46 files changed, 607 insertions, 638 deletions

diff --git a/modules/private/websites/chloe/builder.nix b/modules/private/websites/chloe/builder.nix
index f21caeb..bce2b4d 100644
--- a/modules/private/websites/chloe/builder.nix
+++ b/modules/private/websites/chloe/builder.nix
@@ -3,28 +3,25 @@ rec {
   app = chloe.override { inherit (config) environment; };
   phpFpm = rec {
     serviceDeps = [ "mysql.service" ];
-    socket = "/var/run/phpfpm/chloe-${app.environment}.sock";
-    pool = ''
-      user = ${apacheUser}
-      group = ${apacheGroup}
-      listen.owner = ${apacheUser}
-      listen.group = ${apacheGroup}
-      php_admin_value[upload_max_filesize] = 20M
-      php_admin_value[post_max_size] = 20M
-      ;php_admin_flag[log_errors] = on
-      php_admin_value[open_basedir] = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp"
-      php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
-      ${if app.environment == "dev" then ''
-      pm = ondemand
-      pm.max_children = 5
-      pm.process_idle_timeout = 60
-      '' else ''
-      pm = dynamic
-      pm.max_children = 20
-      pm.start_servers = 2
-      pm.min_spare_servers = 1
-      pm.max_spare_servers = 3
-      ''}'';
+    pool = {
+      "listen.owner" = apacheUser;
+      "listen.group" = apacheGroup;
+      "php_admin_value[upload_max_filesize]" = "20M";
+      "php_admin_value[post_max_size]" = "20M";
+      # "php_admin_flag[log_errors]" = "on";
+      "php_admin_value[open_basedir]" = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp";
+      "php_admin_value[session.save_path]" = "${app.varDir}/phpSessions";
+    } // (if app.environment == "dev" then {
+      "pm" = "ondemand";
+      "pm.max_children" = "5";
+      "pm.process_idle_timeout" = "60";
+    } else {
+      "pm" = "dynamic";
+      "pm.max_children" = "20";
+      "pm.start_servers" = "2";
+      "pm.min_spare_servers" = "1";
+      "pm.max_spare_servers" = "3";
+    });
   };
   keys = [{
     dest = "webapps/${app.environment}-chloe";
@@ -51,7 +48,7 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "chloe_${app.environment}";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Include /var/secrets/webapps/${app.environment}-chloe
 
       RewriteEngine On
@@ -60,7 +57,7 @@ rec {
       '' else ""}
 
       <FilesMatch "\.php$">
-        SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+        SetHandler "proxy:unix:${socket}|fcgi://localhost"
       </FilesMatch>
 
       <Directory ${root}>
diff --git a/modules/private/websites/chloe/integration.nix b/modules/private/websites/chloe/integration.nix
index 6276eb7..caf6548 100644
--- a/modules/private/websites/chloe/integration.nix
+++ b/modules/private/websites/chloe/integration.nix
@@ -17,8 +17,9 @@ in {
     systemd.services.phpfpm-chloe_dev.after = lib.mkAfter chloe.phpFpm.serviceDeps;
     systemd.services.phpfpm-chloe_dev.wants = chloe.phpFpm.serviceDeps;
     services.phpfpm.pools.chloe_dev = {
-      listen = chloe.phpFpm.socket;
-      extraConfig = chloe.phpFpm.pool;
+      user = config.services.httpd.Inte.user;
+      group = config.services.httpd.Inte.group;
+      settings = chloe.phpFpm.pool;
       phpOptions = config.services.phpfpm.phpOptions + ''
         extension=${pkgs.php}/lib/php/extensions/mysqli.so
       '';
@@ -31,7 +32,9 @@ in {
       addToCerts  = true;
       hosts       = ["chloe.immae.eu" ];
       root        = chloe.apache.root;
-      extraConfig = [ chloe.apache.vhostConf ];
+      extraConfig = [
+        (chloe.apache.vhostConf config.services.phpfpm.pools.chloe_dev.socket)
+      ];
     };
     services.websites.env.integration.watchPaths = [
       "/var/secrets/webapps/${chloe.app.environment}-chloe"
diff --git a/modules/private/websites/chloe/production.nix b/modules/private/websites/chloe/production.nix
index 578bf91..83f6c9b 100644
--- a/modules/private/websites/chloe/production.nix
+++ b/modules/private/websites/chloe/production.nix
@@ -19,8 +19,9 @@ in {
     systemd.services.phpfpm-chloe_prod.after = lib.mkAfter chloe.phpFpm.serviceDeps;
     systemd.services.phpfpm-chloe_prod.wants = chloe.phpFpm.serviceDeps;
     services.phpfpm.pools.chloe_prod = {
-      listen = chloe.phpFpm.socket;
-      extraConfig = chloe.phpFpm.pool;
+      user = config.services.httpd.Prod.user;
+      group = config.services.httpd.Prod.group;
+      settings = chloe.phpFpm.pool;
       phpOptions = config.services.phpfpm.phpOptions + ''
         extension=${pkgs.php}/lib/php/extensions/mysqli.so
       '';
@@ -39,7 +40,7 @@ in {
           RewriteCond "%{HTTP_HOST}" "!^www\.osteopathe-cc\.fr$" [NC]
           RewriteRule ^(.+)$ https://www.osteopathe-cc.fr$1 [R=302,L]
           ''
-        chloe.apache.vhostConf
+        (chloe.apache.vhostConf config.services.phpfpm.pools.chloe_prod.socket)
       ];
     };
     services.websites.env.production.watchPaths = [
diff --git a/modules/private/websites/commons/adminer.nix b/modules/private/websites/commons/adminer.nix
index d591c90..1803468 100644
--- a/modules/private/websites/commons/adminer.nix
+++ b/modules/private/websites/commons/adminer.nix
@@ -1,24 +1,5 @@
-{}:
-rec {
-  phpFpm = {
-    socket = "/var/run/phpfpm/adminer.sock";
-  };
-  apache = rec {
-    modules = [ "proxy_fcgi" ];
-    webappName = "_adminer";
-    root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
-      Alias /adminer ${root}
-      <Directory ${root}>
-        DirectoryIndex index.php
-        <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
-        </FilesMatch>
-
-        Use LDAPConnect
-        Require ldap-group cn=users,cn=mysql,cn=pam,ou=services,dc=immae,dc=eu
-        Require ldap-group cn=users,cn=postgresql,cn=pam,ou=services,dc=immae,dc=eu
-      </Directory>
-      '';
-  };
+{ config, callPackage }:
+callPackage ../tools/tools/adminer.nix {
+  adminer = null;
+  forcePhpSocket = config.services.phpfpm.pools.adminer.socket;
 }
diff --git a/modules/private/websites/connexionswing/integration.nix b/modules/private/websites/connexionswing/integration.nix
index 81cff8f..4f7b72d 100644
--- a/modules/private/websites/connexionswing/integration.nix
+++ b/modules/private/websites/connexionswing/integration.nix
@@ -25,15 +25,17 @@ in {
         "./bin/console --env=${app.environment} cache:clear --no-warmup"
       ];
       phpOpenbasedir = [ "/tmp" "/run/wrappers/bin/sendmail" ];
-      phpPool = ''
-        php_admin_value[upload_max_filesize] = 20M
-        php_admin_value[post_max_size] = 20M
-        ;php_admin_flag[log_errors] = on
-        pm = ondemand
-        pm.max_children = 5
-        pm.process_idle_timeout = 60
-        env[SYMFONY_DEBUG_MODE] = "yes"
-      '';
+      phpPool = {
+        "php_admin_value[upload_max_filesize]" = "20M";
+        "php_admin_value[post_max_size]" = "20M";
+        #"php_admin_flag[log_errors]" = "on";
+        "pm" = "ondemand";
+        "pm.max_children" = "5";
+        "pm.process_idle_timeout" = "60";
+        };
+      phpEnv = {
+        SYMFONY_DEBUG_MODE = "yes";
+      };
       phpWatchFiles = [
         config.secrets.fullPaths."webapps/${app.environment}-connexionswing"
       ];
diff --git a/modules/private/websites/connexionswing/production.nix b/modules/private/websites/connexionswing/production.nix
index fa31931..0b52af1 100644
--- a/modules/private/websites/connexionswing/production.nix
+++ b/modules/private/websites/connexionswing/production.nix
@@ -26,16 +26,16 @@ in {
         "./bin/console --env=${app.environment} cache:clear --no-warmup"
       ];
       phpOpenbasedir = [ "/tmp" "/run/wrappers/bin/sendmail" ];
-      phpPool = ''
-        php_admin_value[upload_max_filesize] = 20M
-        php_admin_value[post_max_size] = 20M
-        ;php_admin_flag[log_errors] = on
-        pm = dynamic
-        pm.max_children = 20
-        pm.start_servers = 2
-        pm.min_spare_servers = 1
-        pm.max_spare_servers = 3
-      '';
+      phpPool = {
+        "php_admin_value[upload_max_filesize]" = "20M";
+        "php_admin_value[post_max_size]" = "20M";
+        #"php_admin_flag[log_errors]" = "on";
+        "pm" = "dynamic";
+        "pm.max_children" = "20";
+        "pm.start_servers" = "2";
+        "pm.min_spare_servers" = "1";
+        "pm.max_spare_servers" = "3";
+      };
       phpWatchFiles = [
         config.secrets.fullPaths."webapps/${app.environment}-connexionswing"
       ];
diff --git a/modules/private/websites/default.nix b/modules/private/websites/default.nix
index 5c0e655..529ec5c 100644
--- a/modules/private/websites/default.nix
+++ b/modules/private/websites/default.nix
@@ -87,9 +87,9 @@ in
       #openssl = self.openssl_1_1;
       php = php72;
       php72 = (super.php72.override {
-        mysql.connector-c = self.mariadb;
-        config.php.mysqlnd = false;
+        config.php.mysqlnd = true;
         config.php.mysqli = false;
+        config.php.mhash = true; # Is it needed?
       }).overrideAttrs(old: rec {
         # Didn't manage to build with mysqli + mysql_config connector
         configureFlags = old.configureFlags ++ [
@@ -140,9 +140,9 @@ in
         ; 30 days (minutes)
         session.cache_expire = 43200
         '';
-      extraConfig = ''
-        log_level = notice
-        '';
+      settings = {
+        log_level = "notice";
+      };
     };
 
     services.filesWatcher.httpdProd.paths = [ "/var/secrets/apache-ldap" ];
diff --git a/modules/private/websites/emilia/richie.nix b/modules/private/websites/emilia/richie.nix
index f7b4f8d..98ab1cd 100644
--- a/modules/private/websites/emilia/richie.nix
+++ b/modules/private/websites/emilia/richie.nix
@@ -49,22 +49,23 @@ in
         '';
     };
     services.phpfpm.pools.richie_production = {
-      listen = "/run/phpfpm/richie_production.sock";
-      extraConfig = ''
-        user = wwwrun
-        group = wwwrun
-        listen.owner = wwwrun
-        listen.group = wwwrun
+      user = "wwwrun";
+      group = "wwwrun";
+      settings = {
+        "listen.owner" = "wwwrun";
+        "listen.group" = "wwwrun";
 
-        pm = ondemand
-        pm.max_children = 5
-        pm.process_idle_timeout = 60
+        "pm" = "ondemand";
+        "pm.max_children" = "5";
+        "pm.process_idle_timeout" = "60";
 
-        env[PATH] = /run/current-system/sw/bin:${lib.makeBinPath [ pkgs.imagemagick ]}
-        env[BDD_CONNECT] = "/var/secrets/webapps/prod-richie"
-        php_admin_value[open_basedir] = "${vardir}:/var/lib/php/sessions/richie_production:/var/secrets/webapps/prod-richie:${richieSrc}:/tmp"
-        php_admin_value[session.save_path] = "/var/lib/php/sessions/richie_production"
-        '';
+        "php_admin_value[open_basedir]" = "${vardir}:/var/lib/php/sessions/richie_production:/var/secrets/webapps/prod-richie:${richieSrc}:/tmp";
+        "php_admin_value[session.save_path]" = "/var/lib/php/sessions/richie_production";
+      };
+      phpEnv = {
+        PATH = "/run/current-system/sw/bin:${lib.makeBinPath [ pkgs.imagemagick ]}";
+        BDD_CONNECT = "/var/secrets/webapps/prod-richie";
+      };
       phpOptions = config.services.phpfpm.phpOptions + ''
         date.timezone = 'Europe/Paris'
         extension=${pkgs.php}/lib/php/extensions/mysqli.so
@@ -91,7 +92,7 @@ in
           Require all granted
 
           <FilesMatch "\.php$">
-            SetHandler "proxy:unix:/run/phpfpm/richie_production.sock|fcgi://localhost"
+            SetHandler "proxy:unix:${config.services.phpfpm.pools.richie_production.socket}|fcgi://localhost"
           </FilesMatch>
         </Directory>
           ''
diff --git a/modules/private/websites/evariste/production.nix b/modules/private/websites/evariste/production.nix
index 00e6fe1..43b26c8 100644
--- a/modules/private/websites/evariste/production.nix
+++ b/modules/private/websites/evariste/production.nix
@@ -21,20 +21,19 @@ in {
         '';
     };
     services.phpfpm.pools.nsievariste = {
-      listen = "/run/phpfpm/nsievariste.sock";
-      extraConfig = ''
-        user = wwwrun
-        group = wwwrun
-        listen.owner = wwwrun
-        listen.group = wwwrun
+      user = "wwwrun";
+      group = "wwwrun";
+      settings = {
+        "listen.owner" = "wwwrun";
+        "listen.group" = "wwwrun";
 
-        pm = ondemand
-        pm.max_children = 5
-        pm.process_idle_timeout = 60
+        "pm" = "ondemand";
+        "pm.max_children" = "5";
+        "pm.process_idle_timeout" = "60";
 
-        php_admin_value[open_basedir] = "/var/lib/php/sessions/nsievariste:${nsiVarDir}:/tmp"
-        php_admin_value[session.save_path] = "/var/lib/php/sessions/nsievariste"
-        '';
+        "php_admin_value[open_basedir]" = "/var/lib/php/sessions/nsievariste:${nsiVarDir}:/tmp";
+        "php_admin_value[session.save_path]" = "/var/lib/php/sessions/nsievariste";
+      };
     };
     services.websites.env.production.vhostConfs.nsievariste = {
       certName     = "eldiron";
@@ -46,7 +45,7 @@ in {
         Use Stats nsievariste.immae.eu
 
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:/run/phpfpm/nsievariste.sock|fcgi://localhost"
+          SetHandler "proxy:unix:${config.services.phpfpm.pools.nsievariste.socket}|fcgi://localhost"
         </FilesMatch>
 
         <Directory ${nsiVarDir}>
@@ -60,20 +59,19 @@ in {
     };
 
     services.phpfpm.pools.stmgevariste = {
-      listen = "/run/phpfpm/stmgevariste.sock";
-      extraConfig = ''
-        user = wwwrun
-        group = wwwrun
-        listen.owner = wwwrun
-        listen.group = wwwrun
+      user = "wwwrun";
+      group = "wwwrun";
+      settings = {
+        "listen.owner" = "wwwrun";
+        "listen.group" = "wwwrun";
 
-        pm = ondemand
-        pm.max_children = 5
-        pm.process_idle_timeout = 60
+        "pm" = "ondemand";
+        "pm.max_children" = "5";
+        "pm.process_idle_timeout" = "60";
 
-        php_admin_value[open_basedir] = "/var/lib/php/sessions/stmgevariste:${stmgVarDir}:/tmp"
-        php_admin_value[session.save_path] = "/var/lib/php/sessions/stmgevariste"
-        '';
+        "php_admin_value[open_basedir]" = "/var/lib/php/sessions/stmgevariste:${stmgVarDir}:/tmp";
+        "php_admin_value[session.save_path]" = "/var/lib/php/sessions/stmgevariste";
+      };
     };
     services.websites.env.production.vhostConfs.stmgevariste = {
       certName     = "eldiron";
@@ -85,7 +83,7 @@ in {
         Use Stats stmgevariste.immae.eu
 
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:/run/phpfpm/stmgevariste.sock|fcgi://localhost"
+          SetHandler "proxy:unix:${config.services.phpfpm.pools.stmgevariste.socket}|fcgi://localhost"
         </FilesMatch>
 
         <Directory ${stmgVarDir}>
diff --git a/modules/private/websites/florian/app.nix b/modules/private/websites/florian/app.nix
index e262c59..c65c26f 100644
--- a/modules/private/websites/florian/app.nix
+++ b/modules/private/websites/florian/app.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, config,  ... }:
 let
-  adminer = pkgs.callPackage ../commons/adminer.nix {};
+  adminer = pkgs.callPackage ../commons/adminer.nix { inherit config; };
   secrets = config.myEnv.websites.tellesflorian.integration;
   app = pkgs.webapps.tellesflorian.override { environment = secrets.environment; };
   cfg = config.myServices.websites.florian.app;
@@ -24,15 +24,17 @@ in {
         "./bin/console --env=${app.environment} cache:clear --no-warmup"
       ];
       phpOpenbasedir = [ "/tmp" ];
-      phpPool = ''
-        php_admin_value[upload_max_filesize] = 20M
-        php_admin_value[post_max_size] = 20M
-        ;php_admin_flag[log_errors] = on
-        pm = ondemand
-        pm.max_children = 5
-        pm.process_idle_timeout = 60
-        env[SYMFONY_DEBUG_MODE] = "yes"
-      '';
+      phpPool = {
+        "php_admin_value[upload_max_filesize]" = "20M";
+        "php_admin_value[post_max_size]" = "20M";
+        #"php_admin_flag[log_errors]" = "on";
+        "pm" = "ondemand";
+        "pm.max_children" = "5";
+        "pm.process_idle_timeout" = "60";
+      };
+      phpEnv = {
+        SYMFONY_DEBUG_MODE = "yes";
+      };
       phpWatchFiles = [
         config.secrets.fullPaths."webapps/${app.environment}-tellesflorian"
       ];
@@ -134,7 +136,7 @@ in {
 
         </Directory>
         ''
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf null)
       ];
     };
   };
diff --git a/modules/private/websites/florian/integration.nix b/modules/private/websites/florian/integration.nix
index 57c4006..4ee160a 100644
--- a/modules/private/websites/florian/integration.nix
+++ b/modules/private/websites/florian/integration.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, config,  ... }:
 let
-    adminer = pkgs.callPackage ../commons/adminer.nix {};
+    adminer = pkgs.callPackage ../commons/adminer.nix { inherit config; };
     cfg = config.myServices.websites.florian.integration;
     varDir = "/var/lib/ftp/florian";
     env = config.myEnv.websites.florian;
@@ -8,7 +8,7 @@ in {
   options.myServices.websites.florian.integration.enable = lib.mkEnableOption "enable Florian's website integration";
 
   config = lib.mkIf cfg.enable {
-    security.acme2.certs."ftp".extraDomains."florian.immae.eu" = null;
+    security.acme.certs."ftp".extraDomains."florian.immae.eu" = null;
 
     services.websites.env.integration.modules = adminer.apache.modules;
     services.websites.env.integration.vhostConfs.florian = {
@@ -17,7 +17,7 @@ in {
       hosts       = [ "florian.immae.eu" ];
       root        = "${varDir}/florian.immae.eu";
       extraConfig = [
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf null)
         ''
         ServerAdmin ${env.server_admin}
 
diff --git a/modules/private/websites/florian/production.nix b/modules/private/websites/florian/production.nix
index 1abc715..16c6022 100644
--- a/modules/private/websites/florian/production.nix
+++ b/modules/private/websites/florian/production.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, config,  ... }:
 let
-    adminer = pkgs.callPackage ../commons/adminer.nix {};
+    adminer = pkgs.callPackage ../commons/adminer.nix { inherit config; };
     cfg = config.myServices.websites.florian.production;
     varDir = "/var/lib/ftp/florian";
     env = config.myEnv.websites.florian;
@@ -8,7 +8,7 @@ in {
   options.myServices.websites.florian.production.enable = lib.mkEnableOption "enable Florian's website production";
 
   config = lib.mkIf cfg.enable {
-    security.acme2.certs."ftp".extraDomains."tellesflorian.com" = null;
+    security.acme.certs."ftp".extraDomains."tellesflorian.com" = null;
 
     services.websites.env.production.modules = adminer.apache.modules;
     services.websites.env.production.vhostConfs.florian = {
@@ -17,7 +17,7 @@ in {
       hosts        = [ "tellesflorian.com" "www.tellesflorian.com" ];
       root         = "${varDir}/tellesflorian.com";
       extraConfig  = [
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf null)
         ''
         ServerAdmin ${env.server_admin}
 
diff --git a/modules/private/websites/isabelle/aten_integration.nix b/modules/private/websites/isabelle/aten_integration.nix
index a2a087c..fb6eda9 100644
--- a/modules/private/websites/isabelle/aten_integration.nix
+++ b/modules/private/websites/isabelle/aten_integration.nix
@@ -23,15 +23,17 @@ in {
         "APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup"
       ];
       phpOpenbasedir = [ "/tmp" ];
-      phpPool = ''
-        php_admin_value[upload_max_filesize] = 20M
-        php_admin_value[post_max_size] = 20M
-        ;php_admin_flag[log_errors] = on
-        pm = ondemand
-        pm.max_children = 5
-        pm.process_idle_timeout = 60
-        env[SYMFONY_DEBUG_MODE] = "yes"
-      '';
+      phpPool = {
+        "php_admin_value[upload_max_filesize]" = "20M";
+        "php_admin_value[post_max_size]" = "20M";
+        #"php_admin_flag[log_errors]" = "on";
+        "pm" = "ondemand";
+        "pm.max_children" = "5";
+        "pm.process_idle_timeout" = "60";
+      };
+      phpEnv = {
+        SYMFONY_DEBUG_MODE = "yes";
+      };
     };
 
     secrets.keys = [{
diff --git a/modules/private/websites/isabelle/aten_production.nix b/modules/private/websites/isabelle/aten_production.nix
index 8e33f0f..cf7e4a2 100644
--- a/modules/private/websites/isabelle/aten_production.nix
+++ b/modules/private/websites/isabelle/aten_production.nix
@@ -24,16 +24,16 @@ in {
         "APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup"
       ];
       phpOpenbasedir = [ "/tmp" ];
-      phpPool = ''
-        php_admin_value[upload_max_filesize] = 20M
-        php_admin_value[post_max_size] = 20M
-        ;php_admin_flag[log_errors] = on
-        pm = dynamic
-        pm.max_children = 20
-        pm.start_servers = 2
-        pm.min_spare_servers = 1
-        pm.max_spare_servers = 3
-      '';
+      phpPool = {
+        "php_admin_value[upload_max_filesize]" = "20M";
+        "php_admin_value[post_max_size]" = "20M";
+        #"php_admin_flag[log_errors]" = "on";
+        "pm" = "dynamic";
+        "pm.max_children" = "20";
+        "pm.start_servers" = "2";
+        "pm.min_spare_servers" = "1";
+        "pm.max_spare_servers" = "3";
+      };
     };
 
     secrets.keys = [{
diff --git a/modules/private/websites/isabelle/iridologie.nix b/modules/private/websites/isabelle/iridologie.nix
index 460bd2a..ffbf259 100644
--- a/modules/private/websites/isabelle/iridologie.nix
+++ b/modules/private/websites/isabelle/iridologie.nix
@@ -19,8 +19,9 @@ in {
     systemd.services.phpfpm-iridologie.after = lib.mkAfter iridologie.phpFpm.serviceDeps;
     systemd.services.phpfpm-iridologie.wants = iridologie.phpFpm.serviceDeps;
     services.phpfpm.pools.iridologie = {
-      listen = iridologie.phpFpm.socket;
-      extraConfig = iridologie.phpFpm.pool;
+      user = config.services.httpd.Prod.user;
+      group = config.services.httpd.Prod.group;
+      settings = iridologie.phpFpm.pool;
       phpOptions = config.services.phpfpm.phpOptions + ''
         extension=${pkgs.php}/lib/php/extensions/mysqli.so
       '';
@@ -39,7 +40,7 @@ in {
           RewriteCond "%{HTTP_HOST}" "!^iridologie\.icommandeur\.org$" [NC]
           RewriteRule ^(.+)$ https://iridologie.icommandeur.org$1 [R=302,L]
           ''
-        iridologie.apache.vhostConf
+        (iridologie.apache.vhostConf config.services.phpfpm.pools.iridologie.socket)
       ];
     };
     services.websites.env.production.watchPaths = [
diff --git a/modules/private/websites/isabelle/spip_builder.nix b/modules/private/websites/isabelle/spip_builder.nix
index 2ab5394..e1130d1 100644
--- a/modules/private/websites/isabelle/spip_builder.nix
+++ b/modules/private/websites/isabelle/spip_builder.nix
@@ -3,28 +3,25 @@ rec {
   app = iridologie.override { inherit (config) environment; };
   phpFpm = rec {
     serviceDeps = [ "mysql.service" ];
-    socket = "/var/run/phpfpm/iridologie-${app.environment}.sock";
-    pool = ''
-      user = ${apacheUser}
-      group = ${apacheGroup}
-      listen.owner = ${apacheUser}
-      listen.group = ${apacheGroup}
-      php_admin_value[upload_max_filesize] = 20M
-      php_admin_value[post_max_size] = 20M
-      ;php_admin_flag[log_errors] = on
-      php_admin_value[open_basedir] = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp"
-      php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
-      ${if app.environment == "dev" then ''
-      pm = ondemand
-      pm.max_children = 5
-      pm.process_idle_timeout = 60
-      '' else ''
-      pm = dynamic
-      pm.max_children = 20
-      pm.start_servers = 2
-      pm.min_spare_servers = 1
-      pm.max_spare_servers = 3
-      ''}'';
+    pool = {
+      "listen.owner" = "${apacheUser}";
+      "listen.group" = "${apacheGroup}";
+      "php_admin_value[upload_max_filesize]" = "20M";
+      "php_admin_value[post_max_size]" = "20M";
+      #"php_admin_flag[log_errors]" = "on";
+      "php_admin_value[open_basedir]" = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp";
+      "php_admin_value[session.save_path]" = "${app.varDir}/phpSessions";
+    } // (if app.environment == "dev" then {
+      "pm" = "ondemand";
+      "pm.max_children" = "5";
+      "pm.process_idle_timeout" = "60";
+    } else {
+      "pm" = "dynamic";
+      "pm.max_children" = "20";
+      "pm.start_servers" = "2";
+      "pm.min_spare_servers" = "1";
+      "pm.max_spare_servers" = "3";
+    });
   };
   keys = [{
     dest = "webapps/${app.environment}-iridologie";
@@ -51,13 +48,13 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "iridologie_${app.environment}";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Include /var/secrets/webapps/${app.environment}-iridologie
 
       RewriteEngine On
 
       <FilesMatch "\.php$">
-        SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+        SetHandler "proxy:unix:${socket}|fcgi://localhost"
       </FilesMatch>
 
       <Directory ${root}>
diff --git a/modules/private/websites/leila/production.nix b/modules/private/websites/leila/production.nix
index e8591c8..3b289cf 100644
--- a/modules/private/websites/leila/production.nix
+++ b/modules/private/websites/leila/production.nix
@@ -7,19 +7,18 @@ in {
 
   config = lib.mkIf cfg.enable {
     services.phpfpm.pools.leila = {
-      listen = "/run/phpfpm/leila.sock";
-      extraConfig = ''
-        user = wwwrun
-        group = wwwrun
-        listen.owner = wwwrun
-        listen.group = wwwrun
+      user = "wwwrun";
+      group = "wwwrun";
+      settings = {
+        "listen.owner" = "wwwrun";
+        "listen.group" = "wwwrun";
 
-        pm = ondemand
-        pm.max_children = 5
-        pm.process_idle_timeout = 60
+        "pm" = "ondemand";
+        "pm.max_children" = "5";
+        "pm.process_idle_timeout" = "60";
 
-        php_admin_value[open_basedir] = "${varDir}:/tmp"
-      '';
+        "php_admin_value[open_basedir]" = "${varDir}:/tmp";
+      };
     };
 
     services.webstats.sites = [
@@ -46,7 +45,7 @@ in {
           Require ldap-group cn=chorale.leila.bouya.org,cn=httpd,ou=services,dc=immae,dc=eu
 
           <FilesMatch "\.php$">
-            SetHandler "proxy:unix:/run/phpfpm/leila.sock|fcgi://localhost"
+            SetHandler "proxy:unix:${config.services.phpfpm.pools.leila.socket}|fcgi://localhost"
           </FilesMatch>
         </Directory>
           ''
@@ -66,7 +65,7 @@ in {
           AllowOverride None
 
           <FilesMatch "\.php$">
-            SetHandler "proxy:unix:/run/phpfpm/leila.sock|fcgi://localhost"
+            SetHandler "proxy:unix:${config.services.phpfpm.pools.leila.socket}|fcgi://localhost"
           </FilesMatch>
         </Directory>
           ''
@@ -89,7 +88,7 @@ in {
           Require ldap-group cn=chorale.leila.bouya.org,cn=httpd,ou=services,dc=immae,dc=eu
 
           <FilesMatch "\.php$">
-            SetHandler "proxy:unix:/run/phpfpm/leila.sock|fcgi://localhost"
+            SetHandler "proxy:unix:${config.services.phpfpm.pools.leila.socket}|fcgi://localhost"
           </FilesMatch>
         </Directory>
         <Directory ${varDir}>
diff --git a/modules/private/websites/ludivinecassal/integration.nix b/modules/private/websites/ludivinecassal/integration.nix
index 1cbfd12..d304fdf 100644
--- a/modules/private/websites/ludivinecassal/integration.nix
+++ b/modules/private/websites/ludivinecassal/integration.nix
@@ -23,15 +23,17 @@ in {
         "./bin/console --env=${app.environment} cache:clear --no-warmup"
       ];
       phpOpenbasedir = [ "/tmp" ];
-      phpPool = ''
-        php_admin_value[upload_max_filesize] = 20M
-        php_admin_value[post_max_size] = 20M
-        ;php_admin_flag[log_errors] = on
-        pm = ondemand
-        pm.max_children = 5
-        pm.process_idle_timeout = 60
-        env[SYMFONY_DEBUG_MODE] = "yes"
-      '';
+      phpPool = {
+        "php_admin_value[upload_max_filesize]" = "20M";
+        "php_admin_value[post_max_size]" = "20M";
+        #"php_admin_flag[log_errors]" = "on";
+        "pm" = "ondemand";
+        "pm.max_children" = "5";
+        "pm.process_idle_timeout" = "60";
+      };
+      phpEnv = {
+        SYMFONY_DEBUG_MODE = "yes";
+      };
       phpWatchFiles = [
         config.secrets.fullPaths."webapps/${app.environment}-ludivinecassal"
       ];
diff --git a/modules/private/websites/ludivinecassal/production.nix b/modules/private/websites/ludivinecassal/production.nix
index 7cf00f0..5761be7 100644
--- a/modules/private/websites/ludivinecassal/production.nix
+++ b/modules/private/websites/ludivinecassal/production.nix
@@ -24,16 +24,16 @@ in {
         "./bin/console --env=${app.environment} cache:clear --no-warmup"
       ];
       phpOpenbasedir = [ "/tmp" ];
-      phpPool = ''
-        php_admin_value[upload_max_filesize] = 20M
-        php_admin_value[post_max_size] = 20M
-        ;php_admin_flag[log_errors] = on
-        pm = dynamic
-        pm.max_children = 20
-        pm.start_servers = 2
-        pm.min_spare_servers = 1
-        pm.max_spare_servers = 3
-      '';
+      phpPool = {
+        "php_admin_value[upload_max_filesize]" = "20M";
+        "php_admin_value[post_max_size]" = "20M";
+        #"php_admin_flag[log_errors]" = "on";
+        "pm" = "dynamic";
+        "pm.max_children" = "20";
+        "pm.start_servers" = "2";
+        "pm.min_spare_servers" = "1";
+        "pm.max_spare_servers" = "3";
+      };
       phpWatchFiles = [
         config.secrets.fullPaths."webapps/${app.environment}-ludivinecassal"
       ];
diff --git a/modules/private/websites/nassime/production.nix b/modules/private/websites/nassime/production.nix
index 293519f..f9468f9 100644
--- a/modules/private/websites/nassime/production.nix
+++ b/modules/private/websites/nassime/production.nix
@@ -9,7 +9,7 @@ in {
   config = lib.mkIf cfg.enable {
     services.webstats.sites = [ { name = "nassime.bouya.org"; } ];
 
-    security.acme2.certs."ftp".extraDomains."nassime.bouya.org" = null;
+    security.acme.certs."ftp".extraDomains."nassime.bouya.org" = null;
 
     services.websites.env.production.vhostConfs.nassime = {
       certName     = "nassime";
diff --git a/modules/private/websites/naturaloutil/production.nix b/modules/private/websites/naturaloutil/production.nix
index a276c47..1e79141 100644
--- a/modules/private/websites/naturaloutil/production.nix
+++ b/modules/private/websites/naturaloutil/production.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, config,  ... }:
 let
-  adminer = pkgs.callPackage ../commons/adminer.nix {};
+  adminer = pkgs.callPackage ../commons/adminer.nix { inherit config; };
   cfg = config.myServices.websites.naturaloutil.production;
   varDir = "/var/lib/ftp/jerome";
   env = config.myEnv.websites.jerome;
@@ -10,7 +10,7 @@ in {
   config = lib.mkIf cfg.enable {
     services.webstats.sites = [ { name = "naturaloutil.immae.eu"; } ];
 
-    security.acme2.certs."ftp".extraDomains."naturaloutil.immae.eu" = null;
+    security.acme.certs."ftp".extraDomains."naturaloutil.immae.eu" = null;
 
     secrets.keys = [{
       dest = "webapps/prod-naturaloutil";
@@ -42,21 +42,22 @@ in {
     systemd.services.phpfpm-jerome.after = lib.mkAfter [ "mysql.service" ];
     systemd.services.phpfpm-jerome.wants = [ "mysql.service" ];
     services.phpfpm.pools.jerome = {
-      listen = "/run/phpfpm/naturaloutil.sock";
-      extraConfig = ''
-        user = wwwrun
-        group = wwwrun
-        listen.owner = wwwrun
-        listen.group = wwwrun
+      user = "wwwrun";
+      group = "wwwrun";
+      settings = {
+        "listen.owner" = "wwwrun";
+        "listen.group" = "wwwrun";
 
-        pm = ondemand
-        pm.max_children = 5
-        pm.process_idle_timeout = 60
+        "pm" = "ondemand";
+        "pm.max_children" = "5";
+        "pm.process_idle_timeout" = "60";
 
-        env[BDD_CONNECT] = "/var/secrets/webapps/prod-naturaloutil"
-        php_admin_value[open_basedir] = "/var/lib/php/sessions/naturaloutil:/var/secrets/webapps/prod-naturaloutil:${varDir}:/tmp"
-        php_admin_value[session.save_path] = "/var/lib/php/sessions/naturaloutil"
-        '';
+        "php_admin_value[open_basedir]" = "/var/lib/php/sessions/naturaloutil:/var/secrets/webapps/prod-naturaloutil:${varDir}:/tmp";
+        "php_admin_value[session.save_path]" = "/var/lib/php/sessions/naturaloutil";
+      };
+      phpEnv = {
+        BDD_CONNECT = "/var/secrets/webapps/prod-naturaloutil";
+      };
       phpOptions = config.services.phpfpm.phpOptions + ''
         extension=${pkgs.php}/lib/php/extensions/mysqli.so
         '';
@@ -68,7 +69,7 @@ in {
       hosts        = ["naturaloutil.immae.eu" ];
       root         = varDir;
       extraConfig  = [
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf null)
         ''
         Use Stats naturaloutil.immae.eu
         ServerAdmin ${env.server_admin}
@@ -76,7 +77,7 @@ in {
         CustomLog "${varDir}/logs/access_log" combined
 
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:/run/phpfpm/naturaloutil.sock|fcgi://localhost"
+          SetHandler "proxy:unix:${config.services.phpfpm.pools.jerome.socket}|fcgi://localhost"
         </FilesMatch>
 
         <Directory ${varDir}/logs>
diff --git a/modules/private/websites/papa/maison_bbc.nix b/modules/private/websites/papa/maison_bbc.nix
index eb61b6d..11e7937 100644
--- a/modules/private/websites/papa/maison_bbc.nix
+++ b/modules/private/websites/papa/maison_bbc.nix
@@ -9,19 +9,18 @@ in {
     services.duplyBackup.profiles.papa_maison_bbc.rootDir = varDir;
     services.webstats.sites = [ { name = "maison.bbc.bouya.org"; } ];
     services.phpfpm.pools.papa_maison_bbc = {
-      listen = "/run/phpfpm/papa_maison_bbc.sock";
-      extraConfig = ''
-        user = wwwrun
-        group = wwwrun
-        listen.owner = wwwrun
-        listen.group = wwwrun
+      user = "wwwrun";
+      group = "wwwrun";
+      settings = {
+        "listen.owner" = "wwwrun";
+        "listen.group" = "wwwrun";
 
-        pm = ondemand
-        pm.max_children = 5
-        pm.process_idle_timeout = 60
+        "pm" = "ondemand";
+        "pm.max_children" = "5";
+        "pm.process_idle_timeout" = "60";
 
-        php_admin_value[open_basedir] = "${varDir}"
-        '';
+        "php_admin_value[open_basedir]" = varDir;
+      };
       phpOptions = config.services.phpfpm.phpOptions + ''
         date.timezone = 'Europe/Paris'
         extension=${pkgs.php}/lib/php/extensions/mysqli.so
@@ -34,17 +33,17 @@ in {
       root         = varDir;
       extraConfig  = [
         ''
-        Alias /.well-known/acme-challenge ${config.security.acme2.certs.papa.webroot}/.well-known/acme-challenge
+        Alias /.well-known/acme-challenge ${config.security.acme.certs.papa.webroot}/.well-known/acme-challenge
         RedirectMatch 301 ^/((?!(\.well-known|add.php).*$).*)$ https://maison.bbc.bouya.org/$1
         <Directory ${varDir}>
           DirectoryIndex index.php index.htm index.html
           AllowOverride None
           Require all granted
           <FilesMatch "\.php$">
-            SetHandler "proxy:unix:/run/phpfpm/papa_maison_bbc.sock|fcgi://localhost"
+            SetHandler "proxy:unix:${config.services.phpfpm.pools.papa_maison_bbc.socket}|fcgi://localhost"
           </FilesMatch>
         </Directory>
-        <Directory "${config.security.acme2.certs.papa.webroot}">
+        <Directory "${config.security.acme.certs.papa.webroot}">
           Options Indexes FollowSymLinks
           AllowOverride None
           Require all granted
@@ -64,7 +63,7 @@ in {
           AllowOverride None
           Require all granted
           <FilesMatch "\.php$">
-            SetHandler "proxy:unix:/run/phpfpm/papa_maison_bbc.sock|fcgi://localhost"
+            SetHandler "proxy:unix:${config.services.phpfpm.pools.papa_maison_bbc.socket}|fcgi://localhost"
           </FilesMatch>
         </Directory>
           ''
diff --git a/modules/private/websites/papa/surveillance.nix b/modules/private/websites/papa/surveillance.nix
index f6e1772..1bb6ac8 100644
--- a/modules/private/websites/papa/surveillance.nix
+++ b/modules/private/websites/papa/surveillance.nix
@@ -6,7 +6,7 @@ in {
   options.myServices.websites.papa.surveillance.enable = lib.mkEnableOption "enable Papa surveillance's website";
 
   config = lib.mkIf cfg.enable {
-    security.acme2.certs."ftp".extraDomains."surveillance.maison.bbc.bouya.org" = null;
+    security.acme.certs."ftp".extraDomains."surveillance.maison.bbc.bouya.org" = null;
 
     services.cron = {
       systemCronJobs = let
diff --git a/modules/private/websites/piedsjaloux/integration.nix b/modules/private/websites/piedsjaloux/integration.nix
index 5907bc8..76523ed 100644
--- a/modules/private/websites/piedsjaloux/integration.nix
+++ b/modules/private/websites/piedsjaloux/integration.nix
@@ -23,16 +23,18 @@ in {
         "./bin/console --env=${app.environment} cache:clear --no-warmup"
       ];
       phpOpenbasedir = [ "/tmp" ];
-      phpPool = ''
-        php_admin_value[upload_max_filesize] = 20M
-        php_admin_value[post_max_size] = 20M
-        ;php_admin_flag[log_errors] = on
-        env[PATH] = ${lib.makeBinPath [ pkgs.apg pkgs.unzip ]}
-        pm = ondemand
-        pm.max_children = 5
-        pm.process_idle_timeout = 60
-        env[SYMFONY_DEBUG_MODE] = "yes"
-      '';
+      phpPool = {
+        "php_admin_value[upload_max_filesize]" = "20M";
+        "php_admin_value[post_max_size]" = "20M";
+        #"php_admin_flag[log_errors]" = "on";
+        "pm" = "ondemand";
+        "pm.max_children" = "5";
+        "pm.process_idle_timeout" = "60";
+      };
+      phpEnv = {
+        PATH = lib.makeBinPath [ pkgs.apg pkgs.unzip ];
+        SYMFONY_DEBUG_MODE = "yes";
+      };
       phpWatchFiles = [
         config.secrets.fullPaths."webapps/${app.environment}-piedsjaloux"
       ];
diff --git a/modules/private/websites/piedsjaloux/production.nix b/modules/private/websites/piedsjaloux/production.nix
index e4e29c7..d3e5c2b 100644
--- a/modules/private/websites/piedsjaloux/production.nix
+++ b/modules/private/websites/piedsjaloux/production.nix
@@ -24,17 +24,19 @@ in {
         "./bin/console --env=${app.environment} cache:clear --no-warmup"
       ];
       phpOpenbasedir = [ "/tmp" ];
-      phpPool = ''
-        php_admin_value[upload_max_filesize] = 20M
-        php_admin_value[post_max_size] = 20M
-        ;php_admin_flag[log_errors] = on
-        env[PATH] = ${lib.makeBinPath [ pkgs.apg pkgs.unzip ]}
-        pm = dynamic
-        pm.max_children = 20
-        pm.start_servers = 2
-        pm.min_spare_servers = 1
-        pm.max_spare_servers = 3
-      '';
+      phpPool = {
+        "php_admin_value[upload_max_filesize]" = "20M";
+        "php_admin_value[post_max_size]" = "20M";
+        #"php_admin_flag[log_errors]" = "on";
+        "pm" = "dynamic";
+        "pm.max_children" = "20";
+        "pm.start_servers" = "2";
+        "pm.min_spare_servers" = "1";
+        "pm.max_spare_servers" = "3";
+      };
+      phpEnv = {
+        PATH = lib.makeBinPath [ pkgs.apg pkgs.unzip ];
+      };
       phpWatchFiles = [
         config.secrets.fullPaths."webapps/${app.environment}-piedsjaloux"
       ];
diff --git a/modules/private/websites/teliotortay/production.nix b/modules/private/websites/teliotortay/production.nix
index 2c62d10..62762ec 100644
--- a/modules/private/websites/teliotortay/production.nix
+++ b/modules/private/websites/teliotortay/production.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, config,  ... }:
 let
-  adminer = pkgs.callPackage ../commons/adminer.nix {};
+  adminer = pkgs.callPackage ../commons/adminer.nix { inherit config; };
   cfg = config.myServices.websites.telioTortay.production;
   varDir = "/var/lib/ftp/telio_tortay";
   env = config.myEnv.websites.telioTortay;
@@ -10,7 +10,7 @@ in {
   config = lib.mkIf cfg.enable {
     services.webstats.sites = [ { name = "telio-tortay.immae.eu"; } ];
 
-    security.acme2.certs."ftp".extraDomains."telio-tortay.immae.eu" = null;
+    security.acme.certs."ftp".extraDomains."telio-tortay.immae.eu" = null;
 
     system.activationScripts.telio-tortay = {
       deps = [ "httpd" ];
@@ -22,20 +22,19 @@ in {
     systemd.services.phpfpm-telio-tortay.after = lib.mkAfter [ "mysql.service" ];
     systemd.services.phpfpm-telio-tortay.wants = [ "mysql.service" ];
     services.phpfpm.pools.telio-tortay = {
-      listen = "/run/phpfpm/telio-tortay.sock";
-      extraConfig = ''
-        user = wwwrun
-        group = wwwrun
-        listen.owner = wwwrun
-        listen.group = wwwrun
+      user = "wwwrun";
+      group = "wwwrun";
+      settings = {
+        "listen.owner" = "wwwrun";
+        "listen.group" = "wwwrun";
 
-        pm = ondemand
-        pm.max_children = 5
-        pm.process_idle_timeout = 60
+        "pm" = "ondemand";
+        "pm.max_children" = "5";
+        "pm.process_idle_timeout" = "60";
 
-        php_admin_value[open_basedir] = "/var/lib/php/sessions/telio-tortay:${varDir}:/tmp"
-        php_admin_value[session.save_path] = "/var/lib/php/sessions/telio-tortay"
-        '';
+        "php_admin_value[open_basedir]" = "/var/lib/php/sessions/telio-tortay:${varDir}:/tmp";
+        "php_admin_value[session.save_path]" = "/var/lib/php/sessions/telio-tortay";
+      };
       phpOptions = config.services.phpfpm.phpOptions + ''
         disable_functions = "mail"
         extension=${pkgs.php}/lib/php/extensions/mysqli.so
@@ -48,7 +47,7 @@ in {
       hosts        = ["telio-tortay.immae.eu" "realistesmedia.fr" "www.realistesmedia.fr" ];
       root         = varDir;
       extraConfig  = [
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf null)
         ''
         Use Stats telio-tortay.immae.eu
         ServerAdmin ${env.server_admin}
@@ -56,7 +55,7 @@ in {
         CustomLog "${varDir}/logs/access_log" combined
 
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:/run/phpfpm/telio-tortay.sock|fcgi://localhost"
+          SetHandler "proxy:unix:${config.services.phpfpm.pools.telio-tortay.socket}|fcgi://localhost"
         </FilesMatch>
 
         <Directory ${varDir}/logs>
diff --git a/modules/private/websites/tools/cloud/default.nix b/modules/private/websites/tools/cloud/default.nix
index 4785074..b9bb32f 100644
--- a/modules/private/websites/tools/cloud/default.nix
+++ b/modules/private/websites/tools/cloud/default.nix
@@ -10,37 +10,34 @@ let
     basedir = builtins.concatStringsSep ":" (
       [ nextcloud varDir ]
       ++ builtins.attrValues pkgs.webapps.nextcloud-apps);
-    socket = "/var/run/phpfpm/nextcloud.sock";
     phpConfig = ''
       extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
       extension=${pkgs.phpPackages.apcu}/lib/php/extensions/apcu.so
       zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
       '';
-    pool = ''
-      user = wwwrun
-      group = wwwrun
-      listen.owner = wwwrun
-      listen.group = wwwrun
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = "wwwrun";
+      "listen.group" = "wwwrun";
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      php_admin_value[output_buffering] = 0
-      php_admin_value[max_execution_time] = 1800
-      php_admin_value[zend_extension] = "opcache"
-      ;already enabled by default?
-      ;php_value[opcache.enable] = 1
-      php_value[opcache.enable_cli] = 1
-      php_value[opcache.interned_strings_buffer] = 8
-      php_value[opcache.max_accelerated_files] = 10000
-      php_value[opcache.memory_consumption] = 128
-      php_value[opcache.save_comments] = 1
-      php_value[opcache.revalidate_freq] = 1
-      php_admin_value[memory_limit] = 512M
+      "php_admin_value[output_buffering]" = "0";
+      "php_admin_value[max_execution_time]" = "1800";
+      "php_admin_value[zend_extension]" = "opcache";
+      #already enabled by default?
+      #"php_value[opcache.enable]" = "1";
+      "php_value[opcache.enable_cli]" = "1";
+      "php_value[opcache.interned_strings_buffer]" = "8";
+      "php_value[opcache.max_accelerated_files]" = "10000";
+      "php_value[opcache.memory_consumption]" = "128";
+      "php_value[opcache.save_comments]" = "1";
+      "php_value[opcache.revalidate_freq]" = "1";
+      "php_admin_value[memory_limit]" = "512M";
 
-      php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:${basedir}:/proc/meminfo:/dev/urandom:/proc/self/fd:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:${basedir}:/proc/meminfo:/dev/urandom:/proc/self/fd:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 in {
   options.myServices.websites.tools.cloud = {
@@ -71,7 +68,7 @@ in {
             </IfModule>
             <FilesMatch "\.php$">
               CGIPassAuth on
-              SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+              SetHandler "proxy:unix:${config.services.phpfpm.pools.nextcloud.socket}|fcgi://localhost"
             </FilesMatch>
 
           </Directory>
@@ -171,8 +168,9 @@ in {
       '';
 
     services.phpfpm.pools.nextcloud = {
-      listen = phpFpm.socket;
-      extraConfig = phpFpm.pool;
+      user = "wwwrun";
+      group = "wwwrun";
+      settings = phpFpm.pool;
       phpOptions = config.services.phpfpm.phpOptions + phpFpm.phpConfig;
     };
 
diff --git a/modules/private/websites/tools/dav/davical.nix b/modules/private/websites/tools/dav/davical.nix
index 5eb3fab..9d6cd21 100644
--- a/modules/private/websites/tools/dav/davical.nix
+++ b/modules/private/websites/tools/dav/davical.nix
@@ -73,7 +73,7 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_davical";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /davical "${root}"
       Alias /caldav.php  "${root}/caldav.php"
       <Directory "${root}">
@@ -84,7 +84,7 @@ rec {
 
         <FilesMatch "\.php$">
           CGIPassAuth on
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         RewriteEngine On
@@ -111,28 +111,25 @@ rec {
   phpFpm = rec {
     serviceDeps = [ "postgresql.service" "openldap.service" ];
     basedir = builtins.concatStringsSep ":" [ webapp "/var/secrets/webapps/dav-davical" awl ];
-    socket = "/var/run/phpfpm/davical.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = dynamic
-      pm.max_children = 60
-      pm.start_servers = 2
-      pm.min_spare_servers = 1
-      pm.max_spare_servers = 10
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "dynamic";
+      "pm.max_children" = "60";
+      "pm.start_servers" = "2";
+      "pm.min_spare_servers" = "1";
+      "pm.max_spare_servers" = "10";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = DavicalPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/davical"
-      php_admin_value[include_path] = "${awl}/inc:${webapp}/inc"
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/davical"
-      php_flag[magic_quotes_gpc] = Off
-      php_flag[register_globals] = Off
-      php_admin_value[error_reporting] = "E_ALL & ~E_NOTICE"
-      php_admin_value[default_charset] = "utf-8"
-      php_flag[magic_quotes_runtime] = Off
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "DavicalPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/davical";
+      "php_admin_value[include_path]" = "${awl}/inc:${webapp}/inc";
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/davical";
+      "php_flag[magic_quotes_gpc]" = "Off";
+      "php_flag[register_globals]" = "Off";
+      "php_admin_value[error_reporting]" = "E_ALL & ~E_NOTICE";
+      "php_admin_value[default_charset]" = "utf-8";
+      "php_flag[magic_quotes_runtime]" = "Off";
+    };
   };
 }
diff --git a/modules/private/websites/tools/dav/default.nix b/modules/private/websites/tools/dav/default.nix
index 0012965..30a562c 100644
--- a/modules/private/websites/tools/dav/default.nix
+++ b/modules/private/websites/tools/dav/default.nix
@@ -38,14 +38,15 @@ in {
       root        = "/run/current-system/webapps/_dav";
       extraConfig = [
         infcloud.vhostConf
-        davical.apache.vhostConf
+        (davical.apache.vhostConf config.services.phpfpm.pools.davical.socket)
       ];
     };
 
     services.phpfpm.pools = {
       davical = {
-        listen = davical.phpFpm.socket;
-        extraConfig = davical.phpFpm.pool;
+        user = config.services.httpd.Tools.user;
+        group = config.services.httpd.Tools.group;
+        settings = davical.phpFpm.pool;
       };
     };
 
diff --git a/modules/private/websites/tools/db/default.nix b/modules/private/websites/tools/db/default.nix
index 60592e5..fc8d989 100644
--- a/modules/private/websites/tools/db/default.nix
+++ b/modules/private/websites/tools/db/default.nix
@@ -1,6 +1,6 @@
 { lib, pkgs, config,  ... }:
 let
-    adminer = pkgs.callPackage ../../commons/adminer.nix {};
+    adminer = pkgs.callPackage ../../commons/adminer.nix { inherit config; };
 
     cfg = config.myServices.websites.tools.db;
 in {
@@ -15,7 +15,7 @@ in {
       addToCerts  = true;
       hosts       = ["db-1.immae.eu" ];
       root        = null;
-      extraConfig = [ adminer.apache.vhostConf ];
+      extraConfig = [ (adminer.apache.vhostConf null) ];
     };
   };
 }
diff --git a/modules/private/websites/tools/git/default.nix b/modules/private/websites/tools/git/default.nix
index 054e47b..56e4401 100644
--- a/modules/private/websites/tools/git/default.nix
+++ b/modules/private/websites/tools/git/default.nix
@@ -30,7 +30,7 @@ in {
       root        = gitweb.apache.root;
       extraConfig = [
         gitweb.apache.vhostConf
-        mantisbt.apache.vhostConf
+        (mantisbt.apache.vhostConf config.services.phpfpm.pools.mantisbt.socket)
         ''
           RewriteEngine on
           RewriteCond %{REQUEST_URI}       ^/releases
@@ -40,8 +40,9 @@ in {
     };
     services.phpfpm.pools = {
       mantisbt = {
-        listen = mantisbt.phpFpm.socket;
-        extraConfig = mantisbt.phpFpm.pool;
+        user = config.services.httpd.Tools.user;
+        group = config.services.httpd.Tools.group;
+        settings = mantisbt.phpFpm.pool;
       };
     };
   };
diff --git a/modules/private/websites/tools/git/mantisbt.nix b/modules/private/websites/tools/git/mantisbt.nix
index d75b022..50851aa 100644
--- a/modules/private/websites/tools/git/mantisbt.nix
+++ b/modules/private/websites/tools/git/mantisbt.nix
@@ -53,12 +53,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_mantisbt";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /mantisbt "${root}"
       <Directory "${root}">
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride All
@@ -76,20 +76,17 @@ rec {
     basedir = builtins.concatStringsSep ":" (
       [ webRoot "/var/secrets/webapps/tools-mantisbt" ]
       ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/mantisbt.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      php_admin_value[upload_max_filesize] = 5000000
+      "php_admin_value[upload_max_filesize]" = "5000000";
 
-      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/mantisbt"
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/mantisbt"
-      '';
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/mantisbt";
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/mantisbt";
+    };
   };
 }
diff --git a/modules/private/websites/tools/mail/default.nix b/modules/private/websites/tools/mail/default.nix
index bb36042..1f7f7bf 100644
--- a/modules/private/websites/tools/mail/default.nix
+++ b/modules/private/websites/tools/mail/default.nix
@@ -6,6 +6,7 @@ let
   };
   rainloop = pkgs.callPackage ./rainloop.nix {};
   cfg = config.myServices.websites.tools.email;
+  pcfg = config.services.phpfpm.pools;
 in
 {
   options.myServices.websites.tools.email = {
@@ -34,8 +35,8 @@ in
       hosts      = ["mail.immae.eu"];
       root       = "/run/current-system/webapps/_mail";
       extraConfig = [
-        rainloop.apache.vhostConf
-        roundcubemail.apache.vhostConf
+        (rainloop.apache.vhostConf pcfg.rainloop.socket)
+        (roundcubemail.apache.vhostConf pcfg.roundcubemail.socket)
         ''
           <Directory /run/current-system/webapps/_mail>
             Require all granted
@@ -56,13 +57,15 @@ in
     };
 
     services.phpfpm.pools.roundcubemail = {
-      listen = roundcubemail.phpFpm.socket;
-      extraConfig = roundcubemail.phpFpm.pool;
+      user = "wwwrun";
+      group = "wwwrun";
+      settings = roundcubemail.phpFpm.pool;
       phpOptions = config.services.phpfpm.phpOptions + roundcubemail.phpFpm.phpConfig;
     };
     services.phpfpm.pools.rainloop = {
-      listen = rainloop.phpFpm.socket;
-      extraConfig = rainloop.phpFpm.pool;
+      user = "wwwrun";
+      group = "wwwrun";
+      settings = rainloop.phpFpm.pool;
     };
     system.activationScripts = {
       roundcubemail = roundcubemail.activationScript;
diff --git a/modules/private/websites/tools/mail/rainloop.nix b/modules/private/websites/tools/mail/rainloop.nix
index 2dad46e..9b1f0c5 100644
--- a/modules/private/websites/tools/mail/rainloop.nix
+++ b/modules/private/websites/tools/mail/rainloop.nix
@@ -16,7 +16,7 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_rainloop";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
     Alias /rainloop "${root}"
     <Directory "${root}">
       DirectoryIndex index.php
@@ -25,7 +25,7 @@ rec {
       Require all granted
 
       <FilesMatch "\.php$">
-        SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+        SetHandler "proxy:unix:${socket}|fcgi://localhost"
       </FilesMatch>
     </Directory>
 
@@ -37,22 +37,19 @@ rec {
   phpFpm = rec {
     serviceDeps = [ "postgresql.service" ];
     basedir = builtins.concatStringsSep ":" [ webRoot varDir ];
-    socket = "/var/run/phpfpm/rainloop.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = RainloopPHPSESSID
-      php_admin_value[upload_max_filesize] = 200M
-      php_admin_value[post_max_size] = 200M
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "RainloopPHPSESSID";
+      "php_admin_value[upload_max_filesize]" = "200M";
+      "php_admin_value[post_max_size]" = "200M";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/mail/roundcubemail.nix b/modules/private/websites/tools/mail/roundcubemail.nix
index 35de312..0b35d02 100644
--- a/modules/private/websites/tools/mail/roundcubemail.nix
+++ b/modules/private/websites/tools/mail/roundcubemail.nix
@@ -83,7 +83,7 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_roundcubemail";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
     Alias /roundcube "${root}"
     <Directory "${root}">
         DirectoryIndex index.php
@@ -92,7 +92,7 @@ rec {
         Require all granted
 
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
       </Directory>
       '';
@@ -107,22 +107,19 @@ rec {
       date.timezone = 'CET'
       extension=${phpPackages.imagick}/lib/php/extensions/imagick.so
       '';
-    socket = "/var/run/phpfpm/roundcubemail.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = RoundcubemailPHPSESSID
-      php_admin_value[upload_max_filesize] = 200M
-      php_admin_value[post_max_size] = 200M
-      php_admin_value[open_basedir] = "${basedir}:${apacheHttpd}/conf/mime.types:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "RoundcubemailPHPSESSID";
+      "php_admin_value[upload_max_filesize]" = "200M";
+      "php_admin_value[post_max_size]" = "200M";
+      "php_admin_value[open_basedir]" = "${basedir}:${apacheHttpd}/conf/mime.types:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/adminer.nix b/modules/private/websites/tools/tools/adminer.nix
index 907e37f..52a132c 100644
--- a/modules/private/websites/tools/tools/adminer.nix
+++ b/modules/private/websites/tools/tools/adminer.nix
@@ -1,4 +1,4 @@
-{ adminer }:
+{ adminer, php73, forcePhpSocket ? null }:
 rec {
   activationScript = {
     deps = [ "httpd" ];
@@ -9,22 +9,33 @@ rec {
   };
   webRoot = adminer;
   phpFpm = rec {
-    socket = "/var/run/phpfpm/adminer.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 5
-      pm.process_idle_timeout = 60
-      ;php_admin_flag[log_errors] = on
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = AdminerPHPSESSID
-      php_admin_value[open_basedir] = "${webRoot}:/tmp:/var/lib/php/sessions/adminer:/var/lib/php/tmp/adminer"
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/adminer"
-      php_admin_value[upload_tmp_dir] = "/var/lib/php/tmp/adminer"
-      '';
+    user = apache.user;
+    group = apache.group;
+    phpPackage = (php73.override {
+      config.php.mysqlnd = true;
+      config.php.mysqli = false;
+      config.php.pdo-mysql = false;
+    }).overrideAttrs(old: rec {
+      configureFlags = old.configureFlags ++ [
+        "--with-mysqli=shared,mysqlnd"
+        ];
+    });
+    phpOptions = ''
+      extension=${phpPackage}/lib/php/extensions/mysqli.so
+    '';
+    settings = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "5";
+      "pm.process_idle_timeout" = "60";
+      #"php_admin_flag[log_errors]" = "on";
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "AdminerPHPSESSID";
+      "php_admin_value[open_basedir]" = "${webRoot}:/tmp:/var/lib/php/sessions/adminer:/var/lib/php/tmp/adminer";
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/adminer";
+      "php_admin_value[upload_tmp_dir]" = "/var/lib/php/tmp/adminer";
+    };
   };
   apache = rec {
     user = "wwwrun";
@@ -32,12 +43,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "_adminer";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /adminer ${root}
       <Directory ${root}>
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${if forcePhpSocket != null then forcePhpSocket else socket}|fcgi://localhost"
         </FilesMatch>
 
         Use LDAPConnect
diff --git a/modules/private/websites/tools/tools/default.nix b/modules/private/websites/tools/tools/default.nix
index 5dc0981..5e0d446 100644
--- a/modules/private/websites/tools/tools/default.nix
+++ b/modules/private/websites/tools/tools/default.nix
@@ -40,6 +40,7 @@ let
   };
 
   cfg = config.myServices.websites.tools.tools;
+  pcfg = config.services.phpfpm.pools;
 in {
   options.myServices.websites.tools.tools = {
     enable = lib.mkEnableOption "enable tools website";
@@ -92,7 +93,7 @@ in {
             AllowOverride all
             Require all granted
             <FilesMatch "\.php$">
-              SetHandler "proxy:unix:/var/run/phpfpm/devtools.sock|fcgi://localhost"
+              SetHandler "proxy:unix:${pcfg.devtools.socket}|fcgi://localhost"
             </FilesMatch>
           </Directory>
           ''
@@ -115,21 +116,21 @@ in {
             AllowOverride all
             Require all granted
             <FilesMatch "\.php$">
-              SetHandler "proxy:unix:/var/run/phpfpm/tools.sock|fcgi://localhost"
+              SetHandler "proxy:unix:${pcfg.tools.socket}|fcgi://localhost"
             </FilesMatch>
           </Directory>
           ''
-        adminer.apache.vhostConf
+        (adminer.apache.vhostConf pcfg.adminer.socket)
         ympd.apache.vhostConf
-        ttrss.apache.vhostConf
-        wallabag.apache.vhostConf
-        yourls.apache.vhostConf
-        rompr.apache.vhostConf
-        shaarli.apache.vhostConf
-        dokuwiki.apache.vhostConf
-        ldap.apache.vhostConf
-        kanboard.apache.vhostConf
-        grocy.apache.vhostConf
+        (ttrss.apache.vhostConf pcfg.ttrss.socket)
+        (wallabag.apache.vhostConf pcfg.wallabag.socket)
+        (yourls.apache.vhostConf pcfg.yourls.socket)
+        (rompr.apache.vhostConf pcfg.rompr.socket)
+        (shaarli.apache.vhostConf pcfg.shaarli.socket)
+        (dokuwiki.apache.vhostConf pcfg.dokuwiki.socket)
+        (ldap.apache.vhostConf pcfg.ldap.socket)
+        (kanboard.apache.vhostConf pcfg.kanboard.socket)
+        (grocy.apache.vhostConf pcfg.grocy.socket)
       ];
     };
 
@@ -226,38 +227,36 @@ in {
 
     services.phpfpm.pools = {
       tools = {
-        listen = "/var/run/phpfpm/tools.sock";
-        extraConfig = ''
-          user = wwwrun
-          group = wwwrun
-          listen.owner = wwwrun
-          listen.group = wwwrun
-          pm = dynamic
-          pm.max_children = 60
-          pm.start_servers = 2
-          pm.min_spare_servers = 1
-          pm.max_spare_servers = 10
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = {
+          "listen.owner" = "wwwrun";
+          "listen.group" = "wwwrun";
+          "pm" = "dynamic";
+          "pm.max_children" = "60";
+          "pm.start_servers" = "2";
+          "pm.min_spare_servers" = "1";
+          "pm.max_spare_servers" = "10";
 
-          ; Needed to avoid clashes in browser cookies (same domain)
-          php_value[session.name] = ToolsPHPSESSID
-          php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/tools.immae.eu:/tmp"
-          '';
+          # Needed to avoid clashes in browser cookies (same domain)
+          "php_value[session.name]" = "ToolsPHPSESSID";
+          "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:/var/lib/ftp/tools.immae.eu:/tmp";
+        };
       };
       devtools = {
-        listen = "/var/run/phpfpm/devtools.sock";
-        extraConfig = ''
-          user = wwwrun
-          group = wwwrun
-          listen.owner = wwwrun
-          listen.group = wwwrun
-          pm = dynamic
-          pm.max_children = 60
-          pm.start_servers = 2
-          pm.min_spare_servers = 1
-          pm.max_spare_servers = 10
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = {
+          "listen.owner" = "wwwrun";
+          "listen.group" = "wwwrun";
+          "pm" = "dynamic";
+          "pm.max_children" = "60";
+          "pm.start_servers" = "2";
+          "pm.min_spare_servers" = "1";
+          "pm.max_spare_servers" = "10";
 
-          php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp"
-          '';
+          "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:/var/lib/ftp/devtools.immae.eu:/tmp";
+        };
         phpOptions = config.services.phpfpm.phpOptions + ''
           extension=${pkgs.php}/lib/php/extensions/mysqli.so
           extension=${pkgs.phpPackages.redis}/lib/php/extensions/redis.so
@@ -265,45 +264,51 @@ in {
           zend_extension=${pkgs.php}/lib/php/extensions/opcache.so
           '';
       };
-      adminer = {
-        listen = adminer.phpFpm.socket;
-        extraConfig = adminer.phpFpm.pool;
-      };
+      adminer = adminer.phpFpm;
       ttrss = {
-        listen = ttrss.phpFpm.socket;
-        extraConfig = ttrss.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = ttrss.phpFpm.pool;
       };
       wallabag = {
-        listen = wallabag.phpFpm.socket;
-        extraConfig = wallabag.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = wallabag.phpFpm.pool;
       };
       yourls = {
-        listen = yourls.phpFpm.socket;
-        extraConfig = yourls.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = yourls.phpFpm.pool;
       };
       rompr = {
-        listen = rompr.phpFpm.socket;
-        extraConfig = rompr.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = rompr.phpFpm.pool;
       };
       shaarli = {
-        listen = shaarli.phpFpm.socket;
-        extraConfig = shaarli.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = shaarli.phpFpm.pool;
       };
       dokuwiki = {
-        listen = dokuwiki.phpFpm.socket;
-        extraConfig = dokuwiki.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = dokuwiki.phpFpm.pool;
       };
       ldap = {
-        listen = ldap.phpFpm.socket;
-        extraConfig = ldap.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = ldap.phpFpm.pool;
       };
       kanboard = {
-        listen = kanboard.phpFpm.socket;
-        extraConfig = kanboard.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = kanboard.phpFpm.pool;
       };
       grocy = {
-        listen = grocy.phpFpm.socket;
-        extraConfig = grocy.phpFpm.pool;
+        user = "wwwrun";
+        group = "wwwrun";
+        settings = grocy.phpFpm.pool;
       };
     };
 
diff --git a/modules/private/websites/tools/tools/dokuwiki.nix b/modules/private/websites/tools/tools/dokuwiki.nix
index d66e85d..26c04b7 100644
--- a/modules/private/websites/tools/tools/dokuwiki.nix
+++ b/modules/private/websites/tools/tools/dokuwiki.nix
@@ -26,12 +26,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_dokuwiki";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /dokuwiki "${root}"
       <Directory "${root}">
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride All
@@ -44,20 +44,17 @@ rec {
     serviceDeps = [ "openldap.service" ];
     basedir = builtins.concatStringsSep ":" (
       [ webRoot varDir ] ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/dokuwiki.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = DokuwikiPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "DokuwikiPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/grocy.nix b/modules/private/websites/tools/tools/grocy.nix
index 1b8da20..a98d8ac 100644
--- a/modules/private/websites/tools/tools/grocy.nix
+++ b/modules/private/websites/tools/tools/grocy.nix
@@ -18,12 +18,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_grocy";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /grocy "${root}"
       <Directory "${root}">
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride All
@@ -35,21 +35,18 @@ rec {
   phpFpm = rec {
     basedir = builtins.concatStringsSep ":" (
       [ grocy grocy.yarnModules varDir ]);
-    socket = "/var/run/phpfpm/grocy.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = grocyPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "grocyPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
 
diff --git a/modules/private/websites/tools/tools/kanboard.nix b/modules/private/websites/tools/tools/kanboard.nix
index 1880cbd..0f6fefc 100644
--- a/modules/private/websites/tools/tools/kanboard.nix
+++ b/modules/private/websites/tools/tools/kanboard.nix
@@ -49,7 +49,7 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_kanboard";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
     Alias /kanboard "${root}"
     <Directory "${root}">
       DirectoryIndex index.php
@@ -58,7 +58,7 @@ rec {
       Require all granted
 
       <FilesMatch "\.php$">
-        SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+        SetHandler "proxy:unix:${socket}|fcgi://localhost"
       </FilesMatch>
     </Directory>
     <DirectoryMatch "${root}/data">
@@ -69,20 +69,17 @@ rec {
   phpFpm = rec {
     serviceDeps = [ "postgresql.service" "openldap.service" ];
     basedir = builtins.concatStringsSep ":" [ webRoot varDir "/var/secrets/webapps/tools-kanboard" ];
-    socket = "/var/run/phpfpm/kanboard.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = KanboardPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "KanboardPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/ldap.nix b/modules/private/websites/tools/tools/ldap.nix
index e58a9bd..0c1a21f 100644
--- a/modules/private/websites/tools/tools/ldap.nix
+++ b/modules/private/websites/tools/tools/ldap.nix
@@ -39,12 +39,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_ldap";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /ldap "${root}"
       <Directory "${root}">
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride None
@@ -55,20 +55,17 @@ rec {
   phpFpm = rec {
     serviceDeps = [ "openldap.service" ];
     basedir = builtins.concatStringsSep ":" [ webRoot "/var/secrets/webapps/tools-ldap" ];
-    socket = "/var/run/phpfpm/ldap.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = LdapPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/phpldapadmin"
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/phpldapadmin"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "LdapPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/phpldapadmin";
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/phpldapadmin";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/rompr.nix b/modules/private/websites/tools/tools/rompr.nix
index 75adabe..106164c 100644
--- a/modules/private/websites/tools/tools/rompr.nix
+++ b/modules/private/websites/tools/tools/rompr.nix
@@ -15,7 +15,7 @@ rec {
     modules = [ "headers" "mime" "proxy_fcgi" ];
     webappName = "tools_rompr";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /rompr ${root}
 
       <Directory ${root}>
@@ -29,7 +29,7 @@ rec {
         AddType image/x-icon .ico
 
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
       </Directory>
 
@@ -51,29 +51,26 @@ rec {
   };
   phpFpm = rec {
     basedir = builtins.concatStringsSep ":" [ webRoot varDir ];
-    socket = "/var/run/phpfpm/rompr.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = RomprPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      php_flag[magic_quotes_gpc] = Off
-      php_flag[track_vars] = On
-      php_flag[register_globals] = Off
-      php_admin_flag[allow_url_fopen] = On
-      php_value[include_path] = ${webRoot}
-      php_admin_value[upload_tmp_dir] = "${varDir}/prefs"
-      php_admin_value[post_max_size] = 32M
-      php_admin_value[upload_max_filesize] = 32M
-      php_admin_value[memory_limit] = 256M
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "RomprPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+      "php_flag[magic_quotes_gpc]" = "Off";
+      "php_flag[track_vars]" = "On";
+      "php_flag[register_globals]" = "Off";
+      "php_admin_flag[allow_url_fopen]" = "On";
+      "php_value[include_path]" = "${webRoot}";
+      "php_admin_value[upload_tmp_dir]" = "${varDir}/prefs";
+      "php_admin_value[post_max_size]" = "32M";
+      "php_admin_value[upload_max_filesize]" = "32M";
+      "php_admin_value[memory_limit]" = "256M";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/shaarli.nix b/modules/private/websites/tools/tools/shaarli.nix
index 0a75755..950d296 100644
--- a/modules/private/websites/tools/tools/shaarli.nix
+++ b/modules/private/websites/tools/tools/shaarli.nix
@@ -17,7 +17,7 @@ in rec {
     modules =  [ "proxy_fcgi" "rewrite" "env" ];
     webappName = "tools_shaarli";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /Shaarli "${root}"
 
       Include /var/secrets/webapps/tools-shaarli
@@ -27,7 +27,7 @@ in rec {
         AllowOverride All
         Require all granted
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
       </Directory>
       '';
@@ -48,20 +48,17 @@ in rec {
   phpFpm = rec {
     serviceDeps = [ "openldap.service" ];
     basedir = builtins.concatStringsSep ":" [ webRoot varDir ];
-    socket = "/var/run/phpfpm/shaarli.sock";
-    pool = ''
-        user = ${apache.user}
-        group = ${apache.group}
-        listen.owner = ${apache.user}
-        listen.group = ${apache.group}
-        pm = ondemand
-        pm.max_children = 60
-        pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-        ; Needed to avoid clashes in browser cookies (same domain)
-        php_value[session.name] = ShaarliPHPSESSID
-        php_admin_value[open_basedir] = "${basedir}:/tmp"
-        php_admin_value[session.save_path] = "${varDir}/phpSessions"
-    '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "ShaarliPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/ttrss.nix b/modules/private/websites/tools/tools/ttrss.nix
index a8b2a93..48876d3 100644
--- a/modules/private/websites/tools/tools/ttrss.nix
+++ b/modules/private/websites/tools/tools/ttrss.nix
@@ -95,12 +95,12 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_ttrss";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /ttrss "${root}"
       <Directory "${root}">
         DirectoryIndex index.php
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride All
@@ -114,20 +114,17 @@ rec {
     basedir = builtins.concatStringsSep ":" (
       [ webRoot "/var/secrets/webapps/tools-ttrss" varDir ]
       ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/ttrss.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
-
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = TtrssPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp"
-      php_admin_value[session.save_path] = "${varDir}/phpSessions"
-      '';
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
+
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "TtrssPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp";
+      "php_admin_value[session.save_path]" = "${varDir}/phpSessions";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/wallabag.nix b/modules/private/websites/tools/tools/wallabag.nix
index 014d8a1..00e2dc9 100644
--- a/modules/private/websites/tools/tools/wallabag.nix
+++ b/modules/private/websites/tools/tools/wallabag.nix
@@ -82,7 +82,7 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_wallabag";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /wallabag "${root}"
       <Directory "${root}">
         AllowOverride None
@@ -91,7 +91,7 @@ rec {
         CGIPassAuth On
 
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         <IfModule mod_rewrite.c>
@@ -129,22 +129,19 @@ rec {
     '';
     serviceDeps = [ "postgresql.service" "openldap.service" ];
     basedir = builtins.concatStringsSep ":" [ webappDir "/var/secrets/webapps/tools-wallabag" varDir ];
-    socket = "/var/run/phpfpm/wallabag.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = dynamic
-      pm.max_children = 60
-      pm.start_servers = 2
-      pm.min_spare_servers = 1
-      pm.max_spare_servers = 10
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "dynamic";
+      "pm.max_children" = "60";
+      "pm.start_servers" = "2";
+      "pm.min_spare_servers" = "1";
+      "pm.max_spare_servers" = "10";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = WallabagPHPSESSID
-      php_admin_value[open_basedir] = "/run/wrappers/bin/sendmail:${basedir}:/tmp"
-      php_value[max_execution_time] = 300
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "WallabagPHPSESSID";
+      "php_admin_value[open_basedir]" = "/run/wrappers/bin/sendmail:${basedir}:/tmp";
+      "php_value[max_execution_time]" = "300";
+    };
   };
 }
diff --git a/modules/private/websites/tools/tools/yourls.nix b/modules/private/websites/tools/tools/yourls.nix
index 466ceae..cb03b6c 100644
--- a/modules/private/websites/tools/tools/yourls.nix
+++ b/modules/private/websites/tools/tools/yourls.nix
@@ -48,11 +48,11 @@ rec {
     modules = [ "proxy_fcgi" ];
     webappName = "tools_yourls";
     root = "/run/current-system/webapps/${webappName}";
-    vhostConf = ''
+    vhostConf = socket: ''
       Alias /url "${root}"
       <Directory "${root}">
         <FilesMatch "\.php$">
-          SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
+          SetHandler "proxy:unix:${socket}|fcgi://localhost"
         </FilesMatch>
 
         AllowOverride None
@@ -73,20 +73,17 @@ rec {
     basedir = builtins.concatStringsSep ":" (
       [ webRoot "/var/secrets/webapps/tools-yourls" ]
       ++ webRoot.plugins);
-    socket = "/var/run/phpfpm/yourls.sock";
-    pool = ''
-      user = ${apache.user}
-      group = ${apache.group}
-      listen.owner = ${apache.user}
-      listen.group = ${apache.group}
-      pm = ondemand
-      pm.max_children = 60
-      pm.process_idle_timeout = 60
+    pool = {
+      "listen.owner" = apache.user;
+      "listen.group" = apache.group;
+      "pm" = "ondemand";
+      "pm.max_children" = "60";
+      "pm.process_idle_timeout" = "60";
 
-      ; Needed to avoid clashes in browser cookies (same domain)
-      php_value[session.name] = YourlsPHPSESSID
-      php_admin_value[open_basedir] = "${basedir}:/tmp:/var/lib/php/sessions/yourls"
-      php_admin_value[session.save_path] = "/var/lib/php/sessions/yourls"
-      '';
+      # Needed to avoid clashes in browser cookies (same domain)
+      "php_value[session.name]" = "YourlsPHPSESSID";
+      "php_admin_value[open_basedir]" = "${basedir}:/tmp:/var/lib/php/sessions/yourls";
+      "php_admin_value[session.save_path]" = "/var/lib/php/sessions/yourls";
+    };
   };
 }