lbhost/conf.www.nix

   1 { config
   2 , pkgs
   3 , lib
   4 , mypkgs
   5 , mylib
   6 , ...
   7 }:
   8
   9 with builtins;
  10 let
  11   inherit (lib)
  12     mapAttrs'
  13     nameValuePair
  14     foldlAttrs
  15     ;
  16   inherit (mylib)
  17     maybe
  18     ;
  19
  20   hostname = config.networking.hostName;
  21   maybe' = maybe (
  22     hostname == "van-sin"
  23   );
  24   www-urls = config.lib.wwwURLs or { };
  25
  26   get-url = url-or-attrs:
  27     if ! isAttrs url-or-attrs then url-or-attrs
  28     else url-or-attrs.url;
  29
  30   get-cfg = url-or-attrs:
  31     if ! isAttrs url-or-attrs then ""
  32     else
  33       foldlAttrs
  34         (acc: k: v:
  35           if k == "url" then acc
  36           else acc + "${k} ${v};\n"
  37         ) ""
  38         url-or-attrs;
  39 in
  40 {
  41   services.nginx = maybe' {
  42     enable = trace "Nginx for www.func.xyz Enabled" true;
  43     virtualHosts."www.func.xyz" = {
  44       forceSSL = true;
  45       enableACME = true;
  46       locations = mapAttrs'
  47         (location: url-or-attrs:
  48           nameValuePair location {
  49             proxyPass = "${get-url url-or-attrs}$is_args$args";
  50             extraConfig = ''
  51               proxy_ssl_verify              on;
  52               proxy_ssl_trusted_certificate ${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt;
  53               proxy_ssl_session_reuse       on;
  54               proxy_ssl_server_name         on;
  55               proxy_set_header              Host $host;
  56               proxy_set_header              X-Real-IP $remote_addr;
  57               proxy_set_header              X-Forwarded-For $proxy_add_x_forwarded_for;
  58               proxy_set_header              X-Forwarded-Proto $scheme;
  59               proxy_set_header              X-Forwarded-Host $host;
  60               proxy_set_header              X-Forwarded-Server $host;
  61
  62             '' + get-cfg url-or-attrs;
  63           })
  64         www-urls;
  65     };
  66   };
  67   security.acme = maybe' {
  68     acceptTerms = true;
  69     certs = {
  70       "www.func.xyz".email = "thomas.cat@func.xyz";
  71     };
  72   };
  73 }