Luj/snowfield
1
0
Fork 0
mirror of https://github.com/JulienMalka/snowfield.git synced 2025-04-01 09:40:55 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

chore(pages): cleanup module

Browse source
This commit is contained in:
Julien Malka 2024-10-26 04:06:52 +02:00
parent 0a4c2444bc
commit ab03b23b45
Signed by: Luj
GPG key ID: 6FC74C847011FD83
1 changed files with 59 additions and 76 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

135
machines/gustave/pages.nix
View file

@ -5,58 +5,51 @@
... ...
}: }:
{ {
options.services.nginx.virtualHosts = lib.mkOption { age.secrets."pages-settings-file".file = ../../secrets/pages-settings-file.age;
type = lib.types.attrsOf (
lib.types.submodule {
config.extraConfig = ''
real_ip_header proxy_protocol;
set_real_ip_from 127.0.0.1;
'';
}
);
};
config = { services.codeberg-pages = {
age.secrets."pages-settings-file".file = ../../secrets/pages-settings-file.age; enable = true;
package = pkgs.unstable.codeberg-pages.overrideAttrs (_: {
services.codeberg-pages = { src = pkgs.fetchFromGitea {
enable = true; domain = "codeberg.org";
package = pkgs.unstable.codeberg-pages.overrideAttrs (_: { owner = "Codeberg";
src = pkgs.fetchFromGitea { repo = "pages-server";
domain = "codeberg.org"; rev = "831ce3d913015e856351dc4d3fc983ada826ef7e";
owner = "Codeberg"; hash = "sha256-Ti9sOppHOaUU72A7Bxyfu4phJUed4m/5e9RyjmVino0=";
repo = "pages-server";
rev = "831ce3d913015e856351dc4d3fc983ada826ef7e";
hash = "sha256-Ti9sOppHOaUU72A7Bxyfu4phJUed4m/5e9RyjmVino0=";
};
patches = [ ./proxy-protocol.patch ];
vendorHash = "sha256-NHrohvZL7ie29xWpY3bO1BVWrqUywwaKAucZAwvEWto=";
});
settings = {
ACME_ACCEPT_TERMS = "true";
ACME_EMAIL = "julien@malka.sh";
DNS_PROVIDER = "gandiv5";
ENABLE_HTTP_SERVER = "false";
GITEA_ROOT = "https://git.luj.fr";
PORT = "8010";
PAGES_DOMAIN = "luj-static.page";
RAW_DOMAIN = "raw.luj-static.page";
PAGES_BRANCHES = "pages,main,master";
LOG_LEVEL = "trace";
USE_PROXY_PROTOCOL = "true";
}; };
patches = [ ./proxy-protocol.patch ];
vendorHash = "sha256-NHrohvZL7ie29xWpY3bO1BVWrqUywwaKAucZAwvEWto=";
});
settingsFile = config.age.secrets."pages-settings-file".path; settings = {
ACME_ACCEPT_TERMS = "true";
ACME_EMAIL = "julien@malka.sh";
DNS_PROVIDER = "gandiv5";
ENABLE_HTTP_SERVER = "false";
GITEA_ROOT = "https://git.luj.fr";
PORT = "8010";
PAGES_DOMAIN = "luj-static.page";
RAW_DOMAIN = "raw.luj-static.page";
PAGES_BRANCHES = "pages,main,master";
LOG_LEVEL = "trace";
USE_PROXY_PROTOCOL = "true";
}; };
networking.firewall.allowedTCPPorts = [ settingsFile = config.age.secrets."pages-settings-file".path;
80 };
443
8447
];
services.nginx.defaultListen = [ networking.firewall.allowedTCPPorts = [
8447
];
luj.nginx.enable = true;
services.nginx = {
appendHttpConfig = ''
set_real_ip_from 127.0.0.1;
real_ip_header proxy_protocol;
'';
defaultListen = [
{ {
addr = "127.0.0.1"; addr = "127.0.0.1";
port = 8446; port = 8446;
@ -69,40 +62,30 @@
} }
]; ];
security.acme.acceptTerms = true; streamConfig = ''
security.acme.defaults.email = "julien@malka.sh"; map $ssl_preread_server_name $sni_upstream {
luj.nginx.enable = lib.mkForce false; hostnames;
services.nginx = { default 0.0.0.0:8010;
enable = true; ${lib.concatMapStringsSep "\n" (vhost: " ${vhost} 0.0.0.0:8446;") (
recommendedGzipSettings = true; lib.filter (e: e != "default") (lib.attrNames config.services.nginx.virtualHosts)
recommendedOptimisation = true; )}
recommendedProxySettings = true; }
recommendedTlsSettings = true;
streamConfig = ''
map $ssl_preread_server_name $sni_upstream {
hostnames;
default 0.0.0.0:8010;
${lib.concatMapStringsSep "\n" (vhost: " ${vhost} 0.0.0.0:8446;") (
lib.attrNames config.services.nginx.virtualHosts
)}
}
server { server {
listen [::]:443; listen [::]:443;
ssl_preread on; ssl_preread on;
proxy_pass $sni_upstream; proxy_pass $sni_upstream;
proxy_protocol on; proxy_protocol on;
} }
server { server {
listen [::]:8447; listen [::]:8447;
proxy_pass 0.0.0.0:8010; proxy_pass 0.0.0.0:8010;
} }
''; '';
defaultSSLListenPort = 8446; defaultSSLListenPort = 8446;
};
}; };
} }