{ config, values, ... }: let gitea = config.services.gitea.settings; keycloak = config.services.keycloak.settings; in { services.nginx = { enable = true; enableReload = true; recommendedProxySettings = true; recommendedTlsSettings = true; recommendedGzipSettings = true; recommendedOptimisation = true; defaultListen = [ { addr = "192.168.10.175"; port = 80; ssl = false; } ]; }; networking.firewall.allowedTCPPorts = [ 80 443 # Internal / Default 43080 43443 # External / Publicly exposed ]; security.acme = { acceptTerms = true; defaults.email = "felix@albrigtsen.it"; }; # Publicly exposed services: services.nginx.virtualHosts = let publicProxy = upstream: overrides: { listen = [ { addr = "192.168.10.175"; port = 43443; ssl = true; } { addr = "192.168.10.175"; port = 43080; ssl = false; } ]; enableACME = true; forceSSL = true; locations."/".proxyPass = "${upstream}"; extraConfig = '' proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header Host $host; server_tokens off; ''; } // overrides; in { "cloud.feal.no" = publicProxy "" { locations."/" = { proxyPass = "http://challenger.home.feal.no"; extraConfig = '' client_max_body_size 8G; ''; }; }; "git.feal.no" = publicProxy "http://unix:${gitea.server.HTTP_ADDR}" {}; "jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/" {}; "iam.feal.no" = publicProxy "http://${keycloak.http-host}:${toString keycloak.http-port}" {}; }; }