coolneng/zion
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Revert "Set up CGM repository"

Browse Source
This commit is contained in:
coolneng
2024-07-16 19:02:25 +02:00
parent 8d6ec59a29
commit 9d600f8c95
6 changed files with 29 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
modules/webstack.nix
View File

@@ -1,5 +1,11 @@
# Web services configuration
{ config, pkgs, lib, ... }: {
{
config,
pkgs,
lib,
...
}:
{
# Reverse proxy configuration
services.nginx = {
@@ -9,8 +15,7 @@
recommendedProxySettings = true;
recommendedOptimisation = true;
clientMaxBodySize = "0";
sslCiphers =
"ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK:!AES128";
sslCiphers = "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK:!AES128";
sslProtocols = "TLSv1.2 TLSv1.3";
sslDhparam = "/var/lib/dhparams/nginx.pem";
commonHttpConfig = ''
@@ -36,10 +41,8 @@
locations = {
"/radicale/".return = "301 https://radicale.coolneng.duckdns.org";
"/syncthing/".return = "301 https://sync.coolneng.duckdns.org";
"/gitea/".extraConfig =
"rewrite ^/gitea/(.*)$ https://git.coolneng.duckdns.org/$1 last;";
"/miniflux/".extraConfig =
"rewrite ^/miniflux/(.*)$ https://rss.coolneng.duckdns.org/$1 last;";
"/gitea/".extraConfig = "rewrite ^/gitea/(.*)$ https://git.coolneng.duckdns.org/$1 last;";
"/miniflux/".extraConfig = "rewrite ^/miniflux/(.*)$ https://rss.coolneng.duckdns.org/$1 last;";
# Delegation for Matrix
"/.well-known/" = {
alias = "${../well-known}" + "/";
@@ -111,8 +114,7 @@
ssl = true;
}
];
locations."~ ^(/_matrix|/_synapse/client)".proxyPass =
"http://localhost:8008";
locations."~ ^(/_matrix|/_synapse/client)".proxyPass = "http://localhost:8008";
};
"element.coolneng.duckdns.org" = {
useACMEHost = "coolneng.duckdns.org";
@@ -165,16 +167,6 @@
proxyWebsockets = true;
};
};
"nightscout.coolneng.duckdns.org" = {
useACMEHost = "coolneng.duckdns.org";
forceSSL = true;
locations."/" = {
proxyPass = "http://localhost:1337";
extraConfig = ''
proxy_set_header X-Forwarded-For $remote_addr;
'';
};
};
};
};
@@ -188,9 +180,9 @@
webroot = "/var/lib/acme/acme-challenge";
ocspMustStaple = true;
};
certs."coolneng.duckdns.org".extraDomainNames =
lib.attrsets.mapAttrsToList (name: value: "${name}")
config.services.nginx.virtualHosts;
certs."coolneng.duckdns.org".extraDomainNames = lib.attrsets.mapAttrsToList (
name: value: "${name}"
) config.services.nginx.virtualHosts;
};
# Generate dhparams