vinzenz/nixos-configuration
0
1
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

mv hosts nixosConfigurations

Browse source
This commit is contained in:
Vinzenz Schroeter 2025-09-14 13:00:03 +02:00
parent 232728a053
commit 4d28e476dc
24 changed files with 8 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

104
hosts/hetzner-vpn2/nginx.nix
View file

@ -1,104 +0,0 @@
{ pkgs, ... }:
let
blog-domain-socket = "/run/nginx/blog.sock";
anubis-domain-socket = "/run/anubis/anubis-blog.sock";
in
{
security.acme = {
acceptTerms = true;
defaults.email = "acme@zerforschen.plus";
};
security.pam.services.nginx.setEnvironment = false;
systemd.services = {
nginx.serviceConfig = {
SupplementaryGroups = [
"shadow"
"anubis"
];
};
anubis-main.serviceConfig = {
SupplementaryGroups = [ "nginx" ];
};
};
services = {
nginx = {
enable = true;
additionalModules = [ pkgs.nginxModules.pam ];
recommendedProxySettings = true;
recommendedTlsSettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
virtualHosts =
#let
# servicesDomain = "services.zerforschen.plus";
# mkServiceConfig =
# { host, port }:
# {
# addSSL = true;
# enableACME = true;
# locations."/" = {
# proxyPass = "http://${host}:${toString port}/";
# extraConfig = ''
# # bind to tailscale ip
# proxy_bind 100.88.118.60;
# # pam auth
# limit_except OPTIONS {
# auth_pam "Password Required";
# auth_pam_service_name "nginx";
# }
# '';
# };
# };
# pc2 = "vinzenz-pc2.donkey-pentatonic.ts.net";
#in
{
#"code.${servicesDomain}" = lib.mkMerge [
# (mkServiceConfig {
# host = pc2;
# port = 8542;
# })
# { locations."/".proxyWebsockets = true; }
#];
#"view.${servicesDomain}" = mkServiceConfig {
# host = pc2;
# port = 1313;
#};
"zerforschen.plus" = {
addSSL = true;
enableACME = true;
locations."/" = {
proxyPass = ("http://unix:" + anubis-domain-socket);
};
};
"blog-in-anubis" = {
root = pkgs.zerforschen-plus-content;
listen = [
{
addr = ("unix:" + blog-domain-socket);
}
];
};
};
};
anubis.instances.main = {
enable = true;
settings = {
BIND = anubis-domain-socket;
TARGET = "unix://" + blog-domain-socket;
};
};
};
networking.firewall.allowedTCPPorts = [
80
443
5201
];
}