142 lines
4.7 KiB
Nix
142 lines
4.7 KiB
Nix
{ pkgs, lib, config, ... }:
|
|
let
|
|
domain = "diabetes-austria.cloonar.dev";
|
|
dataDir = "/var/www/${domain}";
|
|
in {
|
|
systemd.services."phpfpm-${domain}".serviceConfig.ProtectHome = lib.mkForce false;
|
|
|
|
services.phpfpm.pools."${domain}" = {
|
|
user = domain;
|
|
settings = {
|
|
"listen.owner" = config.services.nginx.user;
|
|
"pm" = "dynamic";
|
|
"pm.max_children" = 32;
|
|
"pm.max_requests" = 500;
|
|
"pm.start_servers" = 2;
|
|
"pm.min_spare_servers" = 2;
|
|
"pm.max_spare_servers" = 5;
|
|
"php_admin_value[error_log]" = "stderr";
|
|
"php_admin_flag[log_errors]" = true;
|
|
"catch_workers_output" = true;
|
|
"access.log" = "/var/log/$pool.access.log";
|
|
};
|
|
phpPackage = pkgs.nur.repos.izorkin.php74;
|
|
phpEnv."PATH" = lib.makeBinPath [ pkgs.nur.repos.izorkin.php74 ];
|
|
};
|
|
|
|
services.nginx.virtualHosts."${domain}" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
acmeRoot = null;
|
|
root = "${dataDir}/public";
|
|
|
|
locations."/favicon.ico".extraConfig = ''
|
|
log_not_found off;
|
|
access_log off;
|
|
'';
|
|
|
|
# TYPO3 - Rule for versioned static files, configured through:
|
|
# - $GLOBALS['TYPO3_CONF_VARS']['BE']['versionNumberInFilename']
|
|
# - $GLOBALS['TYPO3_CONF_VARS']['FE']['versionNumberInFilename']
|
|
|
|
extraConfig = ''
|
|
if (!-e $request_filename) {
|
|
rewrite ^/(.+)\.(\d+)\.(php|js|css|png|jpg|gif|gzip)$ /$1.$3 last;
|
|
}
|
|
'';
|
|
|
|
# TYPO3 - Block access to composer files
|
|
locations."~* composer\.(?:json|lock)".extraConfig = ''
|
|
deny all;
|
|
'';
|
|
|
|
|
|
# TYPO3 - Block access to flexform files
|
|
locations."~* flexform[^.]*\.xml".extraConfig = ''
|
|
deny all;
|
|
'';
|
|
|
|
# TYPO3 - Block access to language files
|
|
locations."~* locallang[^.]*\.(?:xml|xlf)$".extraConfig = ''
|
|
deny all;
|
|
'';
|
|
|
|
# TYPO3 - Block access to static typoscript files
|
|
locations."~* ext_conf_template\.txt|ext_typoscript_constants\.txt|ext_typoscript_setup\.txt".extraConfig = ''
|
|
deny all;
|
|
'';
|
|
|
|
# TYPO3 - Block access to miscellaneous protected files
|
|
locations."~* /.*\.(?:bak|co?nf|cfg|ya?ml|ts|typoscript|tsconfig|dist|fla|in[ci]|log|sh|sql|sqlite)$".extraConfig = ''
|
|
deny all;
|
|
'';
|
|
|
|
# TYPO3 - Block access to recycler and temporary directories
|
|
locations."~ _(?:recycler|temp)_/".extraConfig = ''
|
|
deny all;
|
|
'';
|
|
|
|
# TYPO3 - Block access to configuration files stored in fileadmin
|
|
locations."~ fileadmin/(?:templates)/.*\.(?:txt|ts|typoscript)$".extraConfig = ''
|
|
deny all;
|
|
'';
|
|
|
|
|
|
# TYPO3 - Block access to libraries, source and temporary compiled data
|
|
locations."~ ^(?:vendor|typo3_src|typo3temp/var)".extraConfig = ''
|
|
deny all;
|
|
'';
|
|
|
|
|
|
# TYPO3 - Block access to protected extension directories
|
|
locations."~ (?:typo3conf/ext|typo3/sysext|typo3/ext)/[^/]+/(?:Configuration|Resources/Private|Tests?|Documentation|docs?)/".extraConfig = ''
|
|
deny all;
|
|
'';
|
|
|
|
locations."/".extraConfig = ''
|
|
index index.php index.html;
|
|
try_files $uri $uri/ /index.php$is_args$args;
|
|
'';
|
|
|
|
# TYPO3 Backend URLs
|
|
locations."/typo3$".extraConfig = ''
|
|
rewrite ^ /typo3/;
|
|
'';
|
|
|
|
locations."/typo3/".extraConfig = ''
|
|
try_files $uri /typo3/index.php$is_args$args;
|
|
'';
|
|
|
|
locations."~ [^/]\.php(/|$)".extraConfig = ''
|
|
fastcgi_split_path_info ^(.+?\.php)(/.*)$;
|
|
if (!-f $document_root$fastcgi_script_name) {
|
|
return 404;
|
|
}
|
|
include ${pkgs.nginx}/conf/fastcgi_params;
|
|
include ${pkgs.nginx}/conf/fastcgi.conf;
|
|
fastcgi_buffer_size 32k;
|
|
fastcgi_buffers 8 16k;
|
|
fastcgi_connect_timeout 240s;
|
|
fastcgi_read_timeout 240s;
|
|
fastcgi_send_timeout 240s;
|
|
fastcgi_pass unix:${config.services.phpfpm.pools."${domain}".socket};
|
|
fastcgi_index index.php;
|
|
'';
|
|
};
|
|
users.users."${domain}" = {
|
|
#isSystemUser = true;
|
|
isNormalUser = true;
|
|
createHome = true;
|
|
home = dataDir;
|
|
homeMode= "770";
|
|
#home = "/home/${domain}";
|
|
group = "nginx";
|
|
openssh.authorizedKeys.keys = [
|
|
"ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDZg6mxd6kuB7zxxTMw/kgP2Cfddjnz8hCtSbzKckNBtM9TbnJ76ZbAjgh/TDcm/qBADlICi+Ib0tMlzK1BJWLxe1SjHOR78BPzPGASmjtj6vuNAFyM20Ise5rhbbo2sC6o82F6HP4iak+hFzhwTf0Ld1LT5dJ78CltKgHFmyKIaRYBILn5MvTnmORG2UfFY1Tef2DiujrQD24bM2f4BYR2Ni0zoyim8UUkjciQkXceB8yDJQX/e1WcNxGU7Bsh2WGZMu6Ykeinbf7LIu8pPGH2sf81N8tbsYc4PxZv9lovgRWdNNmSfB+Ocsn4jWBN9nVtb8XMXycTaenI4W57F+ZWrx0LddPhwfXbLAdFgxyvqtWW/WF48DH2vETQcCATowIhtU7QDZ3pDKaTIIYhDYnMvPJuM2rQP0SCMaNzQlziXWFvKTRw8nnqkpzTz488OJVkYvULXhiRgr0Uxe6eh7XCOO9SF5wdj1cGeewefOiOjpxmg/GnaQvQW6KjFRMj1ZE="
|
|
];
|
|
};
|
|
users.groups.${domain} = {};
|
|
|
|
services.mysqlBackup.databases = [ "diabetes_austria" ];
|
|
}
|