rearranging alexadira services

hosts/modules/alexandria/services.nix

@@ -1,7 +1,103 @@
-{ ... }:
+{ config, lib, ... }:
+
+let
+  ports = {
+    vaultwarden = "8000";
+    librespeed = "8001";
+    jellyfin = "8096";
+  };
+in
 
 {
-  services.postgresql.enable = true;
+  services = {
+    nginx = {
+      enable = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      virtualHosts =
+        let
+          commonVHostConfig = {
+            useACMEHost = "baduhai.dev";
+            forceSSL = true;
+            kTLS = true;
+          };
+        in
+        lib.mapAttrs (_: lib.recursiveUpdate commonVHostConfig) {
+          "_".locations."/".return = "444";
+          "git.baduhai.dev".locations."/".proxyPass =
+            "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}:/";
+          "jellyfin.baduhai.dev".locations."/".proxyPass = "http://127.0.0.1:${ports.jellyfin}";
+          "pass.baduhai.dev".locations."/".proxyPass = "http://127.0.0.1:${ports.vaultwarden}";
+          "speedtest.baduhai.dev".locations."/".proxyPass = "http://127.0.0.1:${ports.librespeed}";
+        };
+    };
+
+    forgejo = {
+      enable = true;
+      repositoryRoot = "/data/forgejo";
+      settings = {
+        session.COOKIE_SECURE = true;
+        server = {
+          PROTOCOL = "http+unix";
+          DOMAIN = "git.baduhai.dev";
+          ROOT_URL = "https://git.baduhai.dev";
+          OFFLINE_MODE = true; # disable use of CDNs
+          SSH_DOMAIN = "baduhai.dev";
+        };
+        log.LEVEL = "Warn";
+        mailer.ENABLED = false;
+        actions.ENABLED = false;
+      };
+    };
+
+    jellyfin = {
+      enable = true;
+      openFirewall = true;
+    };
+
+    vaultwarden = {
+      enable = true;
+      config = {
+        DOMAIN = "https://pass.baduhai.dev";
+        SIGNUPS_ALLOWED = false;
+        ROCKET_ADDRESS = "127.0.0.1";
+        ROCKET_PORT = "${config.ports.vaultwarden}";
+      };
+    };
+  };
+
+  virtualisation.oci-containers.containers."librespeed" = {
+    image = "lscr.io/linuxserver/librespeed:latest";
+    environment = {
+      TZ = "America/Bahia";
+    };
+    ports = [ "${config.ports.librespeed}:80" ];
+    extraOptions = [
+      "--pull=newer"
+      "--label=io.containers.autoupdate=registry"
+    ];
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = "baduhai@proton.me";
+      dnsResolver = "1.1.1.1:53";
+      dnsProvider = "cloudflare";
+      credentialsFile = config.age.secrets.cloudflare.path;
+    };
+    certs."baduhai.dev" = {
+      extraDomainNames = [ "*.baduhai.dev" ];
+    };
+  };
+
+  age.secrets.cloudflare = {
+    file = ../../../secrets/cloudflare.age;
+    owner = "nginx";
+    group = "hosted";
+  };
 
   # TODO: remove when bug fix
   # serokell/deploy-rs/issues/57