rc/hosts/spore/services/web/default.nix at bf45326e9ec869736464ed56e3177279075b5ab5 · stackptr/rc · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
# Web services and nginx configuration
{
  config,
  pkgs,
  lib,
  ...
}: {
  imports = [
    ./auth.nix
    ./irc-proxy.nix
    ./srv.nix
  ];

  age.secrets.cloudflare-dns.file = ../../secrets/cloudflare-dns.age;

  services.nginx = {
    enable = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
    recommendedGzipSettings = true;
    additionalModules = [pkgs.nginxModules.develkit pkgs.nginxModules.set-misc];

    virtualHosts = {
      "cjohns.com" = {
        forceSSL = true;
        useACMEHost = "zx.dev";
        locations."/".return = "302 https://zx.dev";
        locations."= /resume".return = "302 https://github.com/stackptr/resume/releases/download/latest/resume.pdf";
      };
      "rey.foo" = {
        # forceSSL = true;
        # useACMEHost = "rey.foo";
        locations."/".return = "302 https://zx.dev";
      };
      "zx.dev" = {
        forceSSL = true;
        useACMEHost = "zx.dev";
        locations = {
          "/.well-known/webfinger" = {
            extraConfig = ''
              add_header Access-Control-Allow-Origin '*';
            '';
            return = "301 https://pub.zx.dev$request_uri";
          };
          "/pgp".return = "302 https://keyoxide.org/hkp/413d1a0152bcb08d2e3ddacaf88c08579051ab48";
        };
      };
      "torrents.zx.dev" = {
        forceSSL = true;
        useACMEHost = "zx.dev";
        requireAuth = true;
        locations."/".proxyPass = "http://glyph.rove-duck.ts.net:9091";
        locations."~ (/transmission)?/rpc".proxyPass = "http://glyph.rove-duck.ts.net:9091";
      };
      "homebridge.zx.dev" = {
        forceSSL = true;
        useACMEHost = "zx.dev";
        locations."/".proxyPass = "http://zeta.rove-duck.ts.net:8581";
      };
      "ha.zx.dev" = {
        forceSSL = true;
        useACMEHost = "zx.dev";
        locations."/" = {
          proxyPass = "http://zeta.rove-duck.ts.net:8123";
          proxyWebsockets = true;
        };
      };
      "files.zx.dev" = {
        forceSSL = true;
        useACMEHost = "zx.dev";
        requireAuth = true;
        locations."/".proxyPass = "http://glyph.rove-duck.ts.net:8080";
      };
      "home.zx.dev" = {
        forceSSL = true;
        useACMEHost = "zx.dev";
        requireAuth = true;
        locations."/".proxyPass = "http://127.0.0.1:8082";
      };
      "grafana.zx.dev" = {
        forceSSL = true;
        useACMEHost = "zx.dev";
        locations."/".proxyPass = "http://127.0.0.1:${toString config.services.grafana.settings.server.http_port}";
      };
      "chat.zx.dev" = {
        forceSSL = true;
        useACMEHost = "zx.dev";
        locations."/" = {
          proxyPass = "http://glyph.rove-duck.ts.net:8888";
          proxyWebsockets = true;
        };
      };
      "cache.zx.dev" = {
        forceSSL = true;
        useACMEHost = "zx.dev";
        locations."/" = {
          proxyPass = "http://glyph.rove-duck.ts.net:8199";
          extraConfig = ''
            client_max_body_size 0;
            proxy_read_timeout 300;
            proxy_buffering off;
            proxy_http_version 1.1;
          '';
        };
      };
      "agents.zx.dev" = {
        forceSSL = true;
        useACMEHost = "zx.dev";
        requireAuth = true;
        locations."/".proxyPass = "http://glyph.rove-duck.ts.net:8095";
      };
      "jellyfin.zx.dev" = {
        forceSSL = true;
        useACMEHost = "zx.dev";
        locations."/".proxyPass = "http://glyph.rove-duck.ts.net:8096";
      };
    };
  };

  services.zx-dev = {
    enable = true;
    domain = "zx.dev";
  };

  security.acme = {
    acceptTerms = true;
    defaults.email = "corey@zx.dev";
    certs."zx.dev" = {
      domain = "*.zx.dev";
      dnsProvider = "cloudflare";
      environmentFile = config.age.secrets.cloudflare-dns.path;
      extraDomainNames = ["zx.dev" "cjohns.com"];
    };
  };
  users.users.nginx.extraGroups = ["acme"];
}