From a754e9dbf5d6c35398f3c4ec52c3daf5f8ed2dd3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= <ismael.bouya@normalesup.org>
Date: Tue, 16 Apr 2019 00:04:34 +0200
Subject: Move Aten and Connexionswing secrets to secure location

Related issue: https://git.immae.eu/mantisbt/view.php?id=122
---
 nixops/modules/websites/aten/aten.nix | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

(limited to 'nixops/modules/websites/aten/aten.nix')

diff --git a/nixops/modules/websites/aten/aten.nix b/nixops/modules/websites/aten/aten.nix
index d9286c3..897b3ba 100644
--- a/nixops/modules/websites/aten/aten.nix
+++ b/nixops/modules/websites/aten/aten.nix
@@ -29,6 +29,17 @@ let
         pm.max_spare_servers = 3
         ''}'';
     };
+    keys."${environment}-aten" = {
+      destDir = "/run/keys/webapps";
+      user = apache.user;
+      group = apache.group;
+      permissions = "0700";
+      text = ''
+        SetEnv APP_ENV      "${environment}"
+        SetEnv APP_SECRET   "${config.secret}"
+        SetEnv DATABASE_URL "${config.psql_url}"
+        '';
+    };
     apache = rec {
       user = "wwwrun";
       group = "wwwrun";
@@ -40,9 +51,7 @@ let
         SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
       </FilesMatch>
 
-      SetEnv APP_ENV      "${environment}"
-      SetEnv APP_SECRET   "${config.secret}"
-      SetEnv DATABASE_URL "${config.psql_url}"
+      Include /run/keys/webapps/${environment}-aten
 
       ${if environment == "dev" then ''
       <Location />
@@ -124,8 +133,6 @@ let
         preInstall = ''
           export SYMFONY_ENV="${environment}"
           export APP_ENV="${environment}"
-          export DATABASE_URL="${config.psql_url}"
-          export APP_SECRET="${config.secret}"
           '';
         postInstall = ''
           ln -sf ${yarnModules}/node_modules .
-- 
cgit v1.2.3