let's hope this works

hosts/default/configuration.nix

@@ -9,6 +9,7 @@
       # Include the results of the hardware scan.
       ./hardware-configuration.nix
       ../../modules/games/steam.nix
+      ../../modules/websites
       inputs.nix-minecraft.nixosModules.minecraft-servers
     ];
 
@@ -45,9 +46,6 @@
 
   networking = {
     hostName = "lambdaOS"; # Define your hostname.
-    hosts = {
-      "127.0.0.1" = [ "images.noa.voorwaarts.nl" "sods.noa.voorwaarts.nl" "noa.voorwaarts.nl" "testing.noa.voorwaarts.nl" ];
-    };
   };
   # networking.wireless.enable = true;# Enables wireless support via wpa_supplicant.
 
@@ -163,7 +161,32 @@
     ];
   };
 
-  modules.games.steam.enable = false;
+  modules = {
+    games.steam.enable = false;
+    modules.websites = {
+      enable = true;
+      certMail = "acme@voorwaarts.nl";
+      mainDomains = {
+        "noa.voorwaarts.nl" = {
+          enable = true;
+          proxy = "http://127.0.0.1:3000/";
+          extra_sites = {
+            "images.noa.voorwaarts.nl" = {
+              enable = true;
+              proxy = "http://127.0.0.1:2283/";
+            };
+            "testing.noa.voorwaarts.nl" = {
+              enable = true;
+              proxy = "http://127.0.0.1:8000/";
+            };
+            "sods.noa.voorwaarts.nl" = {
+              enable = true;
+              proxy = "http://127.0.0.1:2000/";
+            };
+          };
+        };
+      };
+    };
 
     users.defaultUserShell = pkgs.zsh;
 
@@ -221,54 +244,6 @@
           };
         };
       };
-    nginx = {
-      enable = true;
-
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-
-      sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
-
-      virtualHosts =
-        let
-          extra = ''
-            client_max_body_size 50000M;
-
-            proxy_set_header Host              $host;
-            proxy_set_header X-Real-IP         $remote_addr;
-            proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto $scheme;
-
-            proxy_http_version 1.1;
-            proxy_set_header   Upgrade    $http_upgrade;
-            proxy_set_header   Connection "upgrade";
-            proxy_redirect     off;
-
-            proxy_read_timeout 600s;
-            proxy_send_timeout 600s;
-            send_timeout       600s;'';
-          proxy = port: {
-            forceSSL = true;
-            useACMEHost = "noa.voorwaarts.nl";
-            extraConfig = extra;
-            locations."/" = {
-              proxyPass = "http://127.0.0.1:${builtins.toString port}/";
-            };
-          };
-        in
-        {
-          "noa.voorwaarts.nl" = {
-            default = true;
-            forceSSL = true;
-            enableACME = true;
-          };
-          "images.noa.voorwaarts.nl" = proxy 2283;
-          "testing.noa.voorwaarts.nl" = proxy 8000;
-          "sods.noa.voorwaarts.nl" = proxy 2000;
-        };
-    };
       openssh = {
         enable = true;
         settings.PasswordAuthentication = false;
@@ -351,15 +326,6 @@
       options v4l2loopback devices=1 video_nr=1 card_label="OBS Cam" exclusive_caps=1
     '';
     security = {
-    acme = {
-      acceptTerms = true;
-      defaults.email = "acme@voorwaarts.nl";
-      certs."noa.voorwaarts.nl".extraDomainNames = [
-        "images.noa.voorwaarts.nl"
-        "sods.noa.voorwaarts.nl"
-        "testing.noa.voorwaarts.nl"
-      ];
-    };
       polkit.enable = true;
     };
 
@@ -384,4 +350,4 @@
     # Before changing this value read the documentation for this option
     # (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
     system.stateVersion = "23.11"; # Did you read the comment?
-}
+  }

modules/websites/default.nix

@@ -0,0 +1,125 @@
+{ config, options, lib, ... }:
+let
+  cfg = config.modules.websites;
+in
+{
+  options.modules.nginx =
+    {
+      enable = lib.mkEnableOption "enable web hosting";
+      cert_mail = lib.mkOption {
+        type = lib.types.str;
+        description = "the email address the certificate will be requested to";
+      };
+      mainDomains = lib.mkOption {
+        description = "nginx domains for which a certificate is needed";
+        type = with lib.types; attrsOf (submodule {
+          options =
+            let
+              proxyOption = lib.mkOption { type = int; description = "what url to proxy the requests to"; };
+            in
+            {
+              enable = lib.mkEnableOption "enable this website";
+              extra_sites = attrsOf
+                (submodule {
+                  options = {
+                    enable = lib.mkEnableOption "enable this website";
+                    proxy = proxyOption;
+                  };
+                });
+              proxy = proxyOption;
+            };
+        });
+      };
+    };
+  config = lib.mkIf cfg.enable (
+    let
+      hostnames = lib.lists.flatten (
+        lib.attrsets.mapAttrsToList
+          (
+            name: config:
+              lib.mkIf config.enable (
+                [ name ] ++ lib.attrsets.mapAttrsToList (n: c: lib.mkIf c.enable n) config.extra_sites
+              )
+          )
+          cfg.mainDomains
+      );
+      certs = lib.attrsets.MapAttrs
+        (
+          name: config:
+            lib.mkIf config.enable {
+              extraDomainNames = lib.attrsets.MapAttrsToList (n: c: lib.mkIf c.enable n) config.extra_sites;
+            }
+        )
+        cfg.mainDomains;
+      hosts = lib.attrsets.MapAtrrs
+        (
+          name: config:
+            let
+              extra = ''
+                client_max_body_size 50000M;
+
+                proxy_set_header Host              $host;
+                proxy_set_header X-Real-IP         $remote_addr;
+                proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+                proxy_set_header X-Forwarded-Proto $scheme;
+
+                proxy_http_version 1.1;
+                proxy_set_header   Upgrade    $http_upgrade;
+                proxy_set_header   Connection "upgrade";
+                proxy_redirect     off;
+
+                proxy_read_timeout 600s;
+                proxy_send_timeout 600s;
+                send_timeout       600s;'';
+              proxy = url: {
+                forceSSL = true;
+                useACMEHost = name;
+                extraConfig = extra;
+                locations."/" = {
+                  proxyPass = url;
+                };
+              };
+            in
+            lib.mkIf config.enable (
+              lib.mkMerge (
+                {
+                  forceSSL = true;
+                  enableACME = true;
+                  extraConfig = extra;
+                  locations."/" = {
+                    proxyPass = config.proxy;
+                  };
+                }
+                ++ (lib.attrsets.MapAttrsToList
+                  (n: c: lib.mkIf c.enable (proxy c.proxy))
+                  config.extra_sites)
+              )
+            )
+        )
+        cfg.mainDomains;
+    in
+    {
+      networking.hosts = {
+        # NOTE: this is needed because I don't have hairpin nat. :(
+        "127.0.0.1" = hostnames;
+      };
+      security.acme = {
+        acceptTerms = true;
+        defaults.email = cfg.cert_mail;
+        certs = certs;
+      };
+      services.nginx = {
+        enable = true;
+
+        recommendedGzipSettings = true;
+        recommendedOptimisation = true;
+        recommendedProxySettings = true;
+        recommendedTlsSettings = true;
+
+        sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
+
+        virtualHosts = hosts;
+      };
+    }
+  );
+}