WARNING: This alone does not work, we need to set the real ip based on
http://nginx.org/en/docs/stream/ngx_stream_realip_module.html

Which is not feasible right now without causing an infinite loop during
eval

@@ -0,0 +1,90 @@
+{
+  pkgs,
+  lib,
+  config,

@@ -0,0 +21,4 @@
+  # Necessary until upstream cuts a new release because of 
+  # https://codeberg.org/Codeberg/pages-server/issues/235
+  # that is fixed on main
+  package = pkgs.callPackage ./codeberg-pages-custom.nix { };

@@ -0,0 +26,4 @@
+
+{
+
+  age-secrets.autoMatch = [ "pages_env_file" ];

@@ -0,0 +31,4 @@
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];

@@ -0,0 +37,4 @@
+    description = "Codeberg pages server";
+    after = [ "network.target" ];
+    wantedBy = [ "multi-user.target" ];
+    environment = settings;

@@ -0,0 +44,4 @@
+      EnvironmentFile = config.age.secrets."pages_env_file".path;
+      WorkingDirectory = "/var/lib/codeberg-pages";
+      DynamicUser = true;
+      ExecStart = "${package}/bin/pages";

@@ -0,0 +65,4 @@
+  };
+
+  services.nginx = {
+    enable = true;

@@ -0,0 +70,4 @@
+      map $ssl_preread_server_name $sni_upstream {
+        hostnames;
+        default 0.0.0.0:8010;
+      ${lib.concatStringsSep "\n" (

@@ -0,0 +71,4 @@
+        hostnames;
+        default 0.0.0.0:8010;
+      ${lib.concatStringsSep "\n" (
+        map (vhost: "  ${vhost} 0.0.0.0:8443;") (lib.attrNames config.services.nginx.virtualHosts)

@@ -0,0 +84,4 @@
+    '';
+
+    defaultSSLListenPort = 8443;
+

@@ -0,0 +86,4 @@
+    defaultSSLListenPort = 8443;
+
+  };
+

@@ -21,6 +21,7 @@
   "outline-oidc_client_secret_file"
   "outline-smtp_password_file"
   "outline-storage_secret_key_file"
+  "pages_env_file"

@@ -0,0 +48,4 @@
+      EnvironmentFile = config.age.secrets."pages-environment_file".path;
+      WorkingDirectory = "/var/lib/codeberg-pages";
+      DynamicUser = true;
+      ExecStart = "${lib.getExe package}";

@@ -0,0 +71,4 @@
+  services.nginx = {
+    streamConfig = ''
+      map $ssl_preread_server_name $sni_upstream {
+        hostnames;

@@ -0,0 +73,4 @@
+      map $ssl_preread_server_name $sni_upstream {
+        hostnames;
+        default 127.0.0.1:8010;
+      ${lib.concatMapStringsSep "\n" (vhost: "  ${vhost} 127.0.0.1:8446;") (