20 files changed, 333 insertions, 353 deletions

diff --git a/modules/private/websites/tools/cloud/default.nix b/modules/private/websites/tools/cloud/default.nix
index 4785074..b9bb32f 100644
--- a/modules/private/websites/tools/cloud/default.nix
+++ b/modules/private/websites/tools/cloud/default.nix
@@ -10,37 +10,34 @@ let
     basedir = builtins.concatStringsSep ":" (
       [ nextcloud varDir ]
       ++ builtins.attrValues pkgs.webapps.nextcloud-apps);
-    socket = "/var/run/phpfpm/nextcloud.sock";
     phpConfig = ''
       extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
       extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
       zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
       '';
-    pool = ''
-      user = wwwrun
-      group = wwwrun
-      listen.owner = wwwrun
-      listen.group = wwwrun
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = "wwwrun";
+      "listen.group" = "wwwrun";
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      php_admin_value[output_buffering] = 0
-      php_admin_value[max_execution_time] = 1800
-      php_admin_value[zend_extension] = "opcache"
-      ;already enabled by default?
-      ;php_value[opcache.enable] = 1
-      php_value[opcache.enable_cli] = 1
-      php_value[opcache.interned_strings_buffer] = 8
-      php_value[opcache.max_accelerated_files] = 10000
-      php_value[opcache.memory_consumption] = 128
-      php_value[opcache.save_comments] = 1
-      php_value[opcache.revalidate_freq] = 1
-      php_admin_value[memory_limit] = 512M
+      "php_admin_value[output_buffering]" = "0";
+      "php_admin_value[max_execution_time]" = "1800";
+      "php_admin_value[zend_extension]" = "opcache";
+      #already enabled by default?
+      #"php_value[opcache.enable]" = "1";
+      "php_value[opcache.enable_cli]" = "1";
+      "php_value[opcache.interned_strings_buffer]" = "8";
+      "php_value[opcache.max_accelerated_files]" = "10000";
+      "php_value[opcache.memory_consumption]" = "128";
+      "php_value[opcache.save_comments]" = "1";
+      "php_value[opcache.revalidate_freq]" = "1";
+      "php_admin_value[memory_limit]" = "512M";
 
-      php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:${basedir}:/proc/meminfo:/dev/urandom:/proc/self/fd:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:${basedir}:/proc/meminfo:/dev/urandom:/proc/self/fd:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 in {
   options.myServices.websites.tools.cloud = {
@@ -71,7 +68,7 @@ in {
             </IfModule>
             <FilesMatch "\.php$">
               CGIPassAuth on
-              SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+              SetHandler "proxy:unix:${config.services.phpfpm.pools.nextcloud.socket}|fcgi://localhost"
             </FilesMatch>
 
           </Directory>
@@ -171,8 +168,9 @@ in {
       '';
 
     services.phpfpm.pools.nextcloud = {
-      listen = phpFpm.socket;
-      extraConfig = phpFpm.pool;
+      user = "wwwrun";
+      group = "wwwrun";
+      settings = phpFpm.pool;
       phpOptions = config.services.phpfpm.phpOptions + phpFpm.phpConfig;
     };
 
diff --git a/modules/private/websites/tools/dav/davical.nix b/modules/private/websites/tools/dav/davical.nix
index 5eb3fab..9d6cd21 100644
--- a/modules/private/websites/tools/dav/davical.nix
+++ b/modules/private/websites/tools/dav/davical.nix
@@ -73,7 +73,7 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_davical";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /davical "${root}"
       Alias /caldav.php  "${root}/caldav.php"
       <Directory "${root}">
@@ -84,7 +84,7 @@ rec {
 
         <FilesMatch "\.php$">
           CGIPassAuth on
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         RewriteEngine On
@@ -111,28 +111,25 @@ rec {
   phpFpm = rec {
     serviceDeps = [ "postgresql.service" "openldap.service" ];
     basedir = builtins.concatStringsSep ":" [ webapp "/var/secrets/webapps/dav-davical" awl ];
-    socket = "/var/run/phpfpm/davical.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = dynamic
-      pm.max_children = 60
-      pm.start_servers = 2
-      pm.min_spare_servers = 1
-      pm.max_spare_servers = 10
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "dynamic";
+      "pm.max_children" = "60";
+      "pm.start_servers" = "2";
+      "pm.min_spare_servers" = "1";
+      "pm.max_spare_servers" = "10";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = DavicalPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/davical"
-      php_admin_value[include_path] = "${awl}/inc:${webapp}/inc"
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/davical"
-      php_flag[magic_quotes_gpc] = Off
-      php_flag[register_globals] = Off
-      php_admin_value[error_reporting] = "E_ALL & ~E_NOTICE"
-      php_admin_value[default_charset] = "utf-8"
-      php_flag[magic_quotes_runtime] = Off
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "DavicalPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/davical";
+      "php_admin_value[include_path]" = "${awl}/inc:${webapp}/inc";
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/davical";
+      "php_flag[magic_quotes_gpc]" = "Off";
+      "php_flag[register_globals]" = "Off";
+      "php_admin_value[error_reporting]" = "E_ALL & ~E_NOTICE";
+      "php_admin_value[default_charset]" = "utf-8";
+      "php_flag[magic_quotes_runtime]" = "Off";
+    };
   };
 }
diff --git a/modules/private/websites/tools/dav/default.nix b/modules/private/websites/tools/dav/default.nix
index 0012965..30a562c 100644
--- a/modules/private/websites/tools/dav/default.nix
+++ b/modules/private/websites/tools/dav/default.nix
@@ -38,14 +38,15 @@ in {
       root        = "/run/current-system/webapps/_dav";
       extraConfig = [
         infcloud.vhostConf
-        davical.apache.vhostConf
+        (davical.apache.vhostConf config.services.phpfpm.pools.davical.socket)
       ];
     };
 
     services.phpfpm.pools = {
       davical = {
-        listen = davical.phpFpm.socket;
-        extraConfig = davical.phpFpm.pool;
+        user = config.services.httpd.Tools.user;
+        group = config.services.httpd.Tools.group;
+        settings = davical.phpFpm.pool;
       };
     };
 
diff --git a/modules/private/websites/tools/db/default.nix b/modules/private/websites/tools/db/default.nix
index 60592e5..fc8d989 100644
--- a/modules/private/websites/tools/db/default.nix
+++ b/modules/private/websites/tools/db/default.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, config,  ... }:
 let
-    adminer = pkgs.callPackage ../../commons/adminer.nix {};
+    adminer = pkgs.callPackage ../../commons/adminer.nix { inherit config; };
 
     cfg = config.myServices.websites.tools.db;
 in {
@@ -15,7 +15,7 @@ in {
       addToCerts  = true;
       hosts       = ["db-1.immae.eu" ];
       root        = null;
-      extraConfig = [ adminer.apache.vhostConf ];
+      extraConfig = [ (adminer.apache.vhostConf null) ];
     };
   };
 }
diff --git a/modules/private/websites/tools/git/default.nix b/modules/private/websites/tools/git/default.nix
index 054e47b..56e4401 100644
--- a/modules/private/websites/tools/git/default.nix
+++ b/modules/private/websites/tools/git/default.nix
@@ -30,7 +30,7 @@ in {
       root        = gitweb.apache.root;
       extraConfig = [
         gitweb.apache.vhostConf
-        mantisbt.apache.vhostConf
+        (mantisbt.apache.vhostConf config.services.phpfpm.pools.mantisbt.socket)
         ''
           RewriteEngine on
           RewriteCond %{REQUEST_URI}       ^/releases
@@ -40,8 +40,9 @@ in {
     };
     services.phpfpm.pools = {
       mantisbt = {
-        listen = mantisbt.phpFpm.socket;
-        extraConfig = mantisbt.phpFpm.pool;
+        user = config.services.httpd.Tools.user;
+        group = config.services.httpd.Tools.group;
+        settings = mantisbt.phpFpm.pool;
       };
     };
   };
diff --git a/modules/private/websites/tools/git/mantisbt.nix b/modules/private/websites/tools/git/mantisbt.nix
index d75b022..50851aa 100644
--- a/modules/private/websites/tools/git/mantisbt.nix
+++ b/modules/private/websites/tools/git/mantisbt.nix
@@ -53,12 +53,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_mantisbt";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /mantisbt "${root}"
       <Directory "${root}">
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride All
@@ -76,20 +76,17 @@ rec {
     basedir = builtins.concatStringsSep ":" (
       [ webRoot "/var/secrets/webapps/tools-mantisbt" ]
       ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/mantisbt.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      php_admin_value[upload_max_filesize] = 5000000
+      "php_admin_value[upload_max_filesize]" = "5000000";
 
-      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/mantisbt"
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/mantisbt"
-      '';
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/mantisbt";
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/mantisbt";
+    };
   };
 }
diff --git a/modules/private/websites/tools/mail/default.nix b/modules/private/websites/tools/mail/default.nix
index bb36042..1f7f7bf 100644
--- a/modules/private/websites/tools/mail/default.nix
+++ b/modules/private/websites/tools/mail/default.nix
@@ -6,6 +6,7 @@ let
   };
   rainloop = pkgs.callPackage ./rainloop.nix {};
   cfg = config.myServices.websites.tools.email;
+  pcfg = config.services.phpfpm.pools;
 in
 {
   options.myServices.websites.tools.email = {
@@ -34,8 +35,8 @@ in
       hosts      = ["mail.immae.eu"];
       root       = "/run/current-system/webapps/_mail";
       extraConfig = [
-        rainloop.apache.vhostConf
-        roundcubemail.apache.vhostConf
+        (rainloop.apache.vhostConf pcfg.rainloop.socket)
+        (roundcubemail.apache.vhostConf pcfg.roundcubemail.socket)
         ''
           <Directory /run/current-system/webapps/_mail>
             Require all granted
@@ -56,13 +57,15 @@ in
     };
 
     services.phpfpm.pools.roundcubemail = {
-      listen = roundcubemail.phpFpm.socket;
-      extraConfig = roundcubemail.phpFpm.pool;
+      user = "wwwrun";
+      group = "wwwrun";
+      settings = roundcubemail.phpFpm.pool;
       phpOptions = config.services.phpfpm.phpOptions + roundcubemail.phpFpm.phpConfig;
     };
     services.phpfpm.pools.rainloop = {
-      listen = rainloop.phpFpm.socket;
-      extraConfig = rainloop.phpFpm.pool;
+      user = "wwwrun";
+      group = "wwwrun";
+      settings = rainloop.phpFpm.pool;
     };
     system.activationScripts = {
       roundcubemail = roundcubemail.activationScript;
diff --git a/modules/private/websites/tools/mail/rainloop.nix b/modules/private/websites/tools/mail/rainloop.nix
index 2dad46e..9b1f0c5 100644
--- a/modules/private/websites/tools/mail/rainloop.nix
+++ b/modules/private/websites/tools/mail/rainloop.nix
@@ -16,7 +16,7 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_rainloop";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
     Alias /rainloop "${root}"
     <Directory "${root}">
       DirectoryIndex index.php
@@ -25,7 +25,7 @@ rec {
       Require all granted
 
       <FilesMatch "\.php$">
-        SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+        SetHandler "proxy:unix:${socket}|fcgi://localhost"
       </FilesMatch>
     </Directory>
 
@@ -37,22 +37,19 @@ rec {
   phpFpm = rec {
     serviceDeps = [ "postgresql.service" ];
     basedir = builtins.concatStringsSep ":" [ webRoot varDir ];
-    socket = "/var/run/phpfpm/rainloop.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = RainloopPHPSESSID
-      php_admin_value[upload_max_filesize] = 200M
-      php_admin_value[post_max_size] = 200M
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "RainloopPHPSESSID";
+      "php_admin_value[upload_max_filesize]" = "200M";
+      "php_admin_value[post_max_size]" = "200M";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/mail/roundcubemail.nix b/modules/private/websites/tools/mail/roundcubemail.nix
index 35de312..0b35d02 100644
--- a/modules/private/websites/tools/mail/roundcubemail.nix
+++ b/modules/private/websites/tools/mail/roundcubemail.nix
@@ -83,7 +83,7 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_roundcubemail";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
     Alias /roundcube "${root}"
     <Directory "${root}">
         DirectoryIndex index.php
@@ -92,7 +92,7 @@ rec {
         Require all granted
 
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
       </Directory>
       '';
@@ -107,22 +107,19 @@ rec {
       date.timezone = 'CET'
       extension=${phpPackages.imagick}/lib/php/extensions/imagick.so
       '';
-    socket = "/var/run/phpfpm/roundcubemail.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = RoundcubemailPHPSESSID
-      php_admin_value[upload_max_filesize] = 200M
-      php_admin_value[post_max_size] = 200M
-      php_admin_value[open_basedir] = "${basedir}:${apacheHttpd}/conf/mime.types:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "RoundcubemailPHPSESSID";
+      "php_admin_value[upload_max_filesize]" = "200M";
+      "php_admin_value[post_max_size]" = "200M";
+      "php_admin_value[open_basedir]" = "${basedir}:${apacheHttpd}/conf/mime.types:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/adminer.nix b/modules/private/websites/tools/tools/adminer.nix
index 907e37f..52a132c 100644
--- a/modules/private/websites/tools/tools/adminer.nix
+++ b/modules/private/websites/tools/tools/adminer.nix
@@ -1,4 +1,4 @@
-{ adminer }:
+{ adminer, php73, forcePhpSocket ? null }:
 rec {
   activationScript = {
     deps = [ "httpd" ];
@@ -9,22 +9,33 @@ rec {
   };
   webRoot = adminer;
   phpFpm = rec {
-    socket = "/var/run/phpfpm/adminer.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 5
-      pm.process_idle_timeout = 60
-      ;php_admin_flag[log_errors] = on
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = AdminerPHPSESSID
-      php_admin_value[open_basedir] = "${webRoot}:/tmp:/var/lib/php/sessions/adminer:/var/lib/php/tmp/adminer"
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/adminer"
-      php_admin_value[upload_tmp_dir] = "/var/lib/php/tmp/adminer"
-      '';
+    user = apache.user;
+    group = apache.group;
+    phpPackage = (php73.override {
+      config.php.mysqlnd = true;
+      config.php.mysqli = false;
+      config.php.pdo-mysql = false;
+    }).overrideAttrs(old: rec {
+      configureFlags = old.configureFlags ++ [
+        "--with-mysqli=shared,mysqlnd"
+        ];
+    });
+    phpOptions = ''
+      extension=${phpPackage}/lib/php/extensions/mysqli.so
+    '';
+    settings = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "5";
+      "pm.process_idle_timeout" = "60";
+      #"php_admin_flag[log_errors]" = "on";
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "AdminerPHPSESSID";
+      "php_admin_value[open_basedir]" = "${webRoot}:/tmp:/var/lib/php/sessions/adminer:/var/lib/php/tmp/adminer";
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/adminer";
+      "php_admin_value[upload_tmp_dir]" = "/var/lib/php/tmp/adminer";
+    };
   };
   apache = rec {
     user = "wwwrun";
@@ -32,12 +43,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "_adminer";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /adminer ${root}
       <Directory ${root}>
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${if forcePhpSocket != null then forcePhpSocket else socket}|fcgi://localhost"
         </FilesMatch>
 
         Use LDAPConnect
diff --git a/modules/private/websites/tools/tools/default.nix b/modules/private/websites/tools/tools/default.nix
index 5dc0981..5e0d446 100644
--- a/modules/private/websites/tools/tools/default.nix
+++ b/modules/private/websites/tools/tools/default.nix
@@ -40,6 +40,7 @@ let
   };
 
   cfg = config.myServices.websites.tools.tools;
+  pcfg = config.services.phpfpm.pools;
 in {
   options.myServices.websites.tools.tools = {
     enable = lib.mkEnableOption "enable tools website";
@@ -92,7 +93,7 @@ in {
             AllowOverride all
             Require all granted
             <FilesMatch "\.php$">
-              SetHandler "proxy:unix:/var/run/phpfpm/devtools.sock|fcgi://localhost"
+              SetHandler "proxy:unix:${pcfg.devtools.socket}|fcgi://localhost"
             </FilesMatch>
           </Directory>
           ''
@@ -115,21 +116,21 @@ in {
             AllowOverride all
             Require all granted
             <FilesMatch "\.php$">
-              SetHandler "proxy:unix:/var/run/phpfpm/tools.sock|fcgi://localhost"
+              SetHandler "proxy:unix:${pcfg.tools.socket}|fcgi://localhost"
             </FilesMatch>
           </Directory>
           ''
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf pcfg.adminer.socket)
         ympd.apache.vhostConf
-        ttrss.apache.vhostConf
-        wallabag.apache.vhostConf
-        yourls.apache.vhostConf
-        rompr.apache.vhostConf
-        shaarli.apache.vhostConf
-        dokuwiki.apache.vhostConf
-        ldap.apache.vhostConf
-        kanboard.apache.vhostConf
-        grocy.apache.vhostConf
+        (ttrss.apache.vhostConf pcfg.ttrss.socket)
+        (wallabag.apache.vhostConf pcfg.wallabag.socket)
+        (yourls.apache.vhostConf pcfg.yourls.socket)
+        (rompr.apache.vhostConf pcfg.rompr.socket)
+        (shaarli.apache.vhostConf pcfg.shaarli.socket)
+        (dokuwiki.apache.vhostConf pcfg.dokuwiki.socket)
+        (ldap.apache.vhostConf pcfg.ldap.socket)
+        (kanboard.apache.vhostConf pcfg.kanboard.socket)
+        (grocy.apache.vhostConf pcfg.grocy.socket)
       ];
     };
 
@@ -226,38 +227,36 @@ in {
 
     services.phpfpm.pools = {
       tools = {
-        listen = "/var/run/phpfpm/tools.sock";
-        extraConfig = ''
-          user = wwwrun
-          group = wwwrun
-          listen.owner = wwwrun
-          listen.group = wwwrun
-          pm = dynamic
-          pm.max_children = 60
-          pm.start_servers = 2
-          pm.min_spare_servers = 1
-          pm.max_spare_servers = 10
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = {
+          "listen.owner" = "wwwrun";
+          "listen.group" = "wwwrun";
+          "pm" = "dynamic";
+          "pm.max_children" = "60";
+          "pm.start_servers" = "2";
+          "pm.min_spare_servers" = "1";
+          "pm.max_spare_servers" = "10";
 
-          ; Needed to avoid clashes in browser cookies (same domain)
-          php_value[session.name] = ToolsPHPSESSID
-          php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/tools.immae.eu:/tmp"
-          '';
+          # Needed to avoid clashes in browser cookies (same domain)
+          "php_value[session.name]" = "ToolsPHPSESSID";
+          "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:/var/lib/ftp/tools.immae.eu:/tmp";
+        };
       };
       devtools = {
-        listen = "/var/run/phpfpm/devtools.sock";
-        extraConfig = ''
-          user = wwwrun
-          group = wwwrun
-          listen.owner = wwwrun
-          listen.group = wwwrun
-          pm = dynamic
-          pm.max_children = 60
-          pm.start_servers = 2
-          pm.min_spare_servers = 1
-          pm.max_spare_servers = 10
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = {
+          "listen.owner" = "wwwrun";
+          "listen.group" = "wwwrun";
+          "pm" = "dynamic";
+          "pm.max_children" = "60";
+          "pm.start_servers" = "2";
+          "pm.min_spare_servers" = "1";
+          "pm.max_spare_servers" = "10";
 
-          php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp"
-          '';
+          "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp";
+        };
         phpOptions = config.services.phpfpm.phpOptions + ''
           extension=${pkgs.php}/lib/php/extensions/mysqli.so
           extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
@@ -265,45 +264,51 @@ in {
           zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
           '';
       };
-      adminer = {
-        listen = adminer.phpFpm.socket;
-        extraConfig = adminer.phpFpm.pool;
-      };
+      adminer = adminer.phpFpm;
       ttrss = {
-        listen = ttrss.phpFpm.socket;
-        extraConfig = ttrss.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = ttrss.phpFpm.pool;
       };
       wallabag = {
-        listen = wallabag.phpFpm.socket;
-        extraConfig = wallabag.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = wallabag.phpFpm.pool;
       };
       yourls = {
-        listen = yourls.phpFpm.socket;
-        extraConfig = yourls.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = yourls.phpFpm.pool;
       };
       rompr = {
-        listen = rompr.phpFpm.socket;
-        extraConfig = rompr.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = rompr.phpFpm.pool;
       };
       shaarli = {
-        listen = shaarli.phpFpm.socket;
-        extraConfig = shaarli.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = shaarli.phpFpm.pool;
       };
       dokuwiki = {
-        listen = dokuwiki.phpFpm.socket;
-        extraConfig = dokuwiki.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = dokuwiki.phpFpm.pool;
       };
       ldap = {
-        listen = ldap.phpFpm.socket;
-        extraConfig = ldap.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = ldap.phpFpm.pool;
       };
       kanboard = {
-        listen = kanboard.phpFpm.socket;
-        extraConfig = kanboard.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = kanboard.phpFpm.pool;
       };
       grocy = {
-        listen = grocy.phpFpm.socket;
-        extraConfig = grocy.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = grocy.phpFpm.pool;
       };
     };
 
diff --git a/modules/private/websites/tools/tools/dokuwiki.nix b/modules/private/websites/tools/tools/dokuwiki.nix
index d66e85d..26c04b7 100644
--- a/modules/private/websites/tools/tools/dokuwiki.nix
+++ b/modules/private/websites/tools/tools/dokuwiki.nix
@@ -26,12 +26,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_dokuwiki";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /dokuwiki "${root}"
       <Directory "${root}">
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride All
@@ -44,20 +44,17 @@ rec {
     serviceDeps = [ "openldap.service" ];
     basedir = builtins.concatStringsSep ":" (
       [ webRoot varDir ] ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/dokuwiki.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = DokuwikiPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "DokuwikiPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/grocy.nix b/modules/private/websites/tools/tools/grocy.nix
index 1b8da20..a98d8ac 100644
--- a/modules/private/websites/tools/tools/grocy.nix
+++ b/modules/private/websites/tools/tools/grocy.nix
@@ -18,12 +18,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_grocy";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /grocy "${root}"
       <Directory "${root}">
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride All
@@ -35,21 +35,18 @@ rec {
   phpFpm = rec {
     basedir = builtins.concatStringsSep ":" (
       [ grocy grocy.yarnModules varDir ]);
-    socket = "/var/run/phpfpm/grocy.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = grocyPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "grocyPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
 
diff --git a/modules/private/websites/tools/tools/kanboard.nix b/modules/private/websites/tools/tools/kanboard.nix
index 1880cbd..0f6fefc 100644
--- a/modules/private/websites/tools/tools/kanboard.nix
+++ b/modules/private/websites/tools/tools/kanboard.nix
@@ -49,7 +49,7 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_kanboard";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
     Alias /kanboard "${root}"
     <Directory "${root}">
       DirectoryIndex index.php
@@ -58,7 +58,7 @@ rec {
       Require all granted
 
       <FilesMatch "\.php$">
-        SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+        SetHandler "proxy:unix:${socket}|fcgi://localhost"
       </FilesMatch>
     </Directory>
     <DirectoryMatch "${root}/data">
@@ -69,20 +69,17 @@ rec {
   phpFpm = rec {
     serviceDeps = [ "postgresql.service" "openldap.service" ];
     basedir = builtins.concatStringsSep ":" [ webRoot varDir "/var/secrets/webapps/tools-kanboard" ];
-    socket = "/var/run/phpfpm/kanboard.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = KanboardPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "KanboardPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/ldap.nix b/modules/private/websites/tools/tools/ldap.nix
index e58a9bd..0c1a21f 100644
--- a/modules/private/websites/tools/tools/ldap.nix
+++ b/modules/private/websites/tools/tools/ldap.nix
@@ -39,12 +39,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_ldap";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /ldap "${root}"
       <Directory "${root}">
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride None
@@ -55,20 +55,17 @@ rec {
   phpFpm = rec {
     serviceDeps = [ "openldap.service" ];
     basedir = builtins.concatStringsSep ":" [ webRoot "/var/secrets/webapps/tools-ldap" ];
-    socket = "/var/run/phpfpm/ldap.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = LdapPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/phpldapadmin"
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/phpldapadmin"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "LdapPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/phpldapadmin";
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/phpldapadmin";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/rompr.nix b/modules/private/websites/tools/tools/rompr.nix
index 75adabe..106164c 100644
--- a/modules/private/websites/tools/tools/rompr.nix
+++ b/modules/private/websites/tools/tools/rompr.nix
@@ -15,7 +15,7 @@ rec {
     modules = [ "headers" "mime" "proxy_fcgi" ];
     webappName = "tools_rompr";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /rompr ${root}
 
       <Directory ${root}>
@@ -29,7 +29,7 @@ rec {
         AddType image/x-icon .ico
 
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
       </Directory>
 
@@ -51,29 +51,26 @@ rec {
   };
   phpFpm = rec {
     basedir = builtins.concatStringsSep ":" [ webRoot varDir ];
-    socket = "/var/run/phpfpm/rompr.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = RomprPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      php_flag[magic_quotes_gpc] = Off
-      php_flag[track_vars] = On
-      php_flag[register_globals] = Off
-      php_admin_flag[allow_url_fopen] = On
-      php_value[include_path] = ${webRoot}
-      php_admin_value[upload_tmp_dir] = "${varDir}/prefs"
-      php_admin_value[post_max_size] = 32M
-      php_admin_value[upload_max_filesize] = 32M
-      php_admin_value[memory_limit] = 256M
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "RomprPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+      "php_flag[magic_quotes_gpc]" = "Off";
+      "php_flag[track_vars]" = "On";
+      "php_flag[register_globals]" = "Off";
+      "php_admin_flag[allow_url_fopen]" = "On";
+      "php_value[include_path]" = "${webRoot}";
+      "php_admin_value[upload_tmp_dir]" = "${varDir}/prefs";
+      "php_admin_value[post_max_size]" = "32M";
+      "php_admin_value[upload_max_filesize]" = "32M";
+      "php_admin_value[memory_limit]" = "256M";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/shaarli.nix b/modules/private/websites/tools/tools/shaarli.nix
index 0a75755..950d296 100644
--- a/modules/private/websites/tools/tools/shaarli.nix
+++ b/modules/private/websites/tools/tools/shaarli.nix
@@ -17,7 +17,7 @@ in rec {
     modules =  [ "proxy_fcgi" "rewrite" "env" ];
     webappName = "tools_shaarli";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /Shaarli "${root}"
 
       Include /var/secrets/webapps/tools-shaarli
@@ -27,7 +27,7 @@ in rec {
         AllowOverride All
         Require all granted
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
       </Directory>
       '';
@@ -48,20 +48,17 @@ in rec {
   phpFpm = rec {
     serviceDeps = [ "openldap.service" ];
     basedir = builtins.concatStringsSep ":" [ webRoot varDir ];
-    socket = "/var/run/phpfpm/shaarli.sock";
-    pool = ''
-        user = ${apache.user}
-        group = ${apache.group}
-        listen.owner = ${apache.user}
-        listen.group = ${apache.group}
-        pm = ondemand
-        pm.max_children = 60
-        pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-        ; Needed to avoid clashes in browser cookies (same domain)
-        php_value[session.name] = ShaarliPHPSESSID
-        php_admin_value[open_basedir] = "${basedir}:/tmp"
-        php_admin_value[session.save_path] = "${varDir}/phpSessions"
-    '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "ShaarliPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/ttrss.nix b/modules/private/websites/tools/tools/ttrss.nix
index a8b2a93..48876d3 100644
--- a/modules/private/websites/tools/tools/ttrss.nix
+++ b/modules/private/websites/tools/tools/ttrss.nix
@@ -95,12 +95,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_ttrss";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /ttrss "${root}"
       <Directory "${root}">
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride All
@@ -114,20 +114,17 @@ rec {
     basedir = builtins.concatStringsSep ":" (
       [ webRoot "/var/secrets/webapps/tools-ttrss" varDir ]
       ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/ttrss.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
-
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = TtrssPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
+
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "TtrssPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/wallabag.nix b/modules/private/websites/tools/tools/wallabag.nix
index 014d8a1..00e2dc9 100644
--- a/modules/private/websites/tools/tools/wallabag.nix
+++ b/modules/private/websites/tools/tools/wallabag.nix
@@ -82,7 +82,7 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_wallabag";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /wallabag "${root}"
       <Directory "${root}">
         AllowOverride None
@@ -91,7 +91,7 @@ rec {
         CGIPassAuth On
 
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         <IfModule mod_rewrite.c>
@@ -129,22 +129,19 @@ rec {
     '';
     serviceDeps = [ "postgresql.service" "openldap.service" ];
     basedir = builtins.concatStringsSep ":" [ webappDir "/var/secrets/webapps/tools-wallabag" varDir ];
-    socket = "/var/run/phpfpm/wallabag.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = dynamic
-      pm.max_children = 60
-      pm.start_servers = 2
-      pm.min_spare_servers = 1
-      pm.max_spare_servers = 10
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "dynamic";
+      "pm.max_children" = "60";
+      "pm.start_servers" = "2";
+      "pm.min_spare_servers" = "1";
+      "pm.max_spare_servers" = "10";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = WallabagPHPSESSID
-      php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:${basedir}:/tmp"
-      php_value[max_execution_time] = 300
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "WallabagPHPSESSID";
+      "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:${basedir}:/tmp";
+      "php_value[max_execution_time]" = "300";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/yourls.nix b/modules/private/websites/tools/tools/yourls.nix
index 466ceae..cb03b6c 100644
--- a/modules/private/websites/tools/tools/yourls.nix
+++ b/modules/private/websites/tools/tools/yourls.nix
@@ -48,11 +48,11 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_yourls";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /url "${root}"
       <Directory "${root}">
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride None
@@ -73,20 +73,17 @@ rec {
     basedir = builtins.concatStringsSep ":" (
       [ webRoot "/var/secrets/webapps/tools-yourls" ]
       ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/yourls.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = YourlsPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/yourls"
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/yourls"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "YourlsPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/yourls";
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/yourls";
+    };
   };
 }