c4patino/yumeami
1
0
Fork 0
Code Activity Actions

feat: added httpd server configurations to nixos-config

Browse source
This commit is contained in:
Ceferino Patino 2025-05-03 10:10:13 -05:00
commit eb3914be30
Signed by: c4patino
SSH key fingerprint: SHA256:Wu+cU1t+7zVT9wzew/4meNmeulo66NzMqc22MdDBgXI
7 changed files with 120 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

6
flake.lock generated
View file

@ -220,11 +220,11 @@
"dotfiles": {
"flake": false,
"locked": {
"lastModified": 1739645711,
"narHash": "sha256-UHhEHtLvHJnqtSjwFhPS201TABfQQEVd63BiflLhLwY=",
"lastModified": 1746223983,
"narHash": "sha256-S6fdkDhOPxjUxKPeCLyU5ZYmjvJdbOHMamNdje5Bv3M=",
"owner": "c4patino",
"repo": "dotfiles",
"rev": "fc408905d8b87964eacecf37f565f98a5e729b70",
"rev": "d137e951102fd4fe7d8dd9ff11afcea5ad38237b",
"type": "github"
},
"original": {

2
inputs/dotfiles

@ -1 +1 @@
Subproject commit fc408905d8b87964eacecf37f565f98a5e729b70
Subproject commit d137e951102fd4fe7d8dd9ff11afcea5ad38237b

5
secrets/sops/secrets.yaml
View file

@ -6,6 +6,7 @@ github:
tailscale:
actions: ENC[AES256_GCM,data:2eIgnhfYt8ZSrEPZ2d7ynHU5WhB3DUnBSPjMx3tQaL6sxuOmHUN5NuLdL7aot/RWn/A9SMcDTJdsDAwo,iv:E04WX6G8M5n8x36YgyMT2lDzsPqluLSd1p4Q6UHbm4M=,tag:TJdJ+ioeitGf+MyapXqyPg==,type:str]
tsdproxy: ENC[AES256_GCM,data:FZNL/UATBqS/Wp2LyA+bvzivSk8yunywAyjUKxYrAWiMzxhooJDlkcY/MZnO4TlG2JIfX8i1BKyjGbpWyj8=,iv:ujv/yxbVkeeJkK9JoYnySvsbMIsbU1FN/TfqMz4fTmk=,tag:i7zE1J6Fh8MCB2LDbho0YQ==,type:str]
cloudflare: ENC[AES256_GCM,data:K6OMG71oQB/xo06zER5GSWwK3A/RYdDw96WLFDaXwIhQUFxObaEYcw==,iv:J7a854JmI2vgrWROsUIyFyPf8lYwIABMv85i5ylAcqE=,tag:h0qrT2tL7WjcaNTXVTyvWg==,type:str]
master-password: ENC[AES256_GCM,data:iAMbu/wtDcjOjLvCdUR+uJj3EtDgNavXrdZbLN/7JEE622RVzcA=,iv:bmIt6ikyFoy7b8xJ6LwRVNNr4R1ohcbWBXrkS6yuXjQ=,tag:AboT9o8mg17whEcpUoljLg==,type:str]
pypi: ENC[AES256_GCM,data:nfq3VL34oPQLCblDIZcYuSae9aeT918jDas3dexmR+VJOQLa4tN2x8HZTEw2mhz4Rh8MWTF4nmsii97rrngjz/C4d0Bz0b7hEKLIQIiAEs1rPJUKvbXDKZEUOz4/ujNBV/iwnwLq/P6Bj1hItK5GT1ofcydLXG7DF5CX2FFi5nohK8v1Uts1TVNH4XioZ9m6S42tsFnKYl1x3dcvliJl73nUghhitCtr0PcY66D4x0a9iaM=,iv:WCDrnLmjkKoiMcL9+vYEfeC5NA/IjTLjExvgKipOqZM=,tag:OoXoGEk4sQWfADc+07OiZg==,type:str]
sops:
@ -37,7 +38,7 @@ sops:
YlhvbmFBT2pmTzk1RDlzbkgyWFdnckEKpWmn89U1KpeApHgBgt3pi0+qqbRVWNiV
ZV7rCRtfL4qy++MiTE92ov4iRn8ffKUuoUMDgT4VzsTB6wjhMbh5kw==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2025-05-01T18:25:55Z"
mac: ENC[AES256_GCM,data:umxfr/u0woN5IUxHabhD8wdJhfuEpBhwRMIFhfTk/4qV95SMqVmXXrR4NvgEH3J56lnCpyHwZPFRNXY8xPMaQKElh487bNwSR6Eoo++ni/HnIPAFYWCCrEq59Em2wh/fALDuEvlXF6sPCmamQSar34L09FUaNWqAsV5n5e5cWFw=,iv:Q81+dYQq5PcMm5uTGET2/s7S5yInRdblDPZlYKW0Zh8=,tag:HptMyo6ZM6G0QOgg3mHTDw==,type:str]
lastmodified: "2025-05-03T15:00:14Z"
mac: ENC[AES256_GCM,data:io6O5Jy2hDMaylfwkYk/Lj+gNKihxs6fINqOt7b0O9bimwAHyxNVrGvGpPqbe/1SDzeHIpZASIrdR3GiEQzX7e3nCNHfY5hzIQRL4TMSFZO41ccvbo7t4sjMxlSSzRPuUusZ2YjSbgtKEc41qB0VS9Oj4Tlc6E6v/bd7XeAq+RY=,iv:ZQLzZxQ6ZeiGtNdXdhCUrdaz9pjWbkiduTzKNVf4VdA=,tag:TEgI8zR/VKBkf82QUe8kHA==,type:str]
unencrypted_suffix: _unencrypted
version: 3.10.2

2
system/hosts/arisu/default.nix
View file

@ -34,6 +34,8 @@ in {
steam.enable = true;
httpd.enable = true;
rustypaste.enable = true;
glance.enable = true;

1
system/secrets.nix
View file

@ -22,6 +22,7 @@ in {
"master-password" = {owner = c4patino.name;};
"tailscale/actions" = {owner = c4patino.name;};
"tailscale/tsdproxy" = {owner = c4patino.name;};
"cloudflare" = {owner = c4patino.name;};
"pypi" = {owner = c4patino.name;};
};
};

1
system/services/default.nix
View file

@ -4,6 +4,7 @@
./glance
./github-runner.nix
./httpd.nix
./ntfy.nix
./pm2.nix
./rustypaste.nix

109
system/services/httpd.nix Normal file
View file

@ -0,0 +1,109 @@
{
lib,
config,
...
}: let
inherit (lib) types;
inherit (config.sops) secrets;
mkDomainConfig = domain: service: let
n = service.name;
p = toString service.port;
in ''
# --- ${n} (subdomain access) ---
RewriteCond %{HTTP_HOST} ^${n}\.${domain}$ [NC]
RewriteRule ^/(.*) http://localhost:${p}/$1 [P,L]
ProxyPassReverse / http://localhost:${p}/
'';
mkPublicVirtualHost = service: let
n = service.name;
p = toString service.port;
in {
name = "${n}.cpatino.com";
value = {
acmeRoot = null;
documentRoot = "/var/empty";
extraConfig = ''
UseCanonicalName Off
RewriteEngine On
# --- ${n} (subdomain access) ---
RewriteRule ^/(.*) http://localhost:${p}/$1 [P,L]
ProxyPassReverse / http://localhost:${p}/
'';
};
};
localhostProxyConfig = lib.concatStringsSep "\n" (map (mkDomainConfig "localhost") config.httpd.services);
publicVirtualHosts = lib.listToAttrs (map mkPublicVirtualHost (lib.filter (s: s.public) config.httpd.services));
in {
options.httpd = {
enable = lib.mkEnableOption "httpd";
services = lib.mkOption {
type = with types;
listOf (submodule {
options = {
name = lib.mkOption {
type = str;
description = "Name of the service, used in path and subdomain";
};
port = lib.mkOption {
type = port;
description = "Local port of the service";
};
public = lib.mkOption {
type = bool;
description = "Whether the service should be publicly accessible.";
default = false;
};
};
});
default = [];
description = "List of apps to reverse-proxy using Apache";
};
};
config = lib.mkIf config.httpd.enable {
services.httpd = {
enable = true;
extraModules = ["proxy" "proxy_http" "rewrite"];
virtualHosts = lib.mkMerge [
{
"localhost" = {
acmeRoot = null;
serverAliases = ["*.localhost"];
documentRoot = "/var/empty";
extraConfig = ''
UseCanonicalName Off
RewriteEngine On
${localhostProxyConfig}
RewriteRule ^ - [R=404,L]
'';
};
}
publicVirtualHosts
];
};
security.acme = {
acceptTerms = true;
defaults.email = "c4patino@gmail.com";
defaults = {
dnsProvider = "cloudflare";
dnsProviderConfig = lib.mkOption {
type = lib.types.attrs;
default = {
CF_Token = secrets."cloudflare";
};
};
};
};
networking.firewall.allowedTCPPorts = [80 443];
};
}