diff options
| -rw-r--r-- | flake.nix | 2 | ||||
| -rw-r--r-- | nix/lib/mkSystem.nix | 5 | ||||
| -rw-r--r-- | nix/machines/vm-synology/default.nix | 1 | ||||
| -rw-r--r-- | nix/machines/vm-synology/nginx.nix | 10 | ||||
| -rw-r--r-- | nix/modules/default.nix | 4 | ||||
| -rw-r--r-- | nix/modules/fcuny-net.nix | 70 | ||||
| -rw-r--r-- | src/fcuny.net/default.nix | 30 |
7 files changed, 92 insertions, 30 deletions
@@ -151,6 +151,8 @@ }; in { + nixosModules = import ./nix/modules; + packages = forAllSystems ( system: let diff --git a/nix/lib/mkSystem.nix b/nix/lib/mkSystem.nix index ba9a46a..e96e1ef 100644 --- a/nix/lib/mkSystem.nix +++ b/nix/lib/mkSystem.nix @@ -42,7 +42,10 @@ systemFunc rec { inputs.agenix.nixosModules.default ] - ++ nixpkgs.lib.optional (!darwin) inputs.disko.nixosModules.disko + ++ nixpkgs.lib.optional (!darwin) [ + (import ../modules/fcuny-net.nix) + inputs.disko.nixosModules.disko + ] ++ [ { # https://github.com/nix-darwin/nix-darwin/issues/1339 diff --git a/nix/machines/vm-synology/default.nix b/nix/machines/vm-synology/default.nix index 966d173..ec508d8 100644 --- a/nix/machines/vm-synology/default.nix +++ b/nix/machines/vm-synology/default.nix @@ -22,6 +22,7 @@ ./git.nix ./hardware.nix ./ingress.nix + ./nginx.nix ../common/network.nix ]; diff --git a/nix/machines/vm-synology/nginx.nix b/nix/machines/vm-synology/nginx.nix new file mode 100644 index 0000000..2c3b7fb --- /dev/null +++ b/nix/machines/vm-synology/nginx.nix @@ -0,0 +1,10 @@ +{ + ... +}: +{ + services.fcuny-net = { + enable = true; + domain = "fcuny.net"; + enableSSL = false; # Enable if you want HTTPS + }; +} diff --git a/nix/modules/default.nix b/nix/modules/default.nix new file mode 100644 index 0000000..3314156 --- /dev/null +++ b/nix/modules/default.nix @@ -0,0 +1,4 @@ +{ + fcuny-net = import ./fcuny-net.nix; + # Add other modules here as you create them +} diff --git a/nix/modules/fcuny-net.nix b/nix/modules/fcuny-net.nix new file mode 100644 index 0000000..eb5bf95 --- /dev/null +++ b/nix/modules/fcuny-net.nix @@ -0,0 +1,70 @@ +{ + config, + lib, + pkgs, + ... +}: + +let + cfg = config.services.fcuny-net; + + # Import your site - you'll need to adjust the path relative to this module + fcunyNet = import ../../src/fcuny.net { inherit pkgs; }; +in +{ + options.services.fcuny-net = { + enable = lib.mkEnableOption "fcuny.net static site"; + + domain = lib.mkOption { + type = lib.types.str; + default = "fcuny.net"; + description = "Domain name for the site"; + }; + + port = lib.mkOption { + type = lib.types.port; + default = 80; + description = "Port to serve the site on"; + }; + + enableSSL = lib.mkOption { + type = lib.types.bool; + default = false; + description = "Enable SSL/TLS with Let's Encrypt"; + }; + }; + + config = lib.mkIf cfg.enable { + services.nginx = { + enable = true; + virtualHosts.${cfg.domain} = { + root = fcunyNet.site; + + # SSL configuration + enableACME = cfg.enableSSL; + forceSSL = cfg.enableSSL; + + locations."/" = { + tryFiles = "$uri $uri/ =404"; + }; + + extraConfig = '' + # Cache static assets + location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg)$ { + expires 1y; + add_header Cache-Control "public, immutable"; + } + ''; + }; + }; + + # Open firewall + networking.firewall.allowedTCPPorts = [ cfg.port ] ++ lib.optional cfg.enableSSL 443; + + # ACME/Let's Encrypt setup if SSL is enabled + security.acme = lib.mkIf cfg.enableSSL { + acceptTerms = true; + defaults.email = "franck@fcuny.net"; + }; + }; +} diff --git a/src/fcuny.net/default.nix b/src/fcuny.net/default.nix index b34bfe0..6ace901 100644 --- a/src/fcuny.net/default.nix +++ b/src/fcuny.net/default.nix @@ -17,7 +17,6 @@ let buildPhase = '' zola build - lychee docs/*.html ''; installPhase = '' @@ -31,36 +30,9 @@ let cd src/fcuny.net ${pkgs.zola}/bin/zola serve --interface 0.0.0.0 --port 1111 ''; - - # Nginx configuration - nginxConfig = pkgs.writeText "fcuny-net.conf" '' - server { - listen 80; - server_name fcuny.net; - - root ${site}; - index index.html; - - location / { - try_files $uri $uri/ =404; - } - - # Optional: Add some basic security headers - add_header X-Frame-Options "SAMEORIGIN" always; - add_header X-Content-Type-Options "nosniff" always; - add_header X-XSS-Protection "1; mode=block" always; - - # Cache static assets - location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg)$ { - expires 1y; - add_header Cache-Control "public, immutable"; - } - } - ''; - in { - inherit site serve nginxConfig; + inherit site serve; # Make site the default output default = site; |