From 423c3f1caefdf5f125a2acf7456b5ca0273cee4b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Sat, 11 Jan 2020 15:34:31 +0100 Subject: Add iridologie via spip --- modules/private/websites/isabelle/config/chmod.php | 4 + .../private/websites/isabelle/config/connect.php | 15 ++++ modules/private/websites/isabelle/config/ldap.php | 9 ++ modules/private/websites/isabelle/iridologie.nix | 76 ++++++++--------- modules/private/websites/isabelle/spip_builder.nix | 99 ++++++++++++++++++++++ 5 files changed, 160 insertions(+), 43 deletions(-) create mode 100644 modules/private/websites/isabelle/config/chmod.php create mode 100644 modules/private/websites/isabelle/config/connect.php create mode 100644 modules/private/websites/isabelle/config/ldap.php create mode 100644 modules/private/websites/isabelle/spip_builder.nix (limited to 'modules/private/websites/isabelle') diff --git a/modules/private/websites/isabelle/config/chmod.php b/modules/private/websites/isabelle/config/chmod.php new file mode 100644 index 0000000..aae16cd --- /dev/null +++ b/modules/private/websites/isabelle/config/chmod.php @@ -0,0 +1,4 @@ + \ No newline at end of file diff --git a/modules/private/websites/isabelle/config/connect.php b/modules/private/websites/isabelle/config/connect.php new file mode 100644 index 0000000..18b0933 --- /dev/null +++ b/modules/private/websites/isabelle/config/connect.php @@ -0,0 +1,15 @@ + diff --git a/modules/private/websites/isabelle/config/ldap.php b/modules/private/websites/isabelle/config/ldap.php new file mode 100644 index 0000000..825b7ed --- /dev/null +++ b/modules/private/websites/isabelle/config/ldap.php @@ -0,0 +1,9 @@ + array('sAMAccountName','uid','login','userid','cn','sn'),'nom' => 'cn','email' => 'mail','bio' => 'description',); +$GLOBALS['ldap_search'] = getenv("SPIP_LDAP_SEARCH"); +?> diff --git a/modules/private/websites/isabelle/iridologie.nix b/modules/private/websites/isabelle/iridologie.nix index cb4e300..460bd2a 100644 --- a/modules/private/websites/isabelle/iridologie.nix +++ b/modules/private/websites/isabelle/iridologie.nix @@ -1,59 +1,49 @@ -{ lib, config, ... }: +{ lib, pkgs, config, ... }: let + iridologie = pkgs.callPackage ./spip_builder.nix { + inherit (pkgs.webapps) iridologie; + config = config.myEnv.websites.isabelle.iridologie; + apacheUser = config.services.httpd.Prod.user; + apacheGroup = config.services.httpd.Prod.group; + }; + cfg = config.myServices.websites.isabelle.iridologie; - varDir = "/var/lib/ftp/isabelle"; in { options.myServices.websites.isabelle.iridologie.enable = lib.mkEnableOption "enable Iridologie's website"; config = lib.mkIf cfg.enable { + services.duplyBackup.profiles.iridologie_prod.rootDir = iridologie.app.varDir; + secrets.keys = iridologie.keys; services.webstats.sites = [ { name = "iridologie.icommandeur.org"; } ]; - system.activationScripts.iridologie = { - deps = [ "httpd" ]; - text = '' - install -m 0755 -o wwwrun -g wwwrun -d /var/lib/php/sessions/iridologie - ''; - }; - services.phpfpm.pools.iridologie = { - listen = "/run/phpfpm/iridologie.sock"; - extraConfig = '' - user = wwwrun - group = wwwrun - listen.owner = wwwrun - listen.group = wwwrun - - pm = ondemand - pm.max_children = 5 - pm.process_idle_timeout = 60 - php_admin_value[open_basedir] = "/var/lib/php/sessions/iridologie:${varDir}:/tmp" - php_admin_value[session.save_path] = "/var/lib/php/sessions/iridologie" - ''; + systemd.services.phpfpm-iridologie.after = lib.mkAfter iridologie.phpFpm.serviceDeps; + systemd.services.phpfpm-iridologie.wants = iridologie.phpFpm.serviceDeps; + services.phpfpm.pools.iridologie = { + listen = iridologie.phpFpm.socket; + extraConfig = iridologie.phpFpm.pool; + phpOptions = config.services.phpfpm.phpOptions + '' + extension=${pkgs.php}/lib/php/extensions/mysqli.so + ''; }; - services.websites.env.production.modules = [ "proxy_fcgi" ]; + system.activationScripts.iridologie = iridologie.activationScript; + myServices.websites.webappDirs."${iridologie.apache.webappName}" = iridologie.app.webRoot; + services.websites.env.production.modules = iridologie.apache.modules; services.websites.env.production.vhostConfs.iridologie = { - certName = "aten"; - addToCerts = true; - hosts = [ "iridologie.icommandeur.org" "icommandeur.org" "www.icommandeur.org" ]; - root = varDir; - extraConfig = [ + certName = "aten"; + addToCerts = true; + hosts = [ "iridologie.icommandeur.org" "icommandeur.org" "www.icommandeur.org" ]; + root = iridologie.apache.root; + extraConfig = [ '' - Use Stats iridologie.icommandeur.org - RewriteEngine On - RewriteCond "%{HTTP_HOST}" "!^iridologie\.icommandeur\.org$" [NC] - RewriteRule ^(.+)$ https://iridologie.icommandeur.org$1 [R=302,L] - - - SetHandler "proxy:unix:/run/phpfpm/iridologie.sock|fcgi://localhost" - - - - DirectoryIndex index.php index.htm index.html - AllowOverride All - Require all granted - + RewriteEngine On + RewriteCond "%{HTTP_HOST}" "!^iridologie\.icommandeur\.org$" [NC] + RewriteRule ^(.+)$ https://iridologie.icommandeur.org$1 [R=302,L] '' + iridologie.apache.vhostConf ]; }; + services.websites.env.production.watchPaths = [ + "/var/secrets/webapps/${iridologie.app.environment}-iridologie" + ]; }; } - diff --git a/modules/private/websites/isabelle/spip_builder.nix b/modules/private/websites/isabelle/spip_builder.nix new file mode 100644 index 0000000..2ab5394 --- /dev/null +++ b/modules/private/websites/isabelle/spip_builder.nix @@ -0,0 +1,99 @@ +{ apacheUser, apacheGroup, iridologie, config }: +rec { + app = iridologie.override { inherit (config) environment; }; + phpFpm = rec { + serviceDeps = [ "mysql.service" ]; + socket = "/var/run/phpfpm/iridologie-${app.environment}.sock"; + pool = '' + user = ${apacheUser} + group = ${apacheGroup} + listen.owner = ${apacheUser} + listen.group = ${apacheGroup} + php_admin_value[upload_max_filesize] = 20M + php_admin_value[post_max_size] = 20M + ;php_admin_flag[log_errors] = on + php_admin_value[open_basedir] = "${app.spipConfig}:${configDir}:${app}:${app.varDir}:/tmp" + php_admin_value[session.save_path] = "${app.varDir}/phpSessions" + ${if app.environment == "dev" then '' + pm = ondemand + pm.max_children = 5 + pm.process_idle_timeout = 60 + '' else '' + pm = dynamic + pm.max_children = 20 + pm.start_servers = 2 + pm.min_spare_servers = 1 + pm.max_spare_servers = 3 + ''}''; + }; + keys = [{ + dest = "webapps/${app.environment}-iridologie"; + user = apacheUser; + group = apacheGroup; + permissions = "0400"; + text = '' + SetEnv SPIP_CONFIG_DIR "${configDir}" + SetEnv SPIP_VAR_DIR "${app.varDir}" + SetEnv SPIP_SITE "iridologie-${app.environment}" + SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu" + SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu" + SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}" + SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}" + SetEnv SPIP_LDAP_SEARCH "${config.ldap.filter}" + SetEnv SPIP_MYSQL_HOST "${config.mysql.host}" + SetEnv SPIP_MYSQL_PORT "${config.mysql.port}" + SetEnv SPIP_MYSQL_DB "${config.mysql.database}" + SetEnv SPIP_MYSQL_USER "${config.mysql.user}" + SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}" + ''; + }]; + apache = rec { + modules = [ "proxy_fcgi" ]; + webappName = "iridologie_${app.environment}"; + root = "/run/current-system/webapps/${webappName}"; + vhostConf = '' + Include /var/secrets/webapps/${app.environment}-iridologie + + RewriteEngine On + + + SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost" + + + + DirectoryIndex index.php index.htm index.html + Options -Indexes +FollowSymLinks +MultiViews +Includes + Include ${root}/htaccess.txt + + AllowOverride AuthConfig FileInfo Limit + Require all granted + + + + Require all denied + + + + Require all denied + + + ${if app.environment == "dev" then '' + + Use LDAPConnect + Require ldap-group cn=isabelle.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu + ErrorDocument 401 "" + + '' else '' + Use Stats iridologie.icommandeur.org + ''} + ''; + }; + activationScript = { + deps = [ "wrappers" ]; + text = '' + install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir} ${app.varDir}/IMG ${app.varDir}/tmp ${app.varDir}/local + install -m 0750 -o ${apacheUser} -g ${apacheGroup} -d ${app.varDir}/phpSessions + ''; + }; + configDir = ./config; +} -- cgit v1.2.3