feat: web change site handling, add php to scana11y, add ssh deploy key for gitea

hosts/web-arm/sites/scana11y.com.nix

@@ -27,10 +27,50 @@ in {
      add_header Cache-Control "public";
     '';
 
-    locations."~ [^/]\.php(/|$)".extraConfig = ''
-      deny all;
+    locations."~ [^/]\\.php(/|$)".extraConfig = ''
+        fastcgi_split_path_info ^(.+?\.php)(/.*)$;
+        if (!-f $document_root$fastcgi_script_name) {
+            return 404;
+        }
+        include ${pkgs.nginx}/conf/fastcgi_params;
+        include ${pkgs.nginx}/conf/fastcgi.conf;
+        fastcgi_buffer_size 32k;
+        fastcgi_buffers 8 16k;
+        fastcgi_connect_timeout 240s;
+        fastcgi_read_timeout 240s;
+        fastcgi_send_timeout 240s;
+        fastcgi_pass unix:${config.services.phpfpm.pools."${domain}".socket};
+        fastcgi_index        index.php;
     '';
   };
+
+
+  systemd.services."phpfpm-${domain}" = {
+    serviceConfig = {
+      ProtectHome = lib.mkForce "tmpfs";
+      BindPaths = "BindPaths=/var/www/${domain}:/var/www/${domain}";
+    };
+  };
+
+  services.phpfpm.pools."${domain}" = {
+    user = user;
+    settings = {
+      "listen.owner" = config.services.nginx.user;
+      "pm" = "dynamic";
+      "pm.max_children" = 32;
+      "pm.max_requests" = 500;
+      "pm.start_servers" = 2;
+      "pm.min_spare_servers" = 2;
+      "pm.max_spare_servers" = 5;
+      "php_admin_value[error_log]" = "syslog";
+      "php_admin_value[max_execution_time]" = 240;
+      "php_admin_value[max_input_vars]" = 1500;
+      "access.log" = "/var/log/$pool.access.log";
+    };
+    phpPackage = pkgs.php84;
+    phpEnv."PATH" = pkgs.lib.makeBinPath [ pkgs.php84 ];
+  };
+
   users.users."${user}" = {
     isNormalUser = true;
     createHome = true;