forge: anubis in front

nixosConfigurations/hyperforge/nginx.nix

@@ -1,6 +1,8 @@
 { config, ... }:
 let
   srv = config.services.forgejo.settings.server;
+  anubis-domain-socket = "/run/anubis/anubis-main/anubis.sock";
+  anubis-metrics-socket = "/run/anubis/anubis-main/anubis-metrics.sock";
 in
 {
   security.acme = {
@@ -8,20 +10,34 @@ in
     defaults.email = "acme@darkest.space";
   };
 
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
+  services = {
+    nginx = {
+      enable = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
 
-    virtualHosts.${srv.DOMAIN} = {
-      enableACME = true;
-      forceSSL = true;
-      extraConfig = ''
-        client_max_body_size 512M;
-      '';
-      locations."/".proxyPass = "http://127.0.0.1:${toString srv.HTTP_PORT}";
+      virtualHosts.${srv.DOMAIN} = {
+        enableACME = true;
+        forceSSL = true;
+        extraConfig = ''
+          client_max_body_size 512M;
+        '';
+        locations = {
+          "/_metrics".proxyPass = "http://unix:" + anubis-metrics-socket + ":/metrics";
+          "/".proxyPass = "http://unix:" + anubis-domain-socket;
+        };
+      };
+    };
+
+    anubis.instances.forge = {
+      enable = true;
+      settings = {
+        BIND = anubis-domain-socket;
+        TARGET = "http://127.0.0.1:${toString srv.HTTP_PORT}";
+        METRICS_BIND = anubis-metrics-socket;
+      };
     };
   };