nginx proxy module

modules/modules.nix

@@ -40,6 +40,7 @@ in
       ./nix/build.nix
       ./users/nixremote.nix
       ./network/firewall.nix
+      ./network/nginx.nix
     ];
   options.my = {
     localhost = lib.mkOption {

modules/network/nginx.nix

@@ -0,0 +1,100 @@
+{ lib, config, ... }:
+let
+  setup = import ../servers/setup.nix { inherit lib config; };
+
+  standardProxyServices = {
+    "firefox-syncserver" = {
+      type = "proxyReverse";
+    };
+    "readeck" = {
+      type = "proxyReverse";
+    };
+    "microbin" = {
+      type = "proxyReverse";
+    };
+    "ryot" = {
+      type = "proxyReverse";
+    };
+    "bazarr" = {
+      type = "proxyReverse";
+    };
+    "shiori" = {
+      type = "proxyReverse";
+    };
+    "metube" = {
+      type = "proxyReverse";
+    };
+    "maloja" = {
+      type = "proxyReverse";
+    };
+    "vaultwarden" = {
+      type = "proxyReverse";
+    };
+    "mealie" = {
+      type = "proxyReverse";
+    };
+    "kavita" = {
+      type = "proxyReverse";
+    };
+    "multi-scrobbler" = {
+      type = "proxyReverse";
+    };
+    "nix-serve" = {
+      type = "proxyReverse";
+    };
+    "audiobookshelf" = {
+      type = "proxyReverseFix";
+    };
+    "lidarr" = {
+      type = "proxyReverseFix";
+    };
+    "gitea" = {
+      type = "proxyReverseFix";
+    };
+    "prowlarr" = {
+      type = "proxyReverseFix";
+    };
+    "ombi" = {
+      type = "proxyReverseFix";
+    };
+    "radarr" = {
+      type = "proxyReverseFix";
+    };
+    "sonarr" = {
+      type = "proxyReverseFix";
+    };
+    "stash" = {
+      type = "proxyReverseFix";
+    };
+    "atticd" = {
+      type = "proxyReverseFix";
+    };
+    "homepage" = {
+      type = "proxyReversePrivate";
+    };
+  };
+
+  generateProxyConfig =
+    serviceName: serviceConfig:
+    let
+      cfg = config.my.servers.${serviceName};
+      proxyFunc =
+        if serviceConfig.type == "proxyReverse" then
+          setup.proxyReverse
+        else if serviceConfig.type == "proxyReverseFix" then
+          setup.proxyReverseFix
+        else if serviceConfig.type == "proxyReversePrivate" then
+          setup.proxyReversePrivate
+        else
+          throw "Unknown proxy type: ${serviceConfig.type}";
+    in
+    lib.nameValuePair cfg.host (lib.mkIf cfg.enableProxy (proxyFunc cfg));
+
+  standardProxyConfigs = lib.mapAttrs' generateProxyConfig standardProxyServices;
+
+in
+{
+  config = lib.mkIf config.my.enableProxy {
+    services.nginx.virtualHosts = standardProxyConfigs;
+  };
+}

modules/servers/atticd.nix

@@ -7,8 +7,7 @@ in
   options.my.servers.atticd = setup.mkOptions "atticd" "cache" 2343;
   config = lib.mkIf cfg.enable {
     sops.secrets."private_cache_keys/atticd".sopsFile = ../../secrets/keys.yaml;
-    services = {
+    services.atticd = {
-      atticd = {
       enable = true;
       environmentFile = config.sops.secrets."private_cache_keys/atticd".path;
       settings = {
@@ -30,7 +29,5 @@ in
         };
       };
     };
-      nginx.virtualHosts."cache.rotehaare.art" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
-    };
   };
 }

modules/servers/audiobookshelf.nix

@@ -7,14 +7,11 @@ in
   options.my.servers.audiobookshelf = setup.mkOptions "audiobookshelf" "audiobooks" 5687;
   config = {
     my.servers.audiobookshelf.enableSocket = true;
-    services = {
+    services.audiobookshelf = lib.mkIf cfg.enable {
-      audiobookshelf = lib.mkIf cfg.enable {
       inherit (cfg) port;
       enable = true;
       host = cfg.ip;
       group = "piracy";
     };
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
-    };
   };
 }

modules/servers/bazarr.nix

@@ -5,13 +5,8 @@ let
 in
 {
   options.my.servers.bazarr = setup.mkOptions "bazarr" "subs" config.services.bazarr.listenPort;
-  config = {
+  config.services.bazarr = lib.mkIf cfg.enable {
-    services = {
-      bazarr = lib.mkIf cfg.enable {
     enable = true;
     group = "piracy";
   };
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverse cfg);
-    };
-  };
 }

modules/servers/firefox-syncserver.nix

@@ -7,8 +7,7 @@ in
   options.my.servers.firefox-syncserver = setup.mkOptions "firefox-syncserver" "sync" 4233;
   config = {
     # sops.secrets.firefox-syncserver.sopsFile = ../../secrets/env.yaml;
-    services = {
+    services.firefox-syncserver = {
-      firefox-syncserver = {
       inherit (cfg) enable;
       # secrets = config.sops.secrets.firefox-syncserver;
       settings.port = cfg.port;
@@ -20,7 +19,5 @@ in
         # url = cfg.host;
       };
     };
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverse cfg);
-    };
   };
 }

modules/servers/gitea.nix

@@ -80,7 +80,6 @@ in
             inherit (pkgs.xorg) libX11;
           };
       };
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
     };
   };
 }

modules/servers/homepage.nix

@@ -15,8 +15,7 @@ in
       };
     };
     my.servers.homepage.certPath = config.sops.secrets."private-ca/pem".path;
-    services = {
+    services.homepage-dashboard = lib.mkIf cfg.enable {
-      homepage-dashboard = lib.mkIf cfg.enable {
       enable = true;
       listenPort = cfg.port;
       environmentFile = config.sops.secrets.homepage.path;
@@ -32,7 +31,5 @@ in
         |> builtins.filter (file: builtins.match ".*\\.nix" file != null)
         |> map (file: import ./homepage/bookmarks/${file});
     };
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReversePrivate cfg);
-    };
   };
 }

modules/servers/kavita.nix

@@ -18,12 +18,9 @@ in
         "piracy"
       ];
     };
-    services = {
+    services.kavita = lib.mkIf cfg.enable {
-      kavita = lib.mkIf cfg.enable {
       enable = true;
       tokenKeyFile = config.sops.secrets.kavita-token.path;
     };
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverse cfg);
-    };
   };
 }

modules/servers/lidarr.nix

@@ -5,8 +5,7 @@ let
 in
 {
   options.my.servers.lidarr = setup.mkOptions "lidarr" "music" 8686;
-  config = {
+  config.virtualisation.oci-containers.containers.lidarr = lib.mkIf cfg.enable {
-    virtualisation.oci-containers.containers.lidarr = lib.mkIf cfg.enable {
     autoStart = true;
     image = "linuxserver/lidarr:version-2.13.3.4711";
     ports = [ "${toString cfg.port}:${toString cfg.port}" ];
@@ -29,6 +28,4 @@ in
       "--network=host"
     ];
   };
-    services.nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
-  };
 }

modules/servers/maloja.nix

@@ -21,6 +21,5 @@ in
       };
       volumes = [ "${config.my.containerData}/maloja:/mljdata" ];
     };
-    services.nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverse cfg);
   };
 }

modules/servers/mealie.nix

@@ -7,8 +7,7 @@ in
   options.my.servers.mealie = setup.mkOptions "mealie" "mealie" 9925;
   config = {
     sops.secrets = lib.mkIf cfg.enable { mealie.sopsFile = ../../secrets/env.yaml; };
-    services = {
+    services.mealie = lib.mkIf cfg.enable {
-      mealie = lib.mkIf cfg.enable {
       enable = true;
       inherit (cfg) port;
       settings = {
@@ -26,7 +25,5 @@ in
       };
       credentialsFile = config.sops.secrets.mealie.path;
     };
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverse cfg);
-    };
   };
 }

modules/servers/metube.nix

@@ -5,8 +5,7 @@ let
 in
 {
   options.my.servers.metube = setup.mkOptions "metube" "bajameesta" 8881;
-  config = {
+  config.virtualisation.oci-containers.containers.metube = lib.mkIf cfg.enable {
-    virtualisation.oci-containers.containers.metube = lib.mkIf cfg.enable {
     image = "ghcr.io/alexta69/metube:2024-11-05";
     ports = [ "${toString cfg.port}:8081" ];
     volumes = [
@@ -20,6 +19,4 @@ in
       PGID = toString config.users.groups.piracy.gid;
     };
   };
-    services.nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverse cfg);
-  };
 }

modules/servers/microbin.nix

@@ -5,9 +5,7 @@ let
 in
 {
   options.my.servers.microbin = setup.mkOptions "microbin" "copy" 8086;
-  config = lib.mkIf config.my.servers.microbin.enable {
+  config.services.microbin = lib.mkIf cfg.enable {
-    services = {
-      microbin = lib.mkIf cfg.enable {
     enable = true;
     settings = {
       MICROBIN_PORT = cfg.port;
@@ -19,7 +17,4 @@ in
       MICROBIN_ENCRYPTION_SERVER_SIDE = true;
     };
   };
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverse cfg);
-    };
-  };
 }

modules/servers/multi-scrobbler.nix

@@ -23,6 +23,5 @@ in
       };
       volumes = [ "${config.my.containerData}/multi-scrobbler:/config" ];
     };
-    services.nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverse cfg);
   };
 }

modules/servers/nix-serve.nix

@@ -12,14 +12,11 @@ in
   options.my.servers.nix-serve = setup.mkOptions "nix-serve" "cache" 5000;
   config = lib.mkIf cfg.enable {
     sops.secrets."private_cache_keys/miniserver".sopsFile = ../../secrets/keys.yaml;
-    services = {
+    services.nix-serve = {
-      nix-serve = {
       enable = true;
       package = pkgs.nix-serve-ng;
       inherit (cfg) port;
       secretKeyFile = config.sops.secrets."private_cache_keys/miniserver".path;
     };
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverse cfg);
-    };
   };
 }

modules/servers/ombi.nix

@@ -5,11 +5,8 @@ let
 in
 {
   options.my.servers.ombi = setup.mkOptions "ombi" "requests" 3425;
-  config.services = {
+  config.services.ombi = lib.mkIf cfg.enable {
-    ombi = lib.mkIf cfg.enable {
     enable = true;
     inherit (cfg) port;
   };
-    nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
-  };
 }

modules/servers/prowlarr.nix

@@ -17,7 +17,6 @@ in
     services = {
       prowlarr.enable = cfg.enable;
       flaresolverr.enable = cfg.enable;
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
     };
   };
 }

modules/servers/radarr.nix

@@ -5,13 +5,8 @@ let
 in
 {
   options.my.servers.radarr = setup.mkOptions "radarr" "movies" 7878;
-  config = {
+  config.services.radarr = lib.mkIf cfg.enable {
-    services = {
-      radarr = lib.mkIf cfg.enable {
     enable = true;
     group = "piracy";
   };
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
-    };
-  };
 }

modules/servers/readeck.nix

@@ -7,8 +7,7 @@ in
   options.my.servers.readeck = setup.mkOptions "readeck" "laters" 9546;
   config = {
     sops.secrets.readeck.sopsFile = ../../secrets/env.yaml;
-    services = {
+    services.readeck = {
-      readeck = {
       inherit (cfg) enable;
       environmentFile = config.sops.secrets.readeck.path;
       settings = {
@@ -22,7 +21,5 @@ in
         };
       };
     };
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverse cfg);
-    };
   };
 }

modules/servers/ryot.nix

@@ -19,6 +19,5 @@ in
       };
       volumes = [ "${config.my.postgresSocket}:${config.my.postgresSocket}" ];
     };
-    services.nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverse cfg);
   };
 }

modules/servers/shiori.nix

@@ -7,14 +7,11 @@ in
   options.my.servers.shiori = setup.mkOptions "shiori" "bookmarks" 4368;
   config = lib.mkIf (config.my.servers.shiori.enable && config.my.servers.postgres.enable) {
     sops.secrets = lib.mkIf cfg.enable { shiori.sopsFile = ../../secrets/env.yaml; };
-    services = {
+    services.shiori = lib.mkIf cfg.enable {
-      shiori = lib.mkIf cfg.enable {
       inherit (cfg) port;
       enable = true;
       environmentFile = config.sops.secrets.shiori.path;
       databaseUrl = "postgres:///shiori?host=${config.my.postgresSocket}";
     };
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverse cfg);
-    };
   };
 }

modules/servers/sonarr.nix

@@ -5,11 +5,8 @@ let
 in
 {
   options.my.servers.sonarr = setup.mkOptions "sonarr" "series" 8989;
-  config.services = {
+  config.services.sonarr = lib.mkIf cfg.enable {
-    sonarr = lib.mkIf cfg.enable {
     enable = true;
     group = "piracy";
   };
-    nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
-  };
 }

modules/servers/stash.nix

@@ -11,8 +11,7 @@ in
       "stash/jwt".sopsFile = ../../secrets/env.yaml;
       "stash/session".sopsFile = ../../secrets/env.yaml;
     };
-    services = {
+    services.stash = lib.mkIf cfg.enable {
-      stash = lib.mkIf cfg.enable {
       enable = true;
       group = "piracy";
       mutableSettings = true;
@@ -30,7 +29,5 @@ in
         ];
       };
     };
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverseFix cfg);
-    };
   };
 }

modules/servers/vaultwarden.nix

@@ -12,8 +12,7 @@ in
   options.my.servers.vaultwarden = setup.mkOptions "vaultwarden" "vault" 8222;
   config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable) {
     sops.secrets = lib.mkIf cfg.enable { vaultwarden.sopsFile = ../../secrets/env.yaml; };
-    services = {
+    services.vaultwarden = lib.mkIf cfg.enable {
-      vaultwarden = lib.mkIf cfg.enable {
       enable = true;
       dbBackend = "postgresql";
       package = pkgs.vaultwarden;
@@ -31,7 +30,5 @@ in
         LOG_LEVEL = "warn";
       };
     };
-      nginx.virtualHosts."${cfg.host}" = lib.mkIf cfg.enableProxy (setup.proxyReverse cfg);
-    };
   };
 }