NullCube/permafrost
1
0
Fork 0
forked from Zynh0722/permafrost
Code Pull requests Activity

nginx: more ssl tinkering

Browse source
This commit is contained in:
Zynh Ludwig 2024-12-27 20:14:55 -08:00
parent 2265f6d144
commit 250f354067
4 changed files with 41 additions and 30 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
modules/forgejo.nix
View file

@ -16,7 +16,7 @@ in
# TODO: Force ssl # TODO: Force ssl
# addSSL = true; # addSSL = true;
serverName = "git.zynh.me"; serverName = "git.zynh.me";
useACMEHost = lib.mkIf ACMEEnabled "scarlet.zynh.me"; useACMEHost = lib.mkIf ACMEEnabled "permafrost";
locations."/" = { locations."/" = {
proxyPass = "http://localhost:3032"; proxyPass = "http://localhost:3032";
}; };

66
modules/foundry.nix
View file

@ -9,34 +9,44 @@ in
enable = lib.mkEnableOption "foundry nixos module"; enable = lib.mkEnableOption "foundry nixos module";
}; };
config = lib.mkIf cfg.enable { config = lib.mkIf cfg.enable (lib.mkMerge [
permafrost.nginx.enable = lib.mkDefault true; {
permafrost.nginx.certDomains = lib.mkIf ACMEEnabled [ "scarlet.zynh.me" ]; permafrost.nginx.enable = lib.mkDefault true;
services.nginx.virtualHosts."scarlet.zynh.me" = { }
# TODO: Force ssl {
# addSSL = true; # permafrost.nginx.certDomains = lib.mkIf ACMEEnabled [ "scarlet.zynh.me" ];
serverName = "scarlet.zynh.me"; services.nginx.virtualHosts."scarlet.zynh.me" = {
useACMEHost = lib.mkIf ACMEEnabled "scarlet.zynh.me"; # TODO: Force ssl
locations."/" = { # addSSL = true;
extraConfig = /* nginx */ '' serverName = "scarlet.zynh.me";
# Set proxy headers useACMEHost = lib.mkIf ACMEEnabled "permafrost";
proxy_set_header Host $host; locations."/.well-known/acme-challenge" = {
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; root = "/var/lib/acme/.challenges";
proxy_set_header X-Forwarded-Proto $scheme; };
locations."/" = {
extraConfig = /* nginx */ ''
# Set proxy headers
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# These are important to support WebSockets # These are important to support WebSockets
proxy_set_header Upgrade $http_upgrade; proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade"; proxy_set_header Connection "Upgrade";
''; '';
proxyPass = "http://localhost:30000"; proxyPass = "http://localhost:30000";
};
}; };
}; }
{
services.nginx.virtualHosts."ddbimporter.zynh.me" = { permafrost.nginx.certDomains = lib.mkIf ACMEEnabled [ "ddbimporter.zynh.me" ];
# TODO: Force ssl services.nginx.virtualHosts."ddbimporter.zynh.me" = {
# addSSL = true; # TODO: Force ssl
serverName = "ddbimporter.zynh.me"; # addSSL = true;
locations."/".proxyPass = "http://localhost:3232"; useACMEHost = lib.mkIf ACMEEnabled "permafrost";
}; serverName = "ddbimporter.zynh.me";
}; locations."/".proxyPass = "http://localhost:3232";
};
}
]);
} }

1
modules/nginx.nix
View file

@ -28,6 +28,7 @@ in
security.acme.certs.permafrost = lib.mkIf cfg.enableACME { security.acme.certs.permafrost = lib.mkIf cfg.enableACME {
email = "Zynh0722@gmail.com"; email = "Zynh0722@gmail.com";
domain = "scarlet.zynh.me"; domain = "scarlet.zynh.me";
group = config.services.nginx.group;
renewInterval = "weekly"; renewInterval = "weekly";
server = server =
if cfg.useStagingServer if cfg.useStagingServer

2
modules/nyazoom.nix
View file

@ -29,7 +29,7 @@ in
# TODO: Force ssl # TODO: Force ssl
# addSSL = true; # addSSL = true;
serverName = "nyazoom.zynh.me"; serverName = "nyazoom.zynh.me";
useACMEHost = lib.mkIf ACMEEnabled "scarlet.zynh.me"; useACMEHost = lib.mkIf ACMEEnabled "permafrost";
locations."/" = { locations."/" = {
proxyPass = "http://localhost:3000"; proxyPass = "http://localhost:3000";
extraConfig = /* nginx */ '' extraConfig = /* nginx */ ''