new mkNginxVHosts function

homeConfigurations.nix

@@ -1,6 +1,7 @@
 { inputs, ... }:
 let
-  utils = import ./utils.nix { inherit inputs; };
+  lib = inputs.nixpkgs.lib;
+  utils = import ./utils.nix { inherit inputs lib; };
   inherit (utils) mkUser;
 in
 {

hosts/alexandria/dav.nix

@@ -1,7 +1,7 @@
 { lib, inputs, ... }:
 let
-  utils = import ../../utils.nix { inherit inputs; };
+  utils = import ../../utils.nix { inherit inputs lib; };
-  inherit (utils) mkNginxVhosts;
+  inherit (utils) mkNginxVHosts;
 
   rclone-webdav-start = pkgs.writeShellScript "rclone-webdav-start.sh" ''
     #!/bin/bash
@@ -46,31 +46,28 @@ let
 in
 {
   services = {
-    nginx.virtualHosts = mkNginxVhosts {
+    nginx.virtualHosts = mkNginxVHosts {
-      inherit lib;
       acmeHost = "baduhai.dev";
-      domains = {
+      domains."dav.baduhai.dev".locations = {
-        "dav.baduhai.dev".locations = {
+        "/caldav" = {
-          "/caldav" = {
+          proxyPass = "http://unix:/run/radicale/radicale.sock:/";
-            proxyPass = "http://unix:/run/radicale/radicale.sock:/";
+          extraConfig = ''
-            extraConfig = ''
+            proxy_set_header X-Script-Name /caldav;
-              proxy_set_header X-Script-Name /caldav;
+            proxy_pass_header Authorization;
-              proxy_pass_header Authorization;
+          '';
-            '';
+        };
-          };
+        "/webdav" = {
-          "/webdav" = {
+          proxyPass = "http://unix:/run/rclone-webdav/webdav.sock:/webdav/";
-            proxyPass = "http://unix:/run/rclone-webdav/webdav.sock:/webdav/";
+          extraConfig = ''
-            extraConfig = ''
+            proxy_set_header X-Script-Name /webdav;
-              proxy_set_header X-Script-Name /webdav;
+            proxy_pass_header Authorization;
-              proxy_pass_header Authorization;
+            proxy_connect_timeout 300;
-              proxy_connect_timeout 300;
+            proxy_send_timeout 300;
-              proxy_send_timeout 300;
+            proxy_read_timeout 300;
-              proxy_read_timeout 300;
+            client_max_body_size 10G;
-              client_max_body_size 10G;
+            proxy_buffering off;
-              proxy_buffering off;
+            proxy_request_buffering off;
-              proxy_request_buffering off;
+          '';
-            '';
-          };
         };
       };
     };

hosts/alexandria/forgejo.nix

@@ -1,5 +1,13 @@
-{ ... }:
+{
-
+  config,
+  lib,
+  inputs,
+  ...
+}:
+let
+  utils = import ../../utils.nix { inherit inputs lib; };
+  inherit (utils) mkNginxVHosts;
+in
 {
   services.forgejo = {
     enable = true;
@@ -18,4 +26,10 @@
       actions.ENABLED = false;
     };
   };
+
+  services.nginx.virtualHosts = mkNginxVHosts {
+    acmeHost = "baduhai.dev";
+    domains."git.baduhai.dev".locations."/".proxyPass =
+      "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}:/";
+  };
 }

hosts/alexandria/jellyfin.nix

@@ -1,8 +1,16 @@
-{ ... }:
+{ lib, inputs, ... }:
-
+let
+  utils = import ../../utils.nix { inherit inputs lib; };
+  inherit (utils) mkNginxVHosts;
+in
 {
   services.jellyfin = {
     enable = true;
     openFirewall = true;
   };
+
+  services.nginx.virtualHosts = mkNginxVHosts {
+    acmeHost = "baduhai.dev";
+    domains."jellyfin.baduhai.dev".locations."/".proxyPass = "http://127.0.0.1:8096/";
+  };
 }

hosts/alexandria/librespeed.nix

@@ -1,5 +1,8 @@
-{ ... }:
+{ lib, inputs, ... }:
-
+let
+  utils = import ../../utils.nix { inherit inputs lib; };
+  inherit (utils) mkNginxVHosts;
+in
 {
   virtualisation.oci-containers.containers."librespeed" = {
     image = "lscr.io/linuxserver/librespeed:latest";
@@ -11,4 +14,9 @@
       "--label=io.containers.autoupdate=registry"
     ];
   };
+
+  services.nginx.virtualHosts = mkNginxVHosts {
+    acmeHost = "baduhai.dev";
+    domains."speedtest.baduhai.dev".locations."/".proxyPass = "http://librespeed:80/";
+  };
 }

hosts/alexandria/nginx.nix

@@ -1,5 +1,13 @@
-{ config, lib, ... }:
+{
-
+  config,
+  lib,
+  inputs,
+  ...
+}:
+let
+  utils = import ../../utils.nix { inherit inputs lib; };
+  inherit (utils) mkNginxVHosts;
+in
 {
   security.acme = {
     acceptTerms = true;
@@ -26,45 +34,10 @@
     recommendedOptimisation = true;
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
-    virtualHosts =
+    virtualHosts = mkNginxVHosts {
-      let
+      acmeHost = "baduhai.dev";
-        commonVHostConfig = {
+      domains."_".locations."/".return = "444";
-          useACMEHost = "baduhai.dev";
+    };
-          forceSSL = true;
-          kTLS = true;
-        };
-      in
-      lib.mapAttrs (_: lib.recursiveUpdate commonVHostConfig) {
-        "_".locations."/".return = "444";
-        "dav.baduhai.dev".locations = {
-          "/caldav" = {
-            proxyPass = "http://unix:/run/radicale/radicale.sock:/";
-            extraConfig = ''
-              proxy_set_header X-Script-Name /caldav;
-              proxy_pass_header Authorization;
-            '';
-          };
-          "/webdav" = {
-            proxyPass = "http://unix:/run/rclone-webdav/webdav.sock:/webdav/";
-            extraConfig = ''
-              proxy_set_header X-Script-Name /webdav;
-              proxy_pass_header Authorization;
-              proxy_connect_timeout 300; # Increase timeouts for large file uploads
-              proxy_send_timeout 300;
-              proxy_read_timeout 300;
-              client_max_body_size 10G; # Allow large file uploads
-              proxy_buffering off; # Buffer settings for better performance
-              proxy_request_buffering off;
-            '';
-          };
-        };
-        "git.baduhai.dev".locations."/".proxyPass =
-          "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}:/";
-        "jellyfin.baduhai.dev".locations."/".proxyPass = "http://127.0.0.1:8096/";
-        "pass.baduhai.dev".locations."/".proxyPass =
-          "http://unix:${config.services.vaultwarden.config.ROCKET_ADDRESS}:/";
-        "speedtest.baduhai.dev".locations."/".proxyPass = "http://librespeed:80/";
-      };
   };
 
   users.users.nginx.extraGroups = [ "acme" ];

hosts/alexandria/vaultwarden.nix

@@ -1,5 +1,13 @@
-{ ... }:
+{
-
+  config,
+  lib,
+  inputs,
+  ...
+}:
+let
+  utils = import ../../utils.nix { inherit inputs lib; };
+  inherit (utils) mkNginxVHosts;
+in
 {
   services.vaultwarden = {
     enable = true;
@@ -9,4 +17,10 @@
       ROCKET_ADDRESS = "/run/vaultwarden/vaultwarden.sock";
     };
   };
+
+  services.nginx.virtualHosts = mkNginxVHosts {
+    acmeHost = "baduhai.dev";
+    domains."pass.baduhai.dev".locations."/".proxyPass =
+      "http://unix:${config.services.vaultwarden.config.ROCKET_ADDRESS}:/";
+  };
 }

nixosConfigurations.nix

@@ -1,6 +1,7 @@
 { inputs, ... }:
 let
-  utils = import ./utils.nix { inherit inputs; };
+  lib = inputs.nixpkgs.lib;
+  utils = import ./utils.nix { inherit inputs lib; };
   inherit (utils) mkHost;
 in
 {

utils.nix

@@ -1,4 +1,4 @@
-{ inputs }:
+{ inputs, lib }:
 let
   inherit (inputs)
     self
@@ -172,4 +172,19 @@ in
         }
       ];
     };
+
+  # Nginx virtual host utilities
+  mkNginxVHosts =
+    {
+      acmeHost,
+      domains,
+    }:
+    let
+      commonVHostConfig = {
+        useACMEHost = acmeHost;
+        forceSSL = true;
+        kTLS = true;
+      };
+    in
+    lib.mapAttrs (_: lib.recursiveUpdate commonVHostConfig) domains;
 }