From d3452fc59b9839846225fd254926c64a9c71f071 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= <ismael.bouya@normalesup.org>
Date: Sat, 18 Apr 2020 16:10:56 +0200
Subject: Refactor websites

---
 modules/private/websites/richie/production.nix | 106 +++++++++++++++++++++++++
 1 file changed, 106 insertions(+)
 create mode 100644 modules/private/websites/richie/production.nix

(limited to 'modules/private/websites/richie/production.nix')

diff --git a/modules/private/websites/richie/production.nix b/modules/private/websites/richie/production.nix
new file mode 100644
index 0000000..d6d19c8
--- /dev/null
+++ b/modules/private/websites/richie/production.nix
@@ -0,0 +1,106 @@
+{ lib, config, pkgs, ... }:
+let
+  cfg = config.myServices.websites.richie.production;
+  vardir = "/var/lib/richie_production";
+  richieSrc = pkgs.stdenv.mkDerivation (pkgs.mylibs.fetchedGitPrivate ./richie.json // {
+    phases = "installPhase";
+    installPhase = ''
+      cp -a $src $out
+      chmod -R u+w $out
+      ln -sf ${vardir}/files $out/
+      ln -sf ${vardir}/drapeaux $out/images/
+      ln -sf ${vardir}/photos $out/
+      sed -i "s@localedef --list-archive@localedef --list-archive /run/current-system/sw/lib/locale/locale-archive@" $out/admin/parametres.php
+      '';
+  });
+  webappdir = config.services.websites.webappDirsPaths.richie_production;
+  secretPath = config.secrets.fullPaths."websites/richie/production";
+  apacheUser = config.services.httpd.Prod.user;
+  apacheGroup = config.services.httpd.Prod.group;
+in
+{
+  options.myServices.websites.richie.production.enable = lib.mkEnableOption "enable Richie's website";
+  config = lib.mkIf cfg.enable {
+    services.duplyBackup.profiles.richie_production.rootDir = vardir;
+    services.webstats.sites = [ { name = "europe-richie.org"; } ];
+
+    secrets.keys = [{
+      dest = "websites/richie/production";
+      user = apacheUser;
+      group = apacheGroup;
+      permissions = "0400";
+      text = with config.myEnv.websites.richie; ''
+        <?php
+
+        $hote_sql = '${mysql.host}';
+        $login_sql = '${mysql.user}';
+        $bdd_sql = '${mysql.database}';
+        $mdp_sql = '${mysql.password}';
+
+        $db = mysqli_connect($hote_sql,$login_sql,$mdp_sql);
+        unset($mdp_sql);
+
+        $smtp_mailer->Auth('${smtp_mailer.user}', '${smtp_mailer.password}');
+        ?>
+        '';
+    }];
+    services.websites.webappDirs.richie_production = richieSrc;
+    system.activationScripts.richie_production = {
+      deps = [ "httpd" ];
+      text = ''
+        install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d /var/lib/php/sessions/richie_production
+        install -m 0755 -o ${apacheUser} -g ${apacheGroup} -d ${vardir}
+        '';
+    };
+    services.phpfpm.pools.richie_production = {
+      user = apacheUser;
+      group = apacheGroup;
+      settings = {
+        "listen.owner" = apacheUser;
+        "listen.group" = apacheGroup;
+
+        "pm" = "ondemand";
+        "pm.max_children" = "5";
+        "pm.process_idle_timeout" = "60";
+
+        "php_admin_value[open_basedir]" = "${vardir}:/var/lib/php/sessions/richie_production:${secretPath}:${richieSrc}:/tmp";
+        "php_admin_value[session.save_path]" = "/var/lib/php/sessions/richie_production";
+      };
+      phpEnv = {
+        PATH = "/run/current-system/sw/bin:${lib.makeBinPath [ pkgs.imagemagick ]}";
+        BDD_CONNECT = secretPath;
+      };
+      phpOptions = config.services.phpfpm.phpOptions + ''
+        date.timezone = 'Europe/Paris'
+        extension=${pkgs.php}/lib/php/extensions/mysqli.so
+        '';
+    };
+    services.websites.env.production.modules = [ "proxy_fcgi" ];
+    services.websites.env.production.vhostConfs.richie_production = {
+      certName    = "richie";
+      addToCerts  = true;
+      certMainHost = "europe-richie.org";
+      hosts       = [ "europe-richie.org" "www.europe-richie.org" ];
+      root        = webappdir;
+      extraConfig = [
+        ''
+        Use Stats europe-richie.org
+        ErrorDocument 404 /404.html
+        <LocationMatch "^/files/.*/admin/">
+          Require all denied
+        </LocationMatch>
+        <Directory ${webappdir}>
+          DirectoryIndex index.php index.htm index.html
+          Options Indexes FollowSymLinks MultiViews Includes
+          AllowOverride None
+          Require all granted
+
+          <FilesMatch "\.php$">
+            SetHandler "proxy:unix:${config.services.phpfpm.pools.richie_production.socket}|fcgi://localhost"
+          </FilesMatch>
+        </Directory>
+          ''
+      ];
+    };
+  };
+}
-- 
cgit v1.2.3