now using flake-parts; refactored nixosConfigurations; using hm standalone

2025-10-14 15:43:12 -03:00 · 2025-10-14 15:43:12 -03:00 · 816496fbab
commit 816496fbab
parent 7f64d49052
104 changed files with 1414 additions and 1910 deletions
--- a/hosts/alexandria/nginx.nix
+++ b/hosts/alexandria/nginx.nix
@ -0,0 +1,71 @@
+{ config, lib, ... }:
+
+{
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = "baduhai@proton.me";
+      dnsResolver = "1.1.1.1:53";
+      dnsProvider = "cloudflare";
+      credentialsFile = config.age.secrets.cloudflare.path;
+    };
+    certs."baduhai.dev" = {
+      extraDomainNames = [ "*.baduhai.dev" ];
+    };
+  };
+
+  age.secrets.cloudflare = {
+    file = ../../secrets/cloudflare.age;
+    owner = "nginx";
+    group = "nginx";
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    virtualHosts =
+      let
+        commonVHostConfig = {
+          useACMEHost = "baduhai.dev";
+          forceSSL = true;
+          kTLS = true;
+        };
+      in
+      lib.mapAttrs (_: lib.recursiveUpdate commonVHostConfig) {
+        "_".locations."/".return = "444";
+        "dav.baduhai.dev".locations = {
+          "/caldav" = {
+            proxyPass = "http://unix:/run/radicale/radicale.sock:/";
+            extraConfig = ''
+              proxy_set_header X-Script-Name /caldav;
+              proxy_pass_header Authorization;
+            '';
+          };
+          "/webdav" = {
+            proxyPass = "http://unix:/run/rclone-webdav/webdav.sock:/webdav/";
+            extraConfig = ''
+              proxy_set_header X-Script-Name /webdav;
+              proxy_pass_header Authorization;
+              proxy_connect_timeout 300; # Increase timeouts for large file uploads
+              proxy_send_timeout 300;
+              proxy_read_timeout 300;
+              client_max_body_size 10G; # Allow large file uploads
+              proxy_buffering off; # Buffer settings for better performance
+              proxy_request_buffering off;
+            '';
+          };
+        };
+        "git.baduhai.dev".locations."/".proxyPass =
+          "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}:/";
+        "jellyfin.baduhai.dev".locations."/".proxyPass = "http://127.0.0.1:8096/";
+        "pass.baduhai.dev".locations."/".proxyPass =
+          "http://unix:${config.services.vaultwarden.config.ROCKET_ADDRESS}:/";
+        "speedtest.baduhai.dev".locations."/".proxyPass = "http://librespeed:80/";
+      };
+  };
+
+  users.users.nginx.extraGroups = [ "acme" ];
+}