postgres configured

server/mods/web.nix

@@ -14,16 +14,18 @@
   services = let
     sslCertDir = config.security.acme.certs."bogaledev.ru".directory;
   in {
-    postgresql.enable = true;
-    phpfpm.pools.default = {
-      user = "php";
-      group = "php";
-      settings = {
-        "pm" = "ondemand";
-        "pm.max_children" = 8;
-        "listen.owner" = "nginx";
-        "listen.group" = "nginx";
-      };
+    postgresqlBackup = {
+      enable = true;
+      compression = "none";
+      databases = [ "php" "forgejo" "vaultwarden" ];
+    };
+    postgresql = {
+      enable = true;
+      ensureDatabases = [ "php" ];
+      ensureUsers = [ {
+        name = "php";
+        ensureDBOwnership = true;
+      } ];
     };
     forgejo = {
       enable = true;
@@ -36,6 +38,17 @@
         };
       };
     };
+    phpfpm.pools.php = {
+      user = "php";
+      group = "php";
+      phpEnv = { PATH = "/run/current-system/sw/bin"; };
+      settings = {
+        "pm" = "ondemand";
+        "pm.max_children" = 8;
+        "listen.owner" = "nginx";
+        "listen.group" = "nginx";
+      };
+    };
     vaultwarden = {
       enable = true;
       dbBackend = "postgresql";
@@ -52,9 +65,9 @@
       };
     };
     nginx.virtualHosts."bogaledev.ru" = let
-      phpPool = pool: ''
+      phpPool = ''
         location ~ \.php$ {
-          fastcgi_pass unix:${config.services.phpfpm.pools.${pool}.socket};
+          fastcgi_pass unix:${config.services.phpfpm.pools.php.socket};
         }
       '';
       localNetworks = ''
@@ -70,16 +83,25 @@
       forceSSL = true;
       root = "/srv/http";
       useACMEHost = "bogaledev.ru";
-      extraConfig = ''add_header Alt-Svc 'h3=":443"; ma=86400' always;'';
+      extraConfig = ''
+        add_header Alt-Svc 'h3=":443"; ma=2592000' always;
+        add_header X-Content-Type-Options "nosniff" always;
+      '';
       locations = {
-        "/app/".extraConfig = phpPool "default";
-        "/git/".proxyPass = "http://127.0.0.1:8039/";
-        "/local/".extraConfig = ''${phpPool "default"} ${localNetworks}'';
+        "/" = {
+          extraConfig = phpPool;
+          index = "index.php index.html";
+        };
+        "/local/" = {
+          extraConfig = "${phpPool} ${localNetworks}";
+          index = "index.php index.html";
+        };
         "/local/net/".extraConfig = ''
           allow fc01::/64;
           allow 10.1.0.0/16;
           deny all;
         '';
+        "/git/".proxyPass = "http://127.0.0.1:8039/";
         "/vw/" = {
           proxyWebsockets = true;
           extraConfig = localNetworks;