116 lines
No EOL
3.9 KiB
Nix
116 lines
No EOL
3.9 KiB
Nix
{ homelab, lib, ... }: let
|
|
base = "proxy.${homelab.domain}";
|
|
hosts = {
|
|
"server" = { dest = "https://server.dns.${homelab.domain}:8006"; auth = false; };
|
|
"router" = { dest = "http://router.dns.${homelab.domain}:80"; auth = false; };
|
|
"home" = { dest = "http://home.dns.${homelab.domain}:8123"; auth = false; };
|
|
|
|
# "dynamic" = { dest = "http://127.0.0.1:8080"; auth = true; };
|
|
"dns" = { dest = "http://localhost:8088"; auth = true; };
|
|
|
|
"containers" = { dest = "http://localhost:5001"; auth = false; };
|
|
"gallery" = { dest = "http://localhost:2283"; auth = false; };
|
|
"remote" = { dest = "http://localhost:8085"; auth = false; };
|
|
"media" = { dest = "http://localhost:8096"; auth = false; };
|
|
"pass" = { dest = "http://localhost:8060"; auth = false; };
|
|
"auth" = { dest = "http://localhost:1411"; auth = false; };
|
|
"git" = { dest = "http://localhost:5080"; auth = false; };
|
|
"ai" = { dest = "http://localhost:8080"; auth = false; };
|
|
"@" = { dest = "http://localhost:5070"; auth = false; };
|
|
};
|
|
redirects = {
|
|
"www" = "https://proxy.${homelab.domain}";
|
|
"dash" = "https://${homelab.domain}";
|
|
"immich" = "https://gallery.proxy${homelab.domain}";
|
|
};
|
|
exta-conf = ''
|
|
proxy_set_header Upgrade $http_upgrade;
|
|
proxy_set_header Connection "upgrade";
|
|
# proxy_set_header X-Auth-User $remote_user;
|
|
proxy_read_timeout 600s;
|
|
proxy_send_timeout 600s;
|
|
proxy_buffering off;
|
|
proxy_cache off;
|
|
send_timeout 600s;
|
|
client_max_body_size 50000M;
|
|
'';
|
|
in {
|
|
users.users = {
|
|
nginx.extraGroups = [ "acme" ];
|
|
traefik.extraGroups = [ "docker" ];
|
|
};
|
|
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults.email = "admin@${homelab.domain}";
|
|
certs."${base}" = {
|
|
domain = "*.${base}";
|
|
extraDomainNames = [ base ];
|
|
dnsProvider = "cloudflare";
|
|
environmentFile = "/var/lib/acme/cloudflare.env";
|
|
# ^^^contents: CLOUDFLARE_DNS_API_TOKEN=XXXXX
|
|
};
|
|
};
|
|
|
|
services = {
|
|
nginx = {
|
|
enable = true;
|
|
recommendedProxySettings = true;
|
|
recommendedTlsSettings = true;
|
|
virtualHosts = {
|
|
"_" = {
|
|
default = true;
|
|
forceSSL = true;
|
|
useACMEHost = base;
|
|
# locations."/".return = "404";
|
|
locations."/" = {
|
|
proxyPass = "http://127.0.0.1:81"; # traefik for docker container dynamic proxy
|
|
proxyWebsockets = true;
|
|
extraConfig = ''
|
|
proxy_set_header Host $host;
|
|
'' + exta-conf;
|
|
};
|
|
};
|
|
} // lib.mapAttrs' (subdomain: cfg: lib.nameValuePair "${subdomain}.${base}" {
|
|
useACMEHost = base;
|
|
forceSSL = true;
|
|
locations."/".return = "301 ${base}";
|
|
}) redirects // lib.mapAttrs' (subdomain: cfg: lib.nameValuePair (if subdomain == "@" then base else "${subdomain}.${base}") {
|
|
useACMEHost = base;
|
|
forceSSL = true;
|
|
extraConfig = ''
|
|
access_log /var/log/nginx/${subdomain}.access.log;
|
|
error_log /var/log/nginx/${subdomain}.error.log;
|
|
'';
|
|
locations."/" = {
|
|
proxyPass = cfg.dest;
|
|
proxyWebsockets = true;
|
|
basicAuthFile = if cfg.auth then "/var/lib/nginx/.htpasswd" else null;
|
|
extraConfig = exta-conf;
|
|
};
|
|
}) hosts;
|
|
};
|
|
traefik = {
|
|
enable = true;
|
|
staticConfigOptions = {
|
|
entryPoints.web = {
|
|
address = "127.0.0.1:81";
|
|
forwardedHeaders.trustedIPs = [ "127.0.0.1/32" ];
|
|
};
|
|
# api = {
|
|
# dashboard = true;
|
|
# insecure = true;
|
|
# };
|
|
global = {
|
|
checkNewVersion = false;
|
|
sendAnonymousUsage = false;
|
|
};
|
|
providers.docker = {
|
|
endpoint = "unix:///var/run/docker.sock";
|
|
exposedByDefault = false;
|
|
defaultRule = "Host(`ct-{{ normalize .Name }}.${base}`)";
|
|
};
|
|
};
|
|
};
|
|
};
|
|
} |