2 files changed, 19 insertions, 7 deletions
diff --git a/nixops/modules/websites/tellesflorian/default.nix b/nixops/modules/websites/tellesflorian/default.nix
index 389c491..97931b9 100644
--- a/nixops/modules/websites/tellesflorian/default.nix
+++ b/nixops/modules/websites/tellesflorian/default.nix
@@ -16,6 +16,7 @@ in {
  };
  config = lib.mkIf cfg.integration.enable {
+    deployment.keys = tellesflorian_dev.keys;
    security.acme.certs."eldiron".extraDomains."app.tellesflorian.com" = null;
    services.myPhpfpm.poolConfigs.tellesflorian_dev = tellesflorian_dev.phpFpm.pool;
    system.activationScripts.tellesflorian_dev = tellesflorian_dev.activationScript;
diff --git a/nixops/modules/websites/tellesflorian/tellesflorian.nix b/nixops/modules/websites/tellesflorian/tellesflorian.nix
index e421581..4c76a76 100644
--- a/nixops/modules/websites/tellesflorian/tellesflorian.nix
+++ b/nixops/modules/websites/tellesflorian/tellesflorian.nix
@@ -3,8 +3,12 @@ let
  tellesflorian = { config }: rec {
    environment = config.environment;
    varDir = "/var/lib/tellesflorian_${environment}";
-    configRoot =
+    keys."${environment}-tellesflorian" = {
-      writeText "parameters.yml" ''
+      destDir = "/run/keys/webapps";
+      user = apache.user;
+      group = apache.group;
+      permissions = "0700";
+      text = ''
        # This file is auto-generated during the composer install
        parameters:
            database_host: ${config.mysql.host}
@@ -18,6 +22,7 @@ let
            mailer_password: null
            secret: ${config.secret}
      '';
+    };
    phpFpm = rec {
      socket = "/var/run/phpfpm/floriantelles-${environment}.sock";
      pool = ''
@@ -29,7 +34,7 @@ let
        php_admin_value[upload_max_filesize] = 20M
        php_admin_value[post_max_size] = 20M
        ;php_admin_flag[log_errors] = on
-        php_admin_value[open_basedir] = "${configRoot}:${webappDir}:${varDir}:/tmp"
+        php_admin_value[open_basedir] = "/run/keys/webapps/${environment}-tellesflorian:${webappDir}:${varDir}:/tmp"
        php_admin_value[session.save_path] = "${varDir}/phpSessions"
        ${if environment == "dev" then ''
        pm = ondemand
@@ -44,9 +49,15 @@ let
        pm.max_spare_servers = 3
        ''}'';
    };
-    passwords = writeText "tellesflorian_passwords" ''
+    keys."${environment}-tellesflorian-passwords" = {
-      invite:${config.invite_passwords}
+      destDir = "/run/keys/webapps";
+      user = apache.user;
+      group = apache.group;
+      permissions = "0700";
+      text = ''
+        invite:${config.invite_passwords}
      '';
+    };
    apache = rec {
      user = "wwwrun";
      group = "wwwrun";
@@ -64,7 +75,7 @@ let
        Use LDAPConnect
        Require ldap-group   cn=app.tellesflorian.com,cn=httpd,ou=services,dc=immae,dc=eu
-        AuthUserFile "${passwords}"
+        AuthUserFile "/run/keys/webapps/${environment}-tellesflorian-passwords"
        Require user "invite"
        ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://tellesflorian.com\"></html>"
@@ -145,7 +156,7 @@ let
        postInstall = ''
          cd $out
          rm app/config/parameters.yml
-          ln -sf ${configRoot} app/config/parameters.yml
+          ln -sf /run/keys/webapps/${environment}-tellesflorian app/config/parameters.yml
          rm -rf var/{logs,cache}
          ln -sf ${varDir}/var/{logs,cache,sessions} var/
          '';