···

       
257
       
 
       
        </listitem>

     

       
258
       
 
       
        <listitem>

     

       
259
       
 
       
          <para>

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
260
       
 
       
            The <literal>piwik</literal> user was renamed to <literal>matomo</literal>.

     

       
261
       
 
       
            The service will adjust ownership automatically for files in the data directory.

     

       
262
       
 
       
            If you use unix socket authentication, remember to give the new <literal>matomo</literal> user

     

···

       
257
       
 
       
        </listitem>

     

       
258
       
 
       
        <listitem>

     

       
259
       
 
       
          <para>

     

       
260
       
+
       
            The default <option>serverName</option> for the nginx configuration changed from

     

       
261
       
+
       
            <literal>piwik.${config.networking.hostName}</literal> to

     

       
262
       
+
       
            <literal>matomo.${config.networking.hostName}.${config.networking.domain}</literal>

     

       
263
       
+
       
            if <option>config.networking.domain</option> is set,

     

       
264
       
+
       
            <literal>matomo.${config.networking.hostName}</literal> if it is not set.

     

       
265
       
+
       
            If you change your <option>serverName</option>, remember you'll need to update the

     

       
266
       
+
       
            <literal>trustedHosts[]</literal> array in <filename>/var/lib/matomo/config/config.ini.php</filename>

     

       
267
       
+
       
            as well.

     

       
268
       
+
       
          </para>

     

       
269
       
+
       
        </listitem>

     

       
270
       
+
       
        <listitem>

     

       
271
       
+
       
          <para>

     

       
272
       
 
       
            The <literal>piwik</literal> user was renamed to <literal>matomo</literal>.

     

       
273
       
 
       
            The service will adjust ownership automatically for files in the data directory.

     

       
274
       
 
       
            If you use unix socket authentication, remember to give the new <literal>matomo</literal> user

     

···

       
14
       
 
       
  phpExecutionUnit = "phpfpm-${pool}";

     

       
15
       
 
       
  databaseService = "mysql.service";

     

       
16
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
17
       
 
       
in {

     

       
18
       
 
       
  options = {

     

       
19
       
 
       
    services.matomo = {

     
···

       
75
       
 
       
        );

     

       
76
       
 
       
        default = null;

     

       
77
       
 
       
        example = {

     

       
78
       
-
       
          serverName = "stats.$\{config.networking.hostName\}";

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
79
       
 
       
          enableACME = false;

     

       
80
       
 
       
        };

     

       
81
       
 
       
        description = ''

     

       
82
       
 
       
            With this option, you can customize an nginx virtualHost which already has sensible defaults for matomo.

     

       
83
       
 
       
            Either this option or the webServerUser option is mandatory.

     

       
84
       
 
       
            Set this to {} to just enable the virtualHost if you don't need any customization.

     

       
85
       
-
       
            If enabled, then by default, the serverName is ${user}.$\{config.networking.hostName\}, SSL is active,

     

       
86
       
-
       
            and certificates are acquired via ACME.

     

       
0
       
 
       

     

       
87
       
 
       
            If this is set to null (the default), no nginx virtualHost will be configured.

     

       
88
       
 
       
        '';

     

       
89
       
 
       
      };

     
···

       
183
       
 
       
      # References:

     

       
184
       
 
       
      # https://fralef.me/piwik-hardening-with-nginx-and-php-fpm.html

     

       
185
       
 
       
      # https://github.com/perusio/piwik-nginx

     

       
186
       
-
       
      # TODO: better default

     

       
187
       
-
       
      "${user}.${config.networking.hostName}" = mkMerge [ cfg.nginx {

     

       
188
       
 
       
        # don't allow to override the root easily, as it will almost certainly break matomo.

     

       
189
       
 
       
        # disadvantage: not shown as default in docs.

     

       
190
       
 
       
        root = mkForce "${pkgs.matomo}/share";

     

···

       
14
       
 
       
  phpExecutionUnit = "phpfpm-${pool}";

     

       
15
       
 
       
  databaseService = "mysql.service";

     

       
16
       
 
       


     

       
17
       
+
       
  fqdn =

     

       
18
       
+
       
    let

     

       
19
       
+
       
      join = hostName: domain: hostName + optionalString (domain != null) ".${domain}";

     

       
20
       
+
       
     in join config.networking.hostName config.networking.domain;

     

       
21
       
+
       


     

       
22
       
 
       
in {

     

       
23
       
 
       
  options = {

     

       
24
       
 
       
    services.matomo = {

     
···

       
80
       
 
       
        );

     

       
81
       
 
       
        default = null;

     

       
82
       
 
       
        example = {

     

       
83
       
+
       
          serverAliases = [

     

       
84
       
+
       
            "matomo.$\{config.networking.domain\}"

     

       
85
       
+
       
            "stats.$\{config.networking.domain\}"

     

       
86
       
+
       
          ];

     

       
87
       
 
       
          enableACME = false;

     

       
88
       
 
       
        };

     

       
89
       
 
       
        description = ''

     

       
90
       
 
       
            With this option, you can customize an nginx virtualHost which already has sensible defaults for matomo.

     

       
91
       
 
       
            Either this option or the webServerUser option is mandatory.

     

       
92
       
 
       
            Set this to {} to just enable the virtualHost if you don't need any customization.

     

       
93
       
+
       
            If enabled, then by default, the <option>serverName</option> is

     

       
94
       
+
       
            <literal>${user}.$\{config.networking.hostName\}.$\{config.networking.domain\}</literal>,

     

       
95
       
+
       
            SSL is active, and certificates are acquired via ACME.

     

       
96
       
 
       
            If this is set to null (the default), no nginx virtualHost will be configured.

     

       
97
       
 
       
        '';

     

       
98
       
 
       
      };

     
···

       
192
       
 
       
      # References:

     

       
193
       
 
       
      # https://fralef.me/piwik-hardening-with-nginx-and-php-fpm.html

     

       
194
       
 
       
      # https://github.com/perusio/piwik-nginx

     

       
195
       
+
       
      "${user}.${fqdn}" = mkMerge [ cfg.nginx {

     

       
0
       
 
       

     

       
196
       
 
       
        # don't allow to override the root easily, as it will almost certainly break matomo.

     

       
197
       
 
       
        # disadvantage: not shown as default in docs.

     

       
198
       
 
       
        root = mkForce "${pkgs.matomo}/share";