dotfiles/Ahwxorg
1
0
Fork 0
mirror of https://github.com/Ahwxorg/nixos-config.git synced 2026-07-16 22:21:55 +08:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: adds postRun line; adds desec token from sops; sets domains correctly

Browse source
This commit is contained in:
Ahwx 2026-04-14 21:37:32 +02:00
parent a1cb797fc4
commit 8ab3a58228
1 changed files with 16 additions and 20 deletions
Download patch file Download diff file Expand all files Collapse all files

36
modules/services/nginx.nix
View file

@ -12,7 +12,7 @@
security.acme = { security.acme = {
acceptTerms = true; acceptTerms = true;
defaults.email = lib.mkDefault "ahwx@ahwx.org"; defaults.email = lib.mkDefault "letsencrypt@liv.town";
maxConcurrentRenewals = 1; maxConcurrentRenewals = 1;
defaults = { defaults = {
validMinDays = 30; validMinDays = 30;
@ -21,35 +21,38 @@
# dnsPropagationCheck = false; # dnsPropagationCheck = false;
extraLegoFlags = [ "--dns.propagation-wait=300s" ]; extraLegoFlags = [ "--dns.propagation-wait=300s" ];
dnsProvider = "ns1.desec.io:53"; dnsProvider = "ns1.desec.io:53";
postRun = "systemctl restart nginx prosody matrix-synapse";
}; };
certs = { certs = {
"liv.town" = { "liv.town" = {
domain = "*.liv.town"; domain = "liv.town";
extraDomainNames = [ "liv.town" ]; extraDomainNames = [ "*.liv.town" ];
group = config.services.nginx.group;
dnsProvider = "desec"; dnsProvider = "desec";
environmentFile = "/home/liv/desec.env"; # location of your DESEC_TOKEN=[value] environmentFile = config.sops.secrets.desecToken.path;
# environmentFile = "/home/liv/desec.env";
webroot = null; webroot = null;
}; };
"ahwx.org" = { "ahwx.org" = {
domain = "*.ahwx.org"; domain = "ahwx.org";
extraDomainNames = [ "ahwx.org" ]; extraDomainNames = [ "*.ahwx.org" ];
group = config.services.nginx.group;
dnsProvider = "desec"; dnsProvider = "desec";
environmentFile = "/home/liv/desec.env"; # location of your DESEC_TOKEN=[value] environmentFile = config.sops.secrets.desecToken.path;
# environmentFile = "/home/liv/desec.env";
webroot = null; webroot = null;
}; };
"quack.social" = { "quack.social" = {
domain = "*.quack.social"; domain = "quack.social";
extraDomainNames = [ "quack.social" ]; extraDomainNames = [ "*.quack.social" ];
group = config.services.nginx.group;
dnsProvider = "desec"; dnsProvider = "desec";
environmentFile = "/home/liv/desec.env"; # location of your DESEC_TOKEN=[value] environmentFile = config.sops.secrets.desecToken.path;
# environmentFile = "/home/liv/desec.env";
webroot = null; webroot = null;
}; };
}; };
}; };
users.users.nginx.extraGroups = [ "acme" ];
services.nginx = { services.nginx = {
enable = true; enable = true;
recommendedTlsSettings = true; recommendedTlsSettings = true;
@ -60,16 +63,9 @@
# Hardened TLS and HSTS preloading # Hardened TLS and HSTS preloading
appendHttpConfig = '' appendHttpConfig = ''
# Proxying
# real_ip_header proxy_protocol;
ssl_certificate /var/lib/acme/quack.social/cert.pem; ssl_certificate /var/lib/acme/quack.social/cert.pem;
ssl_certificate_key /var/lib/acme/quack.social/key.pem; ssl_certificate_key /var/lib/acme/quack.social/key.pem;
# proxy_set_header Host $host;
# proxy_set_header X-Real-IP $proxy_protocol_addr;
# proxy_set_header X-Forwarded-For $proxy_protocol_addr;
# Add HSTS header with preloading to HTTPS requests. # Add HSTS header with preloading to HTTPS requests.
# Do not add HSTS header to HTTP requests. # Do not add HSTS header to HTTP requests.
map $scheme $hsts_header { map $scheme $hsts_header {