aboutsummaryrefslogtreecommitdiff
path: root/nixops/modules/websites/chloe/chloe.nix
diff options
context:
space:
mode:
Diffstat (limited to 'nixops/modules/websites/chloe/chloe.nix')
-rw-r--r--nixops/modules/websites/chloe/chloe.nix224
1 files changed, 96 insertions, 128 deletions
diff --git a/nixops/modules/websites/chloe/chloe.nix b/nixops/modules/websites/chloe/chloe.nix
index e2381d8..2847b9d 100644
--- a/nixops/modules/websites/chloe/chloe.nix
+++ b/nixops/modules/websites/chloe/chloe.nix
@@ -1,137 +1,105 @@
1{ stdenv, lib, fetchzip, fetchurl, fetchedGitPrivate, sassc }: 1{ chloe, config }:
2let 2rec {
3 chloe = { config }: rec { 3 app = chloe.override { inherit (config) environment; };
4 environment = config.environment; 4 phpFpm = rec {
5 phpFpm = rec { 5 serviceDeps = [ "mysql.service" ];
6 serviceDeps = [ "mysql.service" ]; 6 socket = "/var/run/phpfpm/chloe-${app.environment}.sock";
7 socket = "/var/run/phpfpm/chloe-${environment}.sock"; 7 pool = ''
8 pool = '' 8 listen = ${socket}
9 listen = ${socket} 9 user = ${apache.user}
10 user = ${apache.user} 10 group = ${apache.group}
11 group = ${apache.group} 11 listen.owner = ${apache.user}
12 listen.owner = ${apache.user} 12 listen.group = ${apache.group}
13 listen.group = ${apache.group} 13 php_admin_value[upload_max_filesize] = 20M
14 php_admin_value[upload_max_filesize] = 20M 14 php_admin_value[post_max_size] = 20M
15 php_admin_value[post_max_size] = 20M 15 ;php_admin_flag[log_errors] = on
16 ;php_admin_flag[log_errors] = on 16 php_admin_value[open_basedir] = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp"
17 php_admin_value[open_basedir] = "${../commons/spip/spip_mes_options.php}:${configDir}:${webRoot}:${varDir}:/tmp" 17 php_admin_value[session.save_path] = "${app.varDir}/phpSessions"
18 php_admin_value[session.save_path] = "${varDir}/phpSessions" 18 ${if app.environment == "dev" then ''
19 ${if environment == "dev" then '' 19 pm = ondemand
20 pm = ondemand 20 pm.max_children = 5
21 pm.max_children = 5 21 pm.process_idle_timeout = 60
22 pm.process_idle_timeout = 60 22 '' else ''
23 '' else '' 23 pm = dynamic
24 pm = dynamic 24 pm.max_children = 20
25 pm.max_children = 20 25 pm.start_servers = 2
26 pm.start_servers = 2 26 pm.min_spare_servers = 1
27 pm.min_spare_servers = 1 27 pm.max_spare_servers = 3
28 pm.max_spare_servers = 3 28 ''}'';
29 ''}''; 29 };
30 }; 30 keys = [{
31 keys = [{ 31 dest = "webapps/${app.environment}-chloe";
32 dest = "webapps/${environment}-chloe"; 32 user = apache.user;
33 user = apache.user; 33 group = apache.group;
34 group = apache.group; 34 permissions = "0400";
35 permissions = "0400"; 35 text = ''
36 text = '' 36 SetEnv SPIP_CONFIG_DIR "${configDir}"
37 SetEnv SPIP_CONFIG_DIR "${configDir}" 37 SetEnv SPIP_VAR_DIR "${app.varDir}"
38 SetEnv SPIP_VAR_DIR "${varDir}" 38 SetEnv SPIP_SITE "chloe-${app.environment}"
39 SetEnv SPIP_SITE "chloe-${environment}" 39 SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu"
40 SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu" 40 SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu"
41 SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu" 41 SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}"
42 SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}" 42 SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}"
43 SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}" 43 SetEnv SPIP_LDAP_SEARCH "${config.ldap.search}"
44 SetEnv SPIP_LDAP_SEARCH "${config.ldap.search}" 44 SetEnv SPIP_MYSQL_HOST "${config.mysql.host}"
45 SetEnv SPIP_MYSQL_HOST "${config.mysql.host}" 45 SetEnv SPIP_MYSQL_PORT "${config.mysql.port}"
46 SetEnv SPIP_MYSQL_PORT "${config.mysql.port}" 46 SetEnv SPIP_MYSQL_DB "${config.mysql.name}"
47 SetEnv SPIP_MYSQL_DB "${config.mysql.name}" 47 SetEnv SPIP_MYSQL_USER "${config.mysql.user}"
48 SetEnv SPIP_MYSQL_USER "${config.mysql.user}" 48 SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}"
49 SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}" 49 '';
50 ''; 50 }];
51 }]; 51 apache = rec {
52 apache = rec { 52 user = "wwwrun";
53 user = "wwwrun"; 53 group = "wwwrun";
54 group = "wwwrun"; 54 modules = [ "proxy_fcgi" ];
55 modules = [ "proxy_fcgi" ]; 55 webappName = "chloe_${app.environment}";
56 webappName = "chloe_${environment}"; 56 root = "/run/current-system/webapps/${webappName}";
57 root = "/run/current-system/webapps/${webappName}"; 57 vhostConf = ''
58 vhostConf = '' 58 Include /var/secrets/webapps/${app.environment}-chloe
59 Include /var/secrets/webapps/${environment}-chloe
60 59
61 RewriteEngine On 60 RewriteEngine On
62 ${if environment == "prod" then '' 61 ${if app.environment == "prod" then ''
63 RewriteRule ^/news.rss /spip.php?page=backend&id_rubrique=1 62 RewriteRule ^/news.rss /spip.php?page=backend&id_rubrique=1
64 '' else ""} 63 '' else ""}
65 64
66 <FilesMatch "\.php$"> 65 <FilesMatch "\.php$">
67 SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost" 66 SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
68 </FilesMatch> 67 </FilesMatch>
69 68
70 <Directory ${root}> 69 <Directory ${root}>
71 DirectoryIndex index.php index.htm index.html 70 DirectoryIndex index.php index.htm index.html
72 Options -Indexes +FollowSymLinks +MultiViews +Includes 71 Options -Indexes +FollowSymLinks +MultiViews +Includes
73 Include ${root}/htaccess.txt 72 Include ${root}/htaccess.txt
74 73
75 AllowOverride AuthConfig FileInfo Limit 74 AllowOverride AuthConfig FileInfo Limit
76 Require all granted 75 Require all granted
77 </Directory> 76 </Directory>
78 77
79 <DirectoryMatch "${root}/squelettes"> 78 <DirectoryMatch "${root}/squelettes">
80 Require all denied 79 Require all denied
81 </DirectoryMatch> 80 </DirectoryMatch>
82 81
83 <FilesMatch "(.htaccess|rewrite-rules|.gitignore)$"> 82 <FilesMatch "(.htaccess|rewrite-rules|.gitignore)$">
84 Require all denied 83 Require all denied
85 </FilesMatch> 84 </FilesMatch>
86 85
87 ${if environment == "dev" then '' 86 ${if app.environment == "dev" then ''
88 <Location /> 87 <Location />
89 Use LDAPConnect 88 Use LDAPConnect
90 Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu 89 Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
91 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://osteopathe-cc.fr\"></html>" 90 ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://osteopathe-cc.fr\"></html>"
92 </Location> 91 </Location>
93 '' else '' 92 '' else ''
94 Use Stats osteopathe-cc.fr 93 Use Stats osteopathe-cc.fr
95 ''} 94 ''}
96 '';
97 };
98 activationScript = {
99 deps = [ "wrappers" ];
100 text = ''
101 install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir} ${varDir}/IMG ${varDir}/tmp ${varDir}/local
102 install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
103 '';
104 };
105 configDir = ./chloe_config_ + environment;
106 varDir = "/var/lib/chloe_${environment}";
107 siteDir = stdenv.mkDerivation (fetchedGitPrivate ./chloe.json // rec {
108 buildPhase = ''
109 make
110 '';
111 installPhase = ''
112 cp -a . $out
113 '';
114 buildInputs = [ sassc ];
115 });
116 webRoot = stdenv.mkDerivation rec {
117 name = "chloe-${environment}-spip-${version}";
118 version = "3.2.3";
119 src = fetchzip {
120 url = "https://files.spip.net/spip/archives/SPIP-v${version}.zip";
121 sha256 = "1r1mjvsnrp6mvkgjakvi3x4ms8m8k5mp93micbbg8r99fj7qlfkq";
122 };
123 paches = [ ../commons/spip/spip_ldap_patch.patch ];
124 buildPhase = ''
125 rm -rf IMG local tmp config/remove.txt
126 ln -sf ${../commons/spip/spip_mes_options.php} config/mes_options.php
127 echo "Require all denied" > "config/.htaccess"
128 ln -sf ${varDir}/{IMG,local} .
129 ''; 95 '';
130 installPhase = ''
131 cp -a . $out
132 cp -a ${siteDir}/* $out
133 '';
134 };
135 }; 96 };
136in 97 activationScript = {
137 chloe 98 deps = [ "wrappers" ];
99 text = ''
100 install -m 0755 -o ${apache.user} -g ${apache.group} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local
101 install -m 0750 -o ${apache.user} -g ${apache.group} -d ${app.varDir}/phpSessions
102 '';
103 };
104 configDir = ./chloe_config_ + app.environment;
105}
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-05 04:13:37 +0000