From f6427e5237fda301323e14934ccc1e1186cd41c2 Mon Sep 17 00:00:00 2001
From: Ingolf Wagner <contact@ingolf-wagner.de>
Date: Sat, 2 Nov 2024 16:35:32 +0900
Subject: [PATCH] :wrench: put nginx in front of navidrome

---
 components/network/tinc/private.nix  |  1 +
 machines/chungus/media-navidrome.nix | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+)

diff --git a/components/network/tinc/private.nix b/components/network/tinc/private.nix
index e364418..80391c4 100644
--- a/components/network/tinc/private.nix
+++ b/components/network/tinc/private.nix
@@ -28,6 +28,7 @@ let
     "photoprism.orbi" = hosts.orbi;
     # chungus
     "video.chungus" = hosts.chungus;
+    "music.chungus" = hosts.chungus;
     "de.tts.chungus" = hosts.chungus;
     "en.tts.chungus" = hosts.chungus;
     "flix.chungus" = hosts.chungus;
diff --git a/machines/chungus/media-navidrome.nix b/machines/chungus/media-navidrome.nix
index 68f5639..5fd290e 100644
--- a/machines/chungus/media-navidrome.nix
+++ b/machines/chungus/media-navidrome.nix
@@ -22,4 +22,24 @@
     settings.MusicFolder = "/media/arr/lidarr";
   };
 
+  services.nginx = {
+    enable = true;
+    virtualHosts."music.${config.networking.hostName}.private" = {
+      serverAliases = [
+        "music.${config.networking.hostName}.wg0"
+        "music.ingolf-wagner.de"
+      ];
+      locations."/" = {
+        recommendedProxySettings = true;
+        proxyWebsockets = true;
+        proxyPass = "http://localhost:${toString config.services.navidrome.settings.Port}";
+        extraConfig = ''
+          allow ${config.tinc.private.subnet};
+          allow ${config.wireguard.wg0.subnet};
+          deny all;
+        '';
+      };
+    };
+  };
+
 }