summaryrefslogblamecommitdiff
path: root/os/kay/modules/www.nix
blob: 5246d65ac1c609943a4d319d7a6b59e65575bee1 (plain) (tree) 
c2078d3

146026f


279ff62

5b5ba9f

146026f



88bdc03

146026f



a41347e

e0da2bb





146026f


e0da2bb

154f21d

e0da2bb

a74e008

de7146e



a74e008




df2bfb0


e0da2bb




146026f

05c7f64

e0da2bb



6dabf2e

146026f



22d76c0



4d1a6b9


22d76c0




4d1a6b9

22d76c0



88bdc03

22d76c0







88bdc03


4d1a6b9

146026f

22d76c0

e0da2bb

146026f


22d76c0

e0da2bb

22d76c0

e0da2bb

5b5ba9f

5b5ba9f


22d76c0

e0da2bb

4300e47

4300e47


22d76c0

8b148d3










c576f26








c2078d3










51e3f7e
































146026f



1

2
3

4

5

6
7
8

9

10
11
12

13

14
15
16
17
18

19
20

21

22

23

24

25
26
27

28
29
30
31

32
33

34
35
36
37

38

39

40
41
42

43

44
45
46

47
48
49

50
51

52
53
54
55

56

57
58
59

60

61
62
63
64
65
66
67

68
69

70

71

72

73

74
75

76

77

78

79

80

81
82

83

84

85

86
87

88

89
90
91
92
93
94
95
96
97
98

99
100
101
102
103
104
105
106

107
108
109
110
111
112
113
114
115
116

117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148

149
150
151

                           

   
                                         
                                  


             
            


              
                                                                           




                                 

                     
                             
                         
 
                                  


                                                          



                                     

                                              



                      
                        
                             


                                    
                       


                                         


                                                                           

           



                                                  
 


                                                              
                                                                     






                                                             

                                                                                           
          
        
 
                                        

                                    
 
                                    
 
                                        
                                

                                                             
 
                                           
                                   

                                                             
 









                                                                                    







                                              









                                                                 































                                                                                                   


      
{ config, pkgs, lib, ... }:

let
  domain = config.global.userdata.domain;
  storage = "/hdd/users/sftp/shr";
in
{
  imports = [
    ./matrix
    ./cgit.nix
  ];

  security.acme.certs.${domain}.postRun = "systemctl reload nginx.service";
  networking.firewall = {
    allowedTCPPorts = [ 80 443 ];
    allowedUDPPorts = [ 443 ];
  };

  services.nginx = { 
    enable = true;
    package = pkgs.nginxQuic;
    enableQuicBPF = true;

    recommendedTlsSettings = true;
    # breaks home-assistant proxy for some reason
    # only the first request goes through, then site hangs
    # recommendedZstdSettings = true;
    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    recommendedProxySettings = true;
    recommendedBrotliSettings = true;
    eventsConfig = "worker_connections 1024;";

    virtualHosts = let
      defaultOpts = {
        quic = true;
        http3 = true;
        forceSSL = true;
        useACMEHost = domain;
      };
    in {
      "${domain}" = defaultOpts // {
        default = true;
        globalRedirect = "www.${domain}";

        extraConfig = ''
          client_max_body_size ${toString
            config.services.dendrite.settings.media_api.max_file_size_bytes
          };
        '';

        locations = {
          "/.well-known/matrix/server".return = ''
            200 '{ "m.server": "${domain}:443" }'
          '';

          "/.well-known/matrix/client".return = ''
            200 '${builtins.toJSON {
                "m.homeserver".base_url = "https://${domain}";
                "org.matrix.msc3575.proxy".url = "https://${domain}";
            }}'
          '';

          "/_matrix".proxyPass = "http://127.0.0.1:${toString
            config.services.dendrite.httpPort
          }";

          "/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass =
            "http://${config.services.matrix-sliding-sync-dirty.settings.SYNCV3_BINDADDR}";
        };
      };

      "www.${domain}" = defaultOpts // {
        root = "/var/www/${domain}";
      };

      "git.${domain}" = defaultOpts;

      "bin.${domain}" = defaultOpts // {
        root = "${storage}/bin";
        locations."= /".return = "307 https://www.${domain}";
      };

      "static.${domain}" = defaultOpts // {
        root = "${storage}/static";
        locations."= /".return = "301 https://www.${domain}";
      };

      "home.${domain}" = defaultOpts // {
        extraConfig = "proxy_buffering off;";
        locations."/" = {
          proxyWebsockets = true;
          proxyPass = "http://127.0.0.1:${
            builtins.toString config.services.home-assistant.config.http.server_port
          }";
        };
      };

      "mail.${domain}" = defaultOpts // {
        extraConfig = "proxy_buffering off;";
        locations."/" = {
          proxyWebsockets = true;
          proxyPass = "http://127.0.0.1:8085";
        };
      };

      "mta-sts.${domain}" = defaultOpts // {
        locations."= /.well-known/mta-sts.txt".return = ''200 "${
          lib.strings.concatStringsSep "\\n" [
            "version: STSv1"
            "mode: enforce"
            "mx: mail.${domain}"
            "max_age: 86400"
          ]
        }"'';
      };

      "nixbin.${domain}" = defaultOpts // {
        extraConfig = "proxy_buffering off;";
        locations = {
          "= /" = {
            extraConfig = "add_header Content-Type text/html;";
            return = ''200
              '<!DOCTYPE html>
              <html lang="en">
                <head>
                  <meta charset="UTF-8">
                  <title>Nix Cache</title>
                </head>
                <body>
                  <center>
                    <h1 style="font-size: 8em">
                      ❄️ Nix Cache
                    </h1>
                    <p style="font-weight: bold">
                      Public Key: nixbin.sinanmohd.com:dXV3KDPVrm+cGJ2M1ZmTeQJqFGaEapqiVoWHgYDh03k=
                    </p>
                  </center>
                </body>
              </html>'
            '';
          };

          "/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${
              toString config.services.nix-serve.port
          }";
        };
      };
    };
  };
}