40 lines
No EOL
1.2 KiB
Nix
40 lines
No EOL
1.2 KiB
Nix
{ homelab, ... }: let
|
|
base = "proxy.${homelab.domain}";
|
|
proxyMappings = {
|
|
"dns" = { dest = "http://localhost:8088"; auth = true; };
|
|
};
|
|
in {
|
|
users.users.nginx.extraGroups = [ "acme" ];
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults.email = "admin@${homelab.domain}";
|
|
certs."${base}" = {
|
|
domain = "*.${base}";
|
|
extraDomainNames = [ base ];
|
|
dnsProvider = "cloudflare";
|
|
environmentFile = "/var/lib/acme/cloudflare.env";
|
|
# ^^^contents: CLOUDFLARE_DNS_API_TOKEN=XXXXX
|
|
};
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
recommendedProxySettings = true;
|
|
recommendedTlsSettings = true;
|
|
virtualHosts = builtins.mapAttrs (subdomain: cfg: {
|
|
forceSSL = true;
|
|
useACMEHost = base;
|
|
|
|
locations."/" = {
|
|
proxyPass = cfg.dest;
|
|
proxyWebsockets = true;
|
|
basicAuthFile = if cfg.auth then "/var/lib/nginx/.htpasswd" else null;
|
|
extraConfig = ''
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
'';
|
|
};
|
|
}) proxyMappings;
|
|
};
|
|
} |