nixos-configuration/hosts/hetzner-vpn1/default.nix

{
  nixpkgs,
  common-modules,
  desktop-modules,
  ...
}:
nixpkgs.lib.nixosSystem {
  system = "aarch64-linux";
  modules =
    common-modules
    ++ [
      ./hardware.nix
      ../../users/vinzenz.nix
      ../../users/ronja.nix
      {
        networking.hostName = "hetzner-vpn1";
      }
      {
        # uncomment for build check on non arm system (requires --impure)
        # nixpkgs.buildPlatform = builtins.currentSystem;
      }

      {
        users.users = {
          root.openssh.authorizedKeys.keys = [
            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdYqY3Y1/f1bsAi5Qfyr/UWuX9ixu96IeAlhoQaJkbf''
            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv vinzenz-pc2 home roaming''
            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC vinzenz-lpt2-roaming''
          ];
          vinzenz.openssh.authorizedKeys.keys = [
            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAICdYqY3Y1/f1bsAi5Qfyr/UWuX9ixu96IeAlhoQaJkbf''
            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFCJUpbpB3KEKVoKWsKoar9J4RNah8gmQoSH6jQEw5dY vinzenz-pixel-JuiceSSH''
            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIO1CRn4yYTL4XUdCebE8Z4ZeuMujBjorTdWifg911EOv vinzenz-pc2 home roaming''
            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPDNpLDmctyqGpow/ElQvdhY4BLBPS/sigDJ1QEcC7wC vinzenz-lpt2-roaming''
          ];
          ronja.openssh.authorizedKeys.keys = [
            ''ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIALWKm+d6KL6Vl3grPOcGouiNTkvdhXuWJmcrdEBY2nw ronja-ssh-host-key''
          ];
        };
      }
      {
        security.acme = {
          acceptTerms = true;
          defaults.email = "acme@zerforschen.plus";
        };

        security.pam.services.nginx.setEnvironment = false;
        systemd.services.nginx.serviceConfig = {
          SupplementaryGroups = ["shadow"];
        };

        services.nginx = {
          enable = true;
          additionalModules = [pkgs.nginxModules.pam];

          recommendedProxySettings = true;
          recommendedTlsSettings = true;
          recommendedGzipSettings = true;
          recommendedOptimisation = true;

          virtualHosts = let
            servicesDomain = "services.zerforschen.plus";
            mkServiceConfig = host: port: {
              addSSL = true;
              enableACME = true;
              locations."/" = {
                proxyPass = "http://${host}:${toString port}/";
                extraConfig = ''
                  # bind to tailscale ip
                  proxy_bind 100.88.118.60;
                  # pam auth
                  limit_except OPTIONS {
                    auth_pam  "Password Required";
                    auth_pam_service_name "nginx";
                  }
                '';
              };
            };
            lpt2 = "vinzenz-lpt2.donkey-pentatonic.ts.net";
            pc2 = "vinzenz-pc2.donkey-pentatonic.ts.net";
          in {
            "vscode.${servicesDomain}" = lib.mkMerge [
              (mkServiceConfig pc2 8542)
              {locations."/" .proxyWebsockets = true;}
            ];
            "preon-app.${servicesDomain}" = mkServiceConfig pc2 8543;
            "preon-api.${servicesDomain}" = mkServiceConfig pc2 8544;
          };
        };

        networking.firewall.allowedTCPPorts = [80 443];
      }
    ];
}