nginx restructure

hosts/md/default.nix

@@ -4,7 +4,10 @@
   imports = [
     ../common.nix
     ../../services/openssh.nix
-    ../../services/hedgedoc.nix
+    ./hedgedoc.nix
+    ../../services/nginx.nix
+    ./nginx
+    ./postgres.nix
   ];
 
   networking = {

hosts/md/hedgedoc.nix

@@ -0,0 +1,20 @@
+{ config, ... }:
+
+{
+  services.hedgedoc = {
+    enable = true;
+    settings = {
+      domain = "${config.networking.hostName}.${config.networking.domain}";
+      #environmentFile = config.age.secrets.hedgedoc_settings.path;
+      protocolUseSSL = true;
+      db = {
+        dialect = "postgresql";
+        host = "/run/postgresql";
+        username = "hedgedoc";
+        database = "hedgedoc";
+      };
+      enableStatsApi = true;
+    };
+  };
+}
+

hosts/md/nginx.nix

@@ -0,0 +1,40 @@
+{ config, ... }:
+
+let
+  cfg = config.services.hedgedoc.settings;
+in
+{
+  nginx.virtualHosts."${fqdn}" = {
+    default = true;
+    quic = true;
+    kTLS = true;
+    forceSSL = true;
+    enableACME = true;
+    locations = {
+      "/" = {
+        proxyPass = "http://${cfg.host}:${toString cfg.port}";
+        recommendedProxySettings = true;
+      };
+      "/socket.io/" = {
+        proxyPass = "http://${cfg.host}:${toString cfg.port}";
+        proxyWebsockets = true;
+        recommendedProxySettings = true;
+      };
+      "/metrics" = {
+        proxyPass = "http://${cfg.host}:${toString cfg.port}";
+        recommendedProxySettings = true;
+        #allow 195.160.173.255;
+        #allow 2001:678:760:cccb::ffff;
+        #deny all;
+      };
+      "/status" = {
+        proxyPass = "http://${cfg.host}:${toString cfg.port}";
+        recommendedProxySettings = true;
+        #allow 195.160.173.255;
+        #allow 2001:678:760:cccb::ffff;
+        #deny all;
+      };
+    };
+  };
+}
+

hosts/md/postgres.nix

@@ -0,0 +1,23 @@
+{ config, pkgs, ... }:
+
+{
+  services = {
+    postgresql = {
+      enable = true;
+      package = pkgs.postgresql_18;
+      enableJIT = true;
+      initdbArgs = [
+        "--locale=C"
+        "--encoding=UTF8"
+      ];
+      ensureUsers = [{ name = cfg.db.username; ensureDBOwnership = true; }];
+      ensureDatabases = [ cfg.db.database ];
+    };
+    postgresqlBackup = {
+      enable = true;
+      startAt = "*-*-* 09:00:00";
+      compression = "zstd";
+    };
+  };
+}
+