hosts/losurdo/nginx/sourcephile.fr/losurdo.nix

   1 { domain, ... }:
   2 { pkgs, lib, config, ... }:
   3 let
   4   inherit (config) networking;
   5   inherit (config.security) gnupg;
   6   inherit (config.services) nginx;
   7   srv = "losurdo";
   8   root = "/var/lib/nginx";
   9   onion = "dfc66yn2fundui5yvq2ndx4nmcmbxpho4ji32tlc4cncrjvs2b5yu4id";
  10 in
  11 {
  12 services.tor = {
  13   relay.onionServices."nginx/${domain}/${srv}" = {
  14     secretKey = gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
  15     map = [
  16       80
  17       #{ port = 443; target = { port = 8443; }; }
  18     ];
  19     /*
  20     authorizedClients = [
  21       "descriptor:x25519:2EZQ3AOZXERDVSN6WO5LNSCOIIPL2AT2A7KOS4ZIYNVQDR5EFM2Q" # julm
  22     ];
  23     */
  24   };
  25   /*
  26   client.onionServices.${onion} = {
  27     clientAuthorizations = [
  28       gnupg.secrets."tor/auth/julm".path
  29     ];
  30   };
  31   */
  32 };
  33 security.gnupg.secrets = lib.genAttrs [
  34   "tor/onion/${onion}/hs_ed25519_secret_key"
  35   "tor/auth/julm"
  36   ] (secret: {
  37     systemdConfig.before = [ "tor.service" ];
  38     systemdConfig.wantedBy = [ "tor.service" ];
  39   }) // {
  40   "nginx/sevy/htpasswd" = {
  41     # Generated with: echo "$user:$(openssl passwd -apr1)"
  42     systemdConfig.before = [ "nginx.service" ];
  43     systemdConfig.wantedBy = [ "nginx.service" ];
  44     user = nginx.user;
  45     group = nginx.group;
  46   };
  47 };
  48 services.nginx = {
  49   virtualHosts."${onion}.onion" = {
  50     root = root + "/dl";
  51     extraConfig = ''
  52       access_log /var/log/nginx/${domain}/${srv}/access.log json buffer=32k;
  53       error_log  /var/log/nginx/${domain}/${srv}/error.log warn;
  54     '';
  55     locations."/".extraConfig = ''
  56       autoindex on;
  57       fancyindex on;
  58       fancyindex_exact_size off;
  59       fancyindex_name_length 255;
  60       open_file_cache off;
  61       #open_file_cache_valid 1s;
  62     '';
  63   };
  64   virtualHosts."${srv}.${domain}" = {
  65     serverAliases = [ domain ];
  66     #onlySSL = true;
  67     #addSSL = true;
  68     forceSSL = true;
  69     useACMEHost = domain;
  70     root = root;
  71     extraConfig = ''
  72       access_log /var/log/nginx/${domain}/${srv}/access.log json buffer=32k;
  73       error_log  /var/log/nginx/${domain}/${srv}/error.log warn;
  74     '';
  75     locations."/".extraConfig = ''
  76       #autoindex on;
  77       return 444;
  78     '';
  79     locations."/dl".extraConfig = ''
  80       autoindex on;
  81       fancyindex on;
  82       fancyindex_exact_size off;
  83       fancyindex_name_length 255;
  84       open_file_cache off;
  85       #open_file_cache_valid 1s;
  86     '';
  87     locations."/julm".extraConfig = ''
  88       autoindex on;
  89       fancyindex on;
  90       fancyindex_exact_size off;
  91       fancyindex_name_length 255;
  92       open_file_cache off;
  93       #open_file_cache_valid 1s;
  94     '';
  95     locations."/haskell".extraConfig = ''
  96       autoindex on;
  97       fancyindex on;
  98       fancyindex_exact_size off;
  99       fancyindex_name_length 255;
 100       open_file_cache off;
 101       #open_file_cache_valid 1s;
 102     '';
 103     locations."/sevy".extraConfig = ''
 104       auth_basic "sevy's area";
 105       auth_basic_user_file ${gnupg.secrets."nginx/sevy/htpasswd".path};
 106       autoindex off;
 107     '';
 108   };
 109 };
 110 systemd.services.nginx = {
 111   serviceConfig = {
 112     LogsDirectory = lib.mkForce ["nginx/${domain}/${srv}"];
 113     BindReadOnlyPaths = [
 114       "/home/julm/work/sourcephile/web:${root}/julm"
 115       "/home/julm/dl:${root}/dl"
 116       "/home/julm/work/sourcephile/haskell:${root}/haskell"
 117     ];
 118   };
 119 };
 120 }