#
# Author:: Earth U (<sysadmin @ chromedia.com>)
# Cookbook Name:: cfe-nginx-php-fpm
# Attribute:: default
#
# Copyright 2016, Chromedia Far East, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#

# Setting 'update_cacert' to true will get the latest cacert from
# http://curl.haxx.se/ca/cacert.pem and use that as CAFile for postfix.
default['cfe-nginx-php-fpm']['postfix']['update_cacert'] = true
default['cfe-nginx-php-fpm']['postfix']['email_domain']  = 'example.com'

# If your php-fpm pool is not named 'www', then delete
# the default one ('www'), which is automatically installed by php-fpm
default['cfe-nginx-php-fpm']['php-fpm']['delete_pool_www'] = true
default['cfe-nginx-php-fpm']['php-fpm']['exts'] = [
  'mysqlnd', 'cli', 'curl'
]

default['cfe-nginx-php-fpm']['openssl']['dh_modulus'] = 4096

# Uncomment to set custom locations
#default['cfe-nginx-php-fpm']['nginx']['inc_dir'] =
#  "#{node['nginx']['dir']}/sites-available/include"
#default['cfe-nginx-php-fpm']['nginx']['priv_dir'] =
#  "#{node['nginx']['dir']}/private"

default['cfe-nginx-php-fpm']['nginx']['sites'] = [
  #{
    # Name of server. Mandatory.
    #
    #:server_name => 'example.com',

    # Port number. Default: either '443' or '80',
    # depending on whether HTTPS is used or not.
    # Listen options can be provided as string. If using HTTPS,
    # the string 'ssl' will be automatically added as an option.
    #
    #:port => nil,
    #:listen_opts => nil,

    # Server aliases in an array. Default: []
    #
    #:aliases => ['www.example.com'],

    # Location of document root. If not given, the root directive
    # will not be included in the config. Default: nil
    #
    #:doc_root => '/var/www/example.com',

    # Index, if applicable, of the site. Default: nil
    #
    #:index => 'index.php',

    # Whether to include a default virtual server named '_' or not.
    # If there is more than one server given in this 'sites' array,
    # :catch_all value will always be overriden to false. Default: true
    #
    #:catch_all => true,

    # Access log options as one long string. Default: nil
    #
    #:access_log_options => '<some options>',

    # Whether to log access to /robots.txt
    # Default: false
    #
    #:log_robots => false,

    # Whether to log attempted accesses to hidden directories and files
    # Default: true
    #
    #:log_hidden => true,

    # Necessary values for SSL/TLS setup. Default: nil
    #
    #:ssl => {
    #  # Subvalues and their defaults:
    #
    #  # If LetsEncrypt is used, set to true.
    #  # le_sub_dir defaults to the server name.
    #  #
    #  :letsencrypt => false,
    #  :le_base_dir => '/etc/letsencrypt/live',
    #  :le_sub_dir  => '<server_name>',
    #
    #  # If not using LetsEncrypt, specify cert and key here.
    #  # If using LetsEncrypt, these attributes are not used:
    #  #
    #  :cert => '<contents of chain cert here>',
    #  :key  => '<contents of cert private key here>',
    #
    #  :self_signed     => false,
    #  :cipher_suite    => 'medium', # or 'modern'
    #  :hsts_max_age    => '15758000',
    #  :hsts_subdomains => true
    #},

    # Necessary values for Basic Auth setup. Default: nil
    #
    #:auth => {
    #  :msg => 'Restricted Area. Please authenticate.',
    #  :users => {
    #    'example_user' => '<password>'
    #  }
    #},

    # Array of strings that will be written before the start of
    # the 'server' declaration. Default: []
    #:init_statements => [],

    # Additional headers to insert into the server responses.
    # If the site uses HTTPS, the header 'Strict-Transport-Security' will
    # always be included. Default:
    #   {
    #     'X-Frame-Options'                   => 'SAMEORIGIN',
    #     'X-Content-Type-Options'            => 'nosniff',
    #     'X-XSS-Protection'                  => '"1; mode=block"',
    #     'X-Permitted-Cross-Domain-Policies' => 'none'
    #   }
    #
    #:add_headers => {},

    # An array of strings that will be included as statements in the main
    # nginx config file for this server, before the first 'include'
    # directive. Default: []
    #
    #:server_statements_1 => [],

    # An array of strings that will be included as statements in the main
    # nginx config file for this server, after the last 'include'
    # directive. Default: []
    #
    #:server_statements_2 => [],

    # The cookbook name and source file where the main
    # config file template will be taken from.
    #
    #:main_config_cookbook => 'cfe-nginx-php-fpm',
    #:main_config_source   => 'nginx_site.conf.erb',

    # Enumerates the different site types this server supports.
    # Each type element of this array is a hash containing different attributes.
    #
    # Mandatory attributes are:
    #   :type => One of: 'basic_php' (basic PHP site)
    #                    'wordpress' (standard Wordpress site)
    #                    'webserver_ws' (proxy webserver with websocket)
    #                    'webserver_basic' (proxy generic webserver)
    #   :upstream_servers => An array containing upstream server endpoints.
    #                        Unix socket example: ['/var/run/php-fpm.sock']
    #                        Tcp port example: ['127.0.0.1:9000']
    #                        (This is optional for type 'webserver_basic')
    #
    # Optional attributes are:
    #   :subpath => A string of the form: 'news/blog'.
    #               Indicates what subpath of the site this type applies.
    #               Default: '', which means this site type applies
    #               to the root directory of the site.
    #   :upstream_name => The auto-generated config's upstream name can
    #                     be customized through this attribute.
    #                     Default: (an auto-generated string)
    #   :add_statements => Additional statements to put in the config file.
    #                      Default: []
    #   :static_types => An array of strings that denote the file extensions
    #                    to be included in a certain location directive that
    #                    gives them a max expiration header. Set this value
    #                    to false to disable this directive. Default: %w{
    #                       js css ogg ogv svg svgz eot otf woff mp4 ttf
    #                       rss atom jpg jpeg gif png ico zip tgz gz rar
    #                       bz2 doc xls exe ppt tar mid midi wav bmp rtf
    #                    }
    #   :log_static => Whether to log accesses to the above static files
    #                  or not. Default: false
    #   :source => The name of the config template.
    #              Default depends on :type attribute.
    #   :cookbook => The name of the cookbook where the template
    #                will be taken from. Default is this cookbook.
    #   :custom_params => A hash that will be passed into the template
    #                     (along with the optional attributes mentioned
    #                     above) as the variable called cparams.
    #                     Default: {}
    #
    # Unique attributes for each type are indicated below:
    #   Basic PHP Site (:type => 'basic_php'):
    #     :fastcgi_intercept_errors => Optional. Default: false
    #   Standard Wordpress Site (:type => 'wordpress'):
    #     :fastcgi_intercept_errors => Optional. Default: false
    #     :loginpage_statements => An array of strings to be put on the
    #                              config for the /wp-login.php
    #                              and /wp-admin pages. Default: []
    #   Proxy Websocket Webserver (:type => 'webserver_ws'):
    #     (none)
    #   Proxy Generic Webserver (:type => 'webserver_basic'):
    #     (none)
    #
    #:types => []
  #}
]

#
# php-fpm cookbook
#
# PHP-FPM user should be the same as the Nginx user by default.
# To provide custom values, use override, instead of default.
#override['php-fpm']['user']  = node['nginx']['user']
#override['php-fpm']['group'] = node['nginx']['group']

default['php-fpm']['skip_repository_install']     = true
default['php-fpm']['emergency_restart_threshold'] = '10'
default['php-fpm']['emergency_restart_interval']  = '1m'
default['php-fpm']['process_control_timeout']     = '10s'
default['php-fpm']['pools'] = [
  {
    # Required attributes:
    :name   => 'example_pool',
    :enable => true,
    :listen => '127.0.0.1:9000',
    #:listen => '/var/run/php-fpm.sock',

    # Optional attributes with their defaults:
    #
    # Default is same as Nginx user and group
    #:user   => node['nginx']['user'],
    #:group  => node['nginx']['group'],

    #:max_requests => 500,
    #:max_children => 50,

    #:access_log           => false,
    #:catch_workers_output => 'no',

    #:process_manager => value_for_platform(
    #  'ubuntu'  => { '10.04' => 'dynamic' },
    #  'default' => 'ondemand'
    #),

    # Only used if process_manager is 'dynamic':
    #:start_servers     => 5,
    #:min_spare_servers => 5,
    #:max_spare_servers => 35,

    #:php_options => {
    #  'php_admin_value[cgi.fix_pathinfo]' => '0',
    #  'php_admin_value[expose_php]'       => 'Off',
    #  'php_value[upload_max_filesize]'    => '5M',
    #  'php_value[post_max_size]'          => '10M'
    #}
  }
]

#
# mariadb cookbook
#
default['mariadb']['install']['type']        = 'package'
default['mariadb']['install']['version']     = '10.0'
default['mariadb']['use_default_repository'] = true

#
# postfix cookbook
#
default['postfix']['main']['myorigin'] = '$mydomain'
default['postfix']['main']['mydestination'] =
  ['localhost.localdomain', 'localhost']
# Defaults for both myhostname and mydomain is:
#   node['cfe-nginx-php-fpm']['postfix']['email_domain']
# To provide custom values, use override, instead of default.
#override['postfix']['main']['myhostname'] =
#  node['cfe-nginx-php-fpm']['postfix']['email_domain']
#override['postfix']['main']['mydomain'] =
#  node['cfe-nginx-php-fpm']['postfix']['email_domain']

#
# nginx cookbook
#
default['nginx']['version']              = '1.9.15'
default['nginx']['install_method']       = 'package'
default['nginx']['package_name']         = 'nginx'
default['nginx']['repo_source']          = 'nginx'
default['nginx']['upstream_repository']  =
  'http://nginx.org/packages/mainline/ubuntu'
# Set pid file initially in accordance with Ubuntu 14.04 
# nginx package's pid file. Otherwise, it fails to restart.
default['nginx']['pid']                  = '/var/run/nginx.pid'
default['nginx']['default_site_enabled'] = false

default['nginx']['client_max_body_size']    = '10m'
default['nginx']['client_body_buffer_size'] = '64k'
default['nginx']['keepalive_timeout']       = 15
default['nginx']['keepalive_requests']      = 200

default['nginx']['event']        = 'epoll'
default['nginx']['multi_accept'] = true

# Setting worker_processes to 'auto' will automatically
# set the value to the number of CPUs. But we're going to 
# set it to twice that.
default['nginx']['worker_processes']     =
  ( %x(grep ^processor /proc/cpuinfo | wc -l).to_i ) * 2
# Either use `ulimit -n` (usually 1024) for worker_connections, or
# set it to a much higher value, but not exceeding worker_rlimit_nofile.
default['nginx']['worker_connections']   = 10000
default['nginx']['worker_rlimit_nofile'] = 15000

default['nginx']['disable_access_log'] = false
default['nginx']['server_tokens']      = 'off'
default['nginx']['gzip_comp_level']    = '5'
default['nginx']['extra_configs']      = {
  'reset_timedout_connection' => 'on'
}
# Increase this to 128 if using super long server names
default['nginx']['server_names_hash_bucket_size'] = 64