hosts/losurdo/nginx.nix

   1 { pkgs, config, hostName, ... }:
   2 let
   3   inherit (config) networking;
   4   inherit (config.services) nginx;
   5 in
   6 {
   7   imports = [
   8     ../../nixos/profiles/services/nginx.nix
   9     nginx/sourcephile.fr.nix
  10   ];
  11   users.groups."acme".members = [ nginx.user ];
  12   users.groups."keys".members = [ nginx.user ];
  13   users.groups."transmission".members = [ nginx.user ];
  14   networking.nftables.ruleset = ''
  15     table inet filter {
  16       chain input-net {
  17         tcp dport { http, https } counter accept comment "HTTP(S)"
  18       }
  19     }
  20   '';
  21   fileSystems."/var/lib/nginx" = {
  22     device = "${hostName}/var/www";
  23     fsType = "zfs";
  24   };
  25   services.upnpc.redirections = [
  26     {
  27       description = "HTTP";
  28       externalPort = 80;
  29       protocol = "TCP";
  30       duration = 30 * 60;
  31       service.wantedBy = [ "nginx.service" ];
  32       service.partOf = [ "nginx.service" ];
  33     }
  34     {
  35       description = "HTTPS";
  36       externalPort = 443;
  37       protocol = "TCP";
  38       duration = 30 * 60;
  39       service.wantedBy = [ "nginx.service" ];
  40       service.partOf = [ "nginx.service" ];
  41     }
  42   ];
  43   services.nginx = {
  44     enable = true;
  45     package = pkgs.nginx.override {
  46       modules = with pkgs.nginxModules; [
  47         fancyindex
  48       ];
  49     };
  50     resolver = {
  51       addresses = [ "127.0.0.1:53" ];
  52       valid = "";
  53     };
  54     virtualHosts."_" = {
  55       default = true;
  56       extraConfig = ''
  57         # Connection closed without response
  58         return 444;
  59       '';
  60       forceSSL = true;
  61       useACMEHost = networking.domain;
  62     };
  63   };
  64 }