97 lines
2.3 KiB
Nix
97 lines
2.3 KiB
Nix
{ hostAddress
|
|
, localAddress
|
|
, httpsPort ? 443
|
|
}: {
|
|
config = { config, pkgs, lib, ... }: {
|
|
imports = [
|
|
../profiles/containers/configuration.nix
|
|
];
|
|
|
|
networking.firewall.enable = false;
|
|
|
|
services.ddclientovh = {
|
|
enable = true;
|
|
domain = "www.stefanjunker.de";
|
|
};
|
|
|
|
services.nginx.enable = true;
|
|
services.nginx.virtualHosts."stefanjunker.de" = {
|
|
default = true;
|
|
onlySSL = true;
|
|
root = "/var/www/stefanjunker.de/htdocs";
|
|
|
|
sslCertificate = "/etc/secrets/stefanjunker.de/nginx/nginx.crt";
|
|
sslCertificateKey = "/etc/secrets/stefanjunker.de/nginx/nginx.key";
|
|
|
|
locations."/fi" = {
|
|
index = "index.php";
|
|
};
|
|
|
|
locations."~ ^(.+\.php)(.*)$".extraConfig = ''
|
|
fastcgi_split_path_info ^(.+\.php)(.*)$;
|
|
|
|
fastcgi_pass unix:${config.services.phpfpm.pools.mypool.socket};
|
|
fastcgi_index index.php;
|
|
'';
|
|
};
|
|
|
|
services.phpfpm.pools.mypool = {
|
|
user = "nobody";
|
|
phpPackage = pkgs.php5;
|
|
settings = {
|
|
"listen.owner" = config.services.nginx.user;
|
|
"pm" = "dynamic";
|
|
"pm.max_children" = 5;
|
|
"pm.start_servers" = 2;
|
|
"pm.min_spare_servers" = 1;
|
|
"pm.max_spare_servers" = 3;
|
|
"pm.max_requests" = 500;
|
|
|
|
"php_admin_value[error_reporting]" = "E_ALL & ~E_NOTICE & ~E_WARNING & ~E_STRICT & ~E_DEPRECATED";
|
|
};
|
|
};
|
|
|
|
# the custom php5 we're using here has no fpm-systemd, so the default `Type = "notify"` won't work
|
|
systemd.services."phpfpm-mypool" = {
|
|
serviceConfig = {
|
|
Type = lib.mkForce "simple";
|
|
};
|
|
};
|
|
|
|
services.mysql = {
|
|
enable = true;
|
|
package = pkgs.mariadb;
|
|
};
|
|
};
|
|
|
|
autoStart = true;
|
|
|
|
bindMounts = {
|
|
"/etc/secrets/" = {
|
|
hostPath = "/var/lib/container-volumes/webserver/etc-secrets";
|
|
isReadOnly = true;
|
|
};
|
|
|
|
"/var/www" = {
|
|
hostPath = "/var/lib/container-volumes/webserver/var-www";
|
|
isReadOnly = false;
|
|
};
|
|
|
|
"/var/lib/mysql" = {
|
|
hostPath = "/var/lib/container-volumes/webserver/var-lib-mysql";
|
|
isReadOnly = false;
|
|
};
|
|
};
|
|
|
|
privateNetwork = true;
|
|
forwardPorts = [
|
|
{
|
|
# https
|
|
containerPort = 443;
|
|
hostPort = httpsPort;
|
|
protocol = "tcp";
|
|
}
|
|
];
|
|
|
|
inherit hostAddress localAddress;
|
|
}
|