From ed3ffb4b66b21fee7c17b88ab63fc13439fa2293 Mon Sep 17 00:00:00 2001
From: Franck Cuny <franck@fcuny.net>
Date: Thu, 17 Jul 2025 07:35:07 -0700
Subject: build and deploy my personal website on the VM

---
 nix/modules/fcuny-net.nix | 70 +++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 nix/modules/fcuny-net.nix

(limited to 'nix/modules/fcuny-net.nix')

diff --git a/nix/modules/fcuny-net.nix b/nix/modules/fcuny-net.nix
new file mode 100644
index 0000000..eb5bf95
--- /dev/null
+++ b/nix/modules/fcuny-net.nix
@@ -0,0 +1,70 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}:
+
+let
+  cfg = config.services.fcuny-net;
+
+  # Import your site - you'll need to adjust the path relative to this module
+  fcunyNet = import ../../src/fcuny.net { inherit pkgs; };
+in
+{
+  options.services.fcuny-net = {
+    enable = lib.mkEnableOption "fcuny.net static site";
+
+    domain = lib.mkOption {
+      type = lib.types.str;
+      default = "fcuny.net";
+      description = "Domain name for the site";
+    };
+
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 80;
+      description = "Port to serve the site on";
+    };
+
+    enableSSL = lib.mkOption {
+      type = lib.types.bool;
+      default = false;
+      description = "Enable SSL/TLS with Let's Encrypt";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.nginx = {
+      enable = true;
+      virtualHosts.${cfg.domain} = {
+        root = fcunyNet.site;
+
+        # SSL configuration
+        enableACME = cfg.enableSSL;
+        forceSSL = cfg.enableSSL;
+
+        locations."/" = {
+          tryFiles = "$uri $uri/ =404";
+        };
+
+        extraConfig = ''
+          # Cache static assets
+          location ~* \.(css|js|png|jpg|jpeg|gif|ico|svg)$ {
+            expires 1y;
+            add_header Cache-Control "public, immutable";
+          }
+        '';
+      };
+    };
+
+    # Open firewall
+    networking.firewall.allowedTCPPorts = [ cfg.port ] ++ lib.optional cfg.enableSSL 443;
+
+    # ACME/Let's Encrypt setup if SSL is enabled
+    security.acme = lib.mkIf cfg.enableSSL {
+      acceptTerms = true;
+      defaults.email = "franck@fcuny.net";
+    };
+  };
+}
-- 
cgit v1.2.3