use merge to segment the complex nginx proxy settings

hosts/vps/toggles.nix

@@ -27,11 +27,6 @@ in
     "sh"
   ];
   servers = {
-    postgres.enable = true;
-    plausible = {
-      enable = true;
-      enableProxy = true;
-    };
     nextcloud = {
       enableProxy = true;
       ip = wgServerIp;
@@ -39,28 +34,29 @@ in
     };
   }
   // enableList mkEnabledProxyIp [
+    "audiobookshelf"
     "bazarr"
     "collabora"
     "gitea"
     # "homepage"
+    "isso"
     "jellyfin"
     "kavita"
+    "keycloak"
     "lidarr"
+    "linkwarden"
     "maloja"
     "mealie"
     "metube"
     "microbin"
     "multi-scrobbler"
+    "oauth2-proxy"
+    "plausible"
     "plex"
     # "prowlarr"
     "radarr"
     "sonarr"
-    "yamtrack"
-    "audiobookshelf"
-    "isso"
-    "keycloak"
-    "linkwarden"
-    "oauth2-proxy"
     "vaultwarden"
+    "yamtrack"
   ];
 }

modules/factories/mkserver.nix

@@ -48,6 +48,10 @@ let
       type = lib.types.bool;
       default = false;
     };
+    useDefaultProxy = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+    };
     certPath = lib.mkOption {
       type = lib.types.nullOr lib.types.path;
       default = null;

modules/network/nginx.nix

@@ -5,25 +5,6 @@
   ...
 }:
 let
-  proxyReverseServices = [
-    "bazarr"
-    "firefox-syncserver"
-    "flame"
-    "flameSecret"
-    "isso"
-    "kavita"
-    "linkwarden"
-    "maloja"
-    "mealie"
-    "metube"
-    "microbin"
-    "multi-scrobbler"
-    "nix-serve"
-    "plausible"
-    "shiori"
-    "vaultwarden"
-    "yamtrack"
-  ];
   proxyReverseFixServices = [
     "atticd"
     "audiobookshelf"
@@ -41,8 +22,7 @@ let
   mkServiceConfig =
     type: services: lib.listToAttrs (map (name: lib.nameValuePair name { inherit type; }) services);
   standardProxyServices =
-    (mkServiceConfig "proxyReverse" proxyReverseServices)
+    (mkServiceConfig "proxyReverseFix" proxyReverseFixServices)
-    // (mkServiceConfig "proxyReverseFix" proxyReverseFixServices)
     // (mkServiceConfig "proxyReversePrivate" proxyReversePrivateServices);
   generateProxyConfig =
     serviceName: serviceConfig:
@@ -59,9 +39,21 @@ let
           throw "Unknown proxy type: ${serviceConfig.type}";
     in
     lib.nameValuePair cfg.host (lib.mkIf cfg.enableProxy (proxyFunc cfg));
+  standardProxyNames = builtins.attrNames standardProxyServices;
+  customProxyServices =
+    config.my.servers
+    |> lib.filterAttrs (
+      name: srv:
+      (srv.enableProxy or false)
+      && (srv.useDefaultProxy or true)
+      && !(builtins.elem name standardProxyNames)
+    )
+    |> lib.mapAttrs (_name: _srv: { type = "proxyReverse"; });
 in
 {
   config = lib.mkIf config.my.enableProxy {
-    services.nginx.virtualHosts = lib.mapAttrs' generateProxyConfig standardProxyServices;
+    services.nginx.virtualHosts = lib.mapAttrs' generateProxyConfig (
+      standardProxyServices // customProxyServices
+    );
   };
 }

modules/servers/jellyfin.nix

@@ -23,7 +23,8 @@ let
 in
 {
   options.my.servers.jellyfin = setup.mkOptions "jellyfin" "flix" 8096;
-  config = lib.mkIf (cfg.enable && config.my.secureHost) {
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable && config.my.secureHost) {
       environment.systemPackages = [
         pkgs.jellyfin-ffmpeg
       ]
@@ -33,12 +34,37 @@ in
         group = "piracy";
         isSystemUser = true;
       };
-    services = {
+      services.jellyfin = {
-      jellyfin = {
         inherit (cfg) enable;
         group = "piracy";
       };
-      nginx = lib.mkIf cfg.enableProxy {
+      systemd = lib.mkIf cfg.enableCron {
+        services.sub-sync = {
+          restartIfChanged = true;
+          description = "syncronizes subtitles downloaded & modified today";
+          wantedBy = [ "default.target" ];
+          path = sub-sync-path;
+          serviceConfig = {
+            Restart = "on-failure";
+            RestartSec = 30;
+            ExecStart = "${sub-sync}/bin/sub-sync all";
+            Type = "simple";
+            User = "root";
+          };
+        };
+        timers.sub-sync = {
+          enable = true;
+          description = "syncronizes subtitles downloaded & modified today";
+          wantedBy = [ "timers.target" ];
+          timerConfig = {
+            OnCalendar = "20:00";
+          };
+        };
+      };
+    })
+    (lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
+      my.servers.jellyfin.useDefaultProxy = false;
+      services.nginx = {
         appendHttpConfig = ''
           # JELLYFIN
           proxy_cache_path /var/cache/nginx/jellyfin levels=1:2 keys_zone=jellyfin:100m max_size=15g inactive=1d use_temp_path=off;
@@ -94,29 +120,6 @@ in
           };
         };
       };
-    };
+    })
-    systemd = lib.mkIf cfg.enableCron {
+  ];
-      services.sub-sync = {
-        restartIfChanged = true;
-        description = "syncronizes subtitles downloaded & modified today";
-        wantedBy = [ "default.target" ];
-        path = sub-sync-path;
-        serviceConfig = {
-          Restart = "on-failure";
-          RestartSec = 30;
-          ExecStart = "${sub-sync}/bin/sub-sync all";
-          Type = "simple";
-          User = "root";
-        };
-      };
-      timers.sub-sync = {
-        enable = true;
-        description = "syncronizes subtitles downloaded & modified today";
-        wantedBy = [ "timers.target" ];
-        timerConfig = {
-          OnCalendar = "20:00";
-        };
-      };
-    };
-  };
 }

modules/servers/keycloak.nix

@@ -10,7 +10,8 @@ let
 in
 {
   options.my.servers.keycloak = setup.mkOptions "keycloak" "auth" 8090;
-  config = lib.mkIf (cfg.enable && config.my.secureHost) {
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable && config.my.secureHost) {
       sops.secrets.postgres-password.sopsFile = ../../secrets/secrets.yaml;
       sops.secrets.keycloak = {
         sopsFile = ../../secrets/env.yaml;
@@ -37,8 +38,10 @@ in
         };
       };
       systemd.services.keycloak.serviceConfig.EnvironmentFile = config.sops.secrets.keycloak.path;
-    services.nginx.virtualHosts.${cfg.host} = lib.mkIf (cfg.enableProxy && config.my.enableProxy) (
+    })
-      inputs.self.lib.proxyReverseFix cfg
+    (lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
-    );
+      my.servers.keycloak.useDefaultProxy = false;
-  };
+      services.nginx.virtualHosts.${cfg.host} = inputs.self.lib.proxyReverseFix cfg;
+    })
+  ];
 }

modules/servers/nextcloud.nix

@@ -42,7 +42,8 @@ in
     collabora = setup.mkOptions "collabora" "collabora" 9980;
     go-vod.enable = lib.mkEnableOption "Go-VOD video transcoding service";
   };
-  config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable && config.my.secureHost) {
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable && config.my.servers.postgres.enable && config.my.secureHost) {
       sops.secrets.nextcloud-adminpass = {
         owner = config.users.users.nextcloud.name;
         inherit (config.users.users.nextcloud) group;
@@ -162,8 +163,82 @@ in
             all.bz2
           ];
         };
-      nginx.virtualHosts = {
+      };
-        "${cfg.host}" = lib.mkIf cfg.enableProxy {
+      virtualisation.oci-containers.containers = {
+        go-vod = lib.mkIf config.my.servers.go-vod.enable {
+          autoStart = true;
+          image = "radialapps/go-vod";
+          environment = {
+            TZ = config.my.timeZone;
+            NEXTCLOUD_HOST = "https://${config.services.nextcloud.hostName}";
+            NVIDIA_VISIBLE_DEVICES = "all";
+          };
+          volumes = [ "ncdata:/var/www/html:ro" ];
+          extraOptions = [
+            "--device=/dev/dri" # VA-API (omit for NVENC)
+          ];
+        };
+        collabora = lib.mkIf cfgC.enable {
+          autoStart = true;
+          image = "collabora/code:latest";
+          ports = [ "${toString cfgC.port}:${toString cfgC.port}" ];
+          environment = {
+            TZ = config.my.timeZone;
+            domain = cfg.host;
+            aliasgroup1 = "${cfg.url}:443";
+            aliasgroup2 = "https://cloud.rotehaare.art:443";
+            server_name = cfgC.host;
+            dictionaries = "en_CA en_US es_MX es_ES fr_FR it pt_BR ru";
+            extra_params = ''
+              --o:ssl.enable=false
+              --o:ssl.termination=true
+              --o:remote_font_config.url=${cfg.url}/apps/richdocuments/settings/fonts.json
+              --o:logging.level=information
+            '';
+            DONT_GEN_SSL_CERT = "1";
+            SLEEPFORDEBUGGER = "0";
+          };
+          extraOptions = [
+            "--cap-add"
+            "MKNOD"
+          ];
+        };
+      };
+      systemd = lib.mkIf cfg.enableCron {
+        services = {
+          nextcloud-cron.path = [ pkgs.perl ];
+          nextcloud-cronjob =
+            let
+              inherit (inputs.jawz-scripts.packages.x86_64-linux) nextcloud-cronjob;
+            in
+            {
+              description = "Runs various nextcloud-related cronjobs";
+              wantedBy = [ "multi-user.target" ];
+              path = [
+                pkgs.bash
+                nextcloud-cronjob
+              ];
+              serviceConfig = {
+                Restart = "on-failure";
+                RestartSec = 30;
+                ExecStart = "${nextcloud-cronjob}/bin/nextcloud-cronjob";
+              };
+            };
+        };
+        timers.nextcloud-cronjob = {
+          enable = true;
+          description = "Runs various nextcloud-related cronjobs";
+          wantedBy = [ "timers.target" ];
+          timerConfig = {
+            OnCalendar = "*:0/10";
+          };
+        };
+      };
+    })
+    (lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
+      my.servers.nextcloud.useDefaultProxy = false;
+      services.nginx.virtualHosts = {
+        "${cfg.host}" = {
           forceSSL = false; # vps
           enableACME = false; # vps
           http2 = false; # vps
@@ -243,76 +318,6 @@ in
           };
         };
       };
-    };
+    })
-    virtualisation.oci-containers.containers = {
-      go-vod = lib.mkIf config.my.servers.go-vod.enable {
-        autoStart = true;
-        image = "radialapps/go-vod";
-        environment = {
-          TZ = config.my.timeZone;
-          NEXTCLOUD_HOST = "https://${config.services.nextcloud.hostName}";
-          NVIDIA_VISIBLE_DEVICES = "all";
-        };
-        volumes = [ "ncdata:/var/www/html:ro" ];
-        extraOptions = [
-          "--device=/dev/dri" # VA-API (omit for NVENC)
   ];
-      };
-      collabora = lib.mkIf cfgC.enable {
-        autoStart = true;
-        image = "collabora/code:latest";
-        ports = [ "${toString cfgC.port}:${toString cfgC.port}" ];
-        environment = {
-          TZ = config.my.timeZone;
-          domain = cfg.host;
-          aliasgroup1 = "${cfg.url}:443";
-          aliasgroup2 = "https://cloud.rotehaare.art:443";
-          server_name = cfgC.host;
-          dictionaries = "en_CA en_US es_MX es_ES fr_FR it pt_BR ru";
-          extra_params = ''
-            --o:ssl.enable=false
-            --o:ssl.termination=true
-            --o:remote_font_config.url=${cfg.url}/apps/richdocuments/settings/fonts.json
-            --o:logging.level=information
-          '';
-          DONT_GEN_SSL_CERT = "1";
-          SLEEPFORDEBUGGER = "0";
-        };
-        extraOptions = [
-          "--cap-add"
-          "MKNOD"
-        ];
-      };
-    };
-    systemd = lib.mkIf cfg.enableCron {
-      services = {
-        nextcloud-cron.path = [ pkgs.perl ];
-        nextcloud-cronjob =
-          let
-            inherit (inputs.jawz-scripts.packages.x86_64-linux) nextcloud-cronjob;
-          in
-          {
-            description = "Runs various nextcloud-related cronjobs";
-            wantedBy = [ "multi-user.target" ];
-            path = [
-              pkgs.bash
-              nextcloud-cronjob
-            ];
-            serviceConfig = {
-              Restart = "on-failure";
-              RestartSec = 30;
-              ExecStart = "${nextcloud-cronjob}/bin/nextcloud-cronjob";
-            };
-          };
-      };
-      timers.nextcloud-cronjob = {
-        enable = true;
-        description = "Runs various nextcloud-related cronjobs";
-        wantedBy = [ "timers.target" ];
-        timerConfig = {
-          OnCalendar = "*:0/10";
-        };
-      };
-    };
-  };
 }

modules/servers/plex.nix

@@ -9,19 +9,21 @@ let
 in
 {
   options.my.servers.plex = setup.mkOptions "plex" "plex" 32400;
-  config = lib.mkIf (cfg.enable && config.my.secureHost) {
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable && config.my.secureHost) {
       users.users.plex = {
         uid = 193;
         group = "piracy";
         isSystemUser = true;
       };
-    services = {
+      services.plex = {
-      plex = {
         inherit (cfg) enable;
         group = "piracy";
       };
-      nginx = lib.mkIf cfg.enableProxy {
+    })
-        virtualHosts."${cfg.host}" = {
+    (lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
+      my.servers.plex.useDefaultProxy = false;
+      services.nginx.virtualHosts."${cfg.host}" = {
         forceSSL = true;
         enableACME = true;
         http2 = true;
@@ -53,7 +55,6 @@ in
           proxyWebsockets = true;
         };
       };
-      };
+    })
-    };
+  ];
-  };
 }

modules/servers/synapse.nix

@@ -25,7 +25,8 @@ in
     synapse = setup.mkOptions "synapse" "pYLemuAfsrzNBaH77xSu" 8008;
     element = setup.mkOptions "element" "55a608953f6d64c199" 5345;
   };
-  config = lib.mkIf (cfg.enable && config.my.secureHost) {
+  config = lib.mkMerge [
+    (lib.mkIf (cfg.enable && config.my.secureHost) {
       my.servers = {
         synapse = { inherit domain; };
         element = { inherit domain; };
@@ -59,8 +60,7 @@ in
         };
       };
       networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
-    services = {
+      services.matrix-synapse = {
-      matrix-synapse = {
         inherit (cfg) enable;
         extraConfigFiles = [
           config.sops.secrets.synapse.path
@@ -100,7 +100,10 @@ in
           ];
         };
       };
-      nginx.virtualHosts = lib.mkIf cfg.enableProxy {
+    })
+    (lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
+      my.servers.synapse.useDefaultProxy = false;
+      services.nginx.virtualHosts = {
         "${cfgE.host}" = {
           enableACME = true;
           forceSSL = true;
@@ -132,6 +135,6 @@ in
           # '';
         };
       };
-    };
+    })
-  };
+  ];
 }