9 files changed, 43 insertions, 30 deletions

diff --git a/modules/private/websites/tools/tools/default.nix b/modules/private/websites/tools/tools/default.nix
index ac92ef4..ada6253 100644
--- a/modules/private/websites/tools/tools/default.nix
+++ b/modules/private/websites/tools/tools/default.nix
@@ -12,8 +12,10 @@ let
     inherit (pkgs.webapps) ttrss ttrss-plugins;
     env = config.myEnv.tools.ttrss;
     php = pkgs.php72;
+    inherit config;
   };
   kanboard = pkgs.callPackage ./kanboard.nix  {
+    inherit config;
     env = config.myEnv.tools.kanboard;
   };
   wallabag = pkgs.callPackage ./wallabag.nix {
@@ -23,10 +25,12 @@ let
       };
     };
     env = config.myEnv.tools.wallabag;
+    inherit config;
   };
   yourls = pkgs.callPackage ./yourls.nix {
     inherit (pkgs.webapps) yourls yourls-plugins;
     env = config.myEnv.tools.yourls;
+    inherit config;
   };
   rompr = pkgs.callPackage ./rompr.nix {
     inherit (pkgs.webapps) rompr;
@@ -34,6 +38,7 @@ let
   };
   shaarli = pkgs.callPackage ./shaarli.nix {
     env = config.myEnv.tools.shaarli;
+    inherit config;
   };
   dokuwiki = pkgs.callPackage ./dokuwiki.nix {
     inherit (pkgs.webapps) dokuwiki dokuwiki-plugins;
@@ -41,6 +46,7 @@ let
   ldap = pkgs.callPackage ./ldap.nix {
     inherit (pkgs.webapps) phpldapadmin;
     env = config.myEnv.tools.phpldapadmin;
+    inherit config;
   };
   grocy = pkgs.callPackage ./grocy.nix {
     grocy = pkgs.webapps.grocy.override { composerEnv = pkgs.composerEnv.override { php = pkgs.php72; }; };
@@ -56,6 +62,7 @@ let
   };
   dmarc-reports = pkgs.callPackage ./dmarc_reports.nix {
     env = config.myEnv.tools.dmarc_reports;
+    inherit config;
   };
   csp-reports = pkgs.callPackage ./csp_reports.nix {
     env = config.myEnv.tools.csp_reports;
@@ -188,8 +195,8 @@ in {
             Require all granted
           </Directory>
 
-          Alias /webhooks ${config.secrets.location}/webapps/webhooks
-          <Directory "${config.secrets.location}/webapps/webhooks">
+          Alias /webhooks ${config.secrets.fullPaths."webapps/webhooks"}
+          <Directory "${config.secrets.fullPaths."webapps/webhooks"}">
             Options -Indexes
             Require all granted
             AllowOverride None
@@ -271,7 +278,7 @@ in {
         description = "Standalone MPD Web GUI written in C";
         wantedBy = [ "multi-user.target" ];
         script = ''
-          export MPD_PASSWORD=$(cat /var/secrets/mpd)
+          export MPD_PASSWORD=$(cat ${config.secrets.fullPaths."mpd"})
           ${pkgs.ympd}/bin/ympd --host ${ympd.config.host} --port ${toString ympd.config.port} --webport ${ympd.config.webPort} --user nobody
           '';
       };
@@ -293,7 +300,7 @@ in {
 
     services.filesWatcher.ympd = {
       restart = true;
-      paths = [ "/var/secrets/mpd" ];
+      paths = [ config.secrets.fullPaths."mpd" ];
     };
 
     services.phpfpm.pools = {
@@ -313,9 +320,9 @@ in {
           "php_value[session.name]" = "ToolsPHPSESSID";
           "php_admin_value[open_basedir]" = builtins.concatStringsSep ":" [
             "/run/wrappers/bin/sendmail" landing "/tmp"
-            "${config.secrets.location}/webapps/webhooks"
+            config.secrets.fullPaths."webapps/webhooks"
           ];
-          "include" = "${config.secrets.location}/webapps/tools-csp-reports.conf";
+          "include" = config.secrets.fullPaths."webapps/tools-csp-reports.conf";
         };
         phpEnv = {
           CONTACT_EMAIL = config.myEnv.tools.contact;
@@ -438,11 +445,11 @@ in {
     };
 
     services.websites.env.tools.watchPaths = [
-      "/var/secrets/webapps/tools-shaarli"
+      config.secrets.fullPaths."webapps/tools-shaarli"
     ];
     services.filesWatcher.phpfpm-wallabag = {
       restart = true;
-      paths = [ "/var/secrets/webapps/tools-wallabag" ];
+      paths = [ config.secrets.fullPaths."webapps/tools-wallabag" ];
     };
 
   };
diff --git a/modules/private/websites/tools/tools/dmarc_reports.nix b/modules/private/websites/tools/tools/dmarc_reports.nix
index e264e80..5fdf0b6 100644
--- a/modules/private/websites/tools/tools/dmarc_reports.nix
+++ b/modules/private/websites/tools/tools/dmarc_reports.nix
@@ -1,4 +1,4 @@
-{ env }:
+{ env, config }:
 rec {
   keys = [{
     dest = "webapps/tools-dmarc-reports.php";
@@ -43,7 +43,7 @@ rec {
   };
   phpFpm = rec {
     basedir = builtins.concatStringsSep ":"
-      [ webRoot "/var/secrets/webapps/tools-dmarc-reports.php" ];
+      [ webRoot config.secrets.fullPaths."webapps/tools-dmarc-reports.php" ];
     pool = {
       "listen.owner" = apache.user;
       "listen.group" = apache.group;
@@ -55,7 +55,7 @@ rec {
       "php_admin_value[open_basedir]" = "${basedir}:/tmp";
     };
     phpEnv = {
-      SECRETS_FILE = "/var/secrets/webapps/tools-dmarc-reports.php";
+      SECRETS_FILE = config.secrets.fullPaths."webapps/tools-dmarc-reports.php";
     };
   };
 }
diff --git a/modules/private/websites/tools/tools/kanboard.nix b/modules/private/websites/tools/tools/kanboard.nix
index 0f6fefc..1a70499 100644
--- a/modules/private/websites/tools/tools/kanboard.nix
+++ b/modules/private/websites/tools/tools/kanboard.nix
@@ -1,4 +1,4 @@
-{ env, kanboard }:
+{ env, kanboard, config }:
 rec {
   backups = {
     rootDir = varDir;
@@ -42,7 +42,7 @@ rec {
       ?>
       '';
   }];
-  webRoot = kanboard { kanboard_config = "/var/secrets/webapps/tools-kanboard"; };
+  webRoot = kanboard { kanboard_config = config.secrets.fullPaths."webapps/tools-kanboard"; };
   apache = rec {
     user = "wwwrun";
     group = "wwwrun";
@@ -68,7 +68,7 @@ rec {
   };
   phpFpm = rec {
     serviceDeps = [ "postgresql.service" "openldap.service" ];
-    basedir = builtins.concatStringsSep ":" [ webRoot varDir "/var/secrets/webapps/tools-kanboard" ];
+    basedir = builtins.concatStringsSep ":" [ webRoot varDir config.secrets.fullPaths."webapps/tools-kanboard" ];
     pool = {
       "listen.owner" = apache.user;
       "listen.group" = apache.group;
diff --git a/modules/private/websites/tools/tools/ldap.nix b/modules/private/websites/tools/tools/ldap.nix
index 0c1a21f..cb90edc 100644
--- a/modules/private/websites/tools/tools/ldap.nix
+++ b/modules/private/websites/tools/tools/ldap.nix
@@ -1,4 +1,4 @@
-{ lib, php, env, writeText, phpldapadmin }:
+{ lib, php, env, writeText, phpldapadmin, config }:
 rec {
   activationScript = {
     deps = [ "httpd" ];
@@ -32,7 +32,7 @@ rec {
       $servers->setValue('login','fallback_dn',true);
       '';
   }];
-  webRoot = phpldapadmin.override { config = "/var/secrets/webapps/tools-ldap"; };
+  webRoot = phpldapadmin.override { config = config.secrets.fullPaths."webapps/tools-ldap"; };
   apache = rec {
     user = "wwwrun";
     group = "wwwrun";
@@ -54,7 +54,7 @@ rec {
   };
   phpFpm = rec {
     serviceDeps = [ "openldap.service" ];
-    basedir = builtins.concatStringsSep ":" [ webRoot "/var/secrets/webapps/tools-ldap" ];
+    basedir = builtins.concatStringsSep ":" [ webRoot config.secrets.fullPaths."webapps/tools-ldap" ];
     pool = {
       "listen.owner" = apache.user;
       "listen.group" = apache.group;
diff --git a/modules/private/websites/tools/tools/shaarli.nix b/modules/private/websites/tools/tools/shaarli.nix
index d11f525..80c6a89 100644
--- a/modules/private/websites/tools/tools/shaarli.nix
+++ b/modules/private/websites/tools/tools/shaarli.nix
@@ -1,4 +1,4 @@
-{ lib, env, stdenv, fetchurl, shaarli }:
+{ lib, env, stdenv, fetchurl, shaarli, config }:
 let
   varDir = "/var/lib/shaarli";
 in rec {
@@ -21,7 +21,7 @@ in rec {
     vhostConf = socket: ''
       Alias /Shaarli "${root}"
 
-      Include /var/secrets/webapps/tools-shaarli
+      Include ${config.secrets.fullPaths."webapps/tools-shaarli"}
       <Location /Shaarli>
         Header set Access-Control-Allow-Origin "*"
         Header set Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS"
diff --git a/modules/private/websites/tools/tools/ttrss.nix b/modules/private/websites/tools/tools/ttrss.nix
index ce1ab8e..eb1d415 100644
--- a/modules/private/websites/tools/tools/ttrss.nix
+++ b/modules/private/websites/tools/tools/ttrss.nix
@@ -1,4 +1,4 @@
-{ php, env, ttrss, ttrss-plugins }:
+{ php, env, ttrss, ttrss-plugins, config }:
 rec {
   backups = {
     rootDir = varDir;
@@ -88,7 +88,7 @@ rec {
         define('LDAP_AUTH_DEBUG', FALSE);
       '';
   }];
-  webRoot = (ttrss.override { ttrss_config = "/var/secrets/webapps/tools-ttrss"; }).withPlugins (p: [
+  webRoot = (ttrss.override { ttrss_config = config.secrets.fullPaths."webapps/tools-ttrss"; }).withPlugins (p: [
     p.auth_ldap p.ff_instagram p.tumblr_gdpr_ua
     (p.af_feedmod.override { patched = true; })
     (p.feediron.override { patched = true; })
@@ -116,7 +116,7 @@ rec {
   phpFpm = rec {
     serviceDeps = [ "postgresql.service" "openldap.service" ];
     basedir = builtins.concatStringsSep ":" (
-      [ webRoot "/var/secrets/webapps/tools-ttrss" varDir ]
+      [ webRoot config.secrets.fullPaths."webapps/tools-ttrss" varDir ]
       ++ webRoot.plugins);
     pool = {
       "listen.owner" = apache.user;
diff --git a/modules/private/websites/tools/tools/wallabag.nix b/modules/private/websites/tools/tools/wallabag.nix
index 1cb0645..1a604c7 100644
--- a/modules/private/websites/tools/tools/wallabag.nix
+++ b/modules/private/websites/tools/tools/wallabag.nix
@@ -1,4 +1,4 @@
-{ env, wallabag, mylibs }:
+{ env, wallabag, mylibs, config }:
 rec {
   backups = {
     rootDir = varDir;
@@ -69,7 +69,7 @@ rec {
               arguments: ['/run/wrappers/bin/sendmail -bs']
       '';
   }];
-  webappDir = wallabag.override { ldap = true; wallabag_config = "/var/secrets/webapps/tools-wallabag"; };
+  webappDir = wallabag.override { ldap = true; wallabag_config = config.secrets.fullPaths."webapps/tools-wallabag"; };
   activationScript = ''
     install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir} \
       ${varDir}/var ${varDir}/data/db ${varDir}/assets/images
@@ -125,11 +125,11 @@ rec {
         /run/wrappers/bin/sudo -u wwwrun ./bin/console --env=prod doctrine:migrations:migrate --no-interaction
         popd > /dev/null
         echo -n "${webappDir}" > ${varDir}/currentWebappDir
-        sha512sum /var/secrets/webapps/tools-wallabag > ${varDir}/currentKey
+        sha512sum ${config.secrets.fullPaths."webapps/tools-wallabag"} > ${varDir}/currentKey
       fi
     '';
     serviceDeps = [ "postgresql.service" "openldap.service" ];
-    basedir = builtins.concatStringsSep ":" [ webappDir "/var/secrets/webapps/tools-wallabag" varDir ];
+    basedir = builtins.concatStringsSep ":" [ webappDir config.secrets.fullPaths."webapps/tools-wallabag" varDir ];
     pool = {
       "listen.owner" = apache.user;
       "listen.group" = apache.group;
diff --git a/modules/private/websites/tools/tools/webhooks.nix b/modules/private/websites/tools/tools/webhooks.nix
index 885b68b..8ffb81b 100644
--- a/modules/private/websites/tools/tools/webhooks.nix
+++ b/modules/private/websites/tools/tools/webhooks.nix
@@ -6,5 +6,11 @@
     group = "wwwrun";
     permissions = "0400";
     text = v;
-  }) env;
+  }) env ++ [{
+    dest = "webapps/webhooks";
+    isDir = true;
+    user = "wwwrun";
+    group = "wwwrun";
+    permissions = "0500";
+  }];
 }
diff --git a/modules/private/websites/tools/tools/yourls.nix b/modules/private/websites/tools/tools/yourls.nix
index 77ac0a3..0f977f2 100644
--- a/modules/private/websites/tools/tools/yourls.nix
+++ b/modules/private/websites/tools/tools/yourls.nix
@@ -1,4 +1,4 @@
-{ env, yourls, yourls-plugins }:
+{ env, yourls, yourls-plugins, config }:
 rec {
   activationScript = {
     deps = [ "httpd" ];
@@ -40,7 +40,7 @@ rec {
       define( 'LDAPAUTH_USERCACHE_TYPE', 0);
     '';
   }];
-  webRoot = (yourls.override { yourls_config = "/var/secrets/webapps/tools-yourls"; }).withPlugins (p: [p.ldap]);
+  webRoot = (yourls.override { yourls_config = config.secrets.fullPaths."webapps/tools-yourls"; }).withPlugins (p: [p.ldap]);
   apache = rec {
     user = "wwwrun";
     group = "wwwrun";
@@ -70,7 +70,7 @@ rec {
   phpFpm = rec {
     serviceDeps = [ "mysql.service" "openldap.service" ];
     basedir = builtins.concatStringsSep ":" (
-      [ webRoot "/var/secrets/webapps/tools-yourls" ]
+      [ webRoot config.secrets.fullPaths."webapps/tools-yourls" ]
       ++ webRoot.plugins);
     pool = {
       "listen.owner" = apache.user;