feat: web change site handling, add php to scana11y, add ssh deploy key for gitea

hosts/web-arm/sites/default.nix

@@ -0,0 +1,37 @@
+{ ... }: {
+  imports = [
+    ./autoconfig.cloonar.com.nix
+    ./feeds.cloonar.com.nix
+    ./webmail.cloonar.com.nix
+
+    ./vcard.cloonar.dev.nix
+    ./vcard.cloonar.com.nix
+
+    ./cloonar.com.nix
+    ./gbv-aktuell.at.nix
+    ./matomo.cloonar.com.nix
+    ./support.cloonar.dev.nix
+    ./stage.cloonar-technologies.at.nix
+
+    ./stage.scana11y.com.nix
+    ./scana11y.com.nix
+
+    ./cloonar.dev.nix
+    ./paraclub.at.nix
+    ./api.paraclub.at.nix
+    ./module.paraclub.at.nix
+    ./tandem.paraclub.at.nix
+    ./paraclub.cloonar.dev.nix
+    ./api.paraclub.cloonar.dev.nix
+    ./tandem.paraclub.cloonar.dev.nix
+    ./module.paraclub.cloonar.dev.nix
+    ./gbv-aktuell.cloonar.dev.nix
+    ./stage.myhidden.life.nix
+    ./stage.korean-skin.care.nix
+    ./feeds.jordanrannells.com.nix
+    ./dialog-relations.cloonar.dev.nix
+    ./dialog-relations.at.nix
+    ./lena-schilling.cloonar.dev.nix
+    ./lena-schilling.at.nix
+  ];
+}

hosts/web-arm/sites/scana11y.com.nix

@@ -27,10 +27,50 @@ in {
      add_header Cache-Control "public";
     '';
 
-    locations."~ [^/]\.php(/|$)".extraConfig = ''
-      deny all;
+    locations."~ [^/]\\.php(/|$)".extraConfig = ''
+        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+        if (!-f $document_root$fastcgi_script_name) {
+            return 404;
+        }
+        include ${pkgs.nginx}/conf/fastcgi_params;
+        include ${pkgs.nginx}/conf/fastcgi.conf;
+        fastcgi_buffer_size 32k;
+        fastcgi_buffers 8 16k;
+        fastcgi_connect_timeout 240s;
+        fastcgi_read_timeout 240s;
+        fastcgi_send_timeout 240s;
+        fastcgi_pass unix:${config.services.phpfpm.pools."${domain}".socket};
+        fastcgi_index        index.php;
     '';
   };
+
+
+  systemd.services."phpfpm-${domain}" = {
+    serviceConfig = {
+      ProtectHome = lib.mkForce "tmpfs";
+      BindPaths = "BindPaths=/var/www/${domain}:/var/www/${domain}";
+    };
+  };
+
+  services.phpfpm.pools."${domain}" = {
+    user = user;
+    settings = {
+      "listen.owner" = config.services.nginx.user;
+      "pm" = "dynamic";
+      "pm.max_children" = 32;
+      "pm.max_requests" = 500;
+      "pm.start_servers" = 2;
+      "pm.min_spare_servers" = 2;
+      "pm.max_spare_servers" = 5;
+      "php_admin_value[error_log]" = "syslog";
+      "php_admin_value[max_execution_time]" = 240;
+      "php_admin_value[max_input_vars]" = 1500;
+      "access.log" = "/var/log/$pool.access.log";
+    };
+    phpPackage = pkgs.php84;
+    phpEnv."PATH" = pkgs.lib.makeBinPath [ pkgs.php84 ];
+  };
+
   users.users."${user}" = {
     isNormalUser = true;
     createHome = true;