diff options
Diffstat (limited to '')
| -rw-r--r-- | machines/nixos/x86_64-linux/argonath.nix | 83 | ||||
| -rw-r--r-- | profiles/reverse-proxy.nix | 82 |
2 files changed, 83 insertions, 82 deletions
diff --git a/machines/nixos/x86_64-linux/argonath.nix b/machines/nixos/x86_64-linux/argonath.nix index 63ff2c9..a67054a 100644 --- a/machines/nixos/x86_64-linux/argonath.nix +++ b/machines/nixos/x86_64-linux/argonath.nix @@ -2,34 +2,8 @@ config, lib, adminUser, - pkgs, ... }: -let - mkWebfinger = config: file: pkgs.writeTextDir file (lib.generators.toJSON { } config); - mkWebfingers = - { subject, ... }@config: - map (mkWebfinger config) [ - subject - (lib.escapeURL subject) - ]; - webfingerRoot = pkgs.symlinkJoin { - name = "felschr.com-webfinger"; - paths = lib.flatten ( - builtins.map mkWebfingers [ - { - subject = "acct:franck@fcuny.net"; - links = [ - { - rel = "http://openid.net/specs/connect/1.0/issuer"; - href = "https://auth.fcuny.net"; - } - ]; - } - ] - ); - }; -in { imports = [ ../../../profiles/acme.nix @@ -38,6 +12,7 @@ in ../../../profiles/disk/basic-vm.nix ../../../profiles/hardware/do-droplet.nix ../../../profiles/home-manager.nix + ../../../profiles/reverse-proxy.nix ../../../profiles/server.nix ]; @@ -68,62 +43,6 @@ in networking.firewall.trustedInterfaces = [ "wg0" ]; networking.firewall.allowedUDPPorts = [ 51871 ]; - networking.firewall.allowedTCPPorts = [ - 80 - 443 - ]; - - services.nginx = { - enable = true; - recommendedProxySettings = true; - recommendedGzipSettings = true; - recommendedOptimisation = true; - recommendedTlsSettings = true; - virtualHosts = { - "code.fcuny.net" = { - enableACME = true; - acmeRoot = null; - forceSSL = true; - locations."/" = { - proxyPass = "http://10.100.0.60"; - }; - }; - "auth.fcuny.net" = { - enableACME = true; - acmeRoot = null; - forceSSL = true; - locations."/" = { - proxyPass = "http://10.100.0.60:9092"; - }; - }; - "reader.fcuny.net" = { - enableACME = true; - acmeRoot = null; - forceSSL = true; - locations."/".proxyPass = "http://10.100.0.60:8002"; - }; - "fcuny.net" = { - enableACME = true; - acmeRoot = null; - forceSSL = true; - locations."/" = { - proxyPass = "http://10.100.0.60:8070"; - }; - locations."/.well-known/webfinger" = { - root = webfingerRoot; - extraConfig = '' - add_header Access-Control-Allow-Origin "*"; - default_type "application/jrd+json"; - types { application/jrd+json json; } - if ($arg_resource) { - rewrite ^(.*)$ /$arg_resource break; - } - ''; - }; - }; - }; - }; - system.stateVersion = "25.05"; # Did you read the comment? home-manager = { diff --git a/profiles/reverse-proxy.nix b/profiles/reverse-proxy.nix new file mode 100644 index 0000000..dd98ff2 --- /dev/null +++ b/profiles/reverse-proxy.nix @@ -0,0 +1,82 @@ +{ + pkgs, + lib, + ... +}: +let + httpHost = "10.100.0.60"; + mkWebfinger = config: file: pkgs.writeTextDir file (lib.generators.toJSON { } config); + mkWebfingers = + { subject, ... }@config: + map (mkWebfinger config) [ + subject + (lib.escapeURL subject) + ]; + webfingerRoot = pkgs.symlinkJoin { + name = "felschr.com-webfinger"; + paths = lib.flatten ( + builtins.map mkWebfingers [ + { + subject = "acct:franck@fcuny.net"; + links = [ + { + rel = "http://openid.net/specs/connect/1.0/issuer"; + href = "https://auth.fcuny.net"; + } + ]; + } + ] + ); + }; +in +{ + networking.firewall.allowedTCPPorts = [ + 80 + 443 + ]; + + services.nginx = { + enable = true; + recommendedProxySettings = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedTlsSettings = true; + virtualHosts = { + "code.fcuny.net" = { + enableACME = true; + acmeRoot = null; + forceSSL = true; + locations."/".proxyPass = "http://${httpHost}"; + }; + "auth.fcuny.net" = { + enableACME = true; + acmeRoot = null; + forceSSL = true; + locations."/".proxyPass = "http://${httpHost}:9092"; + }; + "reader.fcuny.net" = { + enableACME = true; + acmeRoot = null; + forceSSL = true; + locations."/".proxyPass = "http://${httpHost}:8002"; + }; + "fcuny.net" = { + enableACME = true; + acmeRoot = null; + forceSSL = true; + locations."/".proxyPass = "http://${httpHost}:8070"; + locations."/.well-known/webfinger" = { + root = webfingerRoot; + extraConfig = '' + add_header Access-Control-Allow-Origin "*"; + default_type "application/jrd+json"; + types { application/jrd+json json; } + if ($arg_resource) { + rewrite ^(.*)$ /$arg_resource break; + } + ''; + }; + }; + }; + }; +} |