hosts/losurdo/nginx/sourcephile.fr/nix-serve.nix

   1 { domain, ... }:
   2 { pkgs, lib, config, hostName, ... }:
   3 let
   4   inherit (config) networking;
   5   inherit (config.security) gnupg;
   6   inherit (config.services) nginx nix-serve;
   7   inherit (config.users) users groups;
   8   srv = "nix-serve";
   9 in
  10 {
  11 nix.trustedUsers = [ users."nix-serve".name ];
  12 users.users."nix-serve".isSystemUser = true;
  13 users.users."nix-serve".extraGroups = [ groups."keys".name ];
  14 security.gnupg.secrets."nix/binary-cache-key/1" = {
  15   user = users."nix-serve".name;
  16   systemdConfig = {
  17     before = [ "nix-serve.service" ];
  18     wantedBy = [ "nix-serve.service" ];
  19   };
  20 };
  21 services.nix-serve = {
  22   enable = true;
  23   secretKeyFile = gnupg.secrets."nix/binary-cache-key/1".path;
  24   bindAddress = "127.0.0.1";
  25 };
  26 services.nginx = let vhostConfig = priority:
  27   {
  28     #onlySSL = true;
  29     #addSSL = true;
  30     forceSSL = true;
  31     useACMEHost = domain;
  32     extraConfig = ''
  33       #access_log /var/log/nginx/${domain}/${srv}/access.log json buffer=32k;
  34       #error_log  /var/log/nginx/${domain}/${srv}/error.log warn;
  35       access_log off;
  36       error_log  /dev/null crit;
  37     '';
  38     locations."/nix-cache-info" = {
  39       # cache.nixos.org has priority 40
  40       return = ''200 "StoreDir: ${builtins.storeDir}\nWantMassQuery: 1\nPriority: ${toString priority}\n"'';
  41       extraConfig = ''
  42         ${nginx.configs.https_add_headers}
  43         add_header Content-Type text/plain;
  44       '';
  45     };
  46     locations."/".extraConfig = ''
  47       proxy_pass http://localhost:${toString nix-serve.port};
  48       proxy_set_header Host $host;
  49       proxy_set_header X-Real-IP $remote_addr;
  50       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  51     '';
  52   };
  53   in {
  54   virtualHosts."nix-localcache.${domain}" = vhostConfig 30;
  55   virtualHosts."nix-extracache.${domain}" = vhostConfig 60 // {
  56     serverAliases = [ "${srv}.${domain}" ];
  57   };
  58 };
  59 systemd.services.nginx = {
  60   serviceConfig = {
  61     LogsDirectory = lib.mkForce ["nginx/${domain}/${srv}"];
  62   };
  63 };
  64 }