mikael/nixfiles-emily
1
0
Fork 0
forked from emily/nixfiles
Code Pull requests Activity

moved things around mainly nginx

Browse source
This commit is contained in:
emily 2024-01-10 13:30:05 +01:00
parent 3b30956d9e
commit 5f8473d38c
Signed by untrusted user: emily
GPG key ID: F6F4C66207FCF995
4 changed files with 91 additions and 65 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

46
config/hosts/web02/configuration.nix
View file

@ -1,14 +1,6 @@
{ config, inputs, pkgs, lib, ... }:
{ config, pkgs, lib, fernglas, ... }:
let
bmpPort = 11019;
extraConfig = ''
add_header Strict-Transport-Security $hsts_header;
#add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header Referrer-Policy "same-origin" always;
'';
autoIndex = ''
autoindex on;
autoindex_exact_size off;
@ -50,23 +42,6 @@ in {
};
};
services.nginx = {
package = pkgs.nginxQuic;
enable = true;
recommendedOptimisation = true;
recommendedTlsSettings = true;
recommendedGzipSettings = true;
sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL";
sslProtocols = "TLSv1.3";
clientMaxBodySize = "0";
appendHttpConfig = ''
map $scheme $hsts_header {
https "max-age=31536000; includeSubdomains; preload";
}
${extraConfig}
'';
createHost = {
"miau.zip" = { root = "/var/www/kyouma.net"; };
"www.miau.zip" = { redirectTo = "miau.zip"; };
@ -107,22 +82,15 @@ in {
};
"lg.kyouma.net" = {
useACMEHost = "kyouma.net";
locations."/".root = inputs.fernglas.packages.${config.nixpkgs.hostPlatform.system}.fernglas-frontend;
locations."/".root = fernglas.packages.${config.nixpkgs.hostPlatform.system}.fernglas-frontend;
locations."/api/".proxyPass = "http://${config.services.fernglas.settings.api.bind}";
};
};
};
security.acme = {
acceptTerms = true;
defaults = {
keyType = "ec384";
email = "noc@kyouma.net";
};
certs = {
"miau.zip" = { extraDomainNames = [ "www.miau.zip" "lg.miau.zip" ]; };
"kyouma.net" = { extraDomainNames = [ "www.kyouma.net" "lg.kyouma.net" ]; };
"emily.cat" = { extraDomainNames = [ "www.emily.cat" ]; };
"cocaine.trade" = { extraDomainNames = [ "www.cocaine.trade" "files.cocaine.trade" ]; };
};
security.acme.certs = {
"miau.zip" = { extraDomainNames = [ "www.miau.zip" "lg.miau.zip" ]; };
"kyouma.net" = { extraDomainNames = [ "www.kyouma.net" "lg.kyouma.net" ]; };
"emily.cat" = { extraDomainNames = [ "www.emily.cat" ]; };
"cocaine.trade" = { extraDomainNames = [ "www.cocaine.trade" "files.cocaine.trade" ]; };
};
}

17
config/lxc.nix
View file

@ -1,17 +0,0 @@
{ config, pkgs, lib, modulesPath, ... }:
with lib; {
imports = [
(modulesPath + "/virtualisation/proxmox-lxc.nix")
];
proxmoxLXC = {
manageNetwork = true;
manageHostName = true;
};
networking.useDHCP = false;
system.autoUpgrade.enable = true;
nix.optimise.automatic = true;
nix.gc.automatic = true;
nix.gc.options = "--delete-older-than 2d";
}

81
flake.lock
View file

@ -1,5 +1,42 @@
{
"nodes": {
"fernglas": {
"inputs": {
"flake-utils": "flake-utils",
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1703863936,
"narHash": "sha256-sy+rSQ1NMUf5Rhoi0waBgBh+vj98ADjrROSkBG4EFWY=",
"owner": "wobcom",
"repo": "fernglas",
"rev": "eef7c251904c9c39eacb0d680474901af4b7a9b4",
"type": "github"
},
"original": {
"owner": "wobcom",
"repo": "fernglas",
"type": "github"
}
},
"flake-utils": {
"inputs": {
"systems": "systems"
},
"locked": {
"lastModified": 1694529238,
"narHash": "sha256-zsNZZGTGnMOf9YpHKJqMSsa0dXbfmxeoJ7xHlrt+xmY=",
"owner": "numtide",
"repo": "flake-utils",
"rev": "ff7b65b44d01cf9ba6a71320833626af21126384",
"type": "github"
},
"original": {
"owner": "numtide",
"repo": "flake-utils",
"type": "github"
}
},
"nixos-hardware": {
"locked": {
"lastModified": 1704786394,
@ -17,15 +54,31 @@
},
"nixpkgs": {
"locked": {
"lastModified": 1704538339,
"narHash": "sha256-1734d3mQuux9ySvwf6axRWZRBhtcZA9Q8eftD6EZg6U=",
"owner": "nixos",
"lastModified": 1699099776,
"narHash": "sha256-X09iKJ27mGsGambGfkKzqvw5esP1L/Rf8H3u3fCqIiU=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "46ae0210ce163b3cba6c7da08840c1d63de9c701",
"rev": "85f1ba3e51676fa8cc604a3d863d729026a6b8eb",
"type": "github"
},
"original": {
"owner": "nixos",
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
}
},
"nixpkgs_2": {
"locked": {
"lastModified": 1704722960,
"narHash": "sha256-mKGJ3sPsT6//s+Knglai5YflJUF2DGj7Ai6Ynopz0kI=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "317484b1ead87b9c1b8ac5261a8d2dd748a0492d",
"type": "github"
},
"original": {
"owner": "NixOS",
"ref": "nixos-unstable",
"repo": "nixpkgs",
"type": "github"
@ -33,8 +86,24 @@
},
"root": {
"inputs": {
"fernglas": "fernglas",
"nixos-hardware": "nixos-hardware",
"nixpkgs": "nixpkgs"
"nixpkgs": "nixpkgs_2"
}
},
"systems": {
"locked": {
"lastModified": 1681028828,
"narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
"owner": "nix-systems",
"repo": "default",
"rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
"type": "github"
},
"original": {
"owner": "nix-systems",
"repo": "default",
"type": "github"
}
}
},

12
flake.nix
View file

@ -1,12 +1,17 @@
{
description = "emilys config hell";
inputs = {
nixpkgs.url = "github:nixos/nixpkgs/nixos-unstable";
nixpkgs = {
type = "github";
owner = "NixOS";
repo = "nixpkgs";
ref = "nixos-unstable";
};
nixos-hardware.url = "github:nixos/nixos-hardware";
fernglas.url = "github:wobcom/fernglas";
};
outputs = { self, nixpkgs, nixos-hardware, ... }@attrs: {
outputs = { self, nixpkgs, nixos-hardware, fernglas, ... }@attrs: {
nixosConfigurations = {
web02 = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
@ -14,7 +19,8 @@
modules = [
fernglas.nixosModules.default
./config/common
./config/lxc.nix
./config/common-lxc.nix
./config/common-nginx.nix
./config/hosts/web02/configuration.nix
];
};