Refactor nginx configuration

configuration.nix

@@ -4,8 +4,12 @@
 
   # A bunch of boot parameters needed for optimal runtime on RPi 4B
   boot.kernelPackages = pkgs.linuxPackages_rpi4;
-  boot.kernelParams =
+  boot.kernelParams = [
-    [ "zfs.zfs_arc_max=134217728" "console=TTYAMA0,115200" "console=tty1" ];
+    "zfs.zfs_arc_max=134217728"
+    "console=TTYAMA0,115200"
+    "console=tty1"
+    "8250.nr_uarts=1"
+  ];
   boot.loader.raspberryPi = {
     enable = true;
     version = 4;

modules/hardware-configuration.nix

@@ -16,6 +16,11 @@
     fsType = "ext4";
   };
 
+  fileSystems."/boot" = {
+    device = "/dev/disk/by-uuid/2178-694E";
+    fsType = "vfat";
+  };
+
   fileSystems."/vault" = {
     device = "vault";
     fsType = "zfs";

modules/webstack.nix

@@ -23,9 +23,6 @@
       }
       add_header Strict-Transport-Security $hsts_header;
 
-      # Enable CSP for your services.
-      #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
-
       # Minimize information leaked to other domains
       add_header 'Referrer-Policy' 'origin-when-cross-origin';
 
@@ -46,18 +43,13 @@
       "coolneng.duckdns.org" = {
         enableACME = true;
         forceSSL = true;
-        locations."/radicale/" = {
+        # Redirect from legacy subdirectory URL to subdomain
-          return = "301 https://radicale.coolneng.duckdns.org";
+        locations = {
-        };
+          "/radicale/".return = "301 https://radicale.coolneng.duckdns.org";
-        locations."/syncthing/" = {
+          "/syncthing/".return = "301 https://sync.coolneng.duckdns.org";
-          return = "301 https://sync.coolneng.duckdns.org";
+          "/gitea/".extraConfig =
-        };
-        locations."/gitea/" = {
-          extraConfig =
             "rewrite ^/gitea/(.*)$ https://git.coolneng.duckdns.org/$1 last;";
-        };
+          "/miniflux/".extraConfig =
-        locations."/miniflux/" = {
-          extraConfig =
             "rewrite ^/miniflux/(.*)$ https://rss.coolneng.duckdns.org/$1 last;";
         };
       };
@@ -75,17 +67,17 @@
       "sync.coolneng.duckdns.org" = {
         enableACME = true;
         forceSSL = true;
-        locations."/" = { proxyPass = "http://localhost:8384/"; };
+        locations."/".proxyPass = "http://localhost:8384/";
       };
       "git.coolneng.duckdns.org" = {
         enableACME = true;
         forceSSL = true;
-        locations."/" = { proxyPass = "http://localhost:3000/"; };
+        locations."/".proxyPass = "http://localhost:3000/";
       };
       "rss.coolneng.duckdns.org" = {
         enableACME = true;
         forceSSL = true;
-        locations."/" = { proxyPass = "http://localhost:8080/"; };
+        locations."/".proxyPass = "http://localhost:8080/";
       };
       "matrix.coolneng.duckdns.org" = {
         enableACME = true;