hosts/losurdo/nginx/sourcephile.fr/losurdo.nix

   1 { domain, ... }:
   2 { lib, config, hostName, ... }:
   3 let
   4   inherit (config.security) gnupg;
   5   inherit (config.services) nginx;
   6   root = "/var/lib/nginx";
   7   onion = "dfc66yn2fundui5yvq2ndx4nmcmbxpho4ji32tlc4cncrjvs2b5yu4id";
   8 in
   9 {
  10   services.tor = {
  11     relay.onionServices."nginx/${domain}/${hostName}" = {
  12       secretKey = gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
  13       map = [
  14         80
  15         #{ port = 443; target = { port = 8443; }; }
  16       ];
  17       /*
  18         authorizedClients = [
  19       "descriptor:x25519:2EZQ3AOZXERDVSN6WO5LNSCOIIPL2AT2A7KOS4ZIYNVQDR5EFM2Q" # julm
  20         ];
  21       */
  22     };
  23     /*
  24       client.onionServices.${onion} = {
  25       clientAuthorizations = [
  26       gnupg.secrets."tor/auth/julm".path
  27       ];
  28       };
  29     */
  30   };
  31   security.gnupg.secrets = lib.genAttrs [
  32     "tor/onion/${onion}/hs_ed25519_secret_key"
  33     "tor/auth/julm"
  34   ]
  35     (_secret: {
  36       systemdConfig.before = [ "tor.service" ];
  37       systemdConfig.wantedBy = [ "tor.service" ];
  38     }) // {
  39     "nginx/perso/htpasswd" = {
  40       # Generated with: for i in $PASSWORD_STORE_DIR/hosts/losurdo/nginx/perso/htpasswd/*.gpg; do i="${i#$PASSWORD_STORE_DIR/}"; i=${i%.gpg}; printf %s: "${i##*/}"; pass $i | openssl passwd -apr1 -stdin; done | pass insert -m hosts/losurdo/nginx/perso/htpasswd
  41       # Then: nix flake lock --update-input pass
  42       systemdConfig.before = [ "nginx.service" ];
  43       systemdConfig.wantedBy = [ "nginx.service" ];
  44       user = nginx.user;
  45       group = nginx.group;
  46     };
  47   };
  48   services.nginx = {
  49     virtualHosts."${onion}.onion" = {
  50       root = root + "/dl";
  51       extraConfig = ''
  52         access_log /var/log/nginx/${domain}/${hostName}/access.json json buffer=32k;
  53         error_log  /var/log/nginx/${domain}/${hostName}/error.log warn;
  54       '';
  55       locations."/".extraConfig = ''
  56         autoindex on;
  57         fancyindex on;
  58         fancyindex_exact_size off;
  59         fancyindex_name_length 255;
  60         open_file_cache off;
  61         #open_file_cache_valid 1s;
  62       '';
  63     };
  64     virtualHosts."${hostName}.${domain}" = {
  65       serverAliases = [ domain ];
  66       #onlySSL = true;
  67       #addSSL = true;
  68       forceSSL = true;
  69       useACMEHost = domain;
  70       root = root;
  71       extraConfig = ''
  72         access_log /var/log/nginx/${domain}/${hostName}/access.json json buffer=32k;
  73         error_log  /var/log/nginx/${domain}/${hostName}/error.log warn;
  74       '';
  75       locations."/".extraConfig = ''
  76         #autoindex on;
  77         return 444;
  78       '';
  79       locations."/dl".extraConfig = ''
  80         autoindex on;
  81         fancyindex on;
  82         fancyindex_exact_size off;
  83         fancyindex_name_length 255;
  84         open_file_cache off;
  85         #open_file_cache_valid 1s;
  86       '';
  87       locations."/julm".extraConfig = ''
  88         autoindex on;
  89         fancyindex on;
  90         fancyindex_exact_size off;
  91         fancyindex_name_length 255;
  92         open_file_cache off;
  93         #open_file_cache_valid 1s;
  94       '';
  95       locations."/haskell".extraConfig = ''
  96         autoindex on;
  97         fancyindex on;
  98         fancyindex_exact_size off;
  99         fancyindex_name_length 255;
 100         open_file_cache off;
 101         #open_file_cache_valid 1s;
 102       '';
 103       locations."/perso" = {
 104         basicAuthFile = gnupg.secrets."nginx/perso/htpasswd".path;
 105         extraConfig = ''
 106           autoindex on;
 107         '';
 108       };
 109     };
 110   };
 111   systemd.services.nginx = {
 112     serviceConfig = {
 113       LogsDirectory = lib.mkForce [
 114         "nginx/${domain}/${hostName}"
 115         "nginx/wg-intra/${hostName}"
 116       ];
 117       BindReadOnlyPaths = [
 118         "/home/julm/work/sourcephile/web:${root}/julm"
 119         "/home/julm/dl:${root}/dl"
 120         "/home/julm/work/sourcephile/haskell:${root}/haskell"
 121         "/home/julm/perso:${root}/perso"
 122       ];
 123     };
 124   };
 125 }