hosts/mermet/nginx.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   inherit (config) networking;
   4   inherit (config.services) nginx;
   5 in
   6 {
   7 imports = [
   8   ../../nixos/profiles/services/nginx.nix
   9   nginx/autogeree.net.nix
  10   nginx/sourcephile.fr.nix
  11 ];
  12 users.groups."acme".members = [nginx.user];
  13 users.groups."keys".members = [nginx.user];
  14 networking.nftables.ruleset = ''
  15   table inet filter {
  16     chain input-net {
  17       tcp dport { 80, 443 } counter accept comment "HTTP(S)"
  18     }
  19   }
  20 '';
  21 services.nginx = {
  22   enable = true;
  23   package = pkgs.nginx.override {
  24     modules = with pkgs.nginxModules; [
  25       fancyindex
  26     ];
  27   };
  28   resolver = {
  29     addresses = [ "127.0.0.1:53" ];
  30     valid = "";
  31   };
  32   virtualHosts."_" = {
  33     forceSSL = true;
  34     useACMEHost = networking.domain;
  35   };
  36 };
  37 fileSystems."/var/lib/nginx" = {
  38   device = "rpool/var/www";
  39   fsType = "zfs";
  40 };
  41 services.sanoid.datasets."rpool/var/www" = {
  42   use_template = [ "snap" ];
  43   daily = 7;
  44 };
  45 }