nixfiles-emily/config/hosts/web02/configuration.nix

{ config, inputs, pkgs, lib, ... }: 
let 
  bmpPort = 11019;
  extraConfig = ''
    add_header Strict-Transport-Security 	$hsts_header;
    #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
    add_header X-Content-Type-Options 	"nosniff" always;
    add_header X-XSS-Protection 		"1; mode=block" always;
    add_header X-Frame-Options 		"SAMEORIGIN" always;
    add_header Referrer-Policy 		"same-origin" always;
  '';
  autoIndex = ''
    autoindex on;
    autoindex_exact_size off;
    autoindex_format html;
    autoindex_localtime on;
  '';
in { 
  networking = {
    hostName = "web02";
    firewall.allowedTCPPorts = [ 80 443 bmpPort ];
    firewall.allowedUDPPorts = [ 443 ];
  };
  systemd.network.networks."98-eth-default" = {
    address = [
      "2a0f:be01:0:100::1312/128" 
    ];
  };
  users.users."lg" = {
    isSystemUser = true;
    createHome = true;
    home = "/var/www/lg.kyouma.net";
    group = "lg";
  };
  users.groups."lg" = {};
  services.vnstat.enable = true;
  services.fernglas = {
    enable = true;
    settings = {
      api.bind = "[::1]:3000";
      collectors = {
        bmp_collector = {
          collector_type = "Bmp";
          bind = "[::]:${toString bmpPort}";
          peers = {
            "45.150.123.0" = {};
          };
        };
      }; 
    };
  };
  services.nginx = {
    package = pkgs.nginxQuic;
    enable = true;
    
    recommendedOptimisation = true;
    recommendedTlsSettings = true;
    recommendedGzipSettings = true;
    sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
    sslProtocols = "TLSv1.3";
    clientMaxBodySize = "0";
    
    appendHttpConfig = ''
      map $scheme $hsts_header {
          https   "max-age=31536000; includeSubdomains; preload";
      }
      ${extraConfig}
    '';

    createHost = {
      "miau.zip" = { root = "/var/www/kyouma.net"; };
      "www.miau.zip" = { redirectTo = "miau.zip"; };
      "www.kyouma.net" = { redirectTo = "kyouma.net"; };
      "emily.cat" = { root = "/var/www/emily.cat/_site"; };
      "www.emily.cat" = { redirectTo = "kyouma.net"; };
      "www.cocaine.trade" = { redirectTo = "cocaine.trade"; };

      "redirect" = {
        default = true;
        reuseport = true;
        useACMEHost = "kyouma.net";
        extraConfig = ''
          return 403;
        '';
      };
      "cocaine.trade" = {
        root = "/var/www/cocaine.trade";
        extraConfig = ''error_page 404 /404.html;'';
        locations."/" = {
          index = "index.html";
          tryFiles = "$uri $uri.html =404";
        };
        locations."= /".extraConfig = ''rewrite ^ /index.html last;'';
      };
      "files.cocaine.trade" = {
        useACMEHost = "cocaine.trade";
        root = "/mnt/basti/files.cocaine.trade";
        locations."/".extraConfig = autoIndex;
      };
      "kyouma.net" = {
        root = "/var/www/kyouma.net";
        locations = {
          "/ihk/".extraConfig = autoIndex;
          "/vyos/".extraConfig = autoIndex;
          "/3ds/".extraConfig = autoIndex;
        };
      };
      "lg.kyouma.net" = {
        useACMEHost = "kyouma.net";
        locations."/".root = inputs.fernglas.packages.${config.nixpkgs.hostPlatform.system}.fernglas-frontend;
        locations."/api/".proxyPass = "http://${config.services.fernglas.settings.api.bind}";
      };
    };
  };
  security.acme = {
    acceptTerms = true;
    defaults = {
      keyType = "ec384";
      email = "noc@kyouma.net";
    };
    certs = {
      "miau.zip" = { extraDomainNames = [ "www.miau.zip" "lg.miau.zip" ]; };
      "kyouma.net" = { extraDomainNames = [ "www.kyouma.net" "lg.kyouma.net" ]; };
      "emily.cat" = { extraDomainNames = [ "www.emily.cat" ]; };
      "cocaine.trade" = { extraDomainNames = [ "www.cocaine.trade" "files.cocaine.trade" ]; };
    };
  };
}