Initial commit from system

nginx/nginx.nix

@@ -0,0 +1,57 @@
+{ lib, pkgs, config, ...}:
+
+{
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedProxySettings = true;
+    recommendedTlsSettings = false;
+    # pulls in the domainname set for ntfy
+    virtualHosts."ntfy.lo-probst.de" = {
+      enableACME = true;
+      acmeRoot = null;
+      forceSSL = true;
+#      sslCertificate = "/var/lib/acme/ntfy.lo-probst.de/fullchain.pem";
+      # directs traffic to the appropriate port for ntfy
+      locations."/" = {
+        proxyPass = "http://localhost:8080";
+        # proxyPass = "http://localhost:3000";
+        proxyWebsockets = true;
+      };
+    };
+    virtualHosts."${config.services.forgejo.settings.server.DOMAIN}" = {
+      enableACME = true;
+      acmeRoot = null;
+      forceSSL = true;
+      extraConfig = ''
+        client_max_body_size 512M;
+      '';
+      locations."/" = {
+        proxyPass = "http://localhost:${toString config.services.forgejo.settings.server.HTTP_PORT}";
+      };
+    };
+#    virtualHosts."oh.lo-probst.de" = {
+#      enableACME = true;
+#      acmeRoot = null;
+#      forceSSL = true;
+#      locations."/" = {
+#        proxyPass = "https://192.168.2.221:9443";
+#      };
+#    };
+  };
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = "admin-infra-one@lo-probst.de";
+      dnsProvider = "ionos";
+      # API for authentication to DNA provider e.g.
+      # CF_API_EMAIL=<insert-dns-account-email>
+      # specify file if not using agenix
+      credentialFiles = {
+        "IONOS_API_KEY_FILE" = "/etc/secrets/ionos-acme-infra-one.txt";
+      };
+    };
+  };
+  users.users.nginx.extraGroups = [ "acme" ];
+}