]> Git — Sourcephile - sourcephile-nix.git/blob - machines/mermet/nginx.nix
nix: factorize security.gnupg.store
[sourcephile-nix.git] / machines / mermet / nginx.nix
1 { pkgs, lib, config, ... }:
2 let
3 inherit (config) networking;
4 inherit (config.services) nginx;
5 in
6 {
7 imports = [
8 ../../nixos/profiles/services/nginx.nix
9 nginx/sourcephile.fr.nix
10 ];
11 users.groups."acme".members = [nginx.user];
12 networking.nftables.ruleset = ''
13 add rule inet filter net2fw tcp dport 80 counter accept comment "HTTP"
14 add rule inet filter net2fw tcp dport 443 counter accept comment "HTTPS"
15 '';
16 services.nginx = {
17 enable = true;
18 package = pkgs.nginx.override {
19 modules = with pkgs.nginxModules; [
20 fancyindex
21 ];
22 };
23 resolver = {
24 addresses = [ "127.0.0.1:53" ];
25 valid = "";
26 };
27 virtualHosts."_" = {
28 forceSSL = true;
29 useACMEHost = networking.domain;
30 };
31 };
32 }