noa/nixconf
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

let's hope this works

Browse source
This commit is contained in:
Noa Aarts 2024-06-05 21:06:03 +02:00
parent 4b580a4f29
commit 5b4cc25a87
2 changed files with 300 additions and 209 deletions
Download patch file Download diff file Expand all files Collapse all files

88
hosts/default/configuration.nix
View file

@ -9,6 +9,7 @@
# Include the results of the hardware scan.
./hardware-configuration.nix
../../modules/games/steam.nix
../../modules/websites
inputs.nix-minecraft.nixosModules.minecraft-servers
];
@ -45,9 +46,6 @@
networking = {
hostName = "lambdaOS"; # Define your hostname.
hosts = {
"127.0.0.1" = [ "images.noa.voorwaarts.nl" "sods.noa.voorwaarts.nl" "noa.voorwaarts.nl" "testing.noa.voorwaarts.nl" ];
};
};
# networking.wireless.enable = true;# Enables wireless support via wpa_supplicant.
@ -163,7 +161,32 @@
];
};
modules.games.steam.enable = false;
modules = {
games.steam.enable = false;
modules.websites = {
enable = true;
certMail = "acme@voorwaarts.nl";
mainDomains = {
"noa.voorwaarts.nl" = {
enable = true;
proxy = "http://127.0.0.1:3000/";
extra_sites = {
"images.noa.voorwaarts.nl" = {
enable = true;
proxy = "http://127.0.0.1:2283/";
};
"testing.noa.voorwaarts.nl" = {
enable = true;
proxy = "http://127.0.0.1:8000/";
};
"sods.noa.voorwaarts.nl" = {
enable = true;
proxy = "http://127.0.0.1:2000/";
};
};
};
};
};
users.defaultUserShell = pkgs.zsh;
@ -221,54 +244,6 @@
};
};
};
nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
virtualHosts =
let
extra = ''
client_max_body_size 50000M;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_redirect off;
proxy_read_timeout 600s;
proxy_send_timeout 600s;
send_timeout 600s;'';
proxy = port: {
forceSSL = true;
useACMEHost = "noa.voorwaarts.nl";
extraConfig = extra;
locations."/" = {
proxyPass = "http://127.0.0.1:${builtins.toString port}/";
};
};
in
{
"noa.voorwaarts.nl" = {
default = true;
forceSSL = true;
enableACME = true;
};
"images.noa.voorwaarts.nl" = proxy 2283;
"testing.noa.voorwaarts.nl" = proxy 8000;
"sods.noa.voorwaarts.nl" = proxy 2000;
};
};
openssh = {
enable = true;
settings.PasswordAuthentication = false;
@ -351,15 +326,6 @@
options v4l2loopback devices=1 video_nr=1 card_label="OBS Cam" exclusive_caps=1
'';
security = {
acme = {
acceptTerms = true;
defaults.email = "acme@voorwaarts.nl";
certs."noa.voorwaarts.nl".extraDomainNames = [
"images.noa.voorwaarts.nl"
"sods.noa.voorwaarts.nl"
"testing.noa.voorwaarts.nl"
];
};
polkit.enable = true;
};

125
modules/websites/default.nix Normal file
View file

@ -0,0 +1,125 @@
{ config, options, lib, ... }:
let
cfg = config.modules.websites;
in
{
options.modules.nginx =
{
enable = lib.mkEnableOption "enable web hosting";
cert_mail = lib.mkOption {
type = lib.types.str;
description = "the email address the certificate will be requested to";
};
mainDomains = lib.mkOption {
description = "nginx domains for which a certificate is needed";
type = with lib.types; attrsOf (submodule {
options =
let
proxyOption = lib.mkOption { type = int; description = "what url to proxy the requests to"; };
in
{
enable = lib.mkEnableOption "enable this website";
extra_sites = attrsOf
(submodule {
options = {
enable = lib.mkEnableOption "enable this website";
proxy = proxyOption;
};
});
proxy = proxyOption;
};
});
};
};
config = lib.mkIf cfg.enable (
let
hostnames = lib.lists.flatten (
lib.attrsets.mapAttrsToList
(
name: config:
lib.mkIf config.enable (
[ name ] ++ lib.attrsets.mapAttrsToList (n: c: lib.mkIf c.enable n) config.extra_sites
)
)
cfg.mainDomains
);
certs = lib.attrsets.MapAttrs
(
name: config:
lib.mkIf config.enable {
extraDomainNames = lib.attrsets.MapAttrsToList (n: c: lib.mkIf c.enable n) config.extra_sites;
}
)
cfg.mainDomains;
hosts = lib.attrsets.MapAtrrs
(
name: config:
let
extra = ''
client_max_body_size 50000M;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_redirect off;
proxy_read_timeout 600s;
proxy_send_timeout 600s;
send_timeout 600s;'';
proxy = url: {
forceSSL = true;
useACMEHost = name;
extraConfig = extra;
locations."/" = {
proxyPass = url;
};
};
in
lib.mkIf config.enable (
lib.mkMerge (
{
forceSSL = true;
enableACME = true;
extraConfig = extra;
locations."/" = {
proxyPass = config.proxy;
};
}
++ (lib.attrsets.MapAttrsToList
(n: c: lib.mkIf c.enable (proxy c.proxy))
config.extra_sites)
)
)
)
cfg.mainDomains;
in
{
networking.hosts = {
# NOTE: this is needed because I don't have hairpin nat. :(
"127.0.0.1" = hostnames;
};
security.acme = {
acceptTerms = true;
defaults.email = cfg.cert_mail;
certs = certs;
};
services.nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
virtualHosts = hosts;
};
}
);
}