{ config, lib, pkgs, ... }: { networking.firewall.allowedTCPPorts = [ 80 443 4443 ]; networking.firewall.allowedUDPPorts = [ 80 443 4443 ]; services.nginx = { enable = true; recommendedProxySettings = true; virtualHosts = { "git.ingolf-wagner.de" = { listen = [ { addr = "0.0.0.0"; port = 4443; ssl = true; } { addr = "0.0.0.0"; port = 80; ssl = false; } ]; forceSSL = true; enableACME = true; locations."/" = { proxyPass = "http://workhorse.private:3000"; }; }; "paste.ingolf-wagner.de" = { listen = [ { addr = "0.0.0.0"; port = 4443; ssl = true; } { addr = "0.0.0.0"; port = 80; ssl = false; } ]; forceSSL = true; enableACME = true; locations."/" = { proxyPass = "http://workhorse.private:8000"; }; }; #"landing.ingolf-wagner.de" = { # default = true; # listen = [ # { addr = "0.0.0.0"; port = 4443; ssl = true; } # { addr = "0.0.0.0"; port = 80; ssl = false; } # ]; # forceSSL = true; # enableACME = true; # locations."/" = { # root = "/srv/www/ingolf-wagner.de"; # }; #}; "travel.ingolf-wagner.de" = { listen = [ { addr = "0.0.0.0"; port = 4443; ssl = true; } { addr = "0.0.0.0"; port = 80; ssl = false; } ]; forceSSL = true; enableACME = true; locations."/" = { root = "/srv/www/travel"; extraConfig = '' if (-d $request_filename) { rewrite [^/]$ $scheme://$http_host$request_uri/ permanent; } ''; }; }; "tech.ingolf-wagner.de" = { listen = [ { addr = "0.0.0.0"; port = 4443; ssl = true; } { addr = "0.0.0.0"; port = 80; ssl = false; } ]; forceSSL = true; enableACME = true; locations."/" = { root = "/srv/www/tech"; extraConfig = '' if (-d $request_filename) { rewrite [^/]$ $scheme://$http_host$request_uri/ permanent; } ''; }; }; "terranix.org" = { listen = [ { addr = "0.0.0.0"; port = 4443; ssl = true; } { addr = "0.0.0.0"; port = 80; ssl = false; } ]; forceSSL = true; enableACME = true; locations."/" = { root = "/srv/www/terranix"; extraConfig = '' if (-d $request_filename) { rewrite [^/]$ $scheme://$http_host$request_uri/ permanent; } ''; }; }; "chat.ingolf-wagner.de" = { listen = [ { addr = "0.0.0.0"; port = 4443; ssl = true; } { addr = "0.0.0.0"; port = 80; ssl = false; } ]; forceSSL = true; enableACME = true; locations = { "/" = { proxyPass = "http://chat.workhorse.private"; proxyWebsockets = true; extraConfig = '' sub_filter "http://chat.ingolf-wagner.de" "https://chat.ingolf-wagner.de"; sub_filter "chat.workhorse.private" "chat.ingolf-wagner.de"; ''; }; }; }; "nextcloud.ingolf-wagner.de" = { listen = [ { addr = "0.0.0.0"; port = 4443; ssl = true; } { addr = "0.0.0.0"; port = 80; ssl = false; } ]; forceSSL = true; enableACME = true; locations = { "/" = { proxyPass = "http://nextcloud.workhorse.private"; extraConfig = '' sub_filter "http://nextcloud.ingolf-wagner.de" "https://nextcloud.ingolf-wagner.de"; sub_filter "nextcloud.workhorse.private" "nextcloud.ingolf-wagner.de"; # used for view/edit office file via Office Online Server client_max_body_size 0; ''; }; "= /.well-known/carddav" = { priority = 210; extraConfig = "return 301 $scheme://$host/remote.php/dav;"; }; "= /.well-known/caldav" = { priority = 210; extraConfig = "return 301 $scheme://$host/remote.php/dav;"; }; }; }; "gaykraft.com" = { listen = [ { addr = "0.0.0.0"; port = 4443; ssl = true; } { addr = "0.0.0.0"; port = 80; ssl = false; } ]; forceSSL = true; enableACME = true; locations."/" = { root = "/srv/www/gaykraft"; }; }; }; }; services.sslh = { enable = true; listenAddress = "0.0.0.0"; port = 443; verbose = false; transparent = true; appendConfig = # json '' protocols: ( { name: "ssh"; service: "ssh"; host: "localhost"; port: "2222"; probe: "builtin"; }, { name: "ssl"; host: "localhost"; port: "4443"; probe: "builtin"; }, { name: "tinc"; host: "localhost"; port: "655"; probe: "builtin"; } ); ''; }; systemd.services."socat-proxy" = { wantedBy = [ "sslh.service" "multi-user.target" ]; after = [ "sslh.service" ]; script = '' ${pkgs.socat}/bin/socat TCP-LISTEN:2222,fork TCP:workhorse.private:2222 ''; #serviceConfig.User = "sslh"; }; }