Merge branch 'fix/upload-limits'

.gitignore

@@ -2,3 +2,5 @@
 /.reference/
 /backend/.phpunit.cache/
 /.postgres/
+/result
+/result-*

flake.nix

@@ -12,12 +12,18 @@
     }:
     let
       nixosModule = import ./nix/nixos-module.nix;
+      uploadLimits = import ./nix/upload-limits.nix;
     in
     utils.lib.eachDefaultSystem (
       system:
       let
         pkgs = nixpkgs.legacyPackages.${system};
-        packages = import ./nix/packages { inherit pkgs; };
+        devPhp = pkgs.php.buildEnv {
+          extraConfig = uploadLimits.phpOptions;
+        };
+        packages = import ./nix/packages {
+          inherit pkgs uploadLimits;
+        };
       in
       {
         inherit packages;
@@ -28,12 +34,37 @@
             inherit nixpkgs system;
             module = nixosModule;
           };
+          dev-php-upload-limits =
+            pkgs.runCommand "rabbi-gerzi-dev-php-upload-limits"
+              {
+                preferLocalBuild = true;
+              }
+              ''
+                actual_upload_max_filesize="$(
+                  ${devPhp}/bin/php -r 'echo ini_get("upload_max_filesize");'
+                )"
+                actual_post_max_size="$(
+                  ${devPhp}/bin/php -r 'echo ini_get("post_max_size");'
+                )"
+
+                if [ "$actual_upload_max_filesize" != "${uploadLimits.phpUploadLimit}" ]; then
+                  echo "upload_max_filesize was $actual_upload_max_filesize" >&2
+                  exit 1
+                fi
+
+                if [ "$actual_post_max_size" != "${uploadLimits.phpUploadLimit}" ]; then
+                  echo "post_max_size was $actual_post_max_size" >&2
+                  exit 1
+                fi
+
+                echo "$actual_upload_max_filesize" > $out
+              '';
         };
 
         devShells.default = pkgs.mkShell {
           buildInputs = with pkgs; [
             onefetch
-            php
+            devPhp
             phpPackages.composer
             phpPackages.php-codesniffer
             vscode-langservers-extracted

nix/checks/module-eval.nix

@@ -7,7 +7,9 @@
 }:
 
 let
-  evaluatedHostName =
+  uploadLimits = import ../upload-limits.nix;
+
+  evaluatedConfig =
     (nixpkgs.lib.nixosSystem {
       inherit system;
       modules = [
@@ -25,13 +27,48 @@ let
           };
         }
       ];
-    }).config.services.rabbi-gerzi.backend.hostName;
+    }).config;
+
+  evaluatedHostName = evaluatedConfig.services.rabbi-gerzi.backend.hostName;
+
+  backendVirtualHost = evaluatedConfig.services.nginx.virtualHosts.${evaluatedHostName};
+
+  phpOptions = evaluatedConfig.services.phpfpm.pools.rabbi-gerzi.phpOptions;
+
+  expectedUploadMaxFilesize = "upload_max_filesize = ${uploadLimits.phpUploadLimit}";
+
+  expectedPostMaxSize = "post_max_size = ${uploadLimits.phpUploadLimit}";
+
+  expectedNginxClientMaxBodySize = "client_max_body_size ${uploadLimits.nginxClientMaxBodySize};";
+
+  assertions = [
+    {
+      passed = lib.hasInfix expectedUploadMaxFilesize phpOptions;
+      message = "php-fpm upload_max_filesize is not 6M";
+    }
+    {
+      passed = lib.hasInfix expectedPostMaxSize phpOptions;
+      message = "php-fpm post_max_size is not 6M";
+    }
+    {
+      passed = lib.hasInfix expectedNginxClientMaxBodySize backendVirtualHost.extraConfig;
+      message = "nginx client_max_body_size is not 6m";
+    }
+  ];
+
+  failedAssertions = lib.filter (assertion: !assertion.passed) assertions;
 in
 pkgs.runCommand "rabbi-gerzi-module-eval"
   {
+    failures = lib.concatMapStringsSep "\n" (assertion: assertion.message) failedAssertions;
     value = evaluatedHostName;
     preferLocalBuild = true;
   }
   ''
+    if [ -n "$failures" ]; then
+      printf '%s\n' "$failures" >&2
+      exit 1
+    fi
+
     echo "$value" > $out
   ''

nix/nixos-module.nix

@@ -13,6 +13,7 @@ let
   appDir = "${backendPackage}/share/php/rabbi-gerzi-backend";
   phpPackage = backendPackage.passthru.php;
   poolName = "rabbi-gerzi";
+  uploadLimits = import ./upload-limits.nix;
   storagePath = "${cfg.stateDir}/storage";
   cachePath = "${cfg.cacheDir}/bootstrap-cache";
   setupService = "rabbi-gerzi-setup";
@@ -239,6 +240,7 @@ in
     services.phpfpm.pools.${poolName} = {
       inherit (cfg) user group;
       inherit phpPackage;
+      phpOptions = uploadLimits.phpOptions;
       settings = {
         "catch_workers_output" = true;
         "clear_env" = "no";
@@ -316,6 +318,9 @@ in
           cfg.backend.nginx
           {
             root = "${appDir}/public";
+            extraConfig = ''
+              client_max_body_size ${uploadLimits.nginxClientMaxBodySize};
+            '';
             locations = {
               "/" = {
                 index = "index.php";

nix/packages/backend.nix

@@ -2,16 +2,19 @@
   lib,
   makeWrapper,
   php,
+  uploadLimits ? import ../upload-limits.nix,
 }:
 
 let
-  phpPackage = php.withExtensions (
+  phpPackage = php.buildEnv {
+    extensions =
       { enabled, all }:
       enabled
       ++ [
         all.pdo_pgsql
-    ]
-  );
+      ];
+    extraConfig = uploadLimits.phpOptions;
+  };
 in
 phpPackage.buildComposerProject2 (finalAttrs: {
   pname = "rabbi-gerzi-backend";

nix/packages/default.nix

@@ -1,7 +1,12 @@
-{ pkgs }:
+{
+  pkgs,
+  uploadLimits ? import ../upload-limits.nix,
+}:
 
 rec {
-  backend = pkgs.callPackage ./backend.nix { };
+  backend = pkgs.callPackage ./backend.nix {
+    inherit uploadLimits;
+  };
   frontend = pkgs.callPackage ./frontend.nix { };
   default = frontend;
 }

nix/upload-limits.nix

@@ -0,0 +1,8 @@
+{
+  nginxClientMaxBodySize = "6m";
+  phpUploadLimit = "6M";
+  phpOptions = ''
+    upload_max_filesize = 6M
+    post_max_size = 6M
+  '';
+}