X-Git-Url: https://git.cyclocoop.org/?p=lhc%2Fateliers.git;a=blobdiff_plain;f=vm_hosted;h=a75d9cb45f27e245244d1a47c95d01d53bd150c3;hp=9743830488a48aa776f4e38b85070f509e83636e;hb=de0435e3d96f9205fd7a27809d2004d5737469fa;hpb=c14dd0458cd29538d1dad7b63d39a16f08643f99

diff --git a/vm_hosted b/vm_hosted
index 9743830..a75d9cb 100755
--- a/vm_hosted
+++ b/vm_hosted
@@ -56,6 +56,11 @@ rule_git_reset () {
 	)
  }
 
+rule_adduser () {
+	local user="$1"; shift
+	getent passwd "$user" >/dev/null ||
+	sudo adduser "$@" "$user"
+ }
 rule_apt_get_install () { # SYNTAX: $package
 	sudo DEBIAN_FRONTEND=noninteractive apt-get install "$@"
  }
@@ -85,7 +90,6 @@ rule_apache2_configure () {
 		# cependant l'usage de suexec impose des forks il semble..
 		# et mod_proxy_fcgi n'apparaît que dans apache 2.4 ;
 		# donc pour l'instant : apache2-mpm-itk
-	rule www_configure
 	cat /dev/stdin "$tool"/etc/apache2/apache2.conf <<-EOF |
 		ServerName "$vm_fqdn"
 		EOF
@@ -117,18 +121,12 @@ rule_apache2_configure () {
 	 /home/www/etc/apache2
 	for conf in "$tool"/etc/apache2/site.d/*/VirtualHost.conf
 	 do conf=${conf#"$tool"/etc/apache2/site.d/}
-		local port site
-		IFS=. read -r port domain <<-EOF
-			${conf%\/VirtualHost\.conf}
-			EOF
-		assert 'test "${port:+set}"'
-		assert 'test "${domain:+set}"'
-		local site="$port.$domain"
-		case $port in
-		 (443)
+		local site=${conf%/VirtualHost.conf}
+		case $site in
+		 (*-tls)
 			local hint="run vm_remote apache2_key_send before"
 			assert "sudo test -f /etc/apache2/site.d/\"$site\"/x509/key.pem" hint
-			sudo install -d -m 770 -o www."$site" -g www."$site" \
+			sudo install -d -m 770 -o www-"$site" -g www-"$site" \
 			 /etc/apache2 \
 			 /etc/apache2/site.d/"$site" \
 			 /etc/apache2/site.d/"$site"/x509 \
@@ -139,7 +137,7 @@ rule_apache2_configure () {
 			sudo install -m 664 -o www -g www \
 			     "$tool"/var/pub/x509/"$site"/crt.self-signed.pem \
 			 /etc/apache2/site.d/"$site"/x509/crt.self-signed.pem
-			#sudo install -m 664 -o www."$site" -g www."$site" \
+			#sudo install -m 664 -o www-"$site" -g www-"$site" \
 			# "$tool"/var/pub/x509/"$site"/rvk.pem \
 			# /etc/apache2/site.d/"$site"/x509/rvk.pem
 			sudo install -m 664 -o www -g www \
@@ -150,27 +148,12 @@ rule_apache2_configure () {
 			 /etc/apache2/site.d/"$site"/x509/crt.pem
 			;;
 		 esac
-		case $port in
-		 (80)
-			cat <<-EOF
-				<VirtualHost *:$port>
-					AssignUserID www.$site www.$site
-					CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
-					#CustomLog "/dev/null" Combined
-					DocumentRoot /home/www/pub/$site
-					ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
-					#ErrorLog "/dev/null"
-					ServerName $domain
-					LogLevel Warn
-					$(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
-				 </VirtualHost>
-				EOF
-			;;
-		 (443)
+		case $site in
+		 (*-tls)
 			cat <<-EOF
 				<IfModule mod_ssl.c>
 					<VirtualHost *:$port>
-						AssignUserID www.$site www.$site
+						AssignUserID www-$site www-$site
 						BrowserMatch "MSIE [2-6]"  ssl-unclean-shutdown nokeepalive downgrade-1.0 force-response-1.0
 						BrowserMatch "MSIE [17-9]" ssl-unclean-shutdown
 						CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
@@ -179,7 +162,6 @@ rule_apache2_configure () {
 						ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
 						#ErrorLog "/dev/null"
 						LogLevel Warn
-						ServerName $domain
 						SSLCACertificateFile    /etc/apache2/site.d/$site/x509/crt.self-signed.pem
 						SSLCACertificatePath    /etc/apache2/site.d/$site/x509/usr/
 						#SSLCARevocationFile    /etc/apache2/site.d/$site/x509/rvk.pem
@@ -206,35 +188,47 @@ rule_apache2_configure () {
 				 </IfModule>
 				EOF
 			;;
+		 (*)
+			cat <<-EOF
+				<VirtualHost *:$port>
+					AssignUserID www-$site www-$site
+					CustomLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/access/%Y-%m-%d.log 86400 60" Combined
+					#CustomLog "/dev/null" Combined
+					DocumentRoot /home/www/pub/$site
+					ErrorLog "|/usr/sbin/rotatelogs /home/www/log/$site/apache2/error/%Y-%m-%d.log 86400 60"
+					#ErrorLog "/dev/null"
+					LogLevel Warn
+					$(cat "$tool"/etc/apache2/site.d/"$site"/VirtualHost.conf)
+				 </VirtualHost>
+				EOF
+			;;
 		 esac |
 		sudo install -m 660 -o root -g root /dev/stdin \
 		 /etc/apache2/site.d/"$site"/VirtualHost.conf
 		sudo ln -fns \
 		 ../site.d/"$site"/VirtualHost.conf \
 		 /etc/apache2/sites-available/"$site"
-		sudo install -d -m 770 -o www."$site" -g www."$site" \
+		sudo install -d -m 770 -o www-"$site" -g www-"$site" \
 		 /home/www/log/"$site" \
 		 /home/www/log/"$site"/apache2
 		sudo ln -fns \
 		 /etc/apache2/site.d/"$site" \
 		 /home/www/etc/apache2/"$site"
 		test -e /home/www/pub/"$site" ||
-		sudo install -d -m 2770 -o www."$site" -g www."$site" \
+		sudo install -d -m 2770 -o www-"$site" -g www-"$site" \
 		 /home/www/pub/"$site"
-		getent passwd www."$site" >/dev/null ||
-		sudo adduser \
+		rule adduser www-"$site"
 		 --disabled-password \
 		 --group \
 		 --no-create-home \
 		 --home /home/www/pub/"$site" \
 		 --shell /bin/false \
-		 --system \
-		 www."$site"
-		#sudo setfacl -m u:"www.$site":--x \
+		 --system
+		#sudo setfacl -m u:"www-$site":--x \
 		# /home/www/ \
 		# /home/www/pub/ \
 		# /home/www/pub/"$site"/
-		#sudo setfacl -m d:u:"www.$site":rwx \
+		#sudo setfacl -m d:u:"www-$site":rwx \
 		# "$home"/pub/www/"$site"/
 		test ! -r "$tool"/etc/apache2/site.d/"$site"/configure.sh ||
 		.         "$tool"/etc/apache2/site.d/"$site"/configure.sh
@@ -313,8 +307,8 @@ rule_dovecot_configure () {
 	local hint="run vm_remote dovecot_key_send before"
 	assert "sudo test -f /etc/dovecot/\"$vm_domainname\"/imap/x509/key.pem" hint
 	sudo install -m 400 -o root -g root \
-	     "$tool"/var/pub/x509/$vm_domainname/imap/crt+crl.self-signed.pem \
-	 /etc/dovecot/$vm_domainname/imap/x509/crt+crl.self-signed.pem
+	 "$tool"/var/pub/x509/imap."$vm_domainname"/crt+crl.self-signed.pem \
+	    /etc/dovecot/"$vm_domainname"/imap/x509/crt+crl.self-signed.pem
 	sudo install -d -m 770 -o root -g root \
 	 /etc/skel/etc/mail \
 	 /etc/skel/etc/sieve
@@ -484,35 +478,50 @@ rule_initramfs_configure () {
 	sudo update-initramfs -u
  }
 rule_gitolite_configure () {
-	local user=git
 	sudo debconf-set-selections <<-EOF
-		gitolite	gitolite/gituser	string	$user
+		gitolite	gitolite/gituser	string	git
 		gitolite	gitolite/adminkey	string	
-		gitolite	gitolite/gitdir	string	/home/$user
+		gitolite	gitolite/gitdir	string	/home/git
 		EOF
 	rule apt_get_install gitolite
-	getent passwd "$user" >/dev/null ||
-	sudo adduser \
+	rule adduser git \
 	 --disabled-password \
 	 --group \
 	 --shell /bin/bash \
-	 --system \
-	 "$user"
-	sudo chfn --full-name "$user" "$user"
-	eval local home\; home="~$user"
-	sudo install -d -m 770 -o "$user" -g "$user" \
+	 --system
+	sudo chfn --full-name git git
+	rule adduser log-git \
+	 --disabled-login \
+	 --disabled-password \
+	 --group \
+	 --home ~git/log \
+	 --shell /bin/false \
+	 --system
+	rule adduser git-daemon\
+	 --disabled-login \
+	 --disabled-password \
+	 --group \
+	 --home /home/git/pub \
+	 --shell /bin/false \
+	 --system
+	sudo install -d -m 770 -o git -g git \
 	 /etc/gitolite \
-	 "$home"/etc \
-	 "$home"/etc/ssh \
-	 "$home"/pub \
-	 "$home"/log \
-	 "$home"/log/gitolite \
-	 "$home"/log/gitolite/perf
-	sudo ln -fns /etc/gitolite "$home"/etc/gitolite
-	sudo ln -fns etc/gitolite/gitolite.rc "$home"/.gitolite.rc
-	sudo ln -fns etc/ssh "$home"/.ssh
-	sudo install -m 770 -o "$user" -g "$user" /dev/stdin \
-	 "$home"/etc/gitolite/gitolite.rc <<-EOF
+	 ~git/etc \
+	 ~git/etc/ssh \
+	 ~git/pub
+	sudo install -d -m 770 -o log-git -g log-git \
+	 ~git/log \
+	 ~git/log/gitolite \
+	 ~git/log/gitolite/perf
+	sudo install -d -m 550 -o www-lhc-git -g www-lhc-git \
+	 /etc/gitweb \
+	 /etc/gitweb/cgi
+	sudo ln -fns /etc/gitolite ~git/etc/gitolite
+	sudo ln -fns /etc/gitweb ~git/etc/gitweb
+	sudo ln -fns etc/gitolite/gitolite.rc ~git/.gitolite.rc
+	sudo ln -fns etc/ssh ~git/.ssh
+	sudo install -m 770 -o git -g git /dev/stdin \
+	 ~git/etc/gitolite/gitolite.rc <<-EOF
 		#\$ADMIN_POST_UPDATE_CHAINS_TO = "hooks/post-update.secondary";
 		#\$BIG_INFO_CAP = 20;
 		#\$ENV{GL_SLAVES} = 'gitolite@server2 gitolite@server3';
@@ -553,17 +562,17 @@ rule_gitolite_configure () {
 		\$RSYNC_BASE = "";
 		\$SVNSERVE = "";
 		#\$UPDATE_CHAINS_TO = "hooks/update.secondary";
-		#\$WEB_INTERFACE = "gitweb";
+		\$WEB_INTERFACE = "gitweb";
 		1;
 		EOF
-	sudo install -m 770 -o "$user" -g "$user" /dev/stdin \
-	 "$home"/etc/gitweb/gitweb.conf <<-EOF
+	sudo install -m 740 -o git -g www-lhc-git /dev/stdin \
+	 ~git/etc/gitweb/gitweb.conf <<-EOF
 		\$commit_oneline_message_width = 70;
 		\$default_projects_order = 'age';
 		\$default_text_plain_charset = 'UTF-8';
 		@diff_opts = ();
 		\$favicon = "img/git-favicon.png";
-		\$git_temp = "/run/shm/gitweb";
+		\$git_temp = "/run/shm/tmp/gitweb";
 		\$home_footer = "/etc/gitweb/cgi/home-footer.cgi.inc";
 		\$home_header = "/etc/gitweb/cgi/home-header.cgi.inc";
 		\$home_link = "/";
@@ -580,28 +589,27 @@ rule_gitolite_configure () {
 		\$projects_list_description_width = 42;
 		\$projects_list_owner_width = 15;
 		\$search_str = "Filtre&nbsp;:";
-		\$site_footer = "/home/fai/pub/www/git.autogeree.net/cgi/site-footer.bin";
+		\$site_footer = "/etc/gitweb/cgi/site-footer.bin";
 		\$site_header = undef;
 		\$site_name = "git.$vm_domainname";
 		\$space_to_nbsp = 0;
 		@stylesheets = ("css/gitweb.css");#
 		\$untabify_tabstop = 2;
 		EOF
-	sudo install -m 600 -o "$user" -g "$user" \
-	 "$tool"/var/pub/ssh/"$user".key \
-	     "$home"/etc/ssh/"$user".pub
-	sudo -u "$user" \
-	 GL_RC="$home"/etc/gitolite/gitolite.rc \
-	 GIT_AUTHOR_NAME="$user" \
-		gl-setup -q "$home"/etc/ssh/"$user".pub "$user"
+	sudo install -m 600 -o git -g git \
+	 "$tool"/var/pub/ssh/git.key \
+	        ~git/etc/ssh/git.pub
+	sudo -u git \
+	 GL_RC=/home/git/etc/gitolite/gitolite.rc \
+	 GIT_AUTHOR_NAME=git \
+		gl-setup -q ~git/etc/ssh/git.pub git
 	local d
 	for d in doc logs src
-	 do test ! -d "$home"/etc/gitolite/"$d" ||
-		rmdir "$home"/etc/gitolite/"$d"
+	 do test ! -d ~git/etc/gitolite/"$d" ||
+		rmdir ~git/etc/gitolite/"$d"
 	 done
 	rule apt_get_install gitweb highlight
-	#sudo sv restart fcgi.git.80.git.heureux-cyclage.org
-	#sudo sv restart git-daemon.git.9418
+	sudo service tmpfs restart
  }
 rule_locales_configure () {
 	sudo debconf-set-selections <<-EOF
@@ -770,26 +778,23 @@ rule_network_configure () {
 		EOF
  }
 rule_www_configure () {
-	getent passwd www >/dev/null ||
-	sudo adduser \
+	rule adduser www \
 	 --disabled-login \
 	 --disabled-password \
 	 --group \
 	 --home /home/www \
 	 --shell /bin/false \
-	 --system \
-	 www
-	sudo adduser \
+	 --system
+	rule adduser log-www \
 	 --disabled-login \
 	 --disabled-password \
 	 --group \
-	 --home ~www/log \
+	 --home /home/www/log \
 	 --shell /bin/false \
-	 --system \
-	 log.www
+	 --system
 	#sudo adduser www www-data
-	sudo adduser www log.www
-	#sudo adduser log log.www
+	sudo adduser www log-www
+	#sudo adduser log log-www
 	usermod --home /home/www/pub www-data
 	sudo install -d -m 751 -o www -g www \
 	 /home/www
@@ -797,20 +802,20 @@ rule_www_configure () {
 	 /home/www/etc
 	sudo install -d -m 1771 -o www-data -g www-data \
 	 /home/www/pub
-	sudo install -d -m 1771 -o log.www -g log.www \
+	sudo install -d -m 1771 -o log-www -g log-www \
 	 /home/www/log
  }
 rule_nginx_configure () {
 	local -; set +f
 	rule apt_get_install nginx
-	rule www_configure
 	sudo rm -rf \
 	 /etc/nginx/conf.d \
 	 /etc/nginx/site.d
 	sudo install -d -m 770 -o www -g www \
 	 /etc/nginx \
 	 /etc/nginx/conf.d \
-	 /etc/nginx/site.d
+	 /etc/nginx/site.d \
+	 /etc/nginx/x509.d
 	sudo ln -fns \
 	 /etc/nginx \
 	 /home/www/etc/nginx
@@ -826,150 +831,138 @@ rule_nginx_configure () {
 	 done
 	for conf in "$tool"/etc/nginx/site.d/*/server.conf
 	 do conf=${conf#"$tool"/etc/nginx/site.d/}
-		local port domain
-		IFS=. read -r port domain <<-EOF
-			${conf%\/server\.conf}
-			EOF
-		assert 'test "${port:+set}"'
-		assert 'test "${domain:+set}"'
-		local site="$port.$domain"
-		getent passwd www."$site" >/dev/null ||
-		sudo adduser \
+		local site="${conf%/server.conf}"
+		rule adduser www-"$site" \
 		 --disabled-login \
 		 --disabled-password \
 		 --group \
-		 --home ~www-data/"$site" \
+		 --home /home/www-data/"$site" \
 		 --shell /bin/false \
-		 --system \
-		 www."$site"
-		getent passwd log."$site" >/dev/null ||
-		sudo adduser \
+		 --system
+		rule adduser log-www-"$site" \
 		 --disabled-login \
 		 --disabled-password \
 		 --group \
+		 --home /home/www/log/"$site"/nginx \
 		 --shell /bin/false \
-		 --system \
-		 log."$site"
-		sudo usermod --home ~www/log/"$site"/nginx log."$site"
+		 --system
+		sudo install -d -m 2770 -o log-www-"$site" -g log-www-"$site" \
+		 /home/www/log/"$site"
 		sudo install -d -m 770 -o www -g www \
 		 /etc/nginx/site.d/"$site"
-		case $port in
-		 (443)
-			local hint="run vm_remote nginx_key_send before"
-			assert "sudo test -f /etc/nginx/\"$site\"/x509/key.pem" hint
-			sudo install -m 664 -o www -g www \
-			 "$tool"/var/pub/x509/"$site"/crt+ca.pem \
-			 /etc/nginx/site.d/"$site"/x509/crt.pem
-			;;
-		 esac
-		case $port in
-		 (80)
-			cat <<-EOF
-				server {
-					listen $port;
-					access_log /home/www/log/$site/nginx/access.log main;
-					error_log  /home/www/log/$site/nginx/error.log warn;
-					root /home/www/pub/$site;
-					server_name $domain;
-					$(cat "$tool"/etc/nginx/site.d/"$site"/server.conf)
-				 }
-				EOF
-			;;
-		 (443)
-			cat <<-EOF
-				server {
-					listen $port;
-					access_log /home/www/log/$site/nginx/access.log main;
-					error_log  /home/www/log/$site/nginx/error.log warn;
-					keepalive_timeout 70;
-					root /home/www/pub/$site;
-					server_name $domain;
-					# DOC: http://wiki.nginx.org/HttpSslModule
-					ssl on;
-					ssl_certificate     /home/www/etc/nginx/site.d/$site/x509/crt.pem;
-					ssl_certificate_key /home/www/etc/nginx/site.d/$site/x509/key.pem;
-					ssl_ciphers HIGH:!ADH:!MD5;
-					ssl_prefer_server_ciphers on;
-					ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
-					ssl_session_cache shared:SSL:10m;
-					$(cat "$tool"/etc/nginx/site.d/"$site"/server.conf)
-				 }
-				EOF
-			;;
-		 esac |
-		sudo install -m 660 -o www -g www /dev/stdin \
-		 /etc/nginx/site.d/"$site"/server.conf
-		adduser www-data www."$site"
-		test -e /home/www/pub/"$site" ||
-		sudo install -d -m 3770 -o www."$site" -g www."$site" \
+		sudo install -d -m 770 -o www -g www \
+		 /etc/nginx/x509.d/"$site"
+		test -L /home/www/pub/"$site" ||
+		sudo install -d -m 3770 -o www-"$site" -g www-"$site" \
 		 /home/www/pub/"$site"
-		sudo install -d -m 3770 -o log."$site" -g log."$site" \
-		 /home/www/log/"$site"/nginx
+		sudo adduser www-data www-"$site"
+		sudo adduser www-data log-www-"$site"
+		sudo install -m 660 -o www -g www /dev/stdin \
+		 /etc/nginx/site.d/"$site"/server.conf <<-EOF
+			server {
+				access_log          /home/www/log/$site/nginx/access.log main;
+				error_log           /home/www/log/$site/nginx/error.log warn;
+				root                /home/www/pub/$site;
+				ssl_certificate     /etc/nginx/x509.d/$site/crt.pem;
+				ssl_certificate_key /etc/nginx/x509.d/$site/key.pem;
+				$(cat "$tool"/etc/nginx/site.d/"$site"/listen.conf)
+				$(cat "$tool"/etc/nginx/site.d/"$site"/server.conf)
+			 }
+			EOF
+		test -d /home/www/pub/"$site" -o -L /home/www/pub/"$site" ||
 		test ! -r "$tool"/etc/nginx/site.d/"$site"/configure.sh ||
 		.         "$tool"/etc/nginx/site.d/"$site"/configure.sh
 	 done
 	rule apt_get_install spawn-fcgi fcgiwrap
 	sudo insserv --remove fcgiwrap
+	sudo insserv --remove nginx
 	rule tmpfs_configure
-	sudo service nginx restart
+	case $(sv status nginx) in
+	 (run:*) sudo sv restart nginx
+	 esac
  }
 rule_php5_fpm_configure () {
 	local -; set +f
 	rule apt_get_install \
 	 php5-fpm \
 	 php-apc
-	getent passwd php5 >/dev/null ||
-	sudo adduser \
+	rule adduser php5 \
 	 --disabled-login \
 	 --disabled-password \
 	 --group \
+	 --home /etc/php5/fpm \
 	 --shell /bin/false \
-	 --system \
-	 php5
-	local conf
+	 --system
+	rule adduser log-php5 \
+	 --disabled-login \
+	 --disabled-password \
+	 --group \
+	 --home /home/www/log/php5/fpm \
+	 --shell /bin/false \
+	 --system
 	sudo ln -fns \
-	 /etc/php5-fpm \
+	 /etc/php5/fpm \
 	 /home/www/etc/php5
-	sudo rm -f /etc/php5/fpm/pool.d/*
+	sudo rm -rf \
+	 /etc/php5/fpm/conf.d \
+	 /etc/php5/fpm/pool.d
+	sudo install -d -m 770 -o php5 -g php5 \
+	 /etc/php5/fpm/conf.d \
+	 /etc/php5/fpm/pool.d
+	sudo install -m 770 -o php5 -g php5 \
+	 "$tool"/etc/php5/fpm/php-fpm.conf \
+	        /etc/php5/fpm/php-fpm.conf
+	local conf
+	#for conf in "$tool"/etc/php5/fpm/conf.d/*.conf
+	# do conf=${conf#"$tool"/etc/php5/fpm/conf.d/}
+	#	sudo install -m 660 -o php5 -g php5 \
+	#	 "$tool"/etc/php5/fpm/conf.d/"$conf" \
+	#	        /etc/php5/fpm/conf.d/"$conf"
+	# done
 	for conf in "$tool"/etc/php5/fpm/pool.d/*.conf
 	 do conf=${conf#"$tool"/etc/php5/fpm/pool.d/}
-		local port domain
-		IFS=. read -r port domain <<-EOF
-			${conf%\.conf}
+		IFS=. read -r pool <<-EOF
+			${conf%.conf}
 			EOF
-		assert 'test "${port:+set}"'
-		assert 'test "${domain:+set}"'
-		local site="$port.$domain"
-		getent passwd php5."$site" >/dev/null ||
-		sudo adduser \
+		assert 'test "${pool:+set}"'
+		rule adduser php5-"$pool" \
+		 --disabled-login \
+		 --disabled-password \
+		 --group \
+		 --no-create-home \
+		 --home /etc/php5/fpm/pool.d \
+		 --shell /bin/false \
+		 --system
+		rule adduser log-php5-"$pool" \
 		 --disabled-login \
 		 --disabled-password \
 		 --group \
 		 --no-create-home \
-		 --home ~www/pub/"$site" \
+		 --home /home/www/log/php5/fpm \
 		 --shell /bin/false \
-		 --system \
-		 php5."$site"
-		sudo install -d -m 770 -o php5 -g php5 \
+		 --system
+		sudo install -d -m 770 -o log-php5 -g log-php5 \
 		 /home/www/log/php5 \
 		 /home/www/log/php5/fpm
-		sudo install -d -m 770 -o log."$site" -g log."$site" \
-		 /home/www/log/"$site"
-		sudo adduser php5."$site" www."$site"
-		sudo install -m 660 -o root -g root /dev/stdin \
-		 /etc/php5/fpm/pool.d/"$conf" <<-EOF
-			[php5.$site]
-			access.log = /home/www/log/$site/php5/fpm/access.log
+		sudo install -d -m 770 -o log-php5-"$pool" -g log-php5-"$pool" \
+		 /home/www/log/php5/fpm/"$pool"
+		sudo install -m 660 -o php5 -g php5 /dev/stdin \
+		 /etc/php5/fpm/pool.d/"$pool".conf <<-EOF
+			[$pool]
+			access.log = /home/www/log/php5/fpm/$pool/access.log
 			catch_workers_output = yes
 			chdir = /
 			env[HOSTNAME] = \$HOSTNAME
 			env[TEMP] = /tmp
 			env[TMPDIR] = /tmp
 			env[TMP] = /tmp
-			group = www-data
-			listen = /run/nginx/fastcgi/php5.$site
+			group = php5-$pool
 			#listen = 127.0.0.1:9000
+			listen = /run/php5/fpm/$pool
 			#listen.allowed_clients = 127.0.0.1
+			listen.group = www-data
+			listen.mode = 0660
+			#listen.owner = www-data
 			listen.backlog = -1
 			pm = dynamic
 			pm.max_children = 5
@@ -982,13 +975,16 @@ rule_php5_fpm_configure () {
 			request_terminate_timeout = 120s
 			rlimit_core = unlimited
 			rlimit_files = 131072
-			slowlog = /home/www/log/$site/php5/fpm/slow.log
-			user = $php5_user
+			slowlog = /home/www/log/php5/fpm/$pool/slow.log
+			user = php5-$pool
 			$(cat "$tool"/etc/php5/fpm/pool.d/"$conf")
 			EOF
-		sudo install -m 664 -o root -g root \
+		sudo install -m 664 -o php5 -g php5 \
 		 "$tool"/etc/php5/fpm/php.ini \
 		        /etc/php5/fpm/php.ini
+		case $(sv status php5-"$pool") in
+		 (run:*) sudo sv restart php5-"$pool"
+		 esac
 	 done
 	rule tmpfs_configure
 	sudo service php5-fpm restart
@@ -1236,6 +1232,7 @@ rule_tmpfs_configure () {
 	 "$tool"/etc/init.d/tmpfs \
 	        /etc/init.d/tmpfs
 	sudo update-rc.d tmpfs defaults
+	sudo service tmpfs restart
  }
 rule_time_configure () {
 	sudo install -m 644 -o root -g root /dev/stdin /etc/timezone <<-EOF
@@ -1251,8 +1248,7 @@ rule_time_configure () {
 rule_user_add () { # SYNTAX: $user
 	rule user_configure
 	local user=$1
-	getent passwd "$user" >/dev/null ||
-	sudo adduser --disabled-password "$user"
+	rule adduser "$user" --disabled-password
 		# NOTE: le mot-de-passe doit être initialisé par l'utilisateur à l'aide de passwd-init .
 	eval local home\; home="~$user"
 	sudo adduser "$user" users
@@ -1336,8 +1332,7 @@ rule_user_configure () {
 rule_user_admin_add () { # SYNTAX: $user
 	rule user_configure
 	local user=$1
-	getent passwd "$user" >/dev/null ||
-	sudo adduser --disabled-password "$user"
+	rule adduser "$user" --disabled-password
 	eval local home\; home="~$user"
 	sudo adduser "$user" sudo
 	sudo install -m 640 -o root -g root \
@@ -1390,9 +1385,10 @@ rule_configure () {
 	rule sysctl_configure
 	rule user_configure
 	rule mail_configure
-	#rule apache2_configure
-	rule nginx_configure
+	rule www_configure
 	rule php5_fpm_configure
+	rule nginx_configure
+	#rule apache2_configure
 	rule gitolite_configure
 	rule runit_configure
  }