diff options
author | Franz Pletz <fpletz@fnordicwalking.de> | 2017-01-25 23:21:33 +0100 |
---|---|---|
committer | Franz Pletz <fpletz@fnordicwalking.de> | 2017-02-27 23:38:53 +0100 |
commit | e3d58dae7f83998395259824ef83dedc33e9ab62 (patch) | |
tree | a6ee726085aa859370955fa3d942ee1d1d5d78d5 /nixos/modules/services/web-servers/phpfpm/default.nix | |
parent | 81b43ccd5773445a7e7e590b99b5b760a1401e3b (diff) | |
download | nixpkgs-e3d58dae7f83998395259824ef83dedc33e9ab62.tar nixpkgs-e3d58dae7f83998395259824ef83dedc33e9ab62.tar.gz nixpkgs-e3d58dae7f83998395259824ef83dedc33e9ab62.tar.bz2 nixpkgs-e3d58dae7f83998395259824ef83dedc33e9ab62.tar.lz nixpkgs-e3d58dae7f83998395259824ef83dedc33e9ab62.tar.xz nixpkgs-e3d58dae7f83998395259824ef83dedc33e9ab62.tar.zst nixpkgs-e3d58dae7f83998395259824ef83dedc33e9ab62.zip |
phpfpm service: one service per pool for isolation
Diffstat (limited to 'nixos/modules/services/web-servers/phpfpm/default.nix')
-rw-r--r-- | nixos/modules/services/web-servers/phpfpm/default.nix | 47 |
1 files changed, 29 insertions, 18 deletions
diff --git a/nixos/modules/services/web-servers/phpfpm/default.nix b/nixos/modules/services/web-servers/phpfpm/default.nix index 2471a06a3b0..f1161c9e19f 100644 --- a/nixos/modules/services/web-servers/phpfpm/default.nix +++ b/nixos/modules/services/web-servers/phpfpm/default.nix @@ -7,21 +7,21 @@ let stateDir = "/run/phpfpm"; + poolConfigs = cfg.poolConfigs // mapAttrs mkPool cfg.pools; + mkPool = n: p: '' - [${n}] listen = ${p.listen} ${p.extraConfig} ''; - cfgFile = pkgs.writeText "phpfpm.conf" '' + fpmCfgFile = pool: poolConfig: pkgs.writeText "phpfpm-${pool}.conf" '' [global] error_log = syslog daemonize = no ${cfg.extraConfig} - ${concatStringsSep "\n" (mapAttrsToList mkPool cfg.pools)} - - ${concatStringsSep "\n" (mapAttrsToList (n: v: "[${n}]\n${v}") cfg.poolConfigs)} + [${pool}] + ${poolConfig} ''; phpIni = pkgs.runCommand "php.ini" { @@ -119,18 +119,29 @@ in { }; }; - config = mkIf (cfg.pools != {} || cfg.poolConfigs != {}) { - - systemd.services.phpfpm = { - wantedBy = [ "multi-user.target" ]; - preStart = '' - mkdir -p "${stateDir}" - ''; - serviceConfig = { - Type = "notify"; - ExecStart = "${cfg.phpPackage}/bin/php-fpm -y ${cfgFile} -c ${phpIni}"; - ExecReload = "${pkgs.coreutils}/bin/kill -USR2 $MAINPID"; - }; - }; + config = { + systemd.services = flip mapAttrs' poolConfigs (pool: poolConfig: + nameValuePair "phpfpm-${pool}" { + description = "PHP FastCGI Process Manager for pool ${pool}"; + after = [ "network.target" ]; + wantedBy = [ "multi-user.target" ]; + preStart = '' + mkdir -p ${stateDir} + ''; + serviceConfig = let + cfgFile = fpmCfgFile pool poolConfig; + in { + PrivateTmp = true; + PrivateDevices = true; + ProtectSystem = "full"; + ProtectHome = true; + NoNewPrivileges = true; + RestrictAddressFamilies = "AF_UNIX AF_INET AF_INET6"; + Type = "notify"; + ExecStart = "${cfg.phpPackage}/bin/php-fpm -y ${cfgFile} -c ${phpIni}"; + ExecReload = "${pkgs.coreutils}/bin/kill -USR2 $MAINPID"; + }; + } + ); }; } |