felixalb/nixos-config
felixalb
/
nixos-config
mirror of https://git.feal.no/felixalb/nixos-config.git
2
1
Fork 0
Code Issues Activity

voyager/kanidm: remove second nginx

This commit is contained in:
Felix Albrigtsen 2024-06-06 20:47:15 +02:00 committed by Felix Albrigtsen
parent 541602b594
commit ef23fded85
2 changed files with 16 additions and 20 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
hosts/defiant/services/nginx.nix
View File

@ -31,7 +31,7 @@
# Publicly exposed services:
services.nginx.virtualHosts = let
publicProxy = upstream: {
publicProxy = upstream: overrides: {
listen = [
{ addr = "192.168.10.175"; port = 43443; ssl = true; }
{ addr = "192.168.10.175"; port = 43080; ssl = false; }
@ -49,11 +49,18 @@
server_tokens off;
'';
};
} // overrides;
in {
"auth.feal.no" = publicProxy "https://voyager.home.feal.no";
"cloud.feal.no" = publicProxy "http://voyager.home.feal.no";
"git.feal.no" = publicProxy "http://unix:${config.services.gitea.settings.server.HTTP_ADDR}";
"jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/";
"auth.feal.no" = publicProxy "" {
locations."/" = {
proxyPass = "https://voyager.home.feal.no:8300";
extraConfig = ''
proxy_ssl_verify off;
'';
};
};
"cloud.feal.no" = publicProxy "http://voyager.home.feal.no" {};
"git.feal.no" = publicProxy "http://unix:${config.services.gitea.settings.server.HTTP_ADDR}" {};
"jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/" {};
};
}

17
hosts/voyager/services/kanidm.nix
View File

@ -10,7 +10,7 @@ in {
serverSettings = {
origin = "https://${cfg.serverSettings.domain}";
domain = "auth.feal.no";
bindaddress = "127.0.1.2:8300";
bindaddress = "0.0.0.0:8300";
inherit ldapbindaddress;
tls_chain = "/run/credentials/kanidm.service/cert.crt";
@ -25,23 +25,12 @@ in {
];
};
services.nginx.virtualHosts."${cfg.serverSettings.domain}" = {
forceSSL = true;
sslCertificate = "${certPath}.crt";
sslCertificateKey = "${certPath}.key";
locations."/" = {
proxyPass = "https://${cfg.serverSettings.bindaddress}";
extraConfig = ''
proxy_ssl_verify off;
'';
};
};
environment = {
systemPackages = [ pkgs.kanidm ];
etc."kanidm/config".text = ''
uri="${cfg.serverSettings.origin}"
'';
};
networking.firewall.allowedTCPPorts = [ 8300 ];
}