nixos/kelder: Independent nginx config

nixos/boxes/kelder/containers/acquisition/default.nix

@@ -1,4 +1,9 @@
-{ lib, ... }: {
+{ lib, ... }:
+let
+  inherit (lib.my) net;
+  inherit (lib.my.kelder) domain prefixes;
+in
+{
   nixos.systems.kelder-acquisition = {
     system = "x86_64-linux";
     nixpkgs = "mine";
@@ -6,8 +11,8 @@
     assignments = {
       internal = {
         name = "acquisition-ctr";
-        domain = lib.my.kelder.domain;
-        ipv4.address = "${lib.my.kelder.start.ctrs.v4}2";
+        inherit domain;
+        ipv4.address = net.cidr.host 2 prefixes.ctrs.v4;
       };
     };
 

nixos/boxes/kelder/default.nix

@@ -1,4 +1,9 @@
-{ lib, ... }: {
+{ lib, ... }:
+let
+  inherit (lib.my) net;
+  inherit (lib.my.kelder) domain prefixes;
+in
+{
   imports = [ ./containers ];
 
   nixos.systems.kelder = {
@@ -7,11 +12,18 @@
     home-manager = "mine";
 
     assignments = {
+      estuary = {
+        ipv4 ={
+          address = net.cidr.host 0 lib.my.colony.prefixes.vip2;
+          mask = 32;
+          gateway = null;
+        };
+      };
       ctrs = {
         name = "kelder-ctrs";
-        domain = lib.my.kelder.domain;
+        inherit domain;
         ipv4 = {
-          address = "${lib.my.kelder.start.ctrs.v4}1";
+          address = net.cidr.host 1 prefixes.ctrs.v4;
           gateway = null;
         };
       };
@@ -153,10 +165,12 @@
                 ];
                 "95-estuary" = {
                   matchConfig.Name = "estuary";
-                  address = [ "${lib.my.kelder.start.vpn.v4}2/30" ];
+                  address = with assignments.estuary; [
+                    (with ipv4; "${address}/${toString mask}")
+                  ];
                   routingPolicyRules = map (r: { routingPolicyRuleConfig = r; }) [
                     {
-                      From = "${lib.my.kelder.start.vpn.v4}2";
+                      From = assignments.estuary.ipv4.address;
                       Table = vpnTable;
                       Priority = 100;
                     }

nixos/boxes/kelder/nginx.nix

@@ -1,6 +1,7 @@
 { lib, pkgs, config, allAssignments, ... }:
 let
-  inherit (lib) mkMerge mkIf;
+  inherit (builtins) mapAttrs;
+  inherit (lib) mkMerge mkIf mkDefault;
 in
 {
   config = {
@@ -10,6 +11,15 @@ in
           owner = "nginx";
           group = "nginx";
         };
+        "dhparams.pem" = {
+          owner = "acme";
+          group = "acme";
+          mode = "440";
+        };
+        "kelder/cloudflare-credentials.conf" = {
+          owner = "acme";
+          group = "acme";
+        };
       };
 
       firewall = {
@@ -17,6 +27,31 @@ in
       };
     };
 
+    security.acme = {
+      acceptTerms = true;
+      defaults = {
+        email = "dev@nul.ie";
+        server = "https://acme-v02.api.letsencrypt.org/directory";
+        reloadServices = [ "nginx" ];
+        dnsResolver = "8.8.8.8";
+      };
+      certs = {
+        "${lib.my.kelder.domain}" = {
+          extraDomainNames = [
+            "*.${lib.my.kelder.domain}"
+          ];
+          dnsProvider = "cloudflare";
+          credentialsFile = config.age.secrets."kelder/cloudflare-credentials.conf".path;
+        };
+      };
+    };
+
+    users = {
+      users = {
+        nginx.extraGroups = [ "acme" ];
+      };
+    };
+
     services = {
       nginx = {
         enable = true;
@@ -25,6 +60,7 @@ in
         recommendedTlsSettings = true;
         clientMaxBodySize = "0";
         serverTokens = true;
+        sslDhparam = config.age.secrets."dhparams.pem".path;
 
         # Based on recommended*Settings, but probably better to be explicit about these
         appendHttpConfig = ''
@@ -79,58 +115,61 @@ in
             c
           ];
           acquisition = "http://${allAssignments.kelder-acquisition.internal.ipv4.address}";
+          hosts = {
+            "_" = {
+              default = true;
+              forceSSL = true;
+              onlySSL = false;
+              locations = {
+                "/".root = "${pkgs.nginx}/html";
+              };
+            };
+
+            "media.${lib.my.kelder.domain}" = {
+              locations = {
+                "/".proxyPass = "${acquisition}:8096";
+                "= /".return = "302 $scheme://$host/web/";
+                "= /web/".proxyPass = "${acquisition}:8096/web/index.html";
+                "/socket" = {
+                  proxyPass = "${acquisition}:8096/socket";
+                  proxyWebsockets = true;
+                  extraConfig = lib.my.nginx.proxyHeaders;
+                };
+              };
+            };
+            "torrents.${lib.my.kelder.domain}" = withAuth {
+              locations."/".proxyPass = "${acquisition}:9091";
+            };
+            "jackett.${lib.my.kelder.domain}" = withAuth {
+              locations."/".proxyPass = "${acquisition}:9117";
+            };
+            "radarr.${lib.my.kelder.domain}" = withAuth {
+              locations."/" = {
+                proxyPass = "${acquisition}:7878";
+                proxyWebsockets = true;
+                extraConfig = lib.my.nginx.proxyHeaders;
+              };
+            };
+            "sonarr.${lib.my.kelder.domain}" = withAuth {
+              locations."/" = {
+                proxyPass = "${acquisition}:8989";
+                proxyWebsockets = true;
+                extraConfig = lib.my.nginx.proxyHeaders;
+              };
+            };
+          };
+
+          defaultsFor = mapAttrs (n: _: {
+            onlySSL = mkDefault true;
+            useACMEHost = mkDefault "${config.networking.domain}";
+            kTLS = mkDefault true;
+            http2 = mkDefault true;
+          });
         in
-        {
-          "_" = {
-            default = true;
-            locations = {
-              "= /".root = "${pkgs.nginx}/html";
-
-              "~ /media/?".return = "302 $scheme://$host/web/";
-              "= /web/".proxyPass = "${acquisition}:8096/web/index.html";
-              "/socket" = {
-                proxyPass = "${acquisition}:8096/socket";
-                proxyWebsockets = true;
-                extraConfig = lib.my.nginx.proxyHeaders;
-              };
-
-              "/".proxyPass = "${acquisition}:8096";
-            };
-          };
-
-          "media.${lib.my.kelder.domain}" = {
-            locations = {
-              "/".proxyPass = "${acquisition}:8096";
-              "= /".return = "302 $scheme://$host/web/";
-              "= /web/".proxyPass = "${acquisition}:8096/web/index.html";
-              "/socket" = {
-                proxyPass = "${acquisition}:8096/socket";
-                proxyWebsockets = true;
-                extraConfig = lib.my.nginx.proxyHeaders;
-              };
-            };
-          };
-          "torrents.${lib.my.kelder.domain}" = withAuth {
-            locations."/".proxyPass = "${acquisition}:9091";
-          };
-          "jackett.${lib.my.kelder.domain}" = withAuth {
-            locations."/".proxyPass = "${acquisition}:9117";
-          };
-          "radarr.${lib.my.kelder.domain}" = withAuth {
-            locations."/" = {
-              proxyPass = "${acquisition}:7878";
-              proxyWebsockets = true;
-              extraConfig = lib.my.nginx.proxyHeaders;
-            };
-          };
-          "sonarr.${lib.my.kelder.domain}" = withAuth {
-            locations."/" = {
-              proxyPass = "${acquisition}:8989";
-              proxyWebsockets = true;
-              extraConfig = lib.my.nginx.proxyHeaders;
-            };
-          };
-        };
+        mkMerge [
+          hosts
+          (defaultsFor hosts)
+        ];
       };
     };
   };