machines/compute01/pages.nix

@@ -69,19 +69,33 @@ in
   };
 
   services.nginx = {
+    defaultListen = [
+      {
+        addr = "127.0.0.1";
+        port = 8446;
+        ssl = true;
+        proxyProtocol = true;
+      }
+      {
+        addr = "0.0.0.0";
+        ssl = false;
+      }
+    ];
     streamConfig = ''
       map $ssl_preread_server_name $sni_upstream {
-        hostnames;
         default 127.0.0.1:8010;
-      ${lib.concatMapStringsSep "\n" (vhost: "  ${vhost} 127.0.0.1:8446;") (
-        lib.attrNames config.services.nginx.virtualHosts
-      )}
+        ${
+          lib.concatMapStringsSep "\n  " (vhost: "${vhost} 127.0.0.1:8446;") (
+            lib.attrNames config.services.nginx.virtualHosts
+          )
+        }
       }
 
       server {
         listen 443;
         ssl_preread on;
         proxy_pass $sni_upstream;
+        proxy_protocol on;
       }
 
     '';