Richie
7f08a6f788
- move HAProxy and ACME certificate management to Portal - route application backends to Jeeves over Tailscale - restrict Jeeves backend ports to the Tailscale interface - expose Gems for remote proxy access
73 lines
1.6 KiB
Nix
73 lines
1.6 KiB
Nix
let
|
|
domains = [
|
|
"audiobookshelf"
|
|
"cache"
|
|
"gitea"
|
|
"gems"
|
|
"jellyfin"
|
|
"share"
|
|
];
|
|
extraDomains = [ "www.norn-sight.com" ];
|
|
|
|
makeCert = name: {
|
|
name = "${name}.tmmworkshop.com";
|
|
value = {
|
|
webroot = "/var/lib/acme/.challenges";
|
|
group = "acme";
|
|
reloadServices = [ "haproxy.service" ];
|
|
};
|
|
};
|
|
|
|
makeExtraCert = name: {
|
|
inherit name;
|
|
value = {
|
|
webroot = "/var/lib/acme/.challenges";
|
|
group = "acme";
|
|
reloadServices = [ "haproxy.service" ];
|
|
};
|
|
};
|
|
|
|
acmeServices =
|
|
map (domain: "acme-${domain}.tmmworkshop.com.service") domains
|
|
++ map (domain: "acme-${domain}.service") extraDomains;
|
|
in
|
|
{
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults.email = "Richie@tmmworkshop.com";
|
|
certs = builtins.listToAttrs ((map makeCert domains) ++ (map makeExtraCert extraDomains));
|
|
};
|
|
|
|
services.nginx = {
|
|
enable = true;
|
|
virtualHosts."acme-challenge" = {
|
|
listen = [
|
|
{
|
|
addr = "127.0.0.1";
|
|
port = 8402;
|
|
}
|
|
];
|
|
locations."/.well-known/acme-challenge/" = {
|
|
root = "/var/lib/acme/.challenges";
|
|
};
|
|
};
|
|
};
|
|
|
|
systemd.tmpfiles.rules = [
|
|
"d /var/lib/acme/.challenges 0750 acme acme - -"
|
|
"d /var/lib/acme/.challenges/.well-known 0750 acme acme - -"
|
|
"d /var/lib/acme/.challenges/.well-known/acme-challenge 0750 acme acme - -"
|
|
];
|
|
|
|
users.users = {
|
|
haproxy.extraGroups = [ "acme" ];
|
|
nginx.extraGroups = [ "acme" ];
|
|
};
|
|
|
|
# HAProxy needs the initial certificates before it can bind to port 443.
|
|
systemd.services.haproxy = {
|
|
after = acmeServices;
|
|
wants = acmeServices;
|
|
};
|
|
}
|