test upload limits

flake.nix

@@ -12,11 +12,13 @@
     }:
     let
       nixosModule = import ./nix/nixos-module.nix;
+      uploadLimits = import ./nix/upload-limits.nix;
     in
     utils.lib.eachDefaultSystem (
       system:
       let
         pkgs = nixpkgs.legacyPackages.${system};
+        devPhp = pkgs.php;
         packages = import ./nix/packages { inherit pkgs; };
       in
       {
@@ -28,12 +30,37 @@
             inherit nixpkgs system;
             module = nixosModule;
           };
+          dev-php-upload-limits =
+            pkgs.runCommand "rabbi-gerzi-dev-php-upload-limits"
+              {
+                preferLocalBuild = true;
+              }
+              ''
+                actual_upload_max_filesize="$(
+                  ${devPhp}/bin/php -r 'echo ini_get("upload_max_filesize");'
+                )"
+                actual_post_max_size="$(
+                  ${devPhp}/bin/php -r 'echo ini_get("post_max_size");'
+                )"
+
+                if [ "$actual_upload_max_filesize" != "${uploadLimits.phpUploadLimit}" ]; then
+                  echo "upload_max_filesize was $actual_upload_max_filesize" >&2
+                  exit 1
+                fi
+
+                if [ "$actual_post_max_size" != "${uploadLimits.phpUploadLimit}" ]; then
+                  echo "post_max_size was $actual_post_max_size" >&2
+                  exit 1
+                fi
+
+                echo "$actual_upload_max_filesize" > $out
+              '';
         };
 
         devShells.default = pkgs.mkShell {
           buildInputs = with pkgs; [
             onefetch
-            php
+            devPhp
             phpPackages.composer
             phpPackages.php-codesniffer
             vscode-langservers-extracted

nix/checks/module-eval.nix

@@ -7,7 +7,9 @@
 }:
 
 let
-  evaluatedHostName =
+  uploadLimits = import ../upload-limits.nix;
+
+  evaluatedConfig =
     (nixpkgs.lib.nixosSystem {
       inherit system;
       modules = [
@@ -25,13 +27,48 @@ let
           };
         }
       ];
-    }).config.services.rabbi-gerzi.backend.hostName;
+    }).config;
+
+  evaluatedHostName = evaluatedConfig.services.rabbi-gerzi.backend.hostName;
+
+  backendVirtualHost = evaluatedConfig.services.nginx.virtualHosts.${evaluatedHostName};
+
+  phpOptions = evaluatedConfig.services.phpfpm.pools.rabbi-gerzi.phpOptions;
+
+  expectedUploadMaxFilesize = "upload_max_filesize = ${uploadLimits.phpUploadLimit}";
+
+  expectedPostMaxSize = "post_max_size = ${uploadLimits.phpUploadLimit}";
+
+  expectedNginxClientMaxBodySize = "client_max_body_size ${uploadLimits.nginxClientMaxBodySize};";
+
+  assertions = [
+    {
+      passed = lib.hasInfix expectedUploadMaxFilesize phpOptions;
+      message = "php-fpm upload_max_filesize is not 6M";
+    }
+    {
+      passed = lib.hasInfix expectedPostMaxSize phpOptions;
+      message = "php-fpm post_max_size is not 6M";
+    }
+    {
+      passed = lib.hasInfix expectedNginxClientMaxBodySize backendVirtualHost.extraConfig;
+      message = "nginx client_max_body_size is not 6m";
+    }
+  ];
+
+  failedAssertions = lib.filter (assertion: !assertion.passed) assertions;
 in
 pkgs.runCommand "rabbi-gerzi-module-eval"
   {
+    failures = lib.concatMapStringsSep "\n" (assertion: assertion.message) failedAssertions;
     value = evaluatedHostName;
     preferLocalBuild = true;
   }
   ''
+    if [ -n "$failures" ]; then
+      printf '%s\n' "$failures" >&2
+      exit 1
+    fi
+
     echo "$value" > $out
   ''

nix/upload-limits.nix

@@ -0,0 +1,4 @@
+{
+  nginxClientMaxBodySize = "6m";
+  phpUploadLimit = "6M";
+}