nixos-config/hosts/defiant/services/nginx.nix

71 lines
1.8 KiB
Nix
Raw Normal View History

{ config, values, ... }:
2024-06-10 10:45:59 +02:00
let
gitea = config.services.gitea.settings;
keycloak = config.services.keycloak.settings;
in {
services.nginx = {
enable = true;
enableReload = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
defaultListen = [
{
addr = "192.168.10.175";
port = 80;
ssl = false;
}
];
};
networking.firewall.allowedTCPPorts = [
80 443 # Internal / Default
43080 43443 # External / Publicly exposed
];
security.acme = {
acceptTerms = true;
defaults.email = "felix@albrigtsen.it";
};
# Publicly exposed services:
services.nginx.virtualHosts = let
2024-06-06 20:47:15 +02:00
publicProxy = upstream: overrides: {
listen = [
{ addr = "192.168.10.175"; port = 43443; ssl = true; }
{ addr = "192.168.10.175"; port = 43080; ssl = false; }
];
enableACME = true;
forceSSL = true;
locations."/".proxyPass = "${upstream}";
2024-01-03 02:35:57 +01:00
extraConfig = ''
2024-01-03 03:05:47 +01:00
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
2024-01-28 01:10:59 +01:00
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $host;
2024-01-03 02:35:57 +01:00
2024-01-28 01:10:59 +01:00
server_tokens off;
2024-01-03 02:35:57 +01:00
'';
2024-06-06 20:47:15 +02:00
} // overrides;
2024-01-28 01:10:59 +01:00
in {
2024-06-06 20:47:15 +02:00
"auth.feal.no" = publicProxy "" {
locations."/" = {
proxyPass = "https://voyager.home.feal.no:8300";
extraConfig = ''
proxy_ssl_verify off;
'';
};
};
"cloud.feal.no" = publicProxy "http://voyager.home.feal.no" {};
2024-06-10 10:45:59 +02:00
"git.feal.no" = publicProxy "http://unix:${gitea.server.HTTP_ADDR}" {};
2024-06-06 20:47:15 +02:00
"jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/" {};
2024-06-10 10:45:59 +02:00
"iam.feal.no" = publicProxy "http://${keycloak.http-host}:${toString keycloak.http-port}" {};
};
}