glennwso/nixos-selfhost
1
0
Fork 0
Code Issues 2 Pull requests Packages Projects Releases Wiki Activity

defer tls/ssl to hyperserver

Browse source
This commit is contained in:
glenn 2025-01-14 15:17:47 +01:00
parent f57f9a37f6
commit 5f7cb33867
12 changed files with 50 additions and 82 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
ai.nix
View file

@ -9,8 +9,6 @@
in { in {
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
${domain} = { ${domain} = {
forceSSL = true;
enableACME = true;
locations."/" = { locations."/" = {
proxyPass = "http://localhost:9876/"; proxyPass = "http://localhost:9876/";
proxyWebsockets = true; proxyWebsockets = true;

13
audiobooks.nix
View file

@ -1,19 +1,13 @@
{ ... }: {...}: let
let
domain = "books.sondell.org"; domain = "books.sondell.org";
in in {
{ #
#
services.audiobookshelf = { services.audiobookshelf = {
enable = true; enable = true;
port = 8000; port = 8000;
}; };
services.nginx.virtualHosts.${domain} = { services.nginx.virtualHosts.${domain} = {
forceSSL = true;
enableACME = true;
default = true; default = true;
locations."/" = { locations."/" = {
proxyPass = "http://localhost:8000/"; proxyPass = "http://localhost:8000/";
@ -21,4 +15,3 @@ in
}; };
}; };
} }

22
coturn.nix
View file

@ -44,23 +44,22 @@
# open the firewall # open the firewall
networking.firewall = { networking.firewall = {
interfaces.enp2s0 = let interfaces.enp2s0 = let
range = with config.services.coturn; [ { range = with config.services.coturn; [
from = min-port; {
to = max-port; from = min-port;
} ]; to = max-port;
in }
{ ];
in {
allowedUDPPortRanges = range; allowedUDPPortRanges = range;
allowedUDPPorts = [ 3478 5349 ]; allowedUDPPorts = [3478 5349];
allowedTCPPortRanges = [ ]; allowedTCPPortRanges = [];
allowedTCPPorts = [ 3478 5349 ]; allowedTCPPorts = [3478 5349];
}; };
}; };
services.nginx = { services.nginx = {
enable = true; enable = true;
virtualHosts."turn.sondell.org" = { virtualHosts."turn.sondell.org" = {
forceSSL = true;
enableACME = true;
}; };
}; };
# get a certificate # get a certificate
@ -82,4 +81,3 @@
]; ];
}; };
} }

2
dufs.nix
View file

@ -36,8 +36,6 @@ in {
}; };
}; };
services.nginx.virtualHosts.${domain} = { services.nginx.virtualHosts.${domain} = {
forceSSL = true;
enableACME = true;
locations."/" = { locations."/" = {
proxyPass = "http://localhost:${port}/"; proxyPass = "http://localhost:${port}/";
proxyWebsockets = true; proxyWebsockets = true;

2
ebooks.nix
View file

@ -17,8 +17,6 @@ in {
}; };
services.nginx.virtualHosts.${domain} = { services.nginx.virtualHosts.${domain} = {
forceSSL = true;
enableACME = true;
locations."/" = { locations."/" = {
proxyPass = "http://localhost:${toString port}/"; proxyPass = "http://localhost:${toString port}/";
proxyWebsockets = true; proxyWebsockets = true;

2
filebrowser.nix
View file

@ -35,8 +35,6 @@ in {
}; };
services.nginx.virtualHosts.${domain} = { services.nginx.virtualHosts.${domain} = {
forceSSL = true;
enableACME = true;
locations."/" = { locations."/" = {
proxyPass = "http://localhost:8080/"; proxyPass = "http://localhost:8080/";
proxyWebsockets = true; proxyWebsockets = true;

2
forgejo.nix
View file

@ -68,8 +68,6 @@ in {
}; };
services.nginx.virtualHosts.${domain} = { services.nginx.virtualHosts.${domain} = {
enableACME = true;
forceSSL = true;
locations."/" = { locations."/" = {
proxyPass = "http://localhost:3000/"; proxyPass = "http://localhost:3000/";
}; };

2
homepage.nix
View file

@ -3,8 +3,6 @@
domain2 = "start.sondell.org"; domain2 = "start.sondell.org";
port = "8118"; port = "8118";
hostSettings = { hostSettings = {
forceSSL = true;
enableACME = true;
locations."/" = { locations."/" = {
proxyPass = "http://localhost:${port}/"; proxyPass = "http://localhost:${port}/";
proxyWebsockets = true; proxyWebsockets = true;

15
jellyfin.nix
View file

@ -1,23 +1,16 @@
{ config, ... }: {config, ...}: let
let
domain = "jelly.sondell.org"; domain = "jelly.sondell.org";
# derp = "hi"; # derp = "hi";
in in {
{ #
#
services.jellyfin = { services.jellyfin = {
enable = true; enable = true;
}; };
services.nginx.virtualHosts.${domain} = { services.nginx.virtualHosts.${domain} = {
forceSSL = true;
enableACME = true;
locations."/" = { locations."/" = {
proxyPass = "http://localhost:8096/"; proxyPass = "http://localhost:8096/";
proxyWebsockets = true; proxyWebsockets = true;
}; };
}; };
} }

45
matrix.nix
View file

@ -1,6 +1,8 @@
{ config, pkgs, ... }: {
config,
let pkgs,
...
}: let
domain = "sondell.org"; domain = "sondell.org";
hostName = "matrix"; hostName = "matrix";
fqdn = "${hostName}.${domain}"; fqdn = "${hostName}.${domain}";
@ -12,9 +14,8 @@ let
add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON data}'; return 200 '${builtins.toJSON data}';
''; '';
in in {
{ #
#
services.matrix-synapse = { services.matrix-synapse = {
enable = true; enable = true;
settings.enable_registration = true; settings.enable_registration = true;
@ -27,33 +28,29 @@ in
type = "http"; type = "http";
tls = false; tls = false;
x_forwarded = true; x_forwarded = true;
resources = [ resources = [
{ {
names = [ "client" "federation" ]; names = ["client" "federation"];
compress = true; compress = true;
} }
]; ];
} }
]; ];
}; };
services.postgresql = {
services.postgresql = { enable = true;
enable = true; initialScript = pkgs.writeText "synapse-init.sql" ''
initialScript = pkgs.writeText "synapse-init.sql" '' CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse';
CREATE ROLE "matrix-synapse" WITH LOGIN PASSWORD 'synapse'; CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse"
CREATE DATABASE "matrix-synapse" WITH OWNER "matrix-synapse" TEMPLATE template0
TEMPLATE template0 LC_COLLATE = "C"
LC_COLLATE = "C" LC_CTYPE = "C";
LC_CTYPE = "C"; '';
''; };
};
services.nginx.virtualHosts = { services.nginx.virtualHosts = {
${fqdn} = { ${fqdn} = {
enableACME = true;
forceSSL = true;
# locations."/".extraConfig = '' # locations."/".extraConfig = ''
# return 404; # return 404;
# ''; # '';
@ -66,7 +63,6 @@ services.postgresql = {
${domain} = { ${domain} = {
enableACME = true; enableACME = true;
forceSSL = true;
# locations."/" = { # locations."/" = {
# proxyPass = "http://localhost:8008"; # proxyPass = "http://localhost:8008";
# }; # };
@ -83,4 +79,3 @@ services.postgresql = {
}; };
}; };
} }

23
nextcloud.nix
View file

@ -64,10 +64,10 @@ in {
nginx.virtualHosts = { nginx.virtualHosts = {
${domain} = { ${domain} = {
forceSSL = true; # forceSSL = true;
enableACME = true; # enableACME = true;
# Use DNS Challenege. # # Use DNS Challenege.
# acmeRoot = null; # # acmeRoot = null;
}; };
}; };
postgresql.enable = true; postgresql.enable = true;
@ -90,6 +90,9 @@ in {
# Let NixOS install and configure Redis caching automatically. # Let NixOS install and configure Redis caching automatically.
configureRedis = true; configureRedis = true;
settings = { settings = {
trusted_proxies = [
"192.168.1.199"
];
maintenance_window_start = 1; maintenance_window_start = 1;
}; };
extraOptions = { extraOptions = {
@ -112,7 +115,7 @@ in {
inherit mail calendar contacts notes onlyoffice cookbook spreed memories previewgenerator; inherit mail calendar contacts notes onlyoffice cookbook spreed memories previewgenerator;
}; };
config = { config = {
overwriteProtocol = "https"; # overwriteProtocol = "https";
defaultPhoneRegion = "SE"; defaultPhoneRegion = "SE";
dbtype = "pgsql"; dbtype = "pgsql";
adminuser = "admin"; adminuser = "admin";
@ -137,9 +140,9 @@ in {
hostname = "office.sondell.org"; hostname = "office.sondell.org";
jwtSecretFile = "/etc/nixos/.secrets/onlyoffice.jwt"; jwtSecretFile = "/etc/nixos/.secrets/onlyoffice.jwt";
}; };
services.nginx.virtualHosts."office.sondell.org" = { # services.nginx.virtualHosts."office.sondell.org" = {
forceSSL = true; # forceSSL = true;
enableACME = true; # enableACME = true;
# locations."/".proxyPass = "http://12:8123"; # # locations."/".proxyPass = "http://12:8123";
}; # };
} }

2
vaultwarden.nix
View file

@ -31,8 +31,6 @@ in {
}; };
}; };
services.nginx.virtualHosts.${domain} = { services.nginx.virtualHosts.${domain} = {
forceSSL = true;
enableACME = true;
locations."/" = { locations."/" = {
proxyPass = "http://localhost:${port}/"; proxyPass = "http://localhost:${port}/";
}; };