117 lines
4 KiB
Nix
117 lines
4 KiB
Nix
|
{ pkgs, config, ... }:
|
||
|
|
let
|
||
|
|
dataDir = "/var/www/shaarli-config";
|
||
|
|
name = "shaarli";
|
||
|
|
in
|
||
|
|
{
|
||
|
|
services.nginx = {
|
||
|
|
enable = true;
|
||
|
|
virtualHosts = {
|
||
|
|
"links.mossnet.lan" = {
|
||
|
|
forceSSL = false;
|
||
|
|
enableACME = false;
|
||
|
|
root = "${dataDir}";
|
||
|
|
#listen = [ { addr = "192.168.1.6"; port = 1234; } ];
|
||
|
|
extraConfig = ''
|
||
|
|
index index.php;
|
||
|
|
'';
|
||
|
|
locations = {
|
||
|
|
"/".extraConfig = ''
|
||
|
|
try_files $uri $uri/ index.php;
|
||
|
|
'';
|
||
|
|
|
||
|
|
"~ (index)\.php$".extraConfig = ''
|
||
|
|
fastcgi_split_path_info ^(.+\.php)(/.*)$;
|
||
|
|
if (!-f $document_root$fastcgi_script_name) {
|
||
|
|
return 404;
|
||
|
|
}
|
||
|
|
|
||
|
|
fastcgi_pass unix:${config.services.phpfpm.pools."${name}".socket};
|
||
|
|
fastcgi_index index.php;
|
||
|
|
|
||
|
|
fastcgi_param QUERY_STRING $query_string;
|
||
|
|
fastcgi_param REQUEST_METHOD $request_method;
|
||
|
|
fastcgi_param CONTENT_TYPE $content_type;
|
||
|
|
fastcgi_param CONTENT_LENGTH $content_length;
|
||
|
|
|
||
|
|
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
|
||
|
|
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
|
||
|
|
fastcgi_param PATH_INFO $fastcgi_path_info;
|
||
|
|
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
|
||
|
|
fastcgi_param REQUEST_URI $request_uri;
|
||
|
|
fastcgi_param DOCUMENT_URI $document_uri;
|
||
|
|
fastcgi_param DOCUMENT_ROOT $document_root;
|
||
|
|
fastcgi_param SERVER_PROTOCOL $server_protocol;
|
||
|
|
|
||
|
|
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
|
||
|
|
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
|
||
|
|
|
||
|
|
fastcgi_param REMOTE_ADDR $remote_addr;
|
||
|
|
fastcgi_param REMOTE_PORT $remote_port;
|
||
|
|
fastcgi_param SERVER_ADDR $server_addr;
|
||
|
|
fastcgi_param SERVER_PORT $server_port;
|
||
|
|
fastcgi_param SERVER_NAME $server_name;
|
||
|
|
'';
|
||
|
|
|
||
|
|
"~ \.php$".extraConfig = ''
|
||
|
|
deny all;
|
||
|
|
'';
|
||
|
|
|
||
|
|
"^~ /tpl/".extraConfig = "alias ${pkgs.shaarli}/tpl/;";
|
||
|
|
|
||
|
|
"^~ /plugins/".extraConfig = "alias ${pkgs.shaarli}/plugins/;";
|
||
|
|
|
||
|
|
"~* \\.(?:ico|css|js|gif|jpe?g|png)$".extraConfig = ''
|
||
|
|
expires max;
|
||
|
|
add_header Pragma public;
|
||
|
|
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
|
||
|
|
services.phpfpm = {
|
||
|
|
pools = {
|
||
|
|
"${name}" = {
|
||
|
|
user = "nginx";
|
||
|
|
group = "nginx";
|
||
|
|
#listen = "/run/phpfpm/php.sock";
|
||
|
|
settings = {
|
||
|
|
"listen.owner" = "nginx";
|
||
|
|
"listen.group" = "nginx";
|
||
|
|
"user" = "nginx";
|
||
|
|
"pm" = "dynamic";
|
||
|
|
"pm.max_children" = "4";
|
||
|
|
"pm.min_spare_servers" = "1";
|
||
|
|
"pm.max_spare_servers" = "4";
|
||
|
|
"pm.max_requests" = "32";
|
||
|
|
"catch_workers_output" = "1";
|
||
|
|
"php_admin_value[error_log]" = "/var/log/nginx/${name}-phpfpm-error.log";
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
};
|
||
|
|
users.extraUsers."${name}" = { group = "${name}"; };
|
||
|
|
users.extraGroups."${name}" = { };
|
||
|
|
systemd.services.shaarli-install = {
|
||
|
|
serviceConfig.Type = "oneshot";
|
||
|
|
wantedBy = [ "multi-user.target" ];
|
||
|
|
script = ''
|
||
|
|
if [ ! -d "${dataDir}" ]; then
|
||
|
|
mkdir -p ${dataDir}/{cache,data,pagecache,tmp}
|
||
|
|
cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/cache/
|
||
|
|
cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/data/
|
||
|
|
cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/pagecache/
|
||
|
|
cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/tmp/
|
||
|
|
ln -S ${pkgs.shaarli}/* ${dataDir}
|
||
|
|
fi
|
||
|
|
chown -Rc nginx:nginx ${dataDir}
|
||
|
|
find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \;
|
||
|
|
find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \;
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
# TODO: Write the configuration file here?
|
||
|
|
networking.firewall.allowedTCPPorts = [ 1234 ];
|
||
|
|
}
|