2023-10-01 22:50:54 +02:00
|
|
|
{ config, lib, ... }:
|
|
|
|
|
|
|
|
let
|
2024-10-12 18:19:43 +02:00
|
|
|
inherit (lib)
|
|
|
|
attrsToList
|
|
|
|
concatStringsSep
|
|
|
|
filterAttrs
|
2024-10-12 18:40:03 +02:00
|
|
|
getAttr
|
|
|
|
mapAttrs
|
|
|
|
mapAttrs'
|
2024-10-12 18:19:43 +02:00
|
|
|
mkEnableOption
|
|
|
|
mkIf
|
|
|
|
mkOption
|
2024-10-12 18:40:03 +02:00
|
|
|
nameValuePair
|
|
|
|
recursiveUpdate
|
2024-10-12 18:19:43 +02:00
|
|
|
;
|
|
|
|
|
2024-10-12 18:40:03 +02:00
|
|
|
inherit (lib.types)
|
|
|
|
attrs
|
|
|
|
attrsOf
|
|
|
|
bool
|
|
|
|
port
|
|
|
|
str
|
|
|
|
submodule
|
|
|
|
;
|
2023-10-01 22:50:54 +02:00
|
|
|
|
|
|
|
cfg = config.dgn-web;
|
2024-02-02 10:51:31 +01:00
|
|
|
in
|
|
|
|
{
|
2023-10-01 22:50:54 +02:00
|
|
|
options.dgn-web = {
|
|
|
|
enable = mkEnableOption "sane defaults for web services.";
|
2024-10-12 18:19:43 +02:00
|
|
|
|
|
|
|
internalPorts = mkOption {
|
|
|
|
type = attrsOf port;
|
|
|
|
default = { };
|
|
|
|
description = ''
|
|
|
|
Map from the web services to their internal ports, it should avoid port clashes.
|
|
|
|
'';
|
|
|
|
};
|
2024-10-12 18:40:03 +02:00
|
|
|
|
|
|
|
simpleProxies = mkOption {
|
|
|
|
type = attrsOf (submodule {
|
|
|
|
options = {
|
|
|
|
port = mkOption {
|
|
|
|
type = port;
|
|
|
|
description = ''
|
|
|
|
Port where the service will listen.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
host = mkOption {
|
|
|
|
type = str;
|
|
|
|
description = ''
|
|
|
|
Hostname of the service.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
proxyWebsockets = mkOption {
|
|
|
|
type = bool;
|
|
|
|
default = false;
|
|
|
|
description = ''
|
|
|
|
Whether to support proxying websocket connections with HTTP/1.1.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
|
|
|
|
vhostConfig = mkOption {
|
|
|
|
type = attrs;
|
|
|
|
default = { };
|
|
|
|
description = ''
|
|
|
|
Additional virtualHost settings.
|
|
|
|
'';
|
|
|
|
};
|
|
|
|
};
|
|
|
|
});
|
2024-10-16 11:07:55 +02:00
|
|
|
default = { };
|
|
|
|
description = ''
|
|
|
|
A set of simple localhost redirections.
|
|
|
|
'';
|
2024-10-12 18:40:03 +02:00
|
|
|
};
|
2023-10-01 22:50:54 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
config = mkIf cfg.enable {
|
2024-10-12 18:19:43 +02:00
|
|
|
assertions = [
|
|
|
|
(
|
|
|
|
let
|
|
|
|
duplicates = builtins.attrValues (
|
|
|
|
builtins.mapAttrs (p: serv: "${p}: ${concatStringsSep ", " serv}") (
|
|
|
|
filterAttrs (_: ls: builtins.length ls != 1) (
|
|
|
|
builtins.foldl' (
|
|
|
|
rev:
|
|
|
|
{ name, value }:
|
|
|
|
let
|
|
|
|
str = builtins.toString value;
|
|
|
|
in
|
|
|
|
rev // { ${str} = (rev.${str} or [ ]) ++ [ name ]; }
|
|
|
|
) { } (attrsToList cfg.internalPorts)
|
|
|
|
)
|
|
|
|
)
|
|
|
|
);
|
|
|
|
in
|
|
|
|
{
|
|
|
|
assertion = duplicates == [ ];
|
|
|
|
message = ''
|
|
|
|
Internal ports cannot be used for multiple services, the clashes are:
|
|
|
|
${concatStringsSep "\n " duplicates}
|
|
|
|
'';
|
|
|
|
}
|
|
|
|
)
|
|
|
|
];
|
|
|
|
|
2024-10-12 18:40:03 +02:00
|
|
|
dgn-web.internalPorts = mapAttrs (_: getAttr "port") cfg.simpleProxies;
|
|
|
|
|
2024-12-10 15:53:06 +01:00
|
|
|
# Keep logs during 1 year (53 weeks)
|
|
|
|
services.logrotate.settings.nginx.rotate = 53;
|
|
|
|
|
2023-10-01 22:50:54 +02:00
|
|
|
services.nginx = {
|
|
|
|
enable = true;
|
|
|
|
|
2024-10-12 18:40:03 +02:00
|
|
|
virtualHosts = mapAttrs' (
|
|
|
|
_:
|
|
|
|
{
|
|
|
|
host,
|
|
|
|
port,
|
|
|
|
proxyWebsockets,
|
|
|
|
vhostConfig,
|
|
|
|
}:
|
|
|
|
nameValuePair host (
|
|
|
|
recursiveUpdate {
|
|
|
|
forceSSL = true;
|
|
|
|
enableACME = true;
|
|
|
|
|
|
|
|
locations."/" = {
|
|
|
|
proxyPass = "http://127.0.0.1:${builtins.toString port}";
|
|
|
|
inherit proxyWebsockets;
|
|
|
|
};
|
|
|
|
} vhostConfig
|
|
|
|
)
|
|
|
|
) cfg.simpleProxies;
|
|
|
|
|
2023-10-01 22:50:54 +02:00
|
|
|
recommendedBrotliSettings = true;
|
|
|
|
recommendedGzipSettings = true;
|
|
|
|
recommendedOptimisation = true;
|
|
|
|
recommendedProxySettings = true;
|
|
|
|
recommendedTlsSettings = true;
|
|
|
|
recommendedZstdSettings = true;
|
|
|
|
};
|
|
|
|
|
2024-02-02 10:51:31 +01:00
|
|
|
networking.firewall.allowedTCPPorts = [
|
|
|
|
80
|
|
|
|
443
|
|
|
|
];
|
2023-10-01 22:50:54 +02:00
|
|
|
};
|
|
|
|
}
|