diff options
| -rw-r--r-- | os/kay/modules/acme.nix | 31 | ||||
| -rw-r--r-- | os/kay/modules/www.nix | 20 | ||||
| -rw-r--r-- | os/kay/secrets.yaml | 5 |
3 files changed, 47 insertions, 9 deletions
diff --git a/os/kay/modules/acme.nix b/os/kay/modules/acme.nix index 00819e7..86ae165 100644 --- a/os/kay/modules/acme.nix +++ b/os/kay/modules/acme.nix @@ -2,22 +2,39 @@ email = config.global.userdata.email; domain = config.global.userdata.domain; + domain_angelo = "angeloantony.com"; + secret_path_angelo = "misc/angelo_cloudflare_dns_api_token"; + environmentFile = pkgs.writeText "acme-dns" "RFC2136_NAMESERVER='[2001:470:ee65::1]:53'"; in { + sops.secrets.${secret_path_angelo} = {}; + security.acme = { acceptTerms = true; defaults.email = email; - certs.${domain} = { - inherit domain; - extraDomainNames = [ "*.${domain}" ]; + certs = { + ${domain_angelo} = { + domain = domain_angelo; + extraDomainNames = [ "*.${domain_angelo}" ]; + + dnsProvider = "cloudflare"; + credentialFiles.CLOUDFLARE_DNS_API_TOKEN_FILE = config.sops.secrets.${secret_path_angelo}.path; + + group = config.services.nginx.group; + }; + + ${domain} = { + inherit domain; + extraDomainNames = [ "*.${domain}" ]; - dnsProvider = "rfc2136"; - dnsPropagationCheck = false; # local DNS server + dnsProvider = "rfc2136"; + dnsPropagationCheck = false; # local DNS server - inherit environmentFile; - group = config.services.nginx.group; + inherit environmentFile; + group = config.services.nginx.group; + }; }; }; } diff --git a/os/kay/modules/www.nix b/os/kay/modules/www.nix index 2ab70aa..3903396 100644 --- a/os/kay/modules/www.nix +++ b/os/kay/modules/www.nix @@ -2,6 +2,10 @@ let domain = config.global.userdata.domain; + + domain_angelo = "angeloantony.com"; + ip_angelo = "10.0.1.6"; + storage = "/hdd/users/sftp/shr"; in { @@ -94,6 +98,22 @@ in }; }; + ".${domain_angelo}" = defaultOpts // { + useACMEHost = domain_angelo; + + extraConfig = '' + proxy_buffering off; + proxy_request_buffering off; + client_max_body_size 0; + ''; + + locations."/" = { + proxyWebsockets = true; + proxyPass = + "http://${ip_angelo}"; + }; + }; + "${config.services.grafana.settings.server.domain}" = defaultOpts // { extraConfig = '' proxy_buffering off; diff --git a/os/kay/secrets.yaml b/os/kay/secrets.yaml index 9d8b634..7713d37 100644 --- a/os/kay/secrets.yaml +++ b/os/kay/secrets.yaml @@ -18,6 +18,7 @@ github-runner: nocodb-registration-token: ENC[AES256_GCM,data:AKXoTMXsyuH+wQMsBvqjy6AdsbzVrFPe0KcSVfQ=,iv:h+rj8K2EswZlmd+AHnQ6aJ3sdy4Ku8y1EuVngE1Ifu0=,tag:Z66amJwbv61SBKUzLVrgxg==,type:str] age-master-key: ENC[AES256_GCM,data:X9hF4Tlu/iki2VrkquYXyNZ22E+CJBN9oFXgzuZtzEMePnIHDON7XVmKvIm4FcPdRIUo7b085+QTSA5RKcslVMbix4BSyWwNLzA=,iv:r51gdhvXmVLGbZ3w0C+kGfRb3DqZaWH3AN6F8c9g+Po=,tag:EzJv7GHuHZofqpMF0ZlqIA==,type:str] misc: + angelo_cloudflare_dns_api_token: ENC[AES256_GCM,data:Rh1L4dt0cg88XUpUWvSB74ubQlCl9ci8px8PZ/b6KjJVd+ZlmG5qWA==,iv:xXd2A11SA7DXDtiUdsAbBkgAzwabV2D7H8Q11UFWe/A=,tag:o3E7Ww9nQ2ba8z9GLShRjA==,type:str] wireguard: ENC[AES256_GCM,data:kbUtxJv3xSmikJWgtu87TSo5N8tUb2BiH3dH3oOV36waYyXI3bp2aBeAl1k=,iv:yB4UIyMDNRS+JmSnt9XuBhNRTLz+k0FqkK4ofjosRto=,tag:BDSD9SfQuQppKT4+6Cu65w==,type:str] default_password: ENC[AES256_GCM,data:6I3Z4Y1r8eTVvyc=,iv:0yMAY6JfsHEkKsrVAgPxb+3So4A5xvWV4ME1Oi33TvQ=,tag:/7dUtXPrVMNkERdxlk0FOw==,type:str] nixbin.sinanmohd.com: ENC[AES256_GCM,data:WQDzDzOozWa73Bitex6BpE7D7KdVcgIKD1Yx92RbCoNzSa8+b33YtY92Vetu7OlH1Zw4tneKBH/hAjz4ytK1SHoFfKj9wvfdzR5L+8gRKYEwxnvcHyc5gekmAaeQr2bWyUS9PBYRRWTRLiL/5A==,iv:3hlqF2CvpnXS5oDpbW9RIERbDHPLMrgQ+TJ+q9EyrZM=,tag:U4E3b2oBqjMFXEONbz8eKw==,type:str] @@ -45,8 +46,8 @@ sops: OXgwSml4bkc1dnloNUFsRGFFcXFHc2cK26l2eiKbZUkogmAXoha6HTUs3YFKixYz bTkpKKyOAIIin3YM975wwvkCuWNG4tbnHBHQFh5JGK2OEyLDXuV7Pg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2025-03-09T17:11:35Z" - mac: ENC[AES256_GCM,data:x44HygQEMeY/Qi0KWGzlVtvZaD3aDfBKgdSKMIOfc5rhsfvzMhezLOGxRjdJ63H1XP/j650hLRKwCgx5ceg0k+1GlbUIxnXCyzCeEFGTVdW3uELNrxZokv1AKPU7iOmR1Mn5/lLEM1Ehxjsjl8PNpOmLpxaRnoUkoq1Sc4NZSck=,iv:3Hpxt4nCvFE5iuMKaGQaE2z0MLNRd1MgKcu1mMpwSlI=,tag:ZLndddPnWdCnWkDSY8+dhA==,type:str] + lastmodified: "2025-03-18T07:20:05Z" + mac: ENC[AES256_GCM,data:n0/qgqNEZo61lprSqE5u98F1sqWrKCLF8MIA0kBg05MDoySsppowYyClYq8KE8HVwQFmRbdl3ATUJg3DMzwkqXTi3M9ZQvDkf+f01DXMw4D1ruSwBqnUxlxy65xcQB8xAHcbptgy5erNZXRX88MwtqZrgspzZAhpdkE3UTn9kEw=,iv:iybukQKeiPudtY5I79V1J3+ItzzNEkFDRONDh1tVJrk=,tag:l+V4FIlsK/7fg6chbvRuRg==,type:str] pgp: [] unencrypted_suffix: _unencrypted version: 3.9.4 |