From dc0eb0ec4674ee97a7bbf0070ce841afbf47b994 Mon Sep 17 00:00:00 2001
From: Christian Krinitsin <code@krinitsin.xyz>
Date: Wed, 26 Feb 2025 13:00:48 +0100
Subject: add nginx webserver with acme

---
 modules/webserver.nix | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)
 create mode 100644 modules/webserver.nix

(limited to 'modules/webserver.nix')

diff --git a/modules/webserver.nix b/modules/webserver.nix
new file mode 100644
index 0000000..50b28f4
--- /dev/null
+++ b/modules/webserver.nix
@@ -0,0 +1,40 @@
+{ config, libs, pkgs, ... }:
+{
+
+  users.users.nginx.extraGroups = [ "acme" ];
+  services.nginx = {
+    enable = true;
+    virtualHosts = {
+      "krinitsin.com" = {
+        forceSSL = true;
+        enableACME = true;
+        root = "/var/www/krinitsin.com";
+	serverAliases = [ "www.krinitsin.com" ];
+
+	locations."/shopping/".basicAuthFile = "/secret/shopping_auth";
+	locations."/shopping/api/".proxyPass = "http://krinitsin.com:5000";
+      };
+
+      "recipes.krinitsin.com" = {
+        forceSSL = true;
+	useACMEHost = "krinitsin.com";
+	root = "/var/www/recipes.krinitsin.com";
+	serverAliases = [ "rezepte.krinitsin.com" ]
+      };
+    };
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "christian@krinitsin.xyz";
+    certs."krinitsin.com".extraDomainNames = [ "shopping.krinitsin.com" "webmail.krinitsin.com" ];
+  };
+
+  systemd.services.flask = {
+    enable = true;
+    wantedBy = ["default.target"];
+    serviceConfig.ExecStart = ''/run/current-system/sw/bin/flask --app /var/www/krinitsin.com/shopping/app.py run -h krinitsin.com'';
+  };
+
+  networking.firewall.allowedTCPPorts = [ 80 443 5000 ];
+}
-- 
cgit 1.4.1