Revert "Merge pull request #63156 from Izorkin/phpfpm-rootless"

This reverts commit b5478fd1a2ef442a54c36031bf3a27a96b5ea31c, reversing
changes made to dbb00bfcbfb291e79d4d2d512041656e6bcfcd9a.

7 files changed, 71 insertions, 99 deletions

diff --git a/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix b/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
index e83270fda5c..910e1d937bf 100644
--- a/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
+++ b/nixos/modules/services/web-apps/icingaweb2/icingaweb2.nix
@@ -1,6 +1,7 @@
 { config, lib, pkgs, ... }: with lib; let
   cfg = config.services.icingaweb2;
   poolName = "icingaweb2";
+  phpfpmSocketName = "/var/run/phpfpm/${poolName}.sock";
 
   defaultConfig = {
     global = {
@@ -161,23 +162,19 @@ in {
   };
 
   config = mkIf cfg.enable {
-    services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
-      "${poolName}" = {
-        socketName = "${poolName}";
-        phpPackage = pkgs.php;
-        user = "icingaweb2";
-        group = "icingaweb2";
-        extraConfig = ''
-          listen.owner = ${config.services.nginx.user}
-          listen.group = ${config.services.nginx.group}
-          listen.mode = 0600
-          pm = dynamic
-          pm.max_children = 75
-          pm.start_servers = 2
-          pm.min_spare_servers = 2
-          pm.max_spare_servers = 10
-        '';
-      };
+    services.phpfpm.poolConfigs = mkIf (cfg.pool == "${poolName}") {
+      "${poolName}" = ''
+        listen = "${phpfpmSocketName}"
+        listen.owner = nginx
+        listen.group = nginx
+        listen.mode = 0600
+        user = icingaweb2
+        pm = dynamic
+        pm.max_children = 75
+        pm.start_servers = 2
+        pm.min_spare_servers = 2
+        pm.max_spare_servers = 10
+      '';
     };
 
     services.phpfpm.phpOptions = mkIf (cfg.pool == "${poolName}")
@@ -209,7 +206,7 @@ in {
             include ${config.services.nginx.package}/conf/fastcgi.conf;
             try_files $uri =404;
             fastcgi_split_path_info ^(.+\.php)(/.+)$;
-            fastcgi_pass unix:/run/phpfpm-${poolName}/${poolName}.sock;
+            fastcgi_pass unix:${phpfpmSocketName};
             fastcgi_param SCRIPT_FILENAME ${pkgs.icingaweb2}/public/index.php;
           '';
         };
@@ -242,8 +239,5 @@ in {
       group = "icingaweb2";
       isSystemUser = true;
     };
-    users.users.nginx = {
-      extraGroups = [ "icingaweb2" ];
-    };
   };
 }
diff --git a/nixos/modules/services/web-apps/limesurvey.nix b/nixos/modules/services/web-apps/limesurvey.nix
index 99a33b8371c..f23b3075574 100644
--- a/nixos/modules/services/web-apps/limesurvey.nix
+++ b/nixos/modules/services/web-apps/limesurvey.nix
@@ -202,13 +202,13 @@ in
     };
 
     services.phpfpm.pools.limesurvey = {
-      socketName = "limesurvey";
       phpPackage = php;
-      user = "${user}";
-      group = "${group}";
+      listen = "/run/phpfpm/limesurvey.sock";
       extraConfig = ''
         listen.owner = ${config.services.httpd.user};
         listen.group = ${config.services.httpd.group};
+        user = ${user};
+        group = ${group};
 
         env[LIMESURVEY_CONFIG] = ${limesurveyConfig}
 
@@ -241,7 +241,7 @@ in
             <Directory "${pkg}/share/limesurvey">
               <FilesMatch "\.php$">
                 <If "-f %{REQUEST_FILENAME}">
-                  SetHandler "proxy:unix:/run/phpfpm-limesurvey/limesurvey.sock|fcgi://localhost/"
+                  SetHandler "proxy:unix:/run/phpfpm/limesurvey.sock|fcgi://localhost/"
                 </If>
               </FilesMatch>
 
diff --git a/nixos/modules/services/web-apps/matomo.nix b/nixos/modules/services/web-apps/matomo.nix
index e058c18ad87..14aca45a342 100644
--- a/nixos/modules/services/web-apps/matomo.nix
+++ b/nixos/modules/services/web-apps/matomo.nix
@@ -4,14 +4,13 @@ let
   cfg = config.services.matomo;
 
   user = "matomo";
-  group = "matomo";
   dataDir = "/var/lib/${user}";
   deprecatedDataDir = "/var/lib/piwik";
 
   pool = user;
-  # it's not possible to use /run/phpfpm-${pool}/${pool}.sock because /run/phpfpm/ is root:root 0770,
+  # it's not possible to use /run/phpfpm/${pool}.sock because /run/phpfpm/ is root:root 0770,
   # and therefore is not accessible by the web server.
-  phpSocket = "/run/phpfpm-${pool}/${pool}.sock";
+  phpSocket = "/run/phpfpm-${pool}.sock";
   phpExecutionUnit = "phpfpm-${pool}";
   databaseService = "mysql.service";
 
@@ -138,12 +137,9 @@ in {
       isSystemUser = true;
       createHome = true;
       home = dataDir;
-      group  = "${group}";
+      group  = user;
     };
-    users.users.${config.services.nginx.user} = {
-      extraGroups = [ "${group}" ];
-    };
-    users.groups.${group} = {};
+    users.groups.${user} = {};
 
     systemd.services.matomo-setup-update = {
       # everything needs to set up and up to date before Matomo php files are executed
@@ -173,7 +169,7 @@ in {
           echo "Migrating from ${deprecatedDataDir} to ${dataDir}"
           mv -T ${deprecatedDataDir} ${dataDir}
         fi
-        chown -R ${user}:${group} ${dataDir}
+        chown -R ${user}:${user} ${dataDir}
         chmod -R ug+rwX,o-rwx ${dataDir}
         '';
       script = ''
@@ -229,26 +225,22 @@ in {
       serviceConfig.UMask = "0007";
     };
 
-    services.phpfpm.pools = let
+    services.phpfpm.poolConfigs = let
       # workaround for when both are null and need to generate a string,
       # which is illegal, but as assertions apparently are being triggered *after* config generation,
       # we have to avoid already throwing errors at this previous stage.
       socketOwner = if (cfg.nginx != null) then config.services.nginx.user
       else if (cfg.webServerUser != null) then cfg.webServerUser else "";
     in {
-      ${pool} = {
-        socketName = "${pool}";
-        phpPackage = pkgs.php;
-        user = "${user}";
-        group = "${group}";
-        extraConfig = ''
-          listen.owner = ${socketOwner}
-          listen.group = ${group}
-          listen.mode = 0600
-          env[PIWIK_USER_PATH] = ${dataDir}
-          ${cfg.phpfpmProcessManagerConfig}
-        '';
-      };
+      ${pool} = ''
+        listen = "${phpSocket}"
+        listen.owner = ${socketOwner}
+        listen.group = root
+        listen.mode = 0600
+        user = ${user}
+        env[PIWIK_USER_PATH] = ${dataDir}
+        ${cfg.phpfpmProcessManagerConfig}
+      '';
     };
 
 
diff --git a/nixos/modules/services/web-apps/nextcloud.nix b/nixos/modules/services/web-apps/nextcloud.nix
index 9475af12fdd..fa9a36d1189 100644
--- a/nixos/modules/services/web-apps/nextcloud.nix
+++ b/nixos/modules/services/web-apps/nextcloud.nix
@@ -394,14 +394,13 @@ in {
                 phpOptions)));
         in {
           phpOptions = phpOptionsExtensions;
-          socketName = "nextcloud";
           phpPackage = phpPackage;
-          user = "nextcloud";
-          group = "${config.services.nginx.group}";
+          listen = "/run/phpfpm/nextcloud";
           extraConfig = ''
-            listen.owner = ${config.services.nginx.user}
-            listen.group = ${config.services.nginx.group}
-            listen.mode = 0600
+            listen.owner = nginx
+            listen.group = nginx
+            user = nextcloud
+            group = nginx
             ${cfg.poolConfig}
             env[NEXTCLOUD_CONFIG_DIR] = ${cfg.home}/config
             env[PATH] = /run/wrappers/bin:/nix/var/nix/profiles/default/bin:/run/current-system/sw/bin:/usr/bin:/bin
@@ -467,7 +466,7 @@ in {
                   fastcgi_param HTTPS ${if cfg.https then "on" else "off"};
                   fastcgi_param modHeadersAvailable true;
                   fastcgi_param front_controller_active true;
-                  fastcgi_pass unix:/run/phpfpm-nextcloud/nextcloud.sock;
+                  fastcgi_pass unix:/run/phpfpm/nextcloud;
                   fastcgi_intercept_errors on;
                   fastcgi_request_buffering off;
                   fastcgi_read_timeout 120s;
diff --git a/nixos/modules/services/web-apps/restya-board.nix b/nixos/modules/services/web-apps/restya-board.nix
index d4c99d6c44b..2e5e0ea6622 100644
--- a/nixos/modules/services/web-apps/restya-board.nix
+++ b/nixos/modules/services/web-apps/restya-board.nix
@@ -13,7 +13,7 @@ let
   runDir = "/run/restya-board";
 
   poolName = "restya-board";
-  phpfpmSocketName = "/run/phpfpm-${poolName}/${poolName}.sock";
+  phpfpmSocketName = "/run/phpfpm/${poolName}.sock";
 
 in
 
@@ -178,12 +178,9 @@ in
 
   config = mkIf cfg.enable {
 
-    services.phpfpm.pools = {
+    services.phpfpm.poolConfigs = {
       "${poolName}" = {
-        socketName = "${poolName}";
-        phpPackage = pkgs.php;
-        user = "${cfg.user}";
-        group = "${cfg.group}";
+        listen = phpfpmSocketName;
         phpOptions = ''
           date.timezone = "CET"
 
@@ -195,9 +192,11 @@ in
           ''}
         '';
         extraConfig = ''
-          listen.owner = ${config.services.nginx.user}
-          listen.group = ${config.services.nginx.group}
+          listen.owner = nginx
+          listen.group = nginx
           listen.mode = 0600
+          user = ${cfg.user}
+          group = ${cfg.group}
           pm = dynamic
           pm.max_children = 75
           pm.start_servers = 10
@@ -366,9 +365,6 @@ in
       home = runDir;
       group  = "restya-board";
     };
-    users.users.nginx = {
-      extraGroups = [ "restya-board" ];
-     };
     users.groups.restya-board = {};
 
     services.postgresql.enable = mkIf (cfg.database.host == null) true;
diff --git a/nixos/modules/services/web-apps/selfoss.nix b/nixos/modules/services/web-apps/selfoss.nix
index 6c5942d1e17..cd0f743a5fb 100644
--- a/nixos/modules/services/web-apps/selfoss.nix
+++ b/nixos/modules/services/web-apps/selfoss.nix
@@ -3,9 +3,9 @@ with lib;
 let
   cfg = config.services.selfoss;
 
-  poolName = "selfoss";
-  phpfpmSocketName = "/run/phpfpm-${poolName}/${poolName}.sock";
-  group = "${cfg.user}";
+  poolName = "selfoss_pool";
+  phpfpmSocketName = "/run/phpfpm/${poolName}.sock";
+
   dataDir = "/var/lib/selfoss";
 
   selfoss-config =
@@ -116,25 +116,21 @@ in
 
   config = mkIf cfg.enable {
 
-    services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
-      "${poolName}" = {
-        socketName = "${poolName}";
-        phpPackage = pkgs.php;
-        user = "${cfg.user}";
-        group = "${group}";
-        extraConfig = ''
-          listen.owner = ${config.services.nginx.user}
-          listen.group = ${config.services.nginx.group}
-          listen.mode = 0600
-          pm = dynamic
-          pm.max_children = 75
-          pm.start_servers = 10
-          pm.min_spare_servers = 5
-          pm.max_spare_servers = 20
-          pm.max_requests = 500
-          catch_workers_output = 1
-        '';
-      };
+    services.phpfpm.poolConfigs = mkIf (cfg.pool == "${poolName}") {
+      "${poolName}" = ''
+        listen = "${phpfpmSocketName}";
+        listen.owner = nginx
+        listen.group = nginx
+        listen.mode = 0600
+        user = nginx
+        pm = dynamic
+        pm.max_children = 75
+        pm.start_servers = 10
+        pm.min_spare_servers = 5
+        pm.max_spare_servers = 20
+        pm.max_requests = 500
+        catch_workers_output = 1
+      '';
     };
 
     systemd.services.selfoss-config = {
@@ -149,7 +145,7 @@ in
         # Create the files
         cp -r "${pkgs.selfoss}/"* "${dataDir}"
         ln -sf "${selfoss-config}" "${dataDir}/config.ini"
-        chown -R "${cfg.user}":"${group}" "${dataDir}"
+        chown -R "${cfg.user}" "${dataDir}"
         chmod -R 755 "${dataDir}"
       '';
       wantedBy = [ "multi-user.target" ];
@@ -166,8 +162,5 @@ in
 
     };
 
-    users.users.nginx = {
-      extraGroups = [ "${group}" ];
-     };
   };
 }
diff --git a/nixos/modules/services/web-apps/tt-rss.nix b/nixos/modules/services/web-apps/tt-rss.nix
index e59988ef7b2..b882f6c2ae7 100644
--- a/nixos/modules/services/web-apps/tt-rss.nix
+++ b/nixos/modules/services/web-apps/tt-rss.nix
@@ -512,14 +512,12 @@ let
 
     services.phpfpm.pools = mkIf (cfg.pool == "${poolName}") {
       "${poolName}" = {
-        socketName = "${poolName}";
-        phpPackage = pkgs.php;
-        user = "${config.services.nginx.user}";
-        group = "${config.services.nginx.group}";
+        listen = "/var/run/phpfpm/${poolName}.sock";
         extraConfig = ''
-          listen.owner = ${config.services.nginx.user}
-          listen.group = ${config.services.nginx.group}
+          listen.owner = nginx
+          listen.group = nginx
           listen.mode = 0600
+          user = ${cfg.user}
           pm = dynamic
           pm.max_children = 75
           pm.start_servers = 10
@@ -545,7 +543,7 @@ let
           locations."~ \.php$" = {
             extraConfig = ''
               fastcgi_split_path_info ^(.+\.php)(/.+)$;
-              fastcgi_pass unix:/run/phpfpm-${poolName}/${poolName}.sock;
+              fastcgi_pass unix:${config.services.phpfpm.pools.${cfg.pool}.listen};
               fastcgi_index index.php;
             '';
           };