]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/nginx/sourcephile.fr/losurdo.nix
nix: update flake.lock
[sourcephile-nix.git] / hosts / losurdo / nginx / sourcephile.fr / losurdo.nix
1 { domain, ... }:
2 { pkgs, lib, config, ... }:
3 let
4 inherit (config) networking;
5 inherit (config.security) gnupg;
6 inherit (config.services) nginx;
7 srv = "losurdo";
8 root = "/var/lib/nginx";
9 onion = "dfc66yn2fundui5yvq2ndx4nmcmbxpho4ji32tlc4cncrjvs2b5yu4id";
10 in
11 {
12 services.tor = {
13 relay.onionServices."nginx/${domain}/${srv}" = {
14 secretKey = gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
15 map = [
16 80
17 #{ port = 443; target = { port = 8443; }; }
18 ];
19 /*
20 authorizedClients = [
21 "descriptor:x25519:2EZQ3AOZXERDVSN6WO5LNSCOIIPL2AT2A7KOS4ZIYNVQDR5EFM2Q" # julm
22 ];
23 */
24 };
25 /*
26 client.onionServices.${onion} = {
27 clientAuthorizations = [
28 gnupg.secrets."tor/auth/julm".path
29 ];
30 };
31 */
32 };
33 security.gnupg.secrets = lib.genAttrs [
34 "tor/onion/${onion}/hs_ed25519_secret_key"
35 "tor/auth/julm"
36 ] (secret: {
37 systemdConfig.before = [ "tor.service" ];
38 systemdConfig.wantedBy = [ "tor.service" ];
39 }) // {
40 "nginx/sevy/htpasswd" = {
41 # Generated with: echo "$user:$(openssl passwd -apr1)"
42 systemdConfig.before = [ "nginx.service" ];
43 systemdConfig.wantedBy = [ "nginx.service" ];
44 user = nginx.user;
45 group = nginx.group;
46 };
47 };
48 services.nginx = {
49 virtualHosts."${onion}.onion" = {
50 root = root + "/dl";
51 extraConfig = ''
52 access_log /var/log/nginx/${domain}/${srv}/access.log json buffer=32k;
53 error_log /var/log/nginx/${domain}/${srv}/error.log warn;
54 '';
55 locations."/".extraConfig = ''
56 autoindex on;
57 fancyindex on;
58 fancyindex_exact_size off;
59 fancyindex_name_length 255;
60 open_file_cache off;
61 #open_file_cache_valid 1s;
62 '';
63 };
64 virtualHosts."${srv}.${domain}" = {
65 serverAliases = [ domain ];
66 #onlySSL = true;
67 #addSSL = true;
68 forceSSL = true;
69 useACMEHost = domain;
70 root = root;
71 extraConfig = ''
72 access_log /var/log/nginx/${domain}/${srv}/access.log json buffer=32k;
73 error_log /var/log/nginx/${domain}/${srv}/error.log warn;
74 '';
75 locations."/".extraConfig = ''
76 #autoindex on;
77 return 444;
78 '';
79 locations."/dl".extraConfig = ''
80 autoindex on;
81 fancyindex on;
82 fancyindex_exact_size off;
83 fancyindex_name_length 255;
84 open_file_cache off;
85 #open_file_cache_valid 1s;
86 '';
87 locations."/julm".extraConfig = ''
88 autoindex on;
89 fancyindex on;
90 fancyindex_exact_size off;
91 fancyindex_name_length 255;
92 open_file_cache off;
93 #open_file_cache_valid 1s;
94 '';
95 locations."/haskell".extraConfig = ''
96 autoindex on;
97 fancyindex on;
98 fancyindex_exact_size off;
99 fancyindex_name_length 255;
100 open_file_cache off;
101 #open_file_cache_valid 1s;
102 '';
103 locations."/sevy".extraConfig = ''
104 auth_basic "sevy's area";
105 auth_basic_user_file ${gnupg.secrets."nginx/sevy/htpasswd".path};
106 autoindex off;
107 '';
108 };
109 };
110 systemd.services.nginx = {
111 serviceConfig = {
112 LogsDirectory = lib.mkForce ["nginx/${domain}/${srv}"];
113 BindReadOnlyPaths = [
114 "/home/julm/work/sourcephile/web:${root}/julm"
115 "/home/julm/dl:${root}/dl"
116 "/home/julm/work/sourcephile/haskell:${root}/haskell"
117 ];
118 };
119 };
120 }