feat(nginx): Switch to simpleProxies for the majority of configs

This proxies the required host to localhost:$port and enables SSL

machines/compute01/ds-fr/default.nix

@@ -6,6 +6,8 @@ in
 {
   imports = [ ./module.nix ];
 
+  dgn-web.internalPorts.ds-fr = 3000;
+
   services.demarches-simplifiees = {
     enable = true;
 

machines/compute01/grafana.nix

@@ -69,17 +69,11 @@ in
         }
       ];
     };
+  };
 
-    nginx.virtualHosts.${host} = {
+  dgn-web.simpleProxies.grafana = {
-      enableACME = true;
+    inherit host port;
-      forceSSL = true;
-
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${builtins.toString port}";
     proxyWebsockets = true;
-        recommendedProxySettings = true;
-      };
-    };
   };
 
   age-secrets.autoMatch = [ "grafana" ];

machines/compute01/hedgedoc.nix

@@ -29,16 +29,6 @@ in
       };
     };
 
-    nginx.virtualHosts.${host} = {
-      forceSSL = true;
-      enableACME = true;
-
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${builtins.toString port}";
-        proxyWebsockets = true;
-      };
-    };
-
     postgresql = {
       enable = true;
 
@@ -53,6 +43,11 @@ in
     };
   };
 
+  dgn-web.simpleProxies.hedgedoc = {
+    inherit host port;
+    proxyWebsockets = true;
+  };
+
   systemd.services.hedgedoc.serviceConfig.StateDirectory = lib.mkForce [
     "hedgedoc"
     "hedgedoc/uploads"

machines/compute01/kanidm/default.nix

@@ -8,7 +8,9 @@
 let
   inherit (lib) escapeRegex concatStringsSep;
 
-  domain = "sso.dgnum.eu";
+  host = "sso.dgnum.eu";
+  port = 8443;
+  domain = host;
 
   cert = config.security.acme.certs.${domain};
 
@@ -51,16 +53,9 @@ in
 
   users.users.kanidm.extraGroups = [ cert.group ];
 
-  services.nginx = {
+  dgn-web.simpleProxies.kanidm = {
-    enable = true;
+    inherit host port;
-
+    vhostConfig.locations."/".extraConfig = ''
-    virtualHosts.${domain} = {
-      enableACME = true;
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "https://127.0.0.1:8443";
-
-        extraConfig = ''
       if ( $request_method !~ ^(GET|POST|HEAD|OPTIONS|PUT|PATCH|DELETE)$ ) {
           return 444;
       }
@@ -93,8 +88,6 @@ in
       }
     '';
   };
-    };
-  };
 
   networking.firewall.allowedTCPPorts = [ 636 ];
   networking.firewall.allowedUDPPorts = [ 636 ];

machines/compute01/nextcloud.nix

@@ -3,6 +3,8 @@
 let
   host = "cloud.dgnum.eu";
   nextcloud-occ = "${config.services.nextcloud.occ}/bin/nextcloud-occ";
+
+  port = 9980;
 in
 {
   services.nextcloud = {
@@ -104,7 +106,7 @@ in
         imageDigest = "sha256:07da8a191b37058514dfdf921ea8c2270c6634fa659acee774cf8594f86950e4";
         sha256 = "sha256-5oaz07NQScHUVN/HznzZGQ2bGrU/V1GhI+9btXHz0GM=";
       };
-      ports = [ "9980:9980" ];
+      ports = [ "${builtins.toString port}:${builtins.toString port}" ];
       environment = {
         domain = "cloud.dgnum.eu";
         extra_params = "--o:ssl.enable=false --o:ssl.termination=true --o:remote_font_config.url=https://cloud.dgnum.eu/apps/richdocuments/settings/fonts.json";
@@ -119,6 +121,8 @@ in
     };
   };
 
+  dgn-web.internalPorts.collabora = port;
+
   services.nginx.virtualHosts = {
     ${host} = {
       enableACME = true;
@@ -136,25 +140,25 @@ in
       extraConfig = ''
         # static files
         location ^~ /browser {
-          proxy_pass http://127.0.0.1:9980;
+          proxy_pass http://127.0.0.1:${builtins.toString port};
           proxy_set_header Host $host;
         }
 
         # WOPI discovery URL
         location ^~ /hosting/discovery {
-          proxy_pass http://127.0.0.1:9980;
+          proxy_pass http://127.0.0.1:${builtins.toString port};
           proxy_set_header Host $host;
         }
 
         # Capabilities
         location ^~ /hosting/capabilities {
-          proxy_pass http://127.0.0.1:9980;
+          proxy_pass http://127.0.0.1:${builtins.toString port};
           proxy_set_header Host $host;
         }
 
         # main websocket
         location ~ ^/cool/(.*)/ws$ {
-          proxy_pass http://127.0.0.1:9980;
+          proxy_pass http://127.0.0.1:${builtins.toString port};
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection "Upgrade";
           proxy_set_header Host $host;
@@ -163,13 +167,13 @@ in
 
         # download, presentation and image upload
         location ~ ^/(c|l)ool {
-          proxy_pass http://127.0.0.1:9980;
+          proxy_pass http://127.0.0.1:${builtins.toString port};
           proxy_set_header Host $host;
         }
 
         # Admin Console websocket
         location ^~ /cool/adminws {
-          proxy_pass http://127.0.0.1:9980;
+          proxy_pass http://127.0.0.1:${builtins.toString port};
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection "Upgrade";
           proxy_set_header Host $host;

machines/compute01/ollama-proxy.nix

@@ -6,8 +6,6 @@
 }:
 {
   services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
     virtualHosts."ollama01.beta.dgnum.eu" = {
       enableACME = true;
       forceSSL = true;
@@ -19,9 +17,4 @@
       };
     };
   };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
 }

machines/compute01/outline.nix

@@ -2,6 +2,7 @@
 
 let
   host = "docs.dgnum.eu";
+  port = 3003;
 in
 {
   services.outline = {
@@ -35,21 +36,12 @@ in
     defaultLanguage = "fr_FR";
 
     forceHttps = false;
-    port = 3003;
+    inherit port;
   };
 
-  services.nginx.virtualHosts.${host} = {
+  dgn-web.simpleProxies.outline = {
-    enableACME = true;
+    inherit host port;
-    forceSSL = true;
+    vhostConfig.locations."/robots.txt".return = ''200 "User-agent: *\nDisallow: /s/demarches-normaliennes/\n"'';
-
-    locations."/" = {
-      proxyPass = "http://localhost:3003";
-      proxyWebsockets = true;
-    };
-
-    locations."/robots.txt" = {
-      return = ''200 "User-agent: *\nDisallow: /s/demarches-normaliennes/\n"'';
-    };
   };
 
   age-secrets.autoMatch = [ "outline" ];

machines/compute01/plausible.nix

@@ -38,16 +38,7 @@ in
     };
   };
 
-  services.nginx = {
+  dgn-web.simpleProxies.plausible = {
-    enable = true;
+    inherit host port;
-
-    virtualHosts.${host} = {
-      enableACME = true;
-      forceSSL = true;
-
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${builtins.toString port}";
-      };
-    };
   };
 }

machines/compute01/satosa/default.nix

@@ -2,16 +2,15 @@
 
 let
   host = "saml-idp.dgnum.eu";
+  port = 8090;
 in
 {
-
   imports = [ ./module.nix ];
 
   services.satosa = {
     enable = true;
 
-    inherit host;
+    inherit host port;
-    port = 8090;
 
     envFile = config.age.secrets."satosa-env_file".path;
 
@@ -148,9 +147,8 @@ in
     };
   };
 
-  services.nginx.virtualHosts.${host} = {
+  dgn-web.simpleProxies.satosa = {
-    enableACME = true;
+    inherit host port;
-    forceSSL = true;
   };
 
   age-secrets.autoMatch = [ "satosa" ];

machines/compute01/satosa/module.nix

@@ -190,14 +190,6 @@ in
       };
     };
 
-    services.nginx = mkIf cfg.configureNginx {
-      enable = true;
-
-      virtualHosts.${cfg.host} = {
-        locations."/".proxyPass = "http://127.0.0.1:${builtins.toString cfg.port}";
-      };
-    };
-
     users.users.satosa = {
       isSystemUser = true;
       group = "satosa";

machines/compute01/stirling-pdf/default.nix

@@ -11,9 +11,12 @@ let
   # - finally, update the commit hash of the customization patch
 
   dgn-id = "8f19cb1c9623f8da71f6512c1528d83acc35db57";
+  port = 8084;
 in
 
 {
+  dgn-web.internalPorts.stirling-pdf = port;
+
   services.stirling-pdf = {
     enable = true;
 
@@ -24,7 +27,7 @@ in
     });
 
     domain = "pdf.dgnum.eu";
-    port = 8084;
+    inherit port;
 
     nginx = {
       enableACME = true;

machines/compute01/vaultwarden.nix

@@ -2,6 +2,8 @@
 
 let
   host = "pass.dgnum.eu";
+  port = 10501;
+  wsPort = 10500;
 in
 {
   services.vaultwarden = {
@@ -10,9 +12,9 @@ in
     config = {
       DOMAIN = "https://${host}";
       WEBSOCKET_ENABLED = true;
-      WEBSOCKET_PORT = 10500;
+      WEBSOCKET_PORT = wsPort;
       SIGNUPS_DOMAINS_WHITELIST = "dgnum.eu,ens.fr,ens.psl.eu";
-      ROCKET_PORT = 10501;
+      ROCKET_PORT = port;
       ROCKET_ADDRESS = "127.0.0.1";
       SIGNUPS_VERIFY = true;
       USE_SYSLOG = true;
@@ -31,34 +33,28 @@ in
     environmentFile = config.age.secrets."vaultwarden-environment_file".path;
   };
 
-  services = {
+  dgn-web = {
-    nginx = {
+    internalPorts.vaultwarden-websockets = wsPort;
-      enable = true;
 
-      virtualHosts.${host} = {
+    simpleProxies.vaultwarden = {
-        forceSSL = true;
+      inherit host port;
-        enableACME = true;
-
-        locations = {
-          "/" = {
-            proxyPass = "http://127.0.0.1:10501";
       proxyWebsockets = true;
-          };
 
+      vhostConfig.locations = {
         "/notifications/hub" = {
-            proxyPass = "http://127.0.0.1:10500";
+          proxyPass = "http://127.0.0.1:${builtins.toString port}";
           proxyWebsockets = true;
         };
 
         "/notifications/hub/negotiate" = {
-            proxyPass = "http://127.0.0.1:10501";
+          proxyPass = "http://127.0.0.1:${builtins.toString wsPort}";
           proxyWebsockets = true;
         };
       };
     };
   };
 
-    postgresql = {
+  services.postgresql = {
     enable = true;
 
     ensureDatabases = [ "vaultwarden" ];
@@ -70,7 +66,6 @@ in
       }
     ];
   };
-  };
 
   dgn-backups.jobs.vaultwarden.settings.paths = [ "/var/lib/bitwarden_rs" ];
   dgn-backups.postgresDatabases = [ "vaultwarden" ];

machines/rescue01/_configuration.nix

@@ -3,6 +3,7 @@
 lib.extra.mkConfig {
   enabledModules = [
     # List of modules to enable
+    "dgn-web"
   ];
 
   enabledServices = [

machines/rescue01/uptime-kuma.nix

@@ -122,23 +122,10 @@ in
 
   services.uptime-kuma.enable = true;
 
-  services.nginx = {
+  dgn-web.simpleProxies.uptime-kuma = {
-    enable = true;
+    inherit host port;
-
-    virtualHosts.${host} = {
-      enableACME = true;
-      forceSSL = true;
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${builtins.toString port}";
     proxyWebsockets = true;
   };
-    };
-  };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
 
   statelessUptimeKuma = {
     probesConfig = mkMerge [

machines/storage01/forgejo.nix

@@ -76,18 +76,10 @@ in
 
       mailerPasswordFile = config.age.secrets."forgejo-mailer_password_file".path;
     };
+  };
 
-    nginx = {
+  dgn-web.simpleProxies.forgejo = {
-      enable = true;
+    inherit host port;
-
-      virtualHosts.${host} = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://127.0.0.1:${toString port}";
-        };
-      };
-    };
   };
 
   users.users.git = {

machines/storage01/garage.nix

@@ -1,6 +1,13 @@
-{ config, pkgs, ... }:
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
 
 let
+  inherit (lib) mapAttrs' nameValuePair;
+
   host = "s3.dgnum.eu";
   webHost = "cdn.dgnum.eu";
 
@@ -25,8 +32,18 @@ let
   ] ++ domains;
 
   mkHosted = host: builtins.map (b: "${b}.${host}");
+
+  ports = {
+    admin_api = 3903;
+    k2v_api = 3904;
+    rpc = 3901;
+    s3_api = 3900;
+    s3_web = 3902;
+  };
 in
 {
+  dgn-web.internalPorts = mapAttrs' (name: nameValuePair "garage-${name}") ports;
+
   services.garage = {
     enable = true;
 
@@ -40,24 +57,24 @@ in
       replication_mode = "none"; # TODO: deprecated
       compression_level = 7;
 
-      rpc_bind_addr = "[::]:3901";
+      rpc_bind_addr = "[::]:${toString ports.rpc}";
-      rpc_public_addr = "127.0.0.1:3901";
+      rpc_public_addr = "127.0.0.1:${toString ports.rpc}";
 
       s3_api = {
         s3_region = "garage";
-        api_bind_addr = "127.0.0.1:3900";
+        api_bind_addr = "127.0.0.1:${toString ports.s3_api}";
         root_domain = ".${host}";
       };
 
       s3_web = {
-        bind_addr = "127.0.0.1:3902";
+        bind_addr = "127.0.0.1:${toString ports.s3_web}";
         root_domain = ".${webHost}";
         index = "index.html";
       };
 
-      k2v_api.api_bind_addr = "[::]:3904";
+      k2v_api.api_bind_addr = "[::]:${toString ports.k2v_api}";
 
-      admin.api_bind_addr = "127.0.0.1:3903";
+      admin.api_bind_addr = "127.0.0.1:${toString ports.admin_api}";
     };
 
     environmentFile = config.age.secrets."garage-environment_file".path;
@@ -84,7 +101,7 @@ in
       forceSSL = true;
 
       locations."/".extraConfig = ''
-        proxy_pass http://127.0.0.1:3903;
+        proxy_pass http://127.0.0.1:${toString ports.admin_api};
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header Host $host;
       '';
@@ -97,7 +114,7 @@ in
       serverAliases = mkHosted host buckets;
 
       locations."/".extraConfig = ''
-        proxy_pass http://127.0.0.1:3900;
+        proxy_pass http://127.0.0.1:${toString ports.s3_api};
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header Host $host;
         # Disable buffering to a temporary file.
@@ -113,7 +130,7 @@ in
       serverAliases = domains ++ (mkHosted webHost buckets);
 
       locations."/".extraConfig = ''
-        proxy_pass http://127.0.0.1:3902;
+        proxy_pass http://127.0.0.1:${toString ports.s3_web};
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header Host $host;
       '';

machines/storage01/influxdb.nix

@@ -5,6 +5,7 @@ let
   token = user: secret "${user}_token_file";
 
   host = "influx.dgnum.eu";
+  port = 8086;
 in
 
 {
@@ -41,13 +42,8 @@ in
     };
   };
 
-  services.nginx.virtualHosts.${host} = {
+  dgn-web.simpleProxies.influxdb = {
-    enableACME = true;
+    inherit host port;
-    forceSSL = true;
-
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:8086";
-    };
   };
 
   age-secrets.autoMatch = [ "influxdb2" ];

machines/storage01/peertube.nix

@@ -4,6 +4,8 @@ let
   host = "videos.dgnum.eu";
 in
 {
+  dgn-web.internalPorts.peertube = config.services.peertube.listenHttp;
+
   services.peertube = {
     enable = true;
 

machines/storage01/prometheus.nix

@@ -77,15 +77,9 @@ in
     ];
   };
 
-  services.nginx.virtualHosts.${host} = {
+  dgn-web.simpleProxies.prometheus = {
-    enableACME = true;
+    inherit host port;
-    forceSSL = true;
-
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:${builtins.toString port}";
     proxyWebsockets = true;
-      recommendedProxySettings = true;
-    };
   };
 
   age-secrets.autoMatch = [ "prometheus" ];

machines/web01/crabfit/default.nix

@@ -12,25 +12,12 @@
 
   dgn-backups.postgresDatabases = [ "crabfit" ];
 
-  services.nginx =
+  dgn-web.simpleProxies = {
-    let
+    crabfit-api = {
-      cfg = config.services.crabfit;
+      inherit (config.services.crabfit.api) host port;
-    in
-    {
-      enable = true;
-
-      virtualHosts.${cfg.frontend.host} = {
-        enableACME = true;
-        forceSSL = true;
-
-        locations."/".proxyPass = "http://127.0.0.1:${builtins.toString cfg.frontend.port}";
     };
-
+    crabfit-frontend = {
-      virtualHosts.${cfg.api.host} = {
+      inherit (config.services.crabfit.frontend) host port;
-        enableACME = true;
-        forceSSL = true;
-
-        locations."/".proxyPass = "http://127.0.0.1:${builtins.toString cfg.api.port}";
     };
   };
 }

machines/web01/linkal/module.nix

@@ -101,20 +101,13 @@ in
     #   };
     # };
 
-    services.nginx = {
+    dgn-web.simpleProxies = mapAttrs' (
-      enable = true;
-
-      virtualHosts = mapAttrs' (
       name:
       { port, ... }:
-        nameValuePair "${name}.${cfg.domain}" {
+      nameValuePair "linkal-${name}" {
-          enableACME = true;
+        inherit port;
-          # acmeRoot = null; # Use DNS-01 validation
+        host = "${name}.${cfg.domain}";
-          forceSSL = true;
-
-          locations."/".proxyPass = "http://127.0.0.1:${builtins.toString port}/";
       }
     ) cfg.calendarGroups;
   };
-  };
 }

machines/web01/netbox.nix

@@ -39,17 +39,6 @@ in
         SOCIAL_AUTH_OIDC_SECRET = env["NETBOX_OIDC_SECRET"]
       '';
     };
-
-    nginx = {
-      enable = true;
-      virtualHosts."netbox.dgnum.eu" = {
-        enableACME = true;
-        forceSSL = true;
-
-        locations."/".proxyPass = "http://${config.services.netbox.listenAddress}:${builtins.toString config.services.netbox.port}";
-        locations."/static/".alias = "${config.services.netbox.dataDir}/static/";
-      };
-    };
   };
 
   systemd.services = {
@@ -69,10 +58,12 @@ in
   };
 
   users.users.nginx.extraGroups = [ "netbox" ];
-  networking.firewall.allowedTCPPorts = [
+
-    443
+  dgn-web.simpleProxies.netbox = {
-    80
+    inherit (config.services.netbox) port;
-  ];
+    host = "netbox.dgnum.eu";
+    vhostConfig.locations."/static/".alias = "${config.services.netbox.dataDir}/static/";
+  };
 
   dgn-backups.jobs.netbox.settings.paths = [ "/var/lib/netbox" ];
   dgn-backups.postgresDatabases = [ "netbox" ];

machines/web01/ntfy-sh.nix

@@ -2,6 +2,7 @@
 
 let
   host = "push.dgnum.eu";
+  port = 2586;
 in
 {
   services.ntfy-sh = {
@@ -17,15 +18,10 @@ in
     };
   };
 
-  services.nginx.virtualHosts.${host} = {
+  dgn-web.simpleProxies.ntfy-sh = {
-    enableACME = true;
+    inherit host port;
-    forceSSL = true;
-
-    locations."/" = {
-      proxyPass = "http://127.0.0.1:2586";
     proxyWebsockets = true;
   };
-  };
 
   systemd.services.ntfy-sh.serviceConfig.EnvironmentFile = [
     config.age.secrets."ntfy_sh-environment_file".path

machines/web02/cas-eleves/default.nix

@@ -9,6 +9,7 @@
 let
   inherit (lib) mapAttrsToList;
 
+  host = "cas.eleves.ens.fr";
   port = 9889;
 
   python3 =
@@ -128,8 +129,18 @@ in
 
   dgn-redirections.permanent."cas-eleves.dgnum.eu" = "cas.eleves.ens.fr";
 
-  services = {
+  dgn-web.simpleProxies.cas-eleves = {
-    postgresql = {
+    inherit host port;
+    vhostConfig = {
+      serverAliases = [ "cas-eleves.dgnum.eu" ];
+      locations = {
+        "/static/".root = staticDrv;
+        "= /robots.txt".root = "${staticDrv}/static";
+      };
+    };
+  };
+
+  services.postgresql = {
     ensureDatabases = [ "cas_server" ];
     ensureUsers = [
       {
@@ -138,18 +149,4 @@ in
       }
     ];
   };
-
-    nginx.virtualHosts."cas.eleves.ens.fr" = {
-      enableACME = true;
-      forceSSL = true;
-
-      serverAliases = [ "cas-eleves.dgnum.eu" ];
-
-      locations = {
-        "/".proxyPass = "http://127.0.0.1:${builtins.toString port}";
-        "/static/".root = staticDrv;
-        "= /robots.txt".root = "${staticDrv}/static";
-      };
-    };
-  };
 }

machines/web02/kadenios/default.nix

@@ -9,6 +9,7 @@
 let
   inherit (lib) mapAttrsToList optionals;
 
+  host = "vote.dgnum.eu";
   port = 9888;
 
   python3 =
@@ -168,8 +169,12 @@ in
     };
   };
 
-  services = {
+  dgn-web.simpleProxies.kadenios = {
-    postgresql = {
+    inherit host port;
+    vhostConfig.locations."/static/".root = staticDrv;
+  };
+
+  services.postgresql = {
     ensureDatabases = [ "kadenios" ];
     ensureUsers = [
       {
@@ -178,15 +183,4 @@ in
       }
     ];
   };
-
-    nginx.virtualHosts."vote.dgnum.eu" = {
-      enableACME = true;
-      forceSSL = true;
-
-      locations = {
-        "/".proxyPass = "http://127.0.0.1:${builtins.toString port}";
-        "/static/".root = staticDrv;
-      };
-    };
-  };
 }

modules/dgn-web.nix

@@ -1,19 +1,135 @@
 { config, lib, ... }:
 
 let
-  inherit (lib) mkEnableOption mkIf;
+  inherit (lib)
+    attrsToList
+    concatStringsSep
+    filterAttrs
+    getAttr
+    mapAttrs
+    mapAttrs'
+    mkEnableOption
+    mkIf
+    mkOption
+    nameValuePair
+    recursiveUpdate
+    ;
+
+  inherit (lib.types)
+    attrs
+    attrsOf
+    bool
+    port
+    str
+    submodule
+    ;
 
   cfg = config.dgn-web;
 in
 {
   options.dgn-web = {
     enable = mkEnableOption "sane defaults for web services.";
+
+    internalPorts = mkOption {
+      type = attrsOf port;
+      default = { };
+      description = ''
+        Map from the web services to their internal ports, it should avoid port clashes.
+      '';
+    };
+
+    simpleProxies = mkOption {
+      type = attrsOf (submodule {
+        options = {
+          port = mkOption {
+            type = port;
+            description = ''
+              Port where the service will listen.
+            '';
+          };
+
+          host = mkOption {
+            type = str;
+            description = ''
+              Hostname of the service.
+            '';
+          };
+
+          proxyWebsockets = mkOption {
+            type = bool;
+            default = false;
+            description = ''
+              Whether to support proxying websocket connections with HTTP/1.1.
+            '';
+          };
+
+          vhostConfig = mkOption {
+            type = attrs;
+            default = { };
+            description = ''
+              Additional virtualHost settings.
+            '';
+          };
+        };
+      });
+    };
   };
 
   config = mkIf cfg.enable {
+    assertions = [
+      (
+        let
+          duplicates = builtins.attrValues (
+            builtins.mapAttrs (p: serv: "${p}: ${concatStringsSep ", " serv}") (
+              filterAttrs (_: ls: builtins.length ls != 1) (
+                builtins.foldl' (
+                  rev:
+                  { name, value }:
+                  let
+                    str = builtins.toString value;
+                  in
+                  rev // { ${str} = (rev.${str} or [ ]) ++ [ name ]; }
+                ) { } (attrsToList cfg.internalPorts)
+              )
+            )
+          );
+        in
+        {
+          assertion = duplicates == [ ];
+          message = ''
+            Internal ports cannot be used for multiple services, the clashes are:
+              ${concatStringsSep "\n  " duplicates}
+          '';
+        }
+      )
+    ];
+
+    dgn-web.internalPorts = mapAttrs (_: getAttr "port") cfg.simpleProxies;
+
     services.nginx = {
       enable = true;
 
+      virtualHosts = mapAttrs' (
+        _:
+        {
+          host,
+          port,
+          proxyWebsockets,
+          vhostConfig,
+        }:
+        nameValuePair host (
+          recursiveUpdate {
+            forceSSL = true;
+            enableACME = true;
+
+            locations."/" = {
+              proxyPass = "http://127.0.0.1:${builtins.toString port}";
+              inherit proxyWebsockets;
+            };
+          } vhostConfig
+        )
+      ) cfg.simpleProxies;
+
       recommendedBrotliSettings = true;
       recommendedGzipSettings = true;
       recommendedOptimisation = true;