grace/dots

dotfiles/nix configs

git clone https://git.gae.moe/grace/dots

Grace Yoderchanged words.gay and added home manager dijkstra stuff01e3245

main
branchesidkmainvulcanwafrn-testingall refs →
3.7 KiB147 linesraw
1{
2  config,
3  lib,
4  pkgs,
5  ...
6}:
7
8let
9  tailnet = import ../tailnet.nix;
10  auth = import ./nginx-auth.nix { };
11  staticSite = root: {
12    inherit root;
13    extraConfig = ''
14      error_page 404 /404.html;
15
16      # Redirect old homepage URLs to /.
17      if ($request_uri ~ "^/index\.(?:html|htmlua|php)(?:\?|$)") {
18        return 301 /$is_args$args;
19      }
20
21      # Redirect explicit page extensions to clean URLs.
22      if ($request_uri ~ "^/([^?]+)\.(?:html|htmlua|php)(?:\?|$)") {
23        return 301 /$1$is_args$args;
24      }
25    '';
26    locations = {
27      "/".tryFiles = "$uri $uri.html $uri/ =404";
28      "~ \\.wasm$" = {
29        tryFiles = "$uri =404";
30        extraConfig = ''
31          types {}
32          default_type application/wasm;
33        '';
34      };
35      "~ /rss\\.xml$" = {
36        tryFiles = "$uri =404";
37        extraConfig = ''
38          types {}
39          default_type application/rss+xml;
40        '';
41      };
42      "= /site.webmanifest" = {
43        tryFiles = "$uri =404";
44        extraConfig = ''
45          types {}
46          default_type application/manifest+json;
47        '';
48      };
49      "^~ /.well-known/" = {
50        tryFiles = "$uri =404";
51        extraConfig = ''
52          types {}
53          default_type text/plain;
54        '';
55      };
56    };
57  };
58  proxy = address: {
59    locations."/" = {
60      proxyPass = address;
61      proxyWebsockets = true;
62      extraConfig = "proxy_connect_timeout 10s;";
63    };
64  };
65  protectedProxy =
66    address:
67    let
68      host = proxy address;
69    in
70    host
71    // {
72      locations = auth.locations // {
73        "/" = host.locations."/" // {
74          extraConfig = host.locations."/".extraConfig + "\n" + auth.browser;
75        };
76      };
77    };
78in
79{
80  imports = [
81    ./authelia.nix
82    ./nginx-defaults.nix
83  ];
84
85  security.acme = {
86    acceptTerms = true;
87    defaults.group = "nginx";
88  };
89
90  networking.firewall.allowedTCPPorts = [
91    80
92    443
93    25565
94  ];
95
96  services.nginx = {
97    enable = true;
98    recommendedProxySettings = true;
99    recommendedTlsSettings = true;
100    recommendedGzipSettings = true;
101    recommendedOptimisation = true;
102    clientMaxBodySize = "10g";
103    proxyTimeout = "300s";
104    appendHttpConfig = ''
105      proxy_buffering off;
106      proxy_request_buffering off;
107      proxy_set_header Remote-User "";
108      proxy_set_header Remote-Groups "";
109      proxy_set_header Remote-Email "";
110      proxy_set_header Remote-Name "";
111    '';
112
113    virtualHosts = {
114      # all of these should be in their respective modules
115      "auth.gae.moe" = proxy "http://127.0.0.1:9091";
116      "fin.gae.moe" = proxy "http://${tailnet.dijkstra}:8096";
117      "files.gae.moe" = protectedProxy "http://${tailnet.dijkstra}:8080";
118      "img.gae.moe" = proxy "http://${tailnet.dijkstra}:2283";
119
120      "map.mc.gae.moe" = proxy "http://${tailnet.dijkstra}:8101";
121
122      "*.nate.gae.moe" = (proxy "http://${tailnet.nate-fedora}:80") // {
123        enableACME = false;
124        forceSSL = false;
125      };
126
127      "grace.pink" = staticSite "/mnt/ext/git/www/private/grace.pink/main";
128      "beta.grace.pink" = staticSite "/mnt/ext/git/www/private/grace.pink/beta";
129
130      "some.words.gay" = staticSite "/mnt/ext/git/www/private/some.words.gay/main";
131      "beta.some.words.gay" = staticSite "/mnt/ext/git/www/private/some.words.gay/beta";
132    };
133  };
134
135  systemd.sockets.minecraft-proxy = {
136    wantedBy = [ "sockets.target" ];
137    listenStreams = [ "0.0.0.0:25565" ];
138  };
139  systemd.services.minecraft-proxy = {
140    description = "TCP proxy for Minecraft";
141    requires = [ "minecraft-proxy.socket" ];
142    serviceConfig = {
143      ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd ${tailnet.dijkstra}:25565";
144      DynamicUser = true;
145    };
146  };
147}