{ pkgs, config, ... }: let dataDir = "/var/www/shaarli-config"; name = "shaarli"; in { services.nginx = { enable = true; virtualHosts = { "links.mossnet.lan" = { forceSSL = false; enableACME = false; root = "${dataDir}"; extraConfig = '' index index.php; ''; locations = { "/".extraConfig = '' index index.php; try_files _ /index.php$is_args$args; ''; "~ (index)\\.php$".extraConfig = '' try_files $uri =404; fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass unix:${config.services.phpfpm.pools."${name}".socket}; fastcgi_index index.php; fastcgi_param QUERY_STRING $query_string; fastcgi_param REQUEST_METHOD $request_method; fastcgi_param CONTENT_TYPE $content_type; fastcgi_param CONTENT_LENGTH $content_length; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param SCRIPT_NAME $fastcgi_script_name; fastcgi_param PATH_INFO $fastcgi_path_info; fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info; fastcgi_param REQUEST_URI $request_uri; fastcgi_param DOCUMENT_URI $document_uri; fastcgi_param DOCUMENT_ROOT $document_root; fastcgi_param SERVER_PROTOCOL $server_protocol; fastcgi_param GATEWAY_INTERFACE CGI/1.1; fastcgi_param SERVER_SOFTWARE nginx/$nginx_version; fastcgi_param REMOTE_ADDR $remote_addr; fastcgi_param REMOTE_PORT $remote_port; fastcgi_param SERVER_ADDR $server_addr; fastcgi_param SERVER_PORT $server_port; fastcgi_param SERVER_NAME $server_name; ''; "~ \\.php$".extraConfig = '' deny all; ''; "^~ /tpl/".extraConfig = "alias ${pkgs.shaarli}/tpl/;"; "^~ /plugins/".extraConfig = "alias ${pkgs.shaarli}/plugins/;"; "~* \\.(?:ico|css|js|gif|jpe?g|png)$".extraConfig = '' expires max; add_header Pragma public; add_header Cache-Control "public, must-revalidate, proxy-revalidate"; ''; }; }; }; }; services.phpfpm = { pools = { "${name}" = { user = "nginx"; group = "nginx"; #listen = "/run/phpfpm/php.sock"; settings = { "listen.owner" = "nginx"; "listen.group" = "nginx"; "user" = "nginx"; "pm" = "dynamic"; "pm.max_children" = "4"; "pm.min_spare_servers" = "1"; "pm.max_spare_servers" = "4"; "pm.max_requests" = "32"; "catch_workers_output" = "1"; "php_admin_value[error_log]" = "/var/log/nginx/${name}-phpfpm-error.log"; }; }; }; }; users.extraUsers."${name}" = { group = "${name}"; }; users.extraGroups."${name}" = { }; users.users.shaarli.isSystemUser = true; systemd.services.shaarli-install = { serviceConfig.Type = "oneshot"; wantedBy = [ "multi-user.target" ]; script = '' if [ ! -d "${dataDir}" ]; then #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/cache/ #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/data/ #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/pagecache/ #cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/tmp/ mkdir -p ${dataDir}/{cache,data,pagecache,tmp} ln -s ${pkgs.shaarli}/* ${dataDir} fi chown -Rc nginx:nginx ${dataDir} find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \; find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \; ''; }; #networking.firewall.allowedTCPPorts = [ 80 ]; }