William
25c69e3c18
Host-specific NixOS configurations for: - alexandria (server) - io (desktop) - rotterdam (desktop) - trantor (server, aarch64) Each host has a main config file and _hostname/ directory with hardware-configuration and other host-specific modules. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
59 lines
1.2 KiB
Nix
59 lines
1.2 KiB
Nix
{
|
|
config,
|
|
lib,
|
|
inputs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
utils = import ../../../utils.nix { inherit inputs lib; };
|
|
inherit (utils) mkNginxVHosts services;
|
|
|
|
# Get all unique domains from shared services that have LAN IPs (served by this host)
|
|
localDomains = lib.unique (map (s: s.domain) (lib.filter (s: s.host == "alexandria") services));
|
|
|
|
# Generate ACME cert configs for all local domains
|
|
acmeCerts = lib.genAttrs localDomains (domain: {
|
|
group = "nginx";
|
|
});
|
|
in
|
|
|
|
{
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults = {
|
|
email = "baduhai@proton.me";
|
|
dnsResolver = "1.1.1.1:53";
|
|
dnsProvider = "cloudflare";
|
|
credentialsFile = config.age.secrets.cloudflare.path;
|
|
};
|
|
certs = acmeCerts;
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
recommendedGzipSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedProxySettings = true;
|
|
recommendedTlsSettings = true;
|
|
virtualHosts = {
|
|
"_" = {
|
|
default = true;
|
|
locations."/".return = "444";
|
|
};
|
|
};
|
|
};
|
|
|
|
users.users.nginx.extraGroups = [ "acme" ];
|
|
|
|
networking.firewall.allowedTCPPorts = [
|
|
80
|
|
443
|
|
];
|
|
|
|
age.secrets.cloudflare = {
|
|
file = ../../../secrets/cloudflare.age;
|
|
owner = "nginx";
|
|
group = "nginx";
|
|
};
|
|
}
|