140 lines
3.6 KiB
Nix
140 lines
3.6 KiB
Nix
{ config, lib, pkgs, inputs, ... }:
|
|
|
|
# 1. copy wp folder to host
|
|
# 2. chown nginx:nginx wordpress.bak/rm16bleibt.org/* -R
|
|
# 3. create user through webinterface
|
|
# 4. delete hello world post
|
|
# 5. run importer
|
|
|
|
with lib;
|
|
|
|
let
|
|
|
|
user = "wordpress";
|
|
stateDir = "/var/lib/wordpress/rm16bleibt.org";
|
|
webserver = config.services.nginx;
|
|
uploadsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/uploads";
|
|
fontsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/fonts";
|
|
|
|
in {
|
|
networking = {
|
|
hostName = mkDefault "wordpress";
|
|
useDHCP = false;
|
|
};
|
|
|
|
imports = [
|
|
inputs.self.nixosModules.malobeo.users
|
|
../modules/sshd.nix
|
|
];
|
|
|
|
malobeo.users = {
|
|
malobeo = false;
|
|
admin = true;
|
|
};
|
|
|
|
users.users.wordpress = {
|
|
group = webserver.group;
|
|
isSystemUser = true;
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d '${stateDir}' 0750 ${user} ${webserver.group} - -"
|
|
"d '${stateDir}/wp-content' 0750 ${user} ${webserver.group} - -"
|
|
"d '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
|
|
"Z '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
|
|
"d '${fontsDir}' 0750 ${user} ${webserver.group} - -"
|
|
"Z '${fontsDir}' 0750 ${user} ${webserver.group} - -"
|
|
];
|
|
|
|
services.phpfpm.pools = {
|
|
"wordpress-rm16bleibt.org" = {
|
|
user = user;
|
|
group = webserver.group;
|
|
settings = {
|
|
"pm" = "dynamic";
|
|
"pm.max_children" = 32;
|
|
"pm.start_servers" = 2;
|
|
"pm.min_spare_servers" = 2;
|
|
"pm.max_spare_servers" = 4;
|
|
"pm.max_requests" = 500;
|
|
"listen.owner" = webserver.user;
|
|
"listen.group" = webserver.group;
|
|
};
|
|
};
|
|
};
|
|
|
|
services.mysql = {
|
|
enable = true;
|
|
#package = mkDefault pkgs.mariadb;
|
|
package = pkgs.mysql84;
|
|
ensureDatabases = ["wordpress"];
|
|
ensureUsers = [
|
|
{
|
|
name = "wordpress";
|
|
ensurePermissions = {
|
|
"wordpress.*" = "ALL PRIVILEGES";
|
|
};
|
|
}
|
|
];
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
virtualHosts."www.rm16bleibt.org" = {
|
|
#serverName = "rm16bleibt.org";
|
|
root = "/var/lib/wordpress/rm16bleibt.org";
|
|
extraConfig = ''
|
|
index index.php;
|
|
'';
|
|
locations = {
|
|
"/" = {
|
|
priority = 200;
|
|
extraConfig = ''
|
|
try_files $uri $uri/ /index.php$is_args$args;
|
|
'';
|
|
};
|
|
"~ \\.php$" = {
|
|
priority = 500;
|
|
extraConfig = ''
|
|
fastcgi_split_path_info ^(.+\.php)(/.+)$;
|
|
fastcgi_pass unix:${config.services.phpfpm.pools."wordpress-rm16bleibt.org".socket};
|
|
fastcgi_index index.php;
|
|
include "${config.services.nginx.package}/conf/fastcgi.conf";
|
|
fastcgi_param PATH_INFO $fastcgi_path_info;
|
|
fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;
|
|
|
|
# Mitigate https://httpoxy.org/ vulnerabilities
|
|
fastcgi_param HTTP_PROXY "";
|
|
fastcgi_intercept_errors off;
|
|
fastcgi_buffer_size 16k;
|
|
fastcgi_buffers 4 16k;
|
|
fastcgi_connect_timeout 300;
|
|
fastcgi_send_timeout 300;
|
|
fastcgi_read_timeout 300;
|
|
'';
|
|
};
|
|
"~ /\\." = {
|
|
priority = 800;
|
|
extraConfig = "deny all;";
|
|
};
|
|
"~* /(?:uploads|files)/.*\\.php$" = {
|
|
priority = 900;
|
|
extraConfig = "deny all;";
|
|
};
|
|
"~* \\.(js|css|png|jpg|jpeg|gif|ico)$" = {
|
|
priority = 1000;
|
|
extraConfig = ''
|
|
expires max;
|
|
log_not_found off;
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = [ 80 ];
|
|
|
|
system.stateVersion = "22.11"; # Did you read the comment?
|
|
}
|
|
|