helm/profiles/shaarli/default.nix
2022-09-19 08:13:50 +10:00

115 lines
4.1 KiB
Nix

{ pkgs, config, ... }:
let
dataDir = "/var/www/shaarli-config";
name = "shaarli";
in
{
services.nginx = {
enable = true;
virtualHosts = {
"links.mossnet.lan" = {
forceSSL = false;
enableACME = false;
root = "${dataDir}";
extraConfig = ''
index index.php;
'';
locations = {
"/".extraConfig = ''
index index.php;
try_files _ /index.php$is_args$args;
'';
"~ (index)\\.php$".extraConfig = ''
try_files $uri =404;
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:${config.services.phpfpm.pools."${name}".socket};
fastcgi_index index.php;
fastcgi_param QUERY_STRING $query_string;
fastcgi_param REQUEST_METHOD $request_method;
fastcgi_param CONTENT_TYPE $content_type;
fastcgi_param CONTENT_LENGTH $content_length;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
fastcgi_param SCRIPT_NAME $fastcgi_script_name;
fastcgi_param PATH_INFO $fastcgi_path_info;
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
fastcgi_param REQUEST_URI $request_uri;
fastcgi_param DOCUMENT_URI $document_uri;
fastcgi_param DOCUMENT_ROOT $document_root;
fastcgi_param SERVER_PROTOCOL $server_protocol;
fastcgi_param GATEWAY_INTERFACE CGI/1.1;
fastcgi_param SERVER_SOFTWARE nginx/$nginx_version;
fastcgi_param REMOTE_ADDR $remote_addr;
fastcgi_param REMOTE_PORT $remote_port;
fastcgi_param SERVER_ADDR $server_addr;
fastcgi_param SERVER_PORT $server_port;
fastcgi_param SERVER_NAME $server_name;
'';
"~ \\.php$".extraConfig = ''
deny all;
'';
"^~ /tpl/".extraConfig = "alias ${pkgs.shaarli}/tpl/;";
"^~ /plugins/".extraConfig = "alias ${pkgs.shaarli}/plugins/;";
"~* \\.(?:ico|css|js|gif|jpe?g|png)$".extraConfig = ''
expires max;
add_header Pragma public;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
'';
};
};
};
};
services.phpfpm = {
pools = {
"${name}" = {
user = "nginx";
group = "nginx";
#listen = "/run/phpfpm/php.sock";
settings = {
"listen.owner" = "nginx";
"listen.group" = "nginx";
"user" = "nginx";
"pm" = "dynamic";
"pm.max_children" = "4";
"pm.min_spare_servers" = "1";
"pm.max_spare_servers" = "4";
"pm.max_requests" = "32";
"catch_workers_output" = "1";
"php_admin_value[error_log]" = "/var/log/nginx/${name}-phpfpm-error.log";
};
};
};
};
users.extraUsers."${name}" = { group = "${name}"; };
users.extraGroups."${name}" = { };
users.users.shaarli.isSystemUser = true;
systemd.services.shaarli-install = {
serviceConfig.Type = "oneshot";
wantedBy = [ "multi-user.target" ];
script = ''
if [ ! -d "${dataDir}" ]; then
#cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/cache/
#cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/data/
#cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/pagecache/
#cp -R ${pkgs.shaarli}/data.orig/.htaccess ${dataDir}/tmp/
mkdir -p ${dataDir}/{cache,data,pagecache,tmp}
ln -s ${pkgs.shaarli}/* ${dataDir}
fi
chown -Rc nginx:nginx ${dataDir}
find ${dataDir} -type d ! -perm 0700 -exec chmod 0700 {} \; -exec chmod g-s {} \;
find ${dataDir} -type f ! -perm 0600 -exec chmod 0600 {} \;
'';
};
#networking.firewall.allowedTCPPorts = [ 80 ];
}