118 lines
3 KiB
Nix
118 lines
3 KiB
Nix
# Nginx Reverse Proxy Module
|
|
# Provides: Nginx with automatic Let's Encrypt certificates
|
|
#
|
|
# Usage:
|
|
# myModules.nginx = {
|
|
# enable = true;
|
|
# email = "your@email.com";
|
|
# domains = {
|
|
# "search.example.com" = {
|
|
# port = 8888;
|
|
# };
|
|
# };
|
|
# };
|
|
|
|
{
|
|
config,
|
|
lib,
|
|
pkgs,
|
|
...
|
|
}:
|
|
|
|
let
|
|
cfg = config.myModules.nginx;
|
|
in
|
|
{
|
|
options.myModules.nginx = {
|
|
enable = lib.mkEnableOption "Nginx reverse proxy with Let's Encrypt";
|
|
|
|
email = lib.mkOption {
|
|
type = lib.types.str;
|
|
example = "admin@example.com";
|
|
description = "Email address for Let's Encrypt registration";
|
|
};
|
|
|
|
domains = lib.mkOption {
|
|
type = lib.types.attrsOf (lib.types.submodule {
|
|
options = {
|
|
port = lib.mkOption {
|
|
type = lib.types.port;
|
|
description = "Local port to proxy to";
|
|
};
|
|
extraConfig = lib.mkOption {
|
|
type = lib.types.lines;
|
|
default = "";
|
|
description = "Extra Nginx config for this location";
|
|
};
|
|
extraLocations = lib.mkOption {
|
|
type = lib.types.attrsOf (lib.types.submodule {
|
|
options = {
|
|
proxyPass = lib.mkOption {
|
|
type = lib.types.str;
|
|
description = "Proxy target URL";
|
|
};
|
|
extraConfig = lib.mkOption {
|
|
type = lib.types.lines;
|
|
default = "";
|
|
description = "Extra Nginx config for this location";
|
|
};
|
|
};
|
|
});
|
|
default = { };
|
|
description = "Additional location blocks to add to this virtual host";
|
|
};
|
|
};
|
|
});
|
|
default = { };
|
|
description = "Domains to configure with their proxy targets";
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
# Open HTTP/HTTPS ports
|
|
networking.firewall.allowedTCPPorts = [ 80 443 ];
|
|
|
|
# ACME (Let's Encrypt) configuration
|
|
security.acme = {
|
|
acceptTerms = true;
|
|
defaults.email = cfg.email;
|
|
certs = lib.mapAttrs' (domain: opts: {
|
|
name = domain;
|
|
value = { };
|
|
}) cfg.domains;
|
|
};
|
|
|
|
# Nginx configuration
|
|
services.nginx = {
|
|
enable = true;
|
|
recommendedGzipSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedProxySettings = true;
|
|
recommendedTlsSettings = true;
|
|
|
|
virtualHosts = lib.mapAttrs' (domain: opts: {
|
|
name = domain;
|
|
value = {
|
|
enableACME = true;
|
|
forceSSL = true;
|
|
|
|
locations = {
|
|
"/" = {
|
|
proxyPass = "http://127.0.0.1:${toString opts.port}";
|
|
extraConfig = opts.extraConfig;
|
|
};
|
|
} // lib.mapAttrs' (locPath: locOpts: {
|
|
name = locPath;
|
|
value = {
|
|
proxyPass = locOpts.proxyPass;
|
|
extraConfig = locOpts.extraConfig;
|
|
};
|
|
}) opts.extraLocations;
|
|
};
|
|
}) cfg.domains;
|
|
};
|
|
|
|
# Ensure nginx user can access ACME certs
|
|
users.users.nginx.extraGroups = [ "acme" ];
|
|
};
|
|
}
|