summaryrefslogtreecommitdiff
path: root/hosts/kay/modules/www.nix
blob: a0b9c200cf2557d9226abbf12f867b0bd5974faf (plain) (blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
{ config, pkgs, ... }:

let
  domain = config.userdata.domain;
  fscusat = "fscusat.org";
  mark = "themark.ing";
  storage = "/hdd/users/sftp/shr";
in
{
  imports = [
    ./dendrite.nix
    ./matrix-sliding-sync.nix
    ./cgit.nix
  ];

  networking.firewall = {
    allowedTCPPorts = [ 80 443 ];
    allowedUDPPorts = [ 443 ];
  };

  services.nginx = { 
    enable = true;
    package = pkgs.nginxQuic;
    enableQuicBPF = true;

    recommendedTlsSettings = true;
    recommendedZstdSettings = true;
    recommendedOptimisation = true;
    recommendedGzipSettings = true;
    recommendedProxySettings = true;
    recommendedBrotliSettings = true;
    eventsConfig = "worker_connections 1024;";

    virtualHosts = let
      defaultOpts = {
        quic = true;
        http3 = true;
        forceSSL = true;
        useACMEHost = domain;
      };
    in {
      "${domain}" = defaultOpts // {
        default = true;
        globalRedirect = "www.${domain}";

        extraConfig = ''
          client_max_body_size ${toString
            config.services.dendrite.settings.media_api.max_file_size_bytes
          };
        '';

        locations = {
          "/.well-known/matrix/server".return = ''
            200 '{ "m.server": "${domain}:443" }'
          '';

          "/.well-known/matrix/client".return = ''
            200 '${builtins.toJSON {
                "m.homeserver".base_url = "https://${domain}";
                "org.matrix.msc3575.proxy".url = "https://${domain}";
            }}'
          '';

          "/_matrix".proxyPass = "http://127.0.0.1:${toString
            config.services.dendrite.httpPort
          }";

          "/_matrix/client/unstable/org.matrix.msc3575/sync".proxyPass =
            "http://${config.services.matrix-sliding-sync.settings.SYNCV3_BINDADDR}";
        };
      };

      "www.${domain}" = defaultOpts // {
        root = "/var/www/${domain}";
      };

      "git.${domain}" = defaultOpts;

      "bin.${domain}" = defaultOpts // {
        root = "${storage}/bin";
        locations."= /".return = "307 https://www.${domain}";
      };

      "static.${domain}" = defaultOpts // {
        root = "${storage}/static";
        locations."= /".return = "301 https://www.${domain}";
      };

      "${fscusat}" = defaultOpts // {
        useACMEHost = null;
        enableACME = true;

        globalRedirect = "www.${fscusat}";
      };
      "www.${fscusat}" = defaultOpts // {
        useACMEHost = null;
        enableACME = true;

        locations."/" = {
          return = "200 '<h1>under construction</h1>'";
          extraConfig = "add_header Content-Type text/html;";
        };
      };

      "${mark}" = defaultOpts // {
        useACMEHost = null;
        enableACME = true;

        globalRedirect = "www.${mark}";
      };
      "www.${mark}" = defaultOpts // {
        useACMEHost = null;
        enableACME = true;

        locations."/" = {
          return = "200 '<h1>under construction, see you soon</h1>'";
          extraConfig = "add_header Content-Type text/html;";
        };
      };
    };
  };
}