.mkAfter ludivinecassal.phpFpm.preStart;
21 services.phpfpm.poolConfigs.ludivinecassal_prod = ludivinecassal.phpFpm.pool;
22 system.activationScripts.ludivinecassal_prod = ludivinecassal.activationScript;
23 myServices.websites.webappDirs."${ludivinecassal.apache.webappName}" = ludivinecassal.app.webRoot;
24 services.websites.env.production.modules = ludivinecassal.apache.modules;
25 services.websites.env.production.vhostConfs.ludivine = {
26 certName = "ludivinecassal"; 81 certName = "ludivinecassal";
27 certMainHost = "ludivinecassal.com"; 82 certMainHost = "ludivinecassal.com";
28 hosts = ["ludivinecassal.com" "www.ludivinecassal.com" ]; 83 hosts = ["ludivinecassal.com" "www.ludivinecassal.com" ];
29 root = ludivinecassal.apache.root; 84 root = pcfg.webappDirs.ludivinecassal_prod;
30 extraConfig = [ ludivinecassal.apache.vhostConf ]; 85 extraConfig = [
31 }; 86 ''
32 services.filesWatcher.phpfpm-ludivinecassal_prod = { 87 <FilesMatch "\.php$">
33 restart = true; 88 SetHandler "proxy:unix:${pcfg.phpListenPaths.ludivinecassal_prod}|fcgi://localhost"
34 paths = [ "/var/secrets/webapps/${ludivinecassal.app.environment}-ludivinecassal" ]; 89 </FilesMatch>
90
91 Use Stats ludivinecassal.com
92
93 <Directory ${pcfg.webappDirs.ludivinecassal_prod}>
94 Options Indexes FollowSymLinks MultiViews Includes
95 AllowOverride All
96 Require all granted
97 </Directory>
98 ''
99 ];
35 }; 100 };
36 }; 101 };
37} 102}
generated by cgit v1.2.3 (git 2.25.1) at 2024-10-20 21:15:06 +0000