machines/losurdo/nginx.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (config) networking;
   4   inherit (config.services) nginx;
   5 in
   6 {
   7 imports = [
   8   ../../nixos/profiles/services/nginx.nix
   9   nginx/sourcephile.fr.nix
  10 ];
  11 users.groups."acme".members = [nginx.user];
  12 users.groups."transmission".members = [nginx.user];
  13 networking.nftables.ruleset = ''
  14   add rule inet filter net2fw tcp dport 80 counter accept comment "HTTP"
  15   add rule inet filter net2fw tcp dport 443 counter accept comment "HTTPS"
  16 '';
  17 services.upnpc.redirections = [
  18   { port = 80; protocol = "TCP"; }
  19   { port = 443; protocol = "TCP"; }
  20 ];
  21 services.nginx = {
  22   enable = true;
  23   package = pkgs.nginx.override {
  24     modules = with pkgs.nginxModules; [
  25       fancyindex
  26     ];
  27   };
  28   resolver = {
  29     addresses = [ "127.0.0.1:53" ];
  30     valid = "";
  31   };
  32   virtualHosts."_" = {
  33     default = true;
  34     extraConfig = ''
  35       # Connection closed without response
  36       return 444;
  37     '';
  38     forceSSL = true;
  39     useACMEHost = networking.domain;
  40   };
  41 };
  42 }