{ pkgs, lib, config, ... }: let inherit (config) networking; inherit (config.services) nginx; in { imports = [ ../../nixos/profiles/services/nginx.nix nginx/autogeree.net.nix nginx/sourcephile.fr.nix ]; users.groups."acme".members = [nginx.user]; users.groups."keys".members = [nginx.user]; networking.nftables.ruleset = '' table inet filter { chain input-net { tcp dport { 80, 443 } counter accept comment "HTTP(S)" } } ''; services.nginx = { enable = true; package = pkgs.nginx.override { modules = with pkgs.nginxModules; [ fancyindex ]; }; resolver = { addresses = [ "127.0.0.1:53" ]; valid = ""; }; virtualHosts."_" = { forceSSL = true; useACMEHost = networking.domain; }; }; fileSystems."/var/lib/nginx" = { device = "rpool/var/www"; fsType = "zfs"; }; services.sanoid.datasets."rpool/var/www" = { use_template = [ "snap" ]; daily = 7; }; }