2023-05-04 15:14:36 +02:00
|
|
|
|
{ pkgs, hosts, ... }:
|
2021-10-30 18:31:37 +02:00
|
|
|
|
let
|
2021-11-21 21:56:17 +01:00
|
|
|
|
proxy = url: {
|
2021-10-30 18:31:37 +02:00
|
|
|
|
enableACME = true;
|
|
|
|
|
forceSSL = true;
|
|
|
|
|
locations."/" = {
|
2021-11-21 21:56:17 +01:00
|
|
|
|
proxyPass = url;
|
2021-10-30 18:31:37 +02:00
|
|
|
|
proxyWebsockets = true;
|
|
|
|
|
};
|
|
|
|
|
};
|
2023-01-16 16:35:23 +01:00
|
|
|
|
k8s_proxy = proxy "http://kubernetes.olympus:80/";
|
2022-07-28 14:23:32 +02:00
|
|
|
|
clientConfig = {
|
2022-07-28 17:01:28 +02:00
|
|
|
|
"m.homeserver" = {
|
|
|
|
|
base_url = "https://chat.meowy.tech";
|
|
|
|
|
server_name = "meowy.tech";
|
|
|
|
|
};
|
|
|
|
|
"m.identity_server" = { };
|
2022-07-28 14:23:32 +02:00
|
|
|
|
};
|
|
|
|
|
serverConfig."m.server" = "chat.meowy.tech:443";
|
|
|
|
|
mkWellKnown = data: ''
|
|
|
|
|
add_header Content-Type application/json;
|
|
|
|
|
add_header Access-Control-Allow-Origin *;
|
|
|
|
|
return 200 '${builtins.toJSON data}';
|
|
|
|
|
'';
|
2022-10-11 14:11:17 +02:00
|
|
|
|
in {
|
2021-10-18 21:37:56 +02:00
|
|
|
|
# This value determines the NixOS release from which the default
|
|
|
|
|
# settings for stateful data, like file locations and database versions
|
|
|
|
|
# on your system were taken. It‘s perfectly fine and recommended to leave
|
|
|
|
|
# this value at the release version of the first install of this system.
|
|
|
|
|
# Before changing this value read the documentation for this option
|
|
|
|
|
# (e.g. man configuration.nix or on https://nixos.org/nixos/options.html).
|
|
|
|
|
system.stateVersion = "21.05"; # Did you read the comment?
|
|
|
|
|
|
2021-10-19 02:02:35 +02:00
|
|
|
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
|
|
|
|
2021-10-18 23:26:26 +02:00
|
|
|
|
services.nginx = {
|
2021-10-18 21:37:56 +02:00
|
|
|
|
enable = true;
|
2022-07-30 12:22:19 +02:00
|
|
|
|
statusPage = true;
|
2021-10-18 23:26:26 +02:00
|
|
|
|
recommendedProxySettings = true;
|
|
|
|
|
recommendedTlsSettings = true;
|
2022-05-15 10:54:26 +02:00
|
|
|
|
recommendedOptimisation = true;
|
2023-04-24 09:42:17 +02:00
|
|
|
|
recommendedBrotliSettings = true;
|
2022-12-06 14:28:03 +01:00
|
|
|
|
clientMaxBodySize = "500m";
|
2021-10-18 23:26:26 +02:00
|
|
|
|
|
2023-04-24 09:42:17 +02:00
|
|
|
|
package = pkgs.nginxMainline;
|
2022-05-08 02:13:44 +02:00
|
|
|
|
|
2023-05-04 15:14:36 +02:00
|
|
|
|
# Templated
|
|
|
|
|
virtualHosts.${hosts.olympus.hedgedoc.exposes.md.domain} = proxy "http://hedgedoc.olympus:${toString hosts.olympus.hedgedoc.exposes.md.port}/";
|
|
|
|
|
|
2022-09-21 18:00:51 +02:00
|
|
|
|
# 0x76.dev
|
2022-04-29 22:24:44 +02:00
|
|
|
|
virtualHosts."ha.0x76.dev" = proxy "http://home-assistant.olympus:8123/";
|
|
|
|
|
virtualHosts."git.0x76.dev" = proxy "http://gitea.olympus:3000";
|
2022-05-15 10:54:26 +02:00
|
|
|
|
virtualHosts."o.0x76.dev" = proxy "http://minio.olympus:9000";
|
2023-04-05 16:31:20 +02:00
|
|
|
|
virtualHosts."grafana.0x76.dev" =
|
|
|
|
|
proxy "http://victoriametrics.olympus:2342";
|
2022-09-20 16:38:57 +02:00
|
|
|
|
virtualHosts."outline.0x76.dev" = proxy "http://outline.olympus:3000";
|
2022-11-05 15:55:18 +01:00
|
|
|
|
virtualHosts."ntfy.0x76.dev" = proxy "http://ntfy.olympus:80";
|
2022-11-07 13:21:09 +01:00
|
|
|
|
virtualHosts."ci.0x76.dev" = proxy "http://woodpecker.olympus:8000";
|
2023-01-16 15:22:02 +01:00
|
|
|
|
virtualHosts."dex.0x76.dev" = proxy "http://dex.olympus:5556";
|
2022-10-11 14:11:17 +02:00
|
|
|
|
virtualHosts."pass.0x76.dev" = {
|
|
|
|
|
enableACME = true;
|
|
|
|
|
forceSSL = true;
|
|
|
|
|
locations."/" = {
|
|
|
|
|
proxyPass = "http://vaultwarden.olympus:8222";
|
|
|
|
|
proxyWebsockets = true;
|
|
|
|
|
};
|
|
|
|
|
locations."/notifications/hub/negotiate" = {
|
|
|
|
|
proxyPass = "http://vaultwarden.olympus:8222";
|
|
|
|
|
proxyWebsockets = true;
|
|
|
|
|
};
|
|
|
|
|
locations."/notifications/hub" = {
|
|
|
|
|
proxyPass = "http://vaultwarden.olympus:3012";
|
|
|
|
|
proxyWebsockets = true;
|
|
|
|
|
};
|
|
|
|
|
};
|
2022-10-03 15:17:09 +02:00
|
|
|
|
|
2022-09-21 18:00:51 +02:00
|
|
|
|
# Redshifts
|
2022-09-09 22:58:15 +02:00
|
|
|
|
virtualHosts."andreea.redshifts.xyz" = proxy "http://zmeura.olympus:8008";
|
2021-11-12 09:43:50 +01:00
|
|
|
|
|
2022-07-28 14:23:32 +02:00
|
|
|
|
# Meow
|
|
|
|
|
virtualHosts."meowy.tech" = {
|
|
|
|
|
enableACME = true;
|
|
|
|
|
forceSSL = true;
|
2022-07-28 17:01:28 +02:00
|
|
|
|
locations."/".extraConfig = ''
|
|
|
|
|
add_header Content-Type 'text/html; charset=UTF-8';
|
2022-07-29 13:02:03 +02:00
|
|
|
|
return 200 '<h1>meow</h1>';
|
2022-07-28 17:01:28 +02:00
|
|
|
|
'';
|
2022-10-11 14:11:17 +02:00
|
|
|
|
locations."= /.well-known/matrix/client".extraConfig =
|
|
|
|
|
mkWellKnown clientConfig;
|
|
|
|
|
locations."= /.well-known/matrix/server".extraConfig =
|
|
|
|
|
mkWellKnown serverConfig;
|
2022-07-28 14:23:32 +02:00
|
|
|
|
};
|
|
|
|
|
virtualHosts."chat.meowy.tech" = {
|
|
|
|
|
enableACME = true;
|
|
|
|
|
forceSSL = true;
|
|
|
|
|
locations."/".extraConfig = ''
|
2022-07-28 17:01:28 +02:00
|
|
|
|
return 307 https://element.chat.meowy.tech;
|
2022-07-28 14:23:32 +02:00
|
|
|
|
'';
|
|
|
|
|
locations."/_matrix".proxyPass = "http://synapse.olympus:8008";
|
|
|
|
|
locations."/_synapse/client".proxyPass = "http://synapse.olympus:8008";
|
2023-04-05 16:31:20 +02:00
|
|
|
|
locations."/_synapse/admin" = {
|
|
|
|
|
# Allow only local and my own IPs
|
|
|
|
|
extraConfig = ''
|
|
|
|
|
allow 127.0.0.1;
|
|
|
|
|
allow 10.42.42.0/23;
|
|
|
|
|
allow 192.168.0.0/23;
|
|
|
|
|
allow 80.60.83.220;
|
2023-04-29 19:48:00 +02:00
|
|
|
|
allow 195.85.167.32/29;
|
2023-04-05 16:31:20 +02:00
|
|
|
|
deny all;
|
|
|
|
|
'';
|
|
|
|
|
proxyPass = "http://synapse.olympus:8008";
|
|
|
|
|
};
|
2022-07-28 14:23:32 +02:00
|
|
|
|
};
|
2022-07-28 17:01:28 +02:00
|
|
|
|
virtualHosts."element.chat.meowy.tech" = {
|
|
|
|
|
enableACME = true;
|
|
|
|
|
forceSSL = true;
|
|
|
|
|
|
|
|
|
|
root = pkgs.element-web.override {
|
|
|
|
|
conf = {
|
|
|
|
|
default_server_config = clientConfig;
|
|
|
|
|
show_labs_settings = true;
|
|
|
|
|
brand = "chat.meowy.tech";
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
};
|
2022-10-03 15:17:09 +02:00
|
|
|
|
virtualHosts."cinny.chat.meowy.tech" = {
|
|
|
|
|
enableACME = true;
|
|
|
|
|
forceSSL = true;
|
|
|
|
|
|
|
|
|
|
root = pkgs.cinny.override {
|
|
|
|
|
conf = {
|
|
|
|
|
defaultHomeserver = 0;
|
|
|
|
|
allowCustomHomeservers = false;
|
|
|
|
|
homeserverList = [ "chat.meowy.tech" ];
|
|
|
|
|
};
|
|
|
|
|
};
|
|
|
|
|
};
|
2022-09-22 11:03:10 +02:00
|
|
|
|
virtualHosts."admin.chat.meowy.tech" = {
|
2022-10-03 15:17:09 +02:00
|
|
|
|
enableACME = true;
|
|
|
|
|
forceSSL = true;
|
|
|
|
|
root = pkgs.synapse-admin;
|
2022-09-22 11:03:10 +02:00
|
|
|
|
};
|
2022-09-21 12:45:34 +02:00
|
|
|
|
virtualHosts."books.meowy.tech" = proxy "http://bookwyrm.olympus:8001";
|
2022-07-28 14:23:32 +02:00
|
|
|
|
|
2021-10-30 18:31:37 +02:00
|
|
|
|
# Kubernetes endpoints
|
2021-11-03 00:52:39 +01:00
|
|
|
|
virtualHosts."0x76.dev" = k8s_proxy;
|
2023-01-26 15:26:53 +01:00
|
|
|
|
virtualHosts."internal.xirion.net" = k8s_proxy;
|
2023-01-26 18:04:19 +01:00
|
|
|
|
virtualHosts."blog.xirion.net" = k8s_proxy;
|
2021-10-18 21:37:56 +02:00
|
|
|
|
};
|
2021-10-18 23:31:35 +02:00
|
|
|
|
|
2022-03-31 12:25:45 +02:00
|
|
|
|
security.acme.defaults.email = "victorheld12@gmail.com";
|
2021-10-18 23:32:11 +02:00
|
|
|
|
security.acme.acceptTerms = true;
|
2021-12-12 15:51:56 +01:00
|
|
|
|
security.acme.preliminarySelfsigned = true;
|
2022-07-30 12:22:19 +02:00
|
|
|
|
|
|
|
|
|
services.prometheus.exporters = {
|
|
|
|
|
nginx = {
|
|
|
|
|
enable = true;
|
|
|
|
|
openFirewall = true;
|
|
|
|
|
};
|
|
|
|
|
};
|
2021-10-18 21:37:56 +02:00
|
|
|
|
}
|