blob: e2381d83e92ba44f932b42b81c315c7fc913f2e8 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
|
{ stdenv, lib, fetchzip, fetchurl, fetchedGitPrivate, sassc }:
let
chloe = { config }: rec {
environment = config.environment;
phpFpm = rec {
serviceDeps = [ "mysql.service" ];
socket = "/var/run/phpfpm/chloe-${environment}.sock";
pool = ''
listen = ${socket}
user = ${apache.user}
group = ${apache.group}
listen.owner = ${apache.user}
listen.group = ${apache.group}
php_admin_value[upload_max_filesize] = 20M
php_admin_value[post_max_size] = 20M
;php_admin_flag[log_errors] = on
php_admin_value[open_basedir] = "${../commons/spip/spip_mes_options.php}:${configDir}:${webRoot}:${varDir}:/tmp"
php_admin_value[session.save_path] = "${varDir}/phpSessions"
${if environment == "dev" then ''
pm = ondemand
pm.max_children = 5
pm.process_idle_timeout = 60
'' else ''
pm = dynamic
pm.max_children = 20
pm.start_servers = 2
pm.min_spare_servers = 1
pm.max_spare_servers = 3
''}'';
};
keys = [{
dest = "webapps/${environment}-chloe";
user = apache.user;
group = apache.group;
permissions = "0400";
text = ''
SetEnv SPIP_CONFIG_DIR "${configDir}"
SetEnv SPIP_VAR_DIR "${varDir}"
SetEnv SPIP_SITE "chloe-${environment}"
SetEnv SPIP_LDAP_BASE "dc=immae,dc=eu"
SetEnv SPIP_LDAP_HOST "ldaps://ldap.immae.eu"
SetEnv SPIP_LDAP_SEARCH_DN "${config.ldap.dn}"
SetEnv SPIP_LDAP_SEARCH_PW "${config.ldap.password}"
SetEnv SPIP_LDAP_SEARCH "${config.ldap.search}"
SetEnv SPIP_MYSQL_HOST "${config.mysql.host}"
SetEnv SPIP_MYSQL_PORT "${config.mysql.port}"
SetEnv SPIP_MYSQL_DB "${config.mysql.name}"
SetEnv SPIP_MYSQL_USER "${config.mysql.user}"
SetEnv SPIP_MYSQL_PASSWORD "${config.mysql.password}"
'';
}];
apache = rec {
user = "wwwrun";
group = "wwwrun";
modules = [ "proxy_fcgi" ];
webappName = "chloe_${environment}";
root = "/run/current-system/webapps/${webappName}";
vhostConf = ''
Include /var/secrets/webapps/${environment}-chloe
RewriteEngine On
${if environment == "prod" then ''
RewriteRule ^/news.rss /spip.php?page=backend&id_rubrique=1
'' else ""}
<FilesMatch "\.php$">
SetHandler "proxy:unix:${phpFpm.socket}|fcgi://localhost"
</FilesMatch>
<Directory ${root}>
DirectoryIndex index.php index.htm index.html
Options -Indexes +FollowSymLinks +MultiViews +Includes
Include ${root}/htaccess.txt
AllowOverride AuthConfig FileInfo Limit
Require all granted
</Directory>
<DirectoryMatch "${root}/squelettes">
Require all denied
</DirectoryMatch>
<FilesMatch "(.htaccess|rewrite-rules|.gitignore)$">
Require all denied
</FilesMatch>
${if environment == "dev" then ''
<Location />
Use LDAPConnect
Require ldap-group cn=chloe.immae.eu,cn=httpd,ou=services,dc=immae,dc=eu
ErrorDocument 401 "<html><meta http-equiv=\"refresh\" content=\"0;url=https://osteopathe-cc.fr\"></html>"
</Location>
'' else ''
Use Stats osteopathe-cc.fr
''}
'';
};
activationScript = {
deps = [ "wrappers" ];
text = ''
install -m 0755 -o ${apache.user} -g ${apache.group} -d ${varDir} ${varDir}/IMG ${varDir}/tmp ${varDir}/local
install -m 0750 -o ${apache.user} -g ${apache.group} -d ${varDir}/phpSessions
'';
};
configDir = ./chloe_config_ + environment;
varDir = "/var/lib/chloe_${environment}";
siteDir = stdenv.mkDerivation (fetchedGitPrivate ./chloe.json // rec {
buildPhase = ''
make
'';
installPhase = ''
cp -a . $out
'';
buildInputs = [ sassc ];
});
webRoot = stdenv.mkDerivation rec {
name = "chloe-${environment}-spip-${version}";
version = "3.2.3";
src = fetchzip {
url = "https://files.spip.net/spip/archives/SPIP-v${version}.zip";
sha256 = "1r1mjvsnrp6mvkgjakvi3x4ms8m8k5mp93micbbg8r99fj7qlfkq";
};
paches = [ ../commons/spip/spip_ldap_patch.patch ];
buildPhase = ''
rm -rf IMG local tmp config/remove.txt
ln -sf ${../commons/spip/spip_mes_options.php} config/mes_options.php
echo "Require all denied" > "config/.htaccess"
ln -sf ${varDir}/{IMG,local} .
'';
installPhase = ''
cp -a . $out
cp -a ${siteDir}/* $out
'';
};
};
in
chloe
|
