{ lib, config, ... }: let inherit (config.networking) domain; root_email = "contact@${domain}"; in { imports = [ ./matrix.nix ./puffer.nix ./gitea.nix ./grafana.nix ./nextcloud.nix # ./prometheus.nix # ./mjolnir.nix ./fail2ban.nix ./email.nix ./discord-matrix-bridge.nix ./mastodon.nix ./nix_cache.nix ./auth.nix ./hedgedoc.nix ./factorio.nix ]; options.serverConfig = let inherit (lib) mkOption types mkEnableOption; in { ports = mkOption { type = types.attrsOf ( types.submodule ( { ... }: { options = { port = mkOption { type = types.int; description = "port to define"; }; open = mkEnableOption "whether to open the port" // { default = true; }; }; } ) ); default = { }; description = "ports associated with services"; }; vhosts = mkOption { type = types.attrsOf ( types.submodule ( { config, ... }: let type_lookup = { proxy = { locations."/".proxyPass = "http://127.0.0.1:${builtins.toString config.port}"; }; redirect = { locations."/".return = "307 https://${domain}"; }; custom = { }; none = { }; }; in { options = { port = mkOption { type = types.int; default = 80; description = "port to redirect to this vhost"; }; host = mkOption { type = types.nonEmptyStr; description = "name if the vhost"; }; accessType = mkOption { type = types.enum (lib.attrNames type_lookup); default = "none"; description = "nginx template to use"; }; extraNginx = mkOption { type = types.attrs; default = type_lookup.${config.accessType}; description = "location definition for nginx"; }; }; } ) ); default = { }; description = "vhosts associated with services"; }; }; config = { networking.firewall.allowedTCPPorts = [ 80 443 ] ++ (lib.mapAttrsToList (n: v: v.port) (lib.filterAttrs (n: v: v.open) config.serverConfig.ports)); # ++ (lib.mapAttrsToList (n: v: v.port) (lib.filterAttrs (n: v: !v.disableWebAccess) config.serverConfig.vhosts)); services.nginx.virtualHosts = { "${domain}" = { forceSSL = true; enableACME = lib.mkForce false; # use the correct cert, not some weird one that matrix-synapse module supplies useACMEHost = domain; locations."/" = { root = "/var/www/${domain}"; }; }; } // (lib.concatMapAttrs (_: host: { "${host.host}" = { serverName = host.host; forceSSL = true; useACMEHost = domain; enableACME = lib.mkForce false; } // host.extraNginx; }) (lib.filterAttrs (n: v: v.accessType != "none") config.serverConfig.vhosts)); serverConfig = { ports = { puffer_sftp_port.port = 5657; gitea_ssh_port.port = 2222; node_exporter = { port = 9002; open = false; }; discord_matrix_bridge_port = { port = 9005; open = false; }; redis_nextcloud_port = { port = 6379; open = false; }; open_ldap_port = { port = 389; open = false; }; }; vhosts = { puffer_host = { port = 8080; host = "puffer.${domain}"; accessType = "proxy"; }; hedgedoc_host = { port = 8048; host = "hedgedoc.${domain}"; accessType = "proxy"; }; tlemap_host = { port = 8100; host = "tlemap.${domain}"; accessType = "proxy"; }; mail_host = { host = "mail.${domain}"; accessType = "redirect"; }; gitea_host = { host = "git.${domain}"; port = 8081; accessType = "proxy"; }; matrix_host = { accessType = "redirect"; host = "matrix.${domain}"; }; prometheus_host = { host = "prometheus.${domain}"; port = 9090; accessType = "redirect"; }; grafana_host = { host = "grafana.${domain}"; accessType = "proxy"; port = 8082; }; nextcloud_host = rec { host = "cloud.${domain}"; port = 8083; accessType = "custom"; extraNginx.serverName = host; }; mastodon_host = { host = "mastodon.${domain}"; }; nix_cache_host = { host = "nixcache.${domain}"; port = 5000; accessType = "proxy"; }; auth_host = { host = "auth.${domain}"; port = 38080; accessType = "proxy"; }; }; }; security.acme = { acceptTerms = true; defaults.email = root_email; certs."${domain}" = { webroot = "/var/lib/acme/acme-challenge/"; extraDomainNames = lib.mapAttrsToList (n: v: v.host) config.serverConfig.vhosts; }; }; services.nginx = { # package = pkgs.nginxStable.override { openssl = pkgs.libressl; }; enable = true; recommendedGzipSettings = true; recommendedOptimisation = true; recommendedProxySettings = true; recommendedTlsSettings = true; sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL"; }; users.users.nginx.extraGroups = [ "acme" ]; }; }