hosts/losurdo/nginx/sourcephile.fr/losurdo.nix

   1 { domain, ... }:
   2 { pkgs, lib, config, ... }:
   3 let
   4   inherit (config) networking;
   5   inherit (config.security) gnupg;
   6   inherit (config.services) nginx;
   7   srv = "losurdo";
   8   root = "/var/lib/nginx";
   9   onion = "dfc66yn2fundui5yvq2ndx4nmcmbxpho4ji32tlc4cncrjvs2b5yu4id";
  10 in
  11 {
  12 services.tor = {
  13   relay.onionServices."nginx/${domain}/${srv}" = {
  14     secretKey = gnupg.secrets."tor/onion/${onion}/hs_ed25519_secret_key".path;
  15     map = [
  16       80
  17       #{ port = 443; target = { port = 8443; }; }
  18     ];
  19     /*
  20     authorizedClients = [
  21       "descriptor:x25519:2EZQ3AOZXERDVSN6WO5LNSCOIIPL2AT2A7KOS4ZIYNVQDR5EFM2Q" # julm
  22     ];
  23     */
  24   };
  25   /*
  26   client.onionServices.${onion} = {
  27     clientAuthorizations = [
  28       gnupg.secrets."tor/auth/julm".path
  29     ];
  30   };
  31   */
  32 };
  33 security.gnupg.secrets = lib.genAttrs [
  34   "tor/onion/${onion}/hs_ed25519_secret_key"
  35   "tor/auth/julm"
  36   ] (secret: {
  37     systemdConfig.before = [ "tor.service" ];
  38     systemdConfig.wantedBy = [ "tor.service" ];
  39   }) // {
  40   "nginx/perso/htpasswd" = {
  41     # Generated with: for i in $PASSWORD_STORE_DIR/hosts/losurdo/nginx/perso/htpasswd/*.gpg; do i="${i#$PASSWORD_STORE_DIR/}"; i=${i%.gpg}; printf %s: "${i##*/}"; pass $i | openssl passwd -apr1 -stdin; done | pass insert -m hosts/losurdo/nginx/perso/htpasswd
  42     # Then: nix flake lock --update-input pass
  43     systemdConfig.before = [ "nginx.service" ];
  44     systemdConfig.wantedBy = [ "nginx.service" ];
  45     user = nginx.user;
  46     group = nginx.group;
  47   };
  48 };
  49 services.nginx = {
  50   virtualHosts."${onion}.onion" = {
  51     root = root + "/dl";
  52     extraConfig = ''
  53       access_log /var/log/nginx/${domain}/${srv}/access.log json buffer=32k;
  54       error_log  /var/log/nginx/${domain}/${srv}/error.log warn;
  55     '';
  56     locations."/".extraConfig = ''
  57       autoindex on;
  58       fancyindex on;
  59       fancyindex_exact_size off;
  60       fancyindex_name_length 255;
  61       open_file_cache off;
  62       #open_file_cache_valid 1s;
  63     '';
  64   };
  65   virtualHosts."${srv}.${domain}" = {
  66     serverAliases = [ domain ];
  67     #onlySSL = true;
  68     #addSSL = true;
  69     forceSSL = true;
  70     useACMEHost = domain;
  71     root = root;
  72     extraConfig = ''
  73       access_log /var/log/nginx/${domain}/${srv}/access.log json buffer=32k;
  74       error_log  /var/log/nginx/${domain}/${srv}/error.log warn;
  75     '';
  76     locations."/".extraConfig = ''
  77       #autoindex on;
  78       return 444;
  79     '';
  80     locations."/dl".extraConfig = ''
  81       autoindex on;
  82       fancyindex on;
  83       fancyindex_exact_size off;
  84       fancyindex_name_length 255;
  85       open_file_cache off;
  86       #open_file_cache_valid 1s;
  87     '';
  88     locations."/julm".extraConfig = ''
  89       autoindex on;
  90       fancyindex on;
  91       fancyindex_exact_size off;
  92       fancyindex_name_length 255;
  93       open_file_cache off;
  94       #open_file_cache_valid 1s;
  95     '';
  96     locations."/haskell".extraConfig = ''
  97       autoindex on;
  98       fancyindex on;
  99       fancyindex_exact_size off;
 100       fancyindex_name_length 255;
 101       open_file_cache off;
 102       #open_file_cache_valid 1s;
 103     '';
 104     locations."/perso".extraConfig = ''
 105       auth_basic "authentication required";
 106       auth_basic_user_file ${gnupg.secrets."nginx/perso/htpasswd".path};
 107       autoindex on;
 108     '';
 109   };
 110 };
 111 systemd.services.nginx = {
 112   serviceConfig = {
 113     LogsDirectory = lib.mkForce ["nginx/${domain}/${srv}"];
 114     BindReadOnlyPaths = [
 115       "/home/julm/work/sourcephile/web:${root}/julm"
 116       "/home/julm/dl:${root}/dl"
 117       "/home/julm/work/sourcephile/haskell:${root}/haskell"
 118       "/home/julm/perso:${root}/perso"
 119     ];
 120   };
 121 };
 122 }