11 files changed, 226 insertions, 237 deletions

diff --git a/modules/private/websites/tools/tools/adminer.nix b/modules/private/websites/tools/tools/adminer.nix
index 907e37f..52a132c 100644
--- a/modules/private/websites/tools/tools/adminer.nix
+++ b/modules/private/websites/tools/tools/adminer.nix
@@ -1,4 +1,4 @@
-{ adminer }:
+{ adminer, php73, forcePhpSocket ? null }:
 rec {
   activationScript = {
     deps = [ "httpd" ];
@@ -9,22 +9,33 @@ rec {
   };
   webRoot = adminer;
   phpFpm = rec {
-    socket = "/var/run/phpfpm/adminer.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 5
-      pm.process_idle_timeout = 60
-      ;php_admin_flag[log_errors] = on
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = AdminerPHPSESSID
-      php_admin_value[open_basedir] = "${webRoot}:/tmp:/var/lib/php/sessions/adminer:/var/lib/php/tmp/adminer"
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/adminer"
-      php_admin_value[upload_tmp_dir] = "/var/lib/php/tmp/adminer"
-      '';
+    user = apache.user;
+    group = apache.group;
+    phpPackage = (php73.override {
+      config.php.mysqlnd = true;
+      config.php.mysqli = false;
+      config.php.pdo-mysql = false;
+    }).overrideAttrs(old: rec {
+      configureFlags = old.configureFlags ++ [
+        "--with-mysqli=shared,mysqlnd"
+        ];
+    });
+    phpOptions = ''
+      extension=${phpPackage}/lib/php/extensions/mysqli.so
+    '';
+    settings = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "5";
+      "pm.process_idle_timeout" = "60";
+      #"php_admin_flag[log_errors]" = "on";
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "AdminerPHPSESSID";
+      "php_admin_value[open_basedir]" = "${webRoot}:/tmp:/var/lib/php/sessions/adminer:/var/lib/php/tmp/adminer";
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/adminer";
+      "php_admin_value[upload_tmp_dir]" = "/var/lib/php/tmp/adminer";
+    };
   };
   apache = rec {
     user = "wwwrun";
@@ -32,12 +43,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "_adminer";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /adminer ${root}
       <Directory ${root}>
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${if forcePhpSocket != null then forcePhpSocket else socket}|fcgi://localhost"
         </FilesMatch>
 
         Use LDAPConnect
diff --git a/modules/private/websites/tools/tools/default.nix b/modules/private/websites/tools/tools/default.nix
index 5dc0981..5e0d446 100644
--- a/modules/private/websites/tools/tools/default.nix
+++ b/modules/private/websites/tools/tools/default.nix
@@ -40,6 +40,7 @@ let
   };
 
   cfg = config.myServices.websites.tools.tools;
+  pcfg = config.services.phpfpm.pools;
 in {
   options.myServices.websites.tools.tools = {
     enable = lib.mkEnableOption "enable tools website";
@@ -92,7 +93,7 @@ in {
             AllowOverride all
             Require all granted
             <FilesMatch "\.php$">
-              SetHandler "proxy:unix:/var/run/phpfpm/devtools.sock|fcgi://localhost"
+              SetHandler "proxy:unix:${pcfg.devtools.socket}|fcgi://localhost"
             </FilesMatch>
           </Directory>
           ''
@@ -115,21 +116,21 @@ in {
             AllowOverride all
             Require all granted
             <FilesMatch "\.php$">
-              SetHandler "proxy:unix:/var/run/phpfpm/tools.sock|fcgi://localhost"
+              SetHandler "proxy:unix:${pcfg.tools.socket}|fcgi://localhost"
             </FilesMatch>
           </Directory>
           ''
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf pcfg.adminer.socket)
         ympd.apache.vhostConf
-        ttrss.apache.vhostConf
-        wallabag.apache.vhostConf
-        yourls.apache.vhostConf
-        rompr.apache.vhostConf
-        shaarli.apache.vhostConf
-        dokuwiki.apache.vhostConf
-        ldap.apache.vhostConf
-        kanboard.apache.vhostConf
-        grocy.apache.vhostConf
+        (ttrss.apache.vhostConf pcfg.ttrss.socket)
+        (wallabag.apache.vhostConf pcfg.wallabag.socket)
+        (yourls.apache.vhostConf pcfg.yourls.socket)
+        (rompr.apache.vhostConf pcfg.rompr.socket)
+        (shaarli.apache.vhostConf pcfg.shaarli.socket)
+        (dokuwiki.apache.vhostConf pcfg.dokuwiki.socket)
+        (ldap.apache.vhostConf pcfg.ldap.socket)
+        (kanboard.apache.vhostConf pcfg.kanboard.socket)
+        (grocy.apache.vhostConf pcfg.grocy.socket)
       ];
     };
 
@@ -226,38 +227,36 @@ in {
 
     services.phpfpm.pools = {
       tools = {
-        listen = "/var/run/phpfpm/tools.sock";
-        extraConfig = ''
-          user = wwwrun
-          group = wwwrun
-          listen.owner = wwwrun
-          listen.group = wwwrun
-          pm = dynamic
-          pm.max_children = 60
-          pm.start_servers = 2
-          pm.min_spare_servers = 1
-          pm.max_spare_servers = 10
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = {
+          "listen.owner" = "wwwrun";
+          "listen.group" = "wwwrun";
+          "pm" = "dynamic";
+          "pm.max_children" = "60";
+          "pm.start_servers" = "2";
+          "pm.min_spare_servers" = "1";
+          "pm.max_spare_servers" = "10";
 
-          ; Needed to avoid clashes in browser cookies (same domain)
-          php_value[session.name] = ToolsPHPSESSID
-          php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/tools.immae.eu:/tmp"
-          '';
+          # Needed to avoid clashes in browser cookies (same domain)
+          "php_value[session.name]" = "ToolsPHPSESSID";
+          "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:/var/lib/ftp/tools.immae.eu:/tmp";
+        };
       };
       devtools = {
-        listen = "/var/run/phpfpm/devtools.sock";
-        extraConfig = ''
-          user = wwwrun
-          group = wwwrun
-          listen.owner = wwwrun
-          listen.group = wwwrun
-          pm = dynamic
-          pm.max_children = 60
-          pm.start_servers = 2
-          pm.min_spare_servers = 1
-          pm.max_spare_servers = 10
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = {
+          "listen.owner" = "wwwrun";
+          "listen.group" = "wwwrun";
+          "pm" = "dynamic";
+          "pm.max_children" = "60";
+          "pm.start_servers" = "2";
+          "pm.min_spare_servers" = "1";
+          "pm.max_spare_servers" = "10";
 
-          php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp"
-          '';
+          "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp";
+        };
         phpOptions = config.services.phpfpm.phpOptions + ''
           extension=${pkgs.php}/lib/php/extensions/mysqli.so
           extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
@@ -265,45 +264,51 @@ in {
           zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
           '';
       };
-      adminer = {
-        listen = adminer.phpFpm.socket;
-        extraConfig = adminer.phpFpm.pool;
-      };
+      adminer = adminer.phpFpm;
       ttrss = {
-        listen = ttrss.phpFpm.socket;
-        extraConfig = ttrss.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = ttrss.phpFpm.pool;
       };
       wallabag = {
-        listen = wallabag.phpFpm.socket;
-        extraConfig = wallabag.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = wallabag.phpFpm.pool;
       };
       yourls = {
-        listen = yourls.phpFpm.socket;
-        extraConfig = yourls.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = yourls.phpFpm.pool;
       };
       rompr = {
-        listen = rompr.phpFpm.socket;
-        extraConfig = rompr.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = rompr.phpFpm.pool;
       };
       shaarli = {
-        listen = shaarli.phpFpm.socket;
-        extraConfig = shaarli.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = shaarli.phpFpm.pool;
       };
       dokuwiki = {
-        listen = dokuwiki.phpFpm.socket;
-        extraConfig = dokuwiki.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = dokuwiki.phpFpm.pool;
       };
       ldap = {
-        listen = ldap.phpFpm.socket;
-        extraConfig = ldap.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = ldap.phpFpm.pool;
       };
       kanboard = {
-        listen = kanboard.phpFpm.socket;
-        extraConfig = kanboard.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = kanboard.phpFpm.pool;
       };
       grocy = {
-        listen = grocy.phpFpm.socket;
-        extraConfig = grocy.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = grocy.phpFpm.pool;
       };
     };
 
diff --git a/modules/private/websites/tools/tools/dokuwiki.nix b/modules/private/websites/tools/tools/dokuwiki.nix
index d66e85d..26c04b7 100644
--- a/modules/private/websites/tools/tools/dokuwiki.nix
+++ b/modules/private/websites/tools/tools/dokuwiki.nix
@@ -26,12 +26,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_dokuwiki";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /dokuwiki "${root}"
       <Directory "${root}">
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride All
@@ -44,20 +44,17 @@ rec {
     serviceDeps = [ "openldap.service" ];
     basedir = builtins.concatStringsSep ":" (
       [ webRoot varDir ] ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/dokuwiki.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = DokuwikiPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "DokuwikiPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/grocy.nix b/modules/private/websites/tools/tools/grocy.nix
index 1b8da20..a98d8ac 100644
--- a/modules/private/websites/tools/tools/grocy.nix
+++ b/modules/private/websites/tools/tools/grocy.nix
@@ -18,12 +18,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_grocy";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /grocy "${root}"
       <Directory "${root}">
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride All
@@ -35,21 +35,18 @@ rec {
   phpFpm = rec {
     basedir = builtins.concatStringsSep ":" (
       [ grocy grocy.yarnModules varDir ]);
-    socket = "/var/run/phpfpm/grocy.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = grocyPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "grocyPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
 
diff --git a/modules/private/websites/tools/tools/kanboard.nix b/modules/private/websites/tools/tools/kanboard.nix
index 1880cbd..0f6fefc 100644
--- a/modules/private/websites/tools/tools/kanboard.nix
+++ b/modules/private/websites/tools/tools/kanboard.nix
@@ -49,7 +49,7 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_kanboard";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
     Alias /kanboard "${root}"
     <Directory "${root}">
       DirectoryIndex index.php
@@ -58,7 +58,7 @@ rec {
       Require all granted
 
       <FilesMatch "\.php$">
-        SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+        SetHandler "proxy:unix:${socket}|fcgi://localhost"
       </FilesMatch>
     </Directory>
     <DirectoryMatch "${root}/data">
@@ -69,20 +69,17 @@ rec {
   phpFpm = rec {
     serviceDeps = [ "postgresql.service" "openldap.service" ];
     basedir = builtins.concatStringsSep ":" [ webRoot varDir "/var/secrets/webapps/tools-kanboard" ];
-    socket = "/var/run/phpfpm/kanboard.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = KanboardPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "KanboardPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/ldap.nix b/modules/private/websites/tools/tools/ldap.nix
index e58a9bd..0c1a21f 100644
--- a/modules/private/websites/tools/tools/ldap.nix
+++ b/modules/private/websites/tools/tools/ldap.nix
@@ -39,12 +39,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_ldap";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /ldap "${root}"
       <Directory "${root}">
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride None
@@ -55,20 +55,17 @@ rec {
   phpFpm = rec {
     serviceDeps = [ "openldap.service" ];
     basedir = builtins.concatStringsSep ":" [ webRoot "/var/secrets/webapps/tools-ldap" ];
-    socket = "/var/run/phpfpm/ldap.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = LdapPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/phpldapadmin"
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/phpldapadmin"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "LdapPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/phpldapadmin";
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/phpldapadmin";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/rompr.nix b/modules/private/websites/tools/tools/rompr.nix
index 75adabe..106164c 100644
--- a/modules/private/websites/tools/tools/rompr.nix
+++ b/modules/private/websites/tools/tools/rompr.nix
@@ -15,7 +15,7 @@ rec {
     modules = [ "headers" "mime" "proxy_fcgi" ];
     webappName = "tools_rompr";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /rompr ${root}
 
       <Directory ${root}>
@@ -29,7 +29,7 @@ rec {
         AddType image/x-icon .ico
 
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
       </Directory>
 
@@ -51,29 +51,26 @@ rec {
   };
   phpFpm = rec {
     basedir = builtins.concatStringsSep ":" [ webRoot varDir ];
-    socket = "/var/run/phpfpm/rompr.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = RomprPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      php_flag[magic_quotes_gpc] = Off
-      php_flag[track_vars] = On
-      php_flag[register_globals] = Off
-      php_admin_flag[allow_url_fopen] = On
-      php_value[include_path] = ${webRoot}
-      php_admin_value[upload_tmp_dir] = "${varDir}/prefs"
-      php_admin_value[post_max_size] = 32M
-      php_admin_value[upload_max_filesize] = 32M
-      php_admin_value[memory_limit] = 256M
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "RomprPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+      "php_flag[magic_quotes_gpc]" = "Off";
+      "php_flag[track_vars]" = "On";
+      "php_flag[register_globals]" = "Off";
+      "php_admin_flag[allow_url_fopen]" = "On";
+      "php_value[include_path]" = "${webRoot}";
+      "php_admin_value[upload_tmp_dir]" = "${varDir}/prefs";
+      "php_admin_value[post_max_size]" = "32M";
+      "php_admin_value[upload_max_filesize]" = "32M";
+      "php_admin_value[memory_limit]" = "256M";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/shaarli.nix b/modules/private/websites/tools/tools/shaarli.nix
index 0a75755..950d296 100644
--- a/modules/private/websites/tools/tools/shaarli.nix
+++ b/modules/private/websites/tools/tools/shaarli.nix
@@ -17,7 +17,7 @@ in rec {
     modules =  [ "proxy_fcgi" "rewrite" "env" ];
     webappName = "tools_shaarli";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /Shaarli "${root}"
 
       Include /var/secrets/webapps/tools-shaarli
@@ -27,7 +27,7 @@ in rec {
         AllowOverride All
         Require all granted
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
       </Directory>
       '';
@@ -48,20 +48,17 @@ in rec {
   phpFpm = rec {
     serviceDeps = [ "openldap.service" ];
     basedir = builtins.concatStringsSep ":" [ webRoot varDir ];
-    socket = "/var/run/phpfpm/shaarli.sock";
-    pool = ''
-        user = ${apache.user}
-        group = ${apache.group}
-        listen.owner = ${apache.user}
-        listen.group = ${apache.group}
-        pm = ondemand
-        pm.max_children = 60
-        pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-        ; Needed to avoid clashes in browser cookies (same domain)
-        php_value[session.name] = ShaarliPHPSESSID
-        php_admin_value[open_basedir] = "${basedir}:/tmp"
-        php_admin_value[session.save_path] = "${varDir}/phpSessions"
-    '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "ShaarliPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/ttrss.nix b/modules/private/websites/tools/tools/ttrss.nix
index a8b2a93..48876d3 100644
--- a/modules/private/websites/tools/tools/ttrss.nix
+++ b/modules/private/websites/tools/tools/ttrss.nix
@@ -95,12 +95,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_ttrss";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /ttrss "${root}"
       <Directory "${root}">
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride All
@@ -114,20 +114,17 @@ rec {
     basedir = builtins.concatStringsSep ":" (
       [ webRoot "/var/secrets/webapps/tools-ttrss" varDir ]
       ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/ttrss.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
-
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = TtrssPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
+
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "TtrssPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/wallabag.nix b/modules/private/websites/tools/tools/wallabag.nix
index 014d8a1..00e2dc9 100644
--- a/modules/private/websites/tools/tools/wallabag.nix
+++ b/modules/private/websites/tools/tools/wallabag.nix
@@ -82,7 +82,7 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_wallabag";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /wallabag "${root}"
       <Directory "${root}">
         AllowOverride None
@@ -91,7 +91,7 @@ rec {
         CGIPassAuth On
 
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         <IfModule mod_rewrite.c>
@@ -129,22 +129,19 @@ rec {
     '';
     serviceDeps = [ "postgresql.service" "openldap.service" ];
     basedir = builtins.concatStringsSep ":" [ webappDir "/var/secrets/webapps/tools-wallabag" varDir ];
-    socket = "/var/run/phpfpm/wallabag.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = dynamic
-      pm.max_children = 60
-      pm.start_servers = 2
-      pm.min_spare_servers = 1
-      pm.max_spare_servers = 10
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "dynamic";
+      "pm.max_children" = "60";
+      "pm.start_servers" = "2";
+      "pm.min_spare_servers" = "1";
+      "pm.max_spare_servers" = "10";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = WallabagPHPSESSID
-      php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:${basedir}:/tmp"
-      php_value[max_execution_time] = 300
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "WallabagPHPSESSID";
+      "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:${basedir}:/tmp";
+      "php_value[max_execution_time]" = "300";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/yourls.nix b/modules/private/websites/tools/tools/yourls.nix
index 466ceae..cb03b6c 100644
--- a/modules/private/websites/tools/tools/yourls.nix
+++ b/modules/private/websites/tools/tools/yourls.nix
@@ -48,11 +48,11 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_yourls";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /url "${root}"
       <Directory "${root}">
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride None
@@ -73,20 +73,17 @@ rec {
     basedir = builtins.concatStringsSep ":" (
       [ webRoot "/var/secrets/webapps/tools-yourls" ]
       ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/yourls.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = YourlsPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/yourls"
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/yourls"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "YourlsPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/yourls";
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/yourls";
+    };
   };
 }