From d3452fc59b9839846225fd254926c64a9c71f071 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Sat, 18 Apr 2020 16:10:56 +0200 Subject: Refactor websites --- modules/private/websites/chloe/integration.nix | 110 ++++++++++++++++++++----- 1 file changed, 91 insertions(+), 19 deletions(-) (limited to 'modules/private/websites/chloe/integration.nix') diff --git a/modules/private/websites/chloe/integration.nix b/modules/private/websites/chloe/integration.nix index caf6548..6d16a86 100644 --- a/modules/private/websites/chloe/integration.nix +++ b/modules/private/websites/chloe/integration.nix @@ -1,43 +1,115 @@ { lib, pkgs, config, ... }: let - chloe = pkgs.callPackage ./builder.nix { - inherit (pkgs.webapps) chloe; - config = config.myEnv.websites.chloe.integration; - apacheUser = config.services.httpd.Inte.user; - apacheGroup = config.services.httpd.Inte.group; + apacheUser = config.services.httpd.Inte.user; + apacheGroup = config.services.httpd.Inte.group; + ccfg = config.myEnv.websites.chloe.integration; + app = pkgs.callPackage ./app { + inherit (ccfg) environment; + inherit (pkgs.webapps) spip; + varDir = "/var/lib/chloe_integration"; }; - cfg = config.myServices.websites.chloe.integration; + webappdir = config.services.websites.webappDirsPaths.chloe_integration; in { options.myServices.websites.chloe.integration.enable = lib.mkEnableOption "enable Chloe's website in integration"; config = lib.mkIf cfg.enable { - services.duplyBackup.profiles.chloe_dev.rootDir = chloe.app.varDir; - secrets.keys = chloe.keys; - systemd.services.phpfpm-chloe_dev.after = lib.mkAfter chloe.phpFpm.serviceDeps; - systemd.services.phpfpm-chloe_dev.wants = chloe.phpFpm.serviceDeps; - services.phpfpm.pools.chloe_dev = { + services.duplyBackup.profiles.chloe_integration.rootDir = app.varDir; + secrets.keys = [ + { + dest = "websites/chloe/integration"; + user = apacheUser; + group = apacheGroup; + permissions = "0400"; + text = '' + SetEnv SPIP_CONFIG_DIR "${./config}" + SetEnv SPIP_VAR_DIR "${app.varDir}" + SetEnv SPIP_SITE "chloe-${app.environment}" + SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu" + SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu" + SetEnv SPIP_LDAP_SEARCH_DN "${ccfg.ldap.dn}" + SetEnv SPIP_LDAP_SEARCH_PW "${ccfg.ldap.password}" + SetEnv SPIP_LDAP_SEARCH "${ccfg.ldap.filter}" + SetEnv SPIP_MYSQL_HOST "${ccfg.mysql.host}" + SetEnv SPIP_MYSQL_PORT "${ccfg.mysql.port}" + SetEnv SPIP_MYSQL_DB "${ccfg.mysql.database}" + SetEnv SPIP_MYSQL_USER "${ccfg.mysql.user}" + SetEnv SPIP_MYSQL_PASSWORD "${ccfg.mysql.password}" + ''; + } + ]; + systemd.services.phpfpm-chloe_integration.after = lib.mkAfter [ "mysql.service" ]; + systemd.services.phpfpm-chloe_integration.wants = [ "mysql.service" ]; + services.phpfpm.pools.chloe_integration = { user = config.services.httpd.Inte.user; group = config.services.httpd.Inte.group; - settings = chloe.phpFpm.pool; + settings = { + "listen.owner" = apacheUser; + "listen.group" = apacheGroup; + "php_admin_value[upload_max_filesize]" = "20M"; + "php_admin_value[post_max_size]" = "20M"; + # "php_admin_flag[log_errors]" = "on"; + "php_admin_value[open_basedir]" = "${app.spipConfig}:${./config}:${app}:${app.varDir}:/tmp"; + "php_admin_value[session.save_path]" = "${app.varDir}/phpSessions"; + "pm" = "ondemand"; + "pm.max_children" = "5"; + "pm.process_idle_timeout" = "60"; + }; phpOptions = config.services.phpfpm.phpOptions + '' extension=${pkgs.php}/lib/php/extensions/mysqli.so ''; }; - system.activationScripts.chloe_dev = chloe.activationScript; - myServices.websites.webappDirs."${chloe.apache.webappName}" = chloe.app.webRoot; - services.websites.env.integration.modules = chloe.apache.modules; - services.websites.env.integration.vhostConfs.chloe = { + system.activationScripts.chloe_integration = { + deps = [ "wrappers" ]; + text = '' + install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local + install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions + ''; + }; + services.websites.webappDirs.chloe_integration = app.webRoot; + services.websites.env.integration.modules = [ "proxy_fcgi" ]; + services.websites.env.integration.vhostConfs.chloe_integration = { certName = "integration"; addToCerts = true; hosts = ["chloe.immae.eu" ]; - root = chloe.apache.root; + root = webappdir; extraConfig = [ - (chloe.apache.vhostConf config.services.phpfpm.pools.chloe_dev.socket) + '' + Include ${config.secrets.fullPaths."websites/chloe/integration"} + + RewriteEngine On + + + SetHandler "proxy:unix:${config.services.phpfpm.pools.chloe_integration.socket}|fcgi://localhost" + + + + DirectoryIndex index.php index.htm index.html + Options -Indexes +FollowSymLinks +MultiViews +Includes + Include ${webappdir}/htaccess.txt + + AllowOverride AuthConfig FileInfo Limit + Require all granted + + + + Require all denied + + + + Require all denied + + + + Use LDAPConnect + Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu + ErrorDocument 401 "" + + '' ]; }; services.websites.env.integration.watchPaths = [ - "/var/secrets/webapps/${chloe.app.environment}-chloe" + config.secrets.fullPaths."websites/chloe/integration" ]; }; } -- cgit v1.2.3