helm/profiles/shaarli/default.nix

{ pkgs, config, ... }:
let 
  dataDir = "/var/www/shaarli-config";
  name = "shaarli";
in
{
  services.nginx = {
    enable = true;
    virtualHosts = {
      "links.mossnet.lan" = {
        forceSSL = false;
        enableACME = false;
        root = "${dataDir}";
        extraConfig = ''
              index index.php;
      '';
        locations = {
        "/".extraConfig = ''
          try_files $uri $uri/ index.php$is_args$args;
        '';

        "~ (index)\\.php$".extraConfig = ''
            try_files $uri =404;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
    
            fastcgi_pass unix:${config.services.phpfpm.pools."${name}".socket};
            fastcgi_index index.php;
    
            fastcgi_param   QUERY_STRING            $query_string;
            fastcgi_param   REQUEST_METHOD          $request_method;
            fastcgi_param   CONTENT_TYPE            $content_type;
            fastcgi_param   CONTENT_LENGTH          $content_length;
    
            fastcgi_param   SCRIPT_FILENAME         $document_root$fastcgi_script_name;
            fastcgi_param   SCRIPT_NAME             $fastcgi_script_name;
            fastcgi_param   PATH_INFO               $fastcgi_path_info;
            fastcgi_param   PATH_TRANSLATED         $document_root$fastcgi_path_info;
            fastcgi_param   REQUEST_URI             $request_uri;
            fastcgi_param   DOCUMENT_URI            $document_uri;
            fastcgi_param   DOCUMENT_ROOT           $document_root;
            fastcgi_param   SERVER_PROTOCOL         $server_protocol;
    
            fastcgi_param   GATEWAY_INTERFACE       CGI/1.1;
            fastcgi_param   SERVER_SOFTWARE         nginx/$nginx_version;
    
            fastcgi_param   REMOTE_ADDR             $remote_addr;
            fastcgi_param   REMOTE_PORT             $remote_port;
            fastcgi_param   SERVER_ADDR             $server_addr;
            fastcgi_param   SERVER_PORT             $server_port;
            fastcgi_param   SERVER_NAME             $server_name;
          '';

          "~ \\.php$".extraConfig = ''
            deny all;
          '';

          "^~ /tpl/".extraConfig = "alias ${pkgs.shaarli}/tpl/;";

          "^~ /plugins/".extraConfig = "alias ${pkgs.shaarli}/plugins/;";

          "~* \\.(?:ico|css|js|gif|jpe?g|png)$".extraConfig = ''
            expires max;
            add_header Pragma public;
            add_header Cache-Control "public, must-revalidate, proxy-revalidate";
          '';
        };
      };
    };
  };

  services.phpfpm = {
    pools = {
      "${name}" = {
        user = "nginx";
        group = "nginx";
        #listen = "/run/phpfpm/php.sock";
	settings = {
	      "listen.owner" = "nginx";
	      "listen.group" = "nginx";
	      "user" = "nginx";
	      "pm" = "dynamic";
	      "pm.max_children" = "4";
	      "pm.min_spare_servers" = "1";
	      "pm.max_spare_servers" = "4";
	      "pm.max_requests" = "32";
	      "catch_workers_output" = "1";
	      "php_admin_value[error_log]" = "/var/log/nginx/${name}-phpfpm-error.log";
      	};
      };
    };
  };
  users.extraUsers."${name}" = { group = "${name}"; };
  users.extraGroups."${name}" = { };
  users.users.shaarli.isSystemUser = true; 
  systemd.services.shaarli-install = {
    serviceConfig.Type = "oneshot";
    wantedBy = [ "multi-user.target" ];
    script = ''
      if [ ! -d "${dataDir}" ]; then
        #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/cache/
        #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/data/
        #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/pagecache/
        #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/tmp/
        mkdir -p ${dataDir}/{cache,data,pagecache,tmp}
	      ln -s ${pkgs.shaarli}/* ${dataDir}
      fi
      chown -Rc nginx:nginx ${dataDir}
      find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \;
      find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \;
    '';
  };
  # TODO: Write the configuration file here?
  #networking.firewall.allowedTCPPorts = [ 80 ];
}