]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/nginx/sourcephile.fr/nix-serve.nix
gpg: set default-key
[sourcephile-nix.git] / hosts / losurdo / nginx / sourcephile.fr / nix-serve.nix
1 { domain, ... }:
2 { pkgs, lib, config, inputs, hostName, ... }:
3 let
4 inherit (config) networking;
5 inherit (config.security) gnupg;
6 inherit (config.services) nginx nix-serve;
7 inherit (config.users) users groups;
8 srv = "nix-serve";
9 in
10 {
11 nix.settings.trusted-users = [ users."nix-serve".name ];
12 users.users."nix-serve" = {
13 isSystemUser = true;
14 group = groups."nix-serve".name;
15 extraGroups = [ groups."keys".name ];
16 };
17 users.groups."nix-serve" = {};
18 security.gnupg.secrets."nix/binary-cache-key/1" = {
19 user = users."nix-serve".name;
20 systemdConfig = {
21 before = [ "nix-serve.service" ];
22 wantedBy = [ "nix-serve.service" ];
23 };
24 };
25 services.nix-serve = {
26 enable = true;
27 secretKeyFile = gnupg.secrets."nix/binary-cache-key/1".path;
28 bindAddress = "127.0.0.1";
29 };
30 nix.settings.allowed-users = [ users."nix-ssh".name ];
31 nix.sshServe = {
32 enable = true;
33 keys = map lib.readFile [
34 (inputs.secrets + "/members/ssh/julm-losurdo.pub")
35 (inputs.secrets + "/members/ssh/julm-oignon.pub")
36 (inputs.secrets + "/members/ssh/sevy-patate.pub")
37 ];
38 };
39
40 services.nginx = let virtualHost = priority:
41 {
42 extraConfig = ''
43 #access_log /var/log/nginx/${domain}/${srv}/access.json json buffer=32k;
44 #error_log /var/log/nginx/${domain}/${srv}/error.log warn;
45 access_log off;
46 error_log /dev/null crit;
47 '';
48 locations."/nix-cache-info" = {
49 # cache.nixos.org has priority 40
50 return = ''200 "StoreDir: ${builtins.storeDir}\nWantMassQuery: 1\nPriority: ${toString priority}\n"'';
51 extraConfig = ''
52 ${nginx.configs.https_add_headers}
53 add_header Content-Type text/plain;
54 '';
55 };
56 locations."/".extraConfig = ''
57 proxy_pass http://localhost:${toString nix-serve.port};
58 proxy_set_header Host $host;
59 proxy_set_header X-Real-IP $remote_addr;
60 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
61 '';
62 };
63 in {
64 # cache.nixos.org has priority over extracache
65 virtualHosts."nix-extracache.${hostName}.wg" = virtualHost 60 // {
66 listenAddresses = [ "nix-extracache.${hostName}.wg" ];
67 forceSSL = false;
68 };
69 # localcache has priority over cache.nixos.org
70 virtualHosts."nix-localcache.${hostName}.wg" = virtualHost 30 // {
71 listenAddresses = [ "nix-localcache.${hostName}.wg" ];
72 forceSSL = false;
73 };
74 };
75 systemd.services.nginx = {
76 serviceConfig = {
77 LogsDirectory = lib.mkForce ["nginx/${domain}/${srv}"];
78 };
79 };
80 }