added nginx autoproxy for exposes config, needs some refactoring
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
This commit is contained in:
parent
fa5bda60be
commit
af893b9e43
3 changed files with 106 additions and 95 deletions
|
@ -20,15 +20,15 @@ let
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
in {
|
in {
|
||||||
options = {
|
options.meta = {
|
||||||
meta.exposes = mkOption {
|
exposes = mkOption {
|
||||||
type = with types; attrsOf (submodule exposesOpts);
|
type = with types; attrsOf (submodule exposesOpts);
|
||||||
description = ''
|
description = ''
|
||||||
Exposed services
|
Exposed services
|
||||||
'';
|
'';
|
||||||
};
|
};
|
||||||
|
|
||||||
meta.ipv4 = mkOption {
|
ipv4 = mkOption {
|
||||||
type = types.str;
|
type = types.str;
|
||||||
description = ''
|
description = ''
|
||||||
Own IPv4 Address
|
Own IPv4 Address
|
||||||
|
|
|
@ -2,7 +2,7 @@
|
||||||
with lib;
|
with lib;
|
||||||
let
|
let
|
||||||
cfg = config.services.v.vault;
|
cfg = config.services.v.vault;
|
||||||
hostIP = config.deployment.targetHost;
|
hostIP = config.meta.ipv4;
|
||||||
|
|
||||||
# Find all vault hosts that do not have the same IP as the current host
|
# Find all vault hosts that do not have the same IP as the current host
|
||||||
vault_hosts =
|
vault_hosts =
|
||||||
|
|
|
@ -1,5 +1,7 @@
|
||||||
{ pkgs, hosts, ... }:
|
{ pkgs, config, hosts, lib, ... }:
|
||||||
let
|
let
|
||||||
|
inherit (builtins) filter hasAttr attrValues concatMap;
|
||||||
|
|
||||||
proxy = url: {
|
proxy = url: {
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
|
@ -22,6 +24,16 @@ let
|
||||||
add_header Access-Control-Allow-Origin *;
|
add_header Access-Control-Allow-Origin *;
|
||||||
return 200 '${builtins.toJSON data}';
|
return 200 '${builtins.toJSON data}';
|
||||||
'';
|
'';
|
||||||
|
|
||||||
|
hostsWithExposes =
|
||||||
|
filter (hasAttr "exposes") (attrValues hosts.${config.networking.domain});
|
||||||
|
exposes = { ip, exposes, ... }:
|
||||||
|
map ({ domain, port }: { inherit ip domain port; }) (attrValues exposes);
|
||||||
|
mkVhost = { ip, domain, port }: {
|
||||||
|
"${domain}" = proxy "http://${ip}:${toString port}";
|
||||||
|
};
|
||||||
|
vhosts = lib.foldr (el: acc: acc // mkVhost el) { }
|
||||||
|
(concatMap exposes hostsWithExposes);
|
||||||
in {
|
in {
|
||||||
# This value determines the NixOS release from which the default
|
# This value determines the NixOS release from which the default
|
||||||
# settings for stateful data, like file locations and database versions
|
# settings for stateful data, like file locations and database versions
|
||||||
|
@ -45,107 +57,106 @@ in {
|
||||||
package = pkgs.nginxMainline;
|
package = pkgs.nginxMainline;
|
||||||
|
|
||||||
# Templated
|
# Templated
|
||||||
virtualHosts.${hosts.olympus.hedgedoc.exposes.md.domain} = proxy "http://hedgedoc.olympus:${toString hosts.olympus.hedgedoc.exposes.md.port}/";
|
virtualHosts = vhosts // {
|
||||||
|
# 0x76.dev
|
||||||
# 0x76.dev
|
"ha.0x76.dev" = proxy "http://home-assistant.olympus:8123/";
|
||||||
virtualHosts."ha.0x76.dev" = proxy "http://home-assistant.olympus:8123/";
|
"git.0x76.dev" = proxy "http://gitea.olympus:3000";
|
||||||
virtualHosts."git.0x76.dev" = proxy "http://gitea.olympus:3000";
|
"o.0x76.dev" = proxy "http://minio.olympus:9000";
|
||||||
virtualHosts."o.0x76.dev" = proxy "http://minio.olympus:9000";
|
"grafana.0x76.dev" = proxy "http://victoriametrics.olympus:2342";
|
||||||
virtualHosts."grafana.0x76.dev" =
|
"outline.0x76.dev" = proxy "http://outline.olympus:3000";
|
||||||
proxy "http://victoriametrics.olympus:2342";
|
"ntfy.0x76.dev" = proxy "http://ntfy.olympus:80";
|
||||||
virtualHosts."outline.0x76.dev" = proxy "http://outline.olympus:3000";
|
"ci.0x76.dev" = proxy "http://woodpecker.olympus:8000";
|
||||||
virtualHosts."ntfy.0x76.dev" = proxy "http://ntfy.olympus:80";
|
"dex.0x76.dev" = proxy "http://dex.olympus:5556";
|
||||||
virtualHosts."ci.0x76.dev" = proxy "http://woodpecker.olympus:8000";
|
"pass.0x76.dev" = {
|
||||||
virtualHosts."dex.0x76.dev" = proxy "http://dex.olympus:5556";
|
enableACME = true;
|
||||||
virtualHosts."pass.0x76.dev" = {
|
forceSSL = true;
|
||||||
enableACME = true;
|
locations."/" = {
|
||||||
forceSSL = true;
|
proxyPass = "http://vaultwarden.olympus:8222";
|
||||||
locations."/" = {
|
proxyWebsockets = true;
|
||||||
proxyPass = "http://vaultwarden.olympus:8222";
|
};
|
||||||
proxyWebsockets = true;
|
locations."/notifications/hub/negotiate" = {
|
||||||
|
proxyPass = "http://vaultwarden.olympus:8222";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
|
locations."/notifications/hub" = {
|
||||||
|
proxyPass = "http://vaultwarden.olympus:3012";
|
||||||
|
proxyWebsockets = true;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
locations."/notifications/hub/negotiate" = {
|
|
||||||
proxyPass = "http://vaultwarden.olympus:8222";
|
|
||||||
proxyWebsockets = true;
|
|
||||||
};
|
|
||||||
locations."/notifications/hub" = {
|
|
||||||
proxyPass = "http://vaultwarden.olympus:3012";
|
|
||||||
proxyWebsockets = true;
|
|
||||||
};
|
|
||||||
};
|
|
||||||
|
|
||||||
# Redshifts
|
# Redshifts
|
||||||
virtualHosts."andreea.redshifts.xyz" = proxy "http://zmeura.olympus:8008";
|
"andreea.redshifts.xyz" = proxy "http://zmeura.olympus:8008";
|
||||||
|
|
||||||
# Meow
|
# Meow
|
||||||
virtualHosts."meowy.tech" = {
|
"meowy.tech" = {
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
forceSSL = true;
|
forceSSL = true;
|
||||||
locations."/".extraConfig = ''
|
locations."/".extraConfig = ''
|
||||||
add_header Content-Type 'text/html; charset=UTF-8';
|
add_header Content-Type 'text/html; charset=UTF-8';
|
||||||
return 200 '<h1>meow</h1>';
|
return 200 '<h1>meow</h1>';
|
||||||
'';
|
|
||||||
locations."= /.well-known/matrix/client".extraConfig =
|
|
||||||
mkWellKnown clientConfig;
|
|
||||||
locations."= /.well-known/matrix/server".extraConfig =
|
|
||||||
mkWellKnown serverConfig;
|
|
||||||
};
|
|
||||||
virtualHosts."chat.meowy.tech" = {
|
|
||||||
enableACME = true;
|
|
||||||
forceSSL = true;
|
|
||||||
locations."/".extraConfig = ''
|
|
||||||
return 307 https://element.chat.meowy.tech;
|
|
||||||
'';
|
|
||||||
locations."/_matrix".proxyPass = "http://synapse.olympus:8008";
|
|
||||||
locations."/_synapse/client".proxyPass = "http://synapse.olympus:8008";
|
|
||||||
locations."/_synapse/admin" = {
|
|
||||||
# Allow only local and my own IPs
|
|
||||||
extraConfig = ''
|
|
||||||
allow 127.0.0.1;
|
|
||||||
allow 10.42.42.0/23;
|
|
||||||
allow 192.168.0.0/23;
|
|
||||||
allow 80.60.83.220;
|
|
||||||
allow 195.85.167.32/29;
|
|
||||||
deny all;
|
|
||||||
'';
|
'';
|
||||||
proxyPass = "http://synapse.olympus:8008";
|
locations."= /.well-known/matrix/client".extraConfig =
|
||||||
|
mkWellKnown clientConfig;
|
||||||
|
locations."= /.well-known/matrix/server".extraConfig =
|
||||||
|
mkWellKnown serverConfig;
|
||||||
};
|
};
|
||||||
};
|
"chat.meowy.tech" = {
|
||||||
virtualHosts."element.chat.meowy.tech" = {
|
enableACME = true;
|
||||||
enableACME = true;
|
forceSSL = true;
|
||||||
forceSSL = true;
|
locations."/".extraConfig = ''
|
||||||
|
return 307 https://element.chat.meowy.tech;
|
||||||
root = pkgs.element-web.override {
|
'';
|
||||||
conf = {
|
locations."/_matrix".proxyPass = "http://synapse.olympus:8008";
|
||||||
default_server_config = clientConfig;
|
locations."/_synapse/client".proxyPass = "http://synapse.olympus:8008";
|
||||||
show_labs_settings = true;
|
locations."/_synapse/admin" = {
|
||||||
brand = "chat.meowy.tech";
|
# Allow only local and my own IPs
|
||||||
|
extraConfig = ''
|
||||||
|
allow 127.0.0.1;
|
||||||
|
allow 10.42.42.0/23;
|
||||||
|
allow 192.168.0.0/23;
|
||||||
|
allow 80.60.83.220;
|
||||||
|
allow 195.85.167.32/29;
|
||||||
|
deny all;
|
||||||
|
'';
|
||||||
|
proxyPass = "http://synapse.olympus:8008";
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
"element.chat.meowy.tech" = {
|
||||||
virtualHosts."cinny.chat.meowy.tech" = {
|
enableACME = true;
|
||||||
enableACME = true;
|
forceSSL = true;
|
||||||
forceSSL = true;
|
|
||||||
|
|
||||||
root = pkgs.cinny.override {
|
root = pkgs.element-web.override {
|
||||||
conf = {
|
conf = {
|
||||||
defaultHomeserver = 0;
|
default_server_config = clientConfig;
|
||||||
allowCustomHomeservers = false;
|
show_labs_settings = true;
|
||||||
homeserverList = [ "chat.meowy.tech" ];
|
brand = "chat.meowy.tech";
|
||||||
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
"cinny.chat.meowy.tech" = {
|
||||||
virtualHosts."admin.chat.meowy.tech" = {
|
enableACME = true;
|
||||||
enableACME = true;
|
forceSSL = true;
|
||||||
forceSSL = true;
|
|
||||||
root = pkgs.synapse-admin;
|
|
||||||
};
|
|
||||||
virtualHosts."books.meowy.tech" = proxy "http://bookwyrm.olympus:8001";
|
|
||||||
|
|
||||||
# Kubernetes endpoints
|
root = pkgs.cinny.override {
|
||||||
virtualHosts."0x76.dev" = k8s_proxy;
|
conf = {
|
||||||
virtualHosts."internal.xirion.net" = k8s_proxy;
|
defaultHomeserver = 0;
|
||||||
virtualHosts."blog.xirion.net" = k8s_proxy;
|
allowCustomHomeservers = false;
|
||||||
|
homeserverList = [ "chat.meowy.tech" ];
|
||||||
|
};
|
||||||
|
};
|
||||||
|
};
|
||||||
|
"admin.chat.meowy.tech" = {
|
||||||
|
enableACME = true;
|
||||||
|
forceSSL = true;
|
||||||
|
root = pkgs.synapse-admin;
|
||||||
|
};
|
||||||
|
"books.meowy.tech" = proxy "http://bookwyrm.olympus:8001";
|
||||||
|
|
||||||
|
# Kubernetes endpoints
|
||||||
|
"0x76.dev" = k8s_proxy;
|
||||||
|
"internal.xirion.net" = k8s_proxy;
|
||||||
|
"blog.xirion.net" = k8s_proxy;
|
||||||
|
};
|
||||||
};
|
};
|
||||||
|
|
||||||
security.acme.defaults.email = "victorheld12@gmail.com";
|
security.acme.defaults.email = "victorheld12@gmail.com";
|
||||||
|
|
Loading…
Reference in a new issue