diff options
Diffstat (limited to 'modules')
-rw-r--r-- | modules/private/websites/aten/builder.nix | 100 | ||||
-rw-r--r-- | modules/private/websites/aten/integration.nix | 78 | ||||
-rw-r--r-- | modules/private/websites/aten/production.nix | 89 | ||||
-rw-r--r-- | modules/secrets.nix | 9 | ||||
-rw-r--r-- | modules/websites/default.nix | 19 | ||||
-rw-r--r-- | modules/websites/php-application.nix | 101 |
6 files changed, 229 insertions, 167 deletions
diff --git a/modules/private/websites/aten/builder.nix b/modules/private/websites/aten/builder.nix deleted file mode 100644 index 83a8f70..0000000 --- a/modules/private/websites/aten/builder.nix +++ /dev/null | |||
@@ -1,100 +0,0 @@ | |||
1 | { apacheUser, apacheGroup, aten, lib, mylibs, config }: rec { | ||
2 | app = aten.override { inherit (config) environment; }; | ||
3 | phpFpm = rec { | ||
4 | preStart = mylibs.phpFpmPreStart { | ||
5 | inherit app; | ||
6 | inherit (app) varDir; | ||
7 | keyFiles = [ | ||
8 | "/var/secrets/webapps/${app.environment}-aten" | ||
9 | ]; | ||
10 | actions = [ | ||
11 | "/run/wrappers/bin/sudo -u ${apacheUser} APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup" | ||
12 | ]; | ||
13 | }; | ||
14 | serviceDeps = [ "postgresql.service" ]; | ||
15 | socket = "/var/run/phpfpm/aten-${app.environment}.sock"; | ||
16 | pool = '' | ||
17 | listen = ${socket} | ||
18 | user = ${apacheUser} | ||
19 | group = ${apacheGroup} | ||
20 | listen.owner = ${apacheUser} | ||
21 | listen.group = ${apacheGroup} | ||
22 | php_admin_value[upload_max_filesize] = 20M | ||
23 | php_admin_value[post_max_size] = 20M | ||
24 | ;php_admin_flag[log_errors] = on | ||
25 | php_admin_value[open_basedir] = "${app}:${app.varDir}:/tmp" | ||
26 | php_admin_value[session.save_path] = "${app.varDir}/phpSessions" | ||
27 | ${if app.environment == "dev" then '' | ||
28 | pm = ondemand | ||
29 | pm.max_children = 5 | ||
30 | pm.process_idle_timeout = 60 | ||
31 | env[SYMFONY_DEBUG_MODE] = "yes" | ||
32 | '' else '' | ||
33 | pm = dynamic | ||
34 | pm.max_children = 20 | ||
35 | pm.start_servers = 2 | ||
36 | pm.min_spare_servers = 1 | ||
37 | pm.max_spare_servers = 3 | ||
38 | ''}''; | ||
39 | }; | ||
40 | keys = [{ | ||
41 | dest = "webapps/${app.environment}-aten"; | ||
42 | user = apacheUser; | ||
43 | group = apacheGroup; | ||
44 | permissions = "0400"; | ||
45 | text = '' | ||
46 | SetEnv APP_ENV "${app.environment}" | ||
47 | SetEnv APP_SECRET "${config.secret}" | ||
48 | SetEnv DATABASE_URL "${config.psql_url}" | ||
49 | ''; | ||
50 | }]; | ||
51 | apache = rec { | ||
52 | modules = [ "proxy_fcgi" ]; | ||
53 | webappName = "aten_${app.environment}"; | ||
54 | root = "/run/current-system/webapps/${webappName}"; | ||
55 | vhostConf = '' | ||
56 | <FilesMatch "\.php$"> | ||
57 | SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost" | ||
58 | </FilesMatch> | ||
59 | |||
60 | Include /var/secrets/webapps/${app.environment}-aten | ||
61 | |||
62 | ${if app.environment == "dev" then '' | ||
63 | <Location /> | ||
64 | Use LDAPConnect | ||
65 | Require ldap-group cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu | ||
66 | ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>" | ||
67 | </Location> | ||
68 | |||
69 | <Location /backend> | ||
70 | Use LDAPConnect | ||
71 | Require ldap-group cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu | ||
72 | ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>" | ||
73 | </Location> | ||
74 | '' else '' | ||
75 | Use Stats aten.pro | ||
76 | |||
77 | <Location /backend> | ||
78 | Use LDAPConnect | ||
79 | Require ldap-group cn=aten.pro,cn=httpd,ou=services,dc=immae,dc=eu | ||
80 | ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>" | ||
81 | </Location> | ||
82 | ''} | ||
83 | |||
84 | <Directory ${root}> | ||
85 | Options Indexes FollowSymLinks MultiViews Includes | ||
86 | AllowOverride All | ||
87 | Require all granted | ||
88 | DirectoryIndex index.php | ||
89 | FallbackResource /index.php | ||
90 | </Directory> | ||
91 | ''; | ||
92 | }; | ||
93 | activationScript = { | ||
94 | deps = [ "wrappers" ]; | ||
95 | text = '' | ||
96 | install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} | ||
97 | install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions | ||
98 | ''; | ||
99 | }; | ||
100 | } | ||
diff --git a/modules/private/websites/aten/integration.nix b/modules/private/websites/aten/integration.nix index 0dbc4fa..38068a7 100644 --- a/modules/private/websites/aten/integration.nix +++ b/modules/private/websites/aten/integration.nix | |||
@@ -1,43 +1,83 @@ | |||
1 | { lib, pkgs, config, myconfig, ... }: | 1 | { lib, pkgs, config, myconfig, ... }: |
2 | let | 2 | let |
3 | aten = pkgs.callPackage ./builder.nix { | 3 | secrets = myconfig.env.websites.aten.integration; |
4 | inherit (pkgs.webapps) aten; | 4 | app = pkgs.webapps.aten.override { environment = secrets.environment; }; |
5 | config = myconfig.env.websites.aten.integration; | ||
6 | apacheUser = config.services.httpd.Inte.user; | ||
7 | apacheGroup = config.services.httpd.Inte.group; | ||
8 | }; | ||
9 | |||
10 | cfg = config.myServices.websites.aten.integration; | 5 | cfg = config.myServices.websites.aten.integration; |
6 | pcfg = config.services.phpApplication; | ||
11 | in { | 7 | in { |
12 | options.myServices.websites.aten.integration.enable = lib.mkEnableOption "enable Aten's website in integration"; | 8 | options.myServices.websites.aten.integration.enable = lib.mkEnableOption "enable Aten's website in integration"; |
13 | 9 | ||
14 | config = lib.mkIf cfg.enable { | 10 | config = lib.mkIf cfg.enable { |
15 | services.phpApplication.aten_dev = let | 11 | services.phpApplication.apps.aten_dev = { |
16 | app = pkgs.webapps.aten.override { environment = "dev"; }; | ||
17 | in { | ||
18 | websiteEnv = "integration"; | 12 | websiteEnv = "integration"; |
19 | httpdUser = config.services.httpd.Inte.user; | 13 | httpdUser = config.services.httpd.Inte.user; |
20 | httpdGroup = config.services.httpd.Inte.group; | 14 | httpdGroup = config.services.httpd.Inte.group; |
15 | httpdWatchFiles = [ | ||
16 | config.secrets.fullPaths."webapps/${app.environment}-aten" | ||
17 | ]; | ||
21 | inherit (app) webRoot varDir; | 18 | inherit (app) webRoot varDir; |
22 | inherit app; | 19 | inherit app; |
23 | serviceDeps = [ "postgresql.service" ]; | 20 | serviceDeps = [ "postgresql.service" ]; |
24 | preStartActions = [ | 21 | preStartActions = [ |
25 | "APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup" | 22 | "APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup" |
26 | ]; | 23 | ]; |
27 | watchFiles = [ | 24 | phpOpenbasedir = [ "/tmp" ]; |
28 | "${config.secrets.location}/webapps/${app.environment}-aten" | 25 | phpPool = '' |
29 | ]; | 26 | php_admin_value[upload_max_filesize] = 20M |
30 | webappName = "aten_dev"; | 27 | php_admin_value[post_max_size] = 20M |
28 | ;php_admin_flag[log_errors] = on | ||
29 | pm = ondemand | ||
30 | pm.max_children = 5 | ||
31 | pm.process_idle_timeout = 60 | ||
32 | env[SYMFONY_DEBUG_MODE] = "yes" | ||
33 | ''; | ||
31 | }; | 34 | }; |
32 | 35 | ||
33 | secrets.keys = aten.keys; | 36 | secrets.keys = [{ |
34 | services.phpfpm.poolConfigs.aten_dev = aten.phpFpm.pool; | 37 | dest = "webapps/${app.environment}-aten"; |
35 | services.websites.env.integration.vhostConfs.aten = { | 38 | user = config.services.httpd.Inte.user; |
39 | group = config.services.httpd.Inte.user; | ||
40 | permissions = "0400"; | ||
41 | text = '' | ||
42 | SetEnv APP_ENV "${app.environment}" | ||
43 | SetEnv APP_SECRET "${secrets.secret}" | ||
44 | SetEnv DATABASE_URL "${secrets.psql_url}" | ||
45 | ''; | ||
46 | }]; | ||
47 | services.websites.env.integration.vhostConfs.aten_dev = { | ||
36 | certName = "eldiron"; | 48 | certName = "eldiron"; |
37 | addToCerts = true; | 49 | addToCerts = true; |
38 | hosts = [ "dev.aten.pro" ]; | 50 | hosts = [ "dev.aten.pro" ]; |
39 | root = aten.apache.root; | 51 | root = pcfg.webappDirs.aten_dev; |
40 | extraConfig = [ aten.apache.vhostConf ]; | 52 | extraConfig = [ |
53 | '' | ||
54 | <FilesMatch "\.php$"> | ||
55 | SetHandler "proxy:unix:${pcfg.phpListenPaths.aten_dev}|fcgi://localhost" | ||
56 | </FilesMatch> | ||
57 | |||
58 | Include ${config.secrets.fullPaths."webapps/${app.environment}-aten"} | ||
59 | |||
60 | <Location /> | ||
61 | Use LDAPConnect | ||
62 | Require ldap-group cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu | ||
63 | ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>" | ||
64 | </Location> | ||
65 | |||
66 | <Location /backend> | ||
67 | Use LDAPConnect | ||
68 | Require ldap-group cn=dev.aten.pro,cn=httpd,ou=services,dc=immae,dc=eu | ||
69 | ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>" | ||
70 | </Location> | ||
71 | |||
72 | <Directory ${pcfg.webappDirs.aten_dev}> | ||
73 | Options Indexes FollowSymLinks MultiViews Includes | ||
74 | AllowOverride All | ||
75 | Require all granted | ||
76 | DirectoryIndex index.php | ||
77 | FallbackResource /index.php | ||
78 | </Directory> | ||
79 | '' | ||
80 | ]; | ||
41 | }; | 81 | }; |
42 | }; | 82 | }; |
43 | } | 83 | } |
diff --git a/modules/private/websites/aten/production.nix b/modules/private/websites/aten/production.nix index 0fab309..21ecdcf 100644 --- a/modules/private/websites/aten/production.nix +++ b/modules/private/websites/aten/production.nix | |||
@@ -1,36 +1,81 @@ | |||
1 | { lib, pkgs, config, myconfig, ... }: | 1 | { lib, pkgs, config, myconfig, ... }: |
2 | let | 2 | let |
3 | aten = pkgs.callPackage ./builder.nix { | 3 | secrets = myconfig.env.websites.aten.production; |
4 | inherit (pkgs.webapps) aten; | 4 | app = pkgs.webapps.aten.override { environment = secrets.environment; }; |
5 | config = myconfig.env.websites.aten.production; | ||
6 | apacheUser = config.services.httpd.Prod.user; | ||
7 | apacheGroup = config.services.httpd.Prod.group; | ||
8 | }; | ||
9 | |||
10 | cfg = config.myServices.websites.aten.production; | 5 | cfg = config.myServices.websites.aten.production; |
6 | pcfg = config.services.phpApplication; | ||
11 | in { | 7 | in { |
12 | options.myServices.websites.aten.production.enable = lib.mkEnableOption "enable Aten's website in production"; | 8 | options.myServices.websites.aten.production.enable = lib.mkEnableOption "enable Aten's website in production"; |
13 | 9 | ||
14 | config = lib.mkIf cfg.enable { | 10 | config = lib.mkIf cfg.enable { |
15 | secrets.keys = aten.keys; | ||
16 | services.webstats.sites = [ { name = "aten.pro"; } ]; | 11 | services.webstats.sites = [ { name = "aten.pro"; } ]; |
12 | services.phpApplication.apps.aten_prod = { | ||
13 | websiteEnv = "production"; | ||
14 | httpdUser = config.services.httpd.Prod.user; | ||
15 | httpdGroup = config.services.httpd.Prod.group; | ||
16 | httpdWatchFiles = [ | ||
17 | config.secrets.fullPaths."webapps/${app.environment}-aten" | ||
18 | ]; | ||
19 | inherit (app) webRoot varDir; | ||
20 | inherit app; | ||
21 | serviceDeps = [ "postgresql.service" ]; | ||
22 | preStartActions = [ | ||
23 | "APP_ENV=${app.environment} ./bin/console --env=${app.environment} cache:clear --no-warmup" | ||
24 | ]; | ||
25 | phpOpenbasedir = [ "/tmp" ]; | ||
26 | phpPool = '' | ||
27 | php_admin_value[upload_max_filesize] = 20M | ||
28 | php_admin_value[post_max_size] = 20M | ||
29 | ;php_admin_flag[log_errors] = on | ||
30 | pm = dynamic | ||
31 | pm.max_children = 20 | ||
32 | pm.start_servers = 2 | ||
33 | pm.min_spare_servers = 1 | ||
34 | pm.max_spare_servers = 3 | ||
35 | ''; | ||
36 | }; | ||
17 | 37 | ||
18 | systemd.services.phpfpm-aten_prod.preStart = lib.mkAfter aten.phpFpm.preStart; | 38 | secrets.keys = [{ |
19 | systemd.services.phpfpm-aten_prod.after = lib.mkAfter aten.phpFpm.serviceDeps; | 39 | dest = "webapps/${app.environment}-aten"; |
20 | systemd.services.phpfpm-aten_prod.wants = aten.phpFpm.serviceDeps; | 40 | user = config.services.httpd.Prod.user; |
21 | services.phpfpm.poolConfigs.aten_prod = aten.phpFpm.pool; | 41 | group = config.services.httpd.Prod.user; |
22 | system.activationScripts.aten_prod = aten.activationScript; | 42 | permissions = "0400"; |
23 | myServices.websites.webappDirs."${aten.apache.webappName}" = aten.app.webRoot; | 43 | text = '' |
24 | services.websites.env.production.modules = aten.apache.modules; | 44 | SetEnv APP_ENV "${app.environment}" |
25 | services.websites.env.production.vhostConfs.aten = { | 45 | SetEnv APP_SECRET "${secrets.secret}" |
46 | SetEnv DATABASE_URL "${secrets.psql_url}" | ||
47 | ''; | ||
48 | }]; | ||
49 | services.websites.env.production.vhostConfs.aten_prod = { | ||
26 | certName = "aten"; | 50 | certName = "aten"; |
27 | certMainHost = "aten.pro"; | 51 | certMainHost = "aten.pro"; |
28 | hosts = [ "aten.pro" "www.aten.pro" ]; | 52 | hosts = [ "aten.pro" "www.aten.pro" ]; |
29 | root = aten.apache.root; | 53 | root = pcfg.webappDirs.aten_prod; |
30 | extraConfig = [ aten.apache.vhostConf ]; | 54 | extraConfig = [ |
55 | '' | ||
56 | <FilesMatch "\.php$"> | ||
57 | SetHandler "proxy:unix:${pcfg.phpListenPaths.aten_prod}|fcgi://localhost" | ||
58 | </FilesMatch> | ||
59 | |||
60 | Include ${config.secrets.fullPaths."webapps/${app.environment}-aten"} | ||
61 | |||
62 | Use Stats aten.pro | ||
63 | |||
64 | <Location /backend> | ||
65 | Use LDAPConnect | ||
66 | Require ldap-group cn=aten.pro,cn=httpd,ou=services,dc=immae,dc=eu | ||
67 | ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://aten.pro\"></html>" | ||
68 | </Location> | ||
69 | |||
70 | <Directory ${pcfg.webappDirs.aten_prod}> | ||
71 | Options Indexes FollowSymLinks MultiViews Includes | ||
72 | AllowOverride All | ||
73 | Require all granted | ||
74 | DirectoryIndex index.php | ||
75 | FallbackResource /index.php | ||
76 | </Directory> | ||
77 | '' | ||
78 | ]; | ||
31 | }; | 79 | }; |
32 | services.websites.env.production.watchPaths = [ | ||
33 | "/var/secrets/webapps/${aten.app.environment}-aten" | ||
34 | ]; | ||
35 | }; | 80 | }; |
36 | } | 81 | } |
diff --git a/modules/secrets.nix b/modules/secrets.nix index 808b15c..a2424e9 100644 --- a/modules/secrets.nix +++ b/modules/secrets.nix | |||
@@ -11,7 +11,16 @@ | |||
11 | default = "/var/secrets"; | 11 | default = "/var/secrets"; |
12 | description = "Location where to put the keys"; | 12 | description = "Location where to put the keys"; |
13 | }; | 13 | }; |
14 | # Read-only variables | ||
15 | fullPaths = lib.mkOption { | ||
16 | type = lib.types.attrsOf lib.types.path; | ||
17 | default = builtins.listToAttrs | ||
18 | (map (v: { name = v.dest; value = "${config.secrets.location}/${v.dest}"; }) config.secrets.keys); | ||
19 | readOnly = true; | ||
20 | description = "set of full paths to secrets"; | ||
21 | }; | ||
14 | }; | 22 | }; |
23 | |||
15 | config = let | 24 | config = let |
16 | location = config.secrets.location; | 25 | location = config.secrets.location; |
17 | keys = config.secrets.keys; | 26 | keys = config.secrets.keys; |
diff --git a/modules/websites/default.nix b/modules/websites/default.nix index ef79cb3..043fc6e 100644 --- a/modules/websites/default.nix +++ b/modules/websites/default.nix | |||
@@ -23,14 +23,6 @@ in | |||
23 | Name of the webapp dir to create in /run/current-system | 23 | Name of the webapp dir to create in /run/current-system |
24 | ''; | 24 | ''; |
25 | }; | 25 | }; |
26 | webappDirsPath = mkOption { | ||
27 | type = str; | ||
28 | readOnly = true; | ||
29 | description = '' | ||
30 | Full path of the webapp dir | ||
31 | ''; | ||
32 | default = "/run/current-system/${cfg.webappDirsName}"; | ||
33 | }; | ||
34 | env = mkOption { | 26 | env = mkOption { |
35 | default = {}; | 27 | default = {}; |
36 | description = "Each type of website to enable will target a distinct httpd server"; | 28 | description = "Each type of website to enable will target a distinct httpd server"; |
@@ -126,6 +118,17 @@ in | |||
126 | }; | 118 | }; |
127 | }); | 119 | }); |
128 | }; | 120 | }; |
121 | # Readonly variables | ||
122 | webappDirsPaths = mkOption { | ||
123 | type = attrsOf path; | ||
124 | readOnly = true; | ||
125 | description = '' | ||
126 | Full paths of the webapp dir | ||
127 | ''; | ||
128 | default = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair | ||
129 | name "/run/current-system/${cfg.webappDirsName}/${name}" | ||
130 | ) cfg.webappDirs; | ||
131 | }; | ||
129 | }; | 132 | }; |
130 | 133 | ||
131 | config.services.httpd = let | 134 | config.services.httpd = let |
diff --git a/modules/websites/php-application.nix b/modules/websites/php-application.nix index 765d406..1bc4872 100644 --- a/modules/websites/php-application.nix +++ b/modules/websites/php-application.nix | |||
@@ -2,11 +2,11 @@ | |||
2 | with lib; | 2 | with lib; |
3 | let | 3 | let |
4 | cfg = config.services.phpApplication; | 4 | cfg = config.services.phpApplication; |
5 | cfgByEnv = lists.groupBy (x: x.websiteEnv) (builtins.attrValues cfg); | 5 | cfgByEnv = lists.groupBy (x: x.websiteEnv) (builtins.attrValues cfg.apps); |
6 | in | 6 | in |
7 | { | 7 | { |
8 | options = { | 8 | options = with types; { |
9 | services.phpApplication = with types; mkOption { | 9 | services.phpApplication.apps = mkOption { |
10 | default = {}; | 10 | default = {}; |
11 | description = '' | 11 | description = '' |
12 | php applications to define | 12 | php applications to define |
@@ -31,6 +31,35 @@ in | |||
31 | default = true; | 31 | default = true; |
32 | description = "Handle phpsession files separately in vardir"; | 32 | description = "Handle phpsession files separately in vardir"; |
33 | }; | 33 | }; |
34 | phpListen = mkOption { | ||
35 | type = nullOr str; | ||
36 | default = null; | ||
37 | description = "Name of the socket to listen to. Defaults to app name if null"; | ||
38 | }; | ||
39 | phpPool = mkOption { | ||
40 | type = lines; | ||
41 | default = ""; | ||
42 | description = "Pool configuration to append"; | ||
43 | }; | ||
44 | phpOptions = mkOption { | ||
45 | type = lines; | ||
46 | default = ""; | ||
47 | description = "php configuration to append"; | ||
48 | }; | ||
49 | phpOpenbasedir = mkOption { | ||
50 | type = listOf path; | ||
51 | default = []; | ||
52 | description = '' | ||
53 | paths to add to php open_basedir configuration in addition to app and vardir | ||
54 | ''; | ||
55 | }; | ||
56 | phpWatchFiles = mkOption { | ||
57 | type = listOf path; | ||
58 | default = []; | ||
59 | description = '' | ||
60 | Path to other files to watch to trigger preStart scripts | ||
61 | ''; | ||
62 | }; | ||
34 | websiteEnv = mkOption { | 63 | websiteEnv = mkOption { |
35 | type = str; | 64 | type = str; |
36 | description = '' | 65 | description = '' |
@@ -51,6 +80,13 @@ in | |||
51 | httpd group to run the prestart scripts as. | 80 | httpd group to run the prestart scripts as. |
52 | ''; | 81 | ''; |
53 | }; | 82 | }; |
83 | httpdWatchFiles = mkOption { | ||
84 | type = listOf path; | ||
85 | default = []; | ||
86 | description = '' | ||
87 | Path to other files to watch to trigger httpd reload | ||
88 | ''; | ||
89 | }; | ||
54 | app = mkOption { | 90 | app = mkOption { |
55 | type = path; | 91 | type = path; |
56 | description = '' | 92 | description = '' |
@@ -59,6 +95,7 @@ in | |||
59 | }; | 95 | }; |
60 | webappName = mkOption { | 96 | webappName = mkOption { |
61 | type = nullOr str; | 97 | type = nullOr str; |
98 | default = null; | ||
62 | description = '' | 99 | description = '' |
63 | Alias name for the app, to be used in services.websites.webappDirs | 100 | Alias name for the app, to be used in services.websites.webappDirs |
64 | ''; | 101 | ''; |
@@ -84,29 +121,57 @@ in | |||
84 | List of systemd services this application depends on | 121 | List of systemd services this application depends on |
85 | ''; | 122 | ''; |
86 | }; | 123 | }; |
87 | watchFiles = mkOption { | ||
88 | type = listOf path; | ||
89 | default = []; | ||
90 | description = '' | ||
91 | Path to other files to watch to trigger preStart scripts | ||
92 | ''; | ||
93 | }; | ||
94 | }; | 124 | }; |
95 | }); | 125 | }); |
96 | }; | 126 | }; |
127 | # Read-only variables | ||
128 | services.phpApplication.phpListenPaths = mkOption { | ||
129 | type = attrsOf path; | ||
130 | default = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair | ||
131 | name "/run/phpfpm/${if icfg.phpListen == null then name else icfg.phpListen}.sock" | ||
132 | ) cfg.apps; | ||
133 | readOnly = true; | ||
134 | description = '' | ||
135 | Full paths to listen for php | ||
136 | ''; | ||
137 | }; | ||
138 | services.phpApplication.webappDirs = mkOption { | ||
139 | type = attrsOf path; | ||
140 | default = attrsets.filterAttrs (n: v: builtins.hasAttr n cfg.apps) config.services.websites.webappDirsPaths; | ||
141 | readOnly = true; | ||
142 | description = '' | ||
143 | Stable name webapp dirs for httpd | ||
144 | ''; | ||
145 | }; | ||
97 | }; | 146 | }; |
98 | 147 | ||
99 | config = { | 148 | config = { |
100 | services.websites.env = attrsets.mapAttrs' (name: cfgs: attrsets.nameValuePair | 149 | services.websites.env = attrsets.mapAttrs' (name: cfgs: attrsets.nameValuePair |
101 | name { | 150 | name { |
102 | modules = [ "proxy_fcgi" ]; | 151 | modules = [ "proxy_fcgi" ]; |
103 | watchPaths = builtins.concatLists (map (c: c.watchFiles) cfgs); | 152 | watchPaths = builtins.concatLists (map (c: c.httpdWatchFiles) cfgs); |
104 | } | 153 | } |
105 | ) cfgByEnv; | 154 | ) cfgByEnv; |
106 | 155 | ||
156 | services.phpfpm.pools = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair | ||
157 | name { | ||
158 | listen = cfg.phpListenPaths."${name}"; | ||
159 | extraConfig = '' | ||
160 | user = ${icfg.httpdUser} | ||
161 | group = ${icfg.httpdGroup} | ||
162 | listen.owner = ${icfg.httpdUser} | ||
163 | listen.group = ${icfg.httpdGroup} | ||
164 | ${optionalString (icfg.phpSession) '' | ||
165 | php_admin_value[session.save_path] = "${icfg.varDir}/phpSessions"''} | ||
166 | php_admin_value[open_basedir] = "${builtins.concatStringsSep ":" ([icfg.app icfg.varDir] ++ icfg.phpOpenbasedir)}" | ||
167 | '' + icfg.phpPool; | ||
168 | phpOptions = config.services.phpfpm.phpOptions + icfg.phpOptions; | ||
169 | } | ||
170 | ) cfg.apps; | ||
171 | |||
107 | services.websites.webappDirs = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair | 172 | services.websites.webappDirs = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair |
108 | icfg.webappName icfg.webRoot | 173 | (if icfg.webappName == null then name else icfg.webappName) icfg.webRoot |
109 | ) (attrsets.filterAttrs (n: v: !isNull v.webappName && !isNull v.webRoot) cfg); | 174 | ) (attrsets.filterAttrs (n: v: !isNull v.webRoot) cfg.apps); |
110 | 175 | ||
111 | systemd.services = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair | 176 | systemd.services = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair |
112 | "phpfpm-${name}" { | 177 | "phpfpm-${name}" { |
@@ -114,7 +179,7 @@ in | |||
114 | wants = icfg.serviceDeps; | 179 | wants = icfg.serviceDeps; |
115 | preStart = lib.mkAfter (optionalString (!isNull icfg.varDir) '' | 180 | preStart = lib.mkAfter (optionalString (!isNull icfg.varDir) '' |
116 | watchFilesChanged() { | 181 | watchFilesChanged() { |
117 | ${optionalString (builtins.length icfg.watchFiles == 0) "return 0"} | 182 | ${optionalString (builtins.length icfg.phpWatchFiles == 0) "return 1"} |
118 | [ ! -f "${icfg.varDir}"/watchedFiles ] \ | 183 | [ ! -f "${icfg.varDir}"/watchedFiles ] \ |
119 | || ! sha512sum -c --status ${icfg.varDir}/watchedFiles | 184 | || ! sha512sum -c --status ${icfg.varDir}/watchedFiles |
120 | } | 185 | } |
@@ -123,8 +188,8 @@ in | |||
123 | "${icfg.app}" != "$(cat ${icfg.varDir}/currentWebappDir 2>/dev/null)" ] | 188 | "${icfg.app}" != "$(cat ${icfg.varDir}/currentWebappDir 2>/dev/null)" ] |
124 | } | 189 | } |
125 | updateWatchFiles() { | 190 | updateWatchFiles() { |
126 | ${optionalString (builtins.length icfg.watchFiles == 0) "return 0"} | 191 | ${optionalString (builtins.length icfg.phpWatchFiles == 0) "return 0"} |
127 | sha512sum ${builtins.concatStringsSep " " icfg.watchFiles} > ${icfg.varDir}/watchedFiles | 192 | sha512sum ${builtins.concatStringsSep " " icfg.phpWatchFiles} > ${icfg.varDir}/watchedFiles |
128 | } | 193 | } |
129 | 194 | ||
130 | if watchFilesChanged || appDirChanged; then | 195 | if watchFilesChanged || appDirChanged; then |
@@ -136,7 +201,7 @@ in | |||
136 | fi | 201 | fi |
137 | ''); | 202 | ''); |
138 | } | 203 | } |
139 | ) cfg; | 204 | ) cfg.apps; |
140 | 205 | ||
141 | system.activationScripts = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair | 206 | system.activationScripts = attrsets.mapAttrs' (name: icfg: attrsets.nameValuePair |
142 | name { | 207 | name { |
@@ -147,6 +212,6 @@ in | |||
147 | install -m 0700 -o ${icfg.httpdUser} -g ${icfg.httpdGroup} -d ${icfg.varDir}/phpSessions | 212 | install -m 0700 -o ${icfg.httpdUser} -g ${icfg.httpdGroup} -d ${icfg.varDir}/phpSessions |
148 | ''; | 213 | ''; |
149 | } | 214 | } |
150 | ) cfg; | 215 | ) cfg.apps; |
151 | }; | 216 | }; |
152 | } | 217 | } |