infrastructure/machines/wordpress/configuration.nix

{ config, lib, pkgs, inputs, ... }:

# 1. copy wp folder to host
# 2. chown nginx:nginx wordpress.bak/rm16bleibt.org/* -R
# 3. create user through webinterface
# 4. delete hello world post
# 5. run importer

with lib;

let

  user = "wordpress";
  stateDir = "/var/lib/wordpress/rm16bleibt.org";
  webserver = config.services.nginx;
  uploadsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/uploads";
  fontsDir = "/var/lib/wordpress/rm16bleibt.org/wp-content/fonts";

in {
  networking = {
    hostName = mkDefault "wordpress";
    useDHCP = false;
  };

  imports = [
    inputs.malobeo.nixosModules.malobeo.users

    ../modules/sshd.nix
  ];

  malobeo.users = {
    malobeo = false;
    admin = true;
  };

  users.users.wordpress = {
    group = webserver.group;
    isSystemUser = true;
  };

  systemd.tmpfiles.rules = [
    "d '${stateDir}' 0750 ${user} ${webserver.group} - -"
    "d '${stateDir}/wp-content' 0750 ${user} ${webserver.group} - -"
    "d '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
    "Z '${uploadsDir}' 0750 ${user} ${webserver.group} - -"
    "d '${fontsDir}' 0750 ${user} ${webserver.group} - -"
    "Z '${fontsDir}' 0750 ${user} ${webserver.group} - -"
  ];

  services.phpfpm.pools = {
    "wordpress-rm16bleibt.org" = {
      user = user;
      group = webserver.group;
      settings = {
        "pm" = "dynamic";
        "pm.max_children" = 32;
        "pm.start_servers" = 2;
        "pm.min_spare_servers" = 2;
        "pm.max_spare_servers" = 4;
        "pm.max_requests" = 500;
        "listen.owner" = webserver.user;
        "listen.group" = webserver.group;
      };
    };
  };

  services.mysql = {
    enable = true;
    #package = mkDefault pkgs.mariadb;
    package = pkgs.mysql84;
    ensureDatabases = ["wordpress"];
    ensureUsers = [
      {
        name = "wordpress";
        ensurePermissions = {
          "wordpress.*" = "ALL PRIVILEGES";
        };
      }
    ];
  };

  services.nginx = {
    enable = true;
    virtualHosts."_" = {
      #serverName = "rm16bleibt.org";
      root = "/var/lib/wordpress/rm16bleibt.org";
      extraConfig = ''
        index index.php;
      '';
      locations = {
        "/" = {
          priority = 200;
          extraConfig = ''
            try_files $uri $uri/ /index.php$is_args$args;
          '';
        };
        "~ \\.php$" = {
          priority = 500;
          extraConfig = ''
            fastcgi_split_path_info ^(.+\.php)(/.+)$;
            fastcgi_pass unix:${config.services.phpfpm.pools."wordpress-rm16bleibt.org".socket};
            fastcgi_index index.php;
            include "${config.services.nginx.package}/conf/fastcgi.conf";
            fastcgi_param PATH_INFO $fastcgi_path_info;
            fastcgi_param PATH_TRANSLATED $document_root$fastcgi_path_info;

            # Mitigate https://httpoxy.org/ vulnerabilities
            fastcgi_param HTTP_PROXY "";
            fastcgi_intercept_errors off;
            fastcgi_buffer_size 16k;
            fastcgi_buffers 4 16k;
            fastcgi_connect_timeout 300;
            fastcgi_send_timeout 300;
            fastcgi_read_timeout 300;
          '';
        };
        "~ /\\." = {
          priority = 800;
          extraConfig = "deny all;";
        };
        "~* /(?:uploads|files)/.*\\.php$" = {
          priority = 900;
          extraConfig = "deny all;";
        };
        "~* \\.(js|css|png|jpg|jpeg|gif|ico)$" = {
          priority = 1000;
          extraConfig = ''
            expires max;
            log_not_found off;
          '';
        };
      };
    };
  };

  networking.firewall.allowedTCPPorts = [ 80 ];

  system.stateVersion = "22.11"; # Did you read the comment?
}