From 040bb41705888c0fe625f8d96ecdfd6cc7af7fa4 Mon Sep 17 00:00:00 2001
From: Vinzenz Schroeter <vinzenz.f.s@gmail.com>
Date: Sun, 4 Jan 2026 20:17:22 +0100
Subject: [PATCH] vpn2: split nginx config

---
 nixosConfigurations/hetzner-vpn2/blog.nix    | 43 +++++++++++++++
 nixosConfigurations/hetzner-vpn2/default.nix |  1 +
 nixosConfigurations/hetzner-vpn2/nginx.nix   | 55 +++-----------------
 3 files changed, 50 insertions(+), 49 deletions(-)
 create mode 100644 nixosConfigurations/hetzner-vpn2/blog.nix

diff --git a/nixosConfigurations/hetzner-vpn2/blog.nix b/nixosConfigurations/hetzner-vpn2/blog.nix
new file mode 100644
index 0000000..4b29cb3
--- /dev/null
+++ b/nixosConfigurations/hetzner-vpn2/blog.nix
@@ -0,0 +1,43 @@
+{ pkgs, ... }:
+let
+  blog-domain-socket = "/run/nginx/blog.sock";
+  anubis-domain-socket = "/run/anubis/anubis-main/anubis.sock";
+  anubis-metrics-socket = "/run/anubis/anubis-main/anubis-metrics.sock";
+in
+{
+  systemd.services = {
+    nginx.serviceConfig.SupplementaryGroups = [ "anubis" ];
+    anubis-main.serviceConfig.SupplementaryGroups = [ "nginx" ];
+  };
+
+  services = {
+    nginx.virtualHosts = {
+      "zerforschen.plus" = {
+        addSSL = true;
+        enableACME = true;
+        locations = {
+          "/_metrics".proxyPass = "http://unix:" + anubis-metrics-socket + ":/metrics";
+          "/".proxyPass = "http://unix:" + anubis-domain-socket;
+        };
+      };
+
+      "blog-in-anubis" = {
+        root = pkgs.zerforschen-plus-content;
+        listen = [
+          {
+            addr = "unix:" + blog-domain-socket;
+          }
+        ];
+      };
+    };
+
+    anubis.instances.main = {
+      enable = true;
+      settings = {
+        BIND = anubis-domain-socket;
+        TARGET = "unix://" + blog-domain-socket;
+        METRICS_BIND = anubis-metrics-socket;
+      };
+    };
+  };
+}
diff --git a/nixosConfigurations/hetzner-vpn2/default.nix b/nixosConfigurations/hetzner-vpn2/default.nix
index 5ad0e0f..cc53cb3 100644
--- a/nixosConfigurations/hetzner-vpn2/default.nix
+++ b/nixosConfigurations/hetzner-vpn2/default.nix
@@ -3,6 +3,7 @@
     ./hardware.nix
     ./nginx.nix
     ./headscale.nix
+    ./blog.nix
   ];
 
   config = {
diff --git a/nixosConfigurations/hetzner-vpn2/nginx.nix b/nixosConfigurations/hetzner-vpn2/nginx.nix
index aa399aa..7178b0d 100644
--- a/nixosConfigurations/hetzner-vpn2/nginx.nix
+++ b/nixosConfigurations/hetzner-vpn2/nginx.nix
@@ -1,62 +1,19 @@
-{ pkgs, ... }:
-let
-  blog-domain-socket = "/run/nginx/blog.sock";
-  anubis-domain-socket = "/run/anubis/anubis-main/anubis.sock";
-  anubis-metrics-socket = "/run/anubis/anubis-main/anubis-metrics.sock";
-in
 {
   security.acme = {
     acceptTerms = true;
     defaults.email = "acme@zerforschen.plus";
   };
 
-  systemd.services = {
-    nginx.serviceConfig.SupplementaryGroups = [ "anubis" ];
-    anubis-main.serviceConfig.SupplementaryGroups = [ "nginx" ];
-  };
-
-  services = {
-    nginx = {
-      enable = true;
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-      recommendedGzipSettings = true;
-      recommendedOptimisation = true;
-
-      virtualHosts = {
-        "zerforschen.plus" = {
-          addSSL = true;
-          enableACME = true;
-          locations = {
-            "/_metrics".proxyPass = "http://unix:" + anubis-metrics-socket + ":/metrics";
-            "/".proxyPass = "http://unix:" + anubis-domain-socket;
-          };
-        };
-
-        "blog-in-anubis" = {
-          root = pkgs.zerforschen-plus-content;
-          listen = [
-            {
-              addr = "unix:" + blog-domain-socket;
-            }
-          ];
-        };
-      };
-    };
-
-    anubis.instances.main = {
-      enable = true;
-      settings = {
-        BIND = anubis-domain-socket;
-        TARGET = "unix://" + blog-domain-socket;
-        METRICS_BIND = anubis-metrics-socket;
-      };
-    };
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
   };
 
   networking.firewall.allowedTCPPorts = [
     80
     443
-    5201
   ];
 }