helm/profiles/shaarli/default.nix

{ pkgs, config, ... }:
let
  dataDir = "/var/www/shaarli-config";
  name = "shaarli";
in
{
  services.nginx = {
    enable = true;
    virtualHosts = {
      "links.mossnet.lan" = {
        forceSSL = false;
        enableACME = false;
        root = "${dataDir}";
        extraConfig = ''
          index index.php;
        '';
        locations = {
          "/".extraConfig = ''
            index index.php;
            try_files _ /index.php$is_args$args;
          '';

          "~ (index)\\.php$".extraConfig = ''
            try_files $uri =404;
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
    
            fastcgi_pass unix:${config.services.phpfpm.pools."${name}".socket};
            fastcgi_index index.php;
    
            fastcgi_param   QUERY_STRING            $query_string;
            fastcgi_param   REQUEST_METHOD          $request_method;
            fastcgi_param   CONTENT_TYPE            $content_type;
            fastcgi_param   CONTENT_LENGTH          $content_length;
    
            fastcgi_param   SCRIPT_FILENAME         $document_root$fastcgi_script_name;
            fastcgi_param   SCRIPT_NAME             $fastcgi_script_name;
            fastcgi_param   PATH_INFO               $fastcgi_path_info;
            fastcgi_param   PATH_TRANSLATED         $document_root$fastcgi_path_info;
            fastcgi_param   REQUEST_URI             $request_uri;
            fastcgi_param   DOCUMENT_URI            $document_uri;
            fastcgi_param   DOCUMENT_ROOT           $document_root;
            fastcgi_param   SERVER_PROTOCOL         $server_protocol;
    
            fastcgi_param   GATEWAY_INTERFACE       CGI/1.1;
            fastcgi_param   SERVER_SOFTWARE         nginx/$nginx_version;
    
            fastcgi_param   REMOTE_ADDR             $remote_addr;
            fastcgi_param   REMOTE_PORT             $remote_port;
            fastcgi_param   SERVER_ADDR             $server_addr;
            fastcgi_param   SERVER_PORT             $server_port;
            fastcgi_param   SERVER_NAME             $server_name;
          '';

          "~ \\.php$".extraConfig = ''
            deny all;
          '';

          "^~ /tpl/".extraConfig = "alias ${pkgs.shaarli}/tpl/;";

          "^~ /plugins/".extraConfig = "alias ${pkgs.shaarli}/plugins/;";

          "~* \\.(?:ico|css|js|gif|jpe?g|png)$".extraConfig = ''
            expires max;
            add_header Pragma public;
            add_header Cache-Control "public, must-revalidate, proxy-revalidate";
          '';
        };
      };
    };
  };

  services.phpfpm = {
    pools = {
      "${name}" = {
        user = "nginx";
        group = "nginx";
        #listen = "/run/phpfpm/php.sock";
        settings = {
          "listen.owner" = "nginx";
          "listen.group" = "nginx";
          "user" = "nginx";
          "pm" = "dynamic";
          "pm.max_children" = "4";
          "pm.min_spare_servers" = "1";
          "pm.max_spare_servers" = "4";
          "pm.max_requests" = "32";
          "catch_workers_output" = "1";
          "php_admin_value[error_log]" = "/var/log/nginx/${name}-phpfpm-error.log";
        };
      };
    };
  };
  users.extraUsers."${name}" = { group = "${name}"; };
  users.extraGroups."${name}" = { };
  users.users.shaarli.isSystemUser = true;
  systemd.services.shaarli-install = {
    serviceConfig.Type = "oneshot";
    wantedBy = [ "multi-user.target" ];
    script = ''
            if [ ! -d "${dataDir}" ]; then
              #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/cache/
              #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/data/
              #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/pagecache/
              #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/tmp/
              mkdir -p ${dataDir}/{cache,data,pagecache,tmp}
      	      ln -s ${pkgs.shaarli}/* ${dataDir}
            fi
            chown -Rc nginx:nginx ${dataDir}
            find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \;
            find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \;
    '';
  };
  #networking.firewall.allowedTCPPorts = [ 80 ];
}