use merge to segment the complex nginx proxy settings

hosts/vps/toggles.nix

@@ -27,11 +27,6 @@ in
     "sh"
   ];
   servers = {
-    postgres.enable = true;
-    plausible = {
-      enable = true;
-      enableProxy = true;
-    };
     nextcloud = {
       enableProxy = true;
       ip = wgServerIp;
@@ -39,28 +34,29 @@ in
     };
   }
   // enableList mkEnabledProxyIp [
+    "audiobookshelf"
     "bazarr"
     "collabora"
     "gitea"
     # "homepage"
+    "isso"
     "jellyfin"
     "kavita"
+    "keycloak"
     "lidarr"
+    "linkwarden"
     "maloja"
     "mealie"
     "metube"
     "microbin"
     "multi-scrobbler"
+    "oauth2-proxy"
+    "plausible"
     "plex"
     # "prowlarr"
     "radarr"
     "sonarr"
-    "yamtrack"
-    "audiobookshelf"
-    "isso"
-    "keycloak"
-    "linkwarden"
-    "oauth2-proxy"
     "vaultwarden"
+    "yamtrack"
   ];
 }

modules/factories/mkserver.nix

@@ -48,6 +48,10 @@ let
       type = lib.types.bool;
       default = false;
     };
+    useDefaultProxy = lib.mkOption {
+      type = lib.types.bool;
+      default = true;
+    };
     certPath = lib.mkOption {
       type = lib.types.nullOr lib.types.path;
       default = null;

modules/network/nginx.nix

@@ -5,25 +5,6 @@
   ...
 }:
 let
-  proxyReverseServices = [
-    "bazarr"
-    "firefox-syncserver"
-    "flame"
-    "flameSecret"
-    "isso"
-    "kavita"
-    "linkwarden"
-    "maloja"
-    "mealie"
-    "metube"
-    "microbin"
-    "multi-scrobbler"
-    "nix-serve"
-    "plausible"
-    "shiori"
-    "vaultwarden"
-    "yamtrack"
-  ];
   proxyReverseFixServices = [
     "atticd"
     "audiobookshelf"
@@ -41,8 +22,7 @@ let
   mkServiceConfig =
     type: services: lib.listToAttrs (map (name: lib.nameValuePair name { inherit type; }) services);
   standardProxyServices =
-    (mkServiceConfig "proxyReverse" proxyReverseServices)
+    (mkServiceConfig "proxyReverseFix" proxyReverseFixServices)
-    // (mkServiceConfig "proxyReverseFix" proxyReverseFixServices)
     // (mkServiceConfig "proxyReversePrivate" proxyReversePrivateServices);
   generateProxyConfig =
     serviceName: serviceConfig:
@@ -59,9 +39,21 @@ let
           throw "Unknown proxy type: ${serviceConfig.type}";
     in
     lib.nameValuePair cfg.host (lib.mkIf cfg.enableProxy (proxyFunc cfg));
+  standardProxyNames = builtins.attrNames standardProxyServices;
+  customProxyServices =
+    config.my.servers
+    |> lib.filterAttrs (
+      name: srv:
+      (srv.enableProxy or false)
+      && (srv.useDefaultProxy or true)
+      && !(builtins.elem name standardProxyNames)
+    )
+    |> lib.mapAttrs (_name: _srv: { type = "proxyReverse"; });
 in
 {
   config = lib.mkIf config.my.enableProxy {
-    services.nginx.virtualHosts = lib.mapAttrs' generateProxyConfig standardProxyServices;
+    services.nginx.virtualHosts = lib.mapAttrs' generateProxyConfig (
+      standardProxyServices // customProxyServices
+    );
   };
 }

modules/servers/jellyfin.nix

@@ -23,22 +23,48 @@ let
 in
 {
   options.my.servers.jellyfin = setup.mkOptions "jellyfin" "flix" 8096;
-  config = lib.mkIf (cfg.enable && config.my.secureHost) {
+  config = lib.mkMerge [
-    environment.systemPackages = [
+    (lib.mkIf (cfg.enable && config.my.secureHost) {
-      pkgs.jellyfin-ffmpeg
+      environment.systemPackages = [
-    ]
+        pkgs.jellyfin-ffmpeg
-    ++ (lib.optional cfg.enableCron [ sub-sync-path ]);
+      ]
-    users.users.jellyfin = {
+      ++ (lib.optional cfg.enableCron [ sub-sync-path ]);
-      uid = 984;
+      users.users.jellyfin = {
-      group = "piracy";
+        uid = 984;
-      isSystemUser = true;
+        group = "piracy";
-    };
+        isSystemUser = true;
-    services = {
+      };
-      jellyfin = {
+      services.jellyfin = {
         inherit (cfg) enable;
         group = "piracy";
       };
-      nginx = lib.mkIf cfg.enableProxy {
+      systemd = lib.mkIf cfg.enableCron {
+        services.sub-sync = {
+          restartIfChanged = true;
+          description = "syncronizes subtitles downloaded & modified today";
+          wantedBy = [ "default.target" ];
+          path = sub-sync-path;
+          serviceConfig = {
+            Restart = "on-failure";
+            RestartSec = 30;
+            ExecStart = "${sub-sync}/bin/sub-sync all";
+            Type = "simple";
+            User = "root";
+          };
+        };
+        timers.sub-sync = {
+          enable = true;
+          description = "syncronizes subtitles downloaded & modified today";
+          wantedBy = [ "timers.target" ];
+          timerConfig = {
+            OnCalendar = "20:00";
+          };
+        };
+      };
+    })
+    (lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
+      my.servers.jellyfin.useDefaultProxy = false;
+      services.nginx = {
         appendHttpConfig = ''
           # JELLYFIN
           proxy_cache_path /var/cache/nginx/jellyfin levels=1:2 keys_zone=jellyfin:100m max_size=15g inactive=1d use_temp_path=off;
@@ -94,29 +120,6 @@ in
           };
         };
       };
-    };
+    })
-    systemd = lib.mkIf cfg.enableCron {
+  ];
-      services.sub-sync = {
-        restartIfChanged = true;
-        description = "syncronizes subtitles downloaded & modified today";
-        wantedBy = [ "default.target" ];
-        path = sub-sync-path;
-        serviceConfig = {
-          Restart = "on-failure";
-          RestartSec = 30;
-          ExecStart = "${sub-sync}/bin/sub-sync all";
-          Type = "simple";
-          User = "root";
-        };
-      };
-      timers.sub-sync = {
-        enable = true;
-        description = "syncronizes subtitles downloaded & modified today";
-        wantedBy = [ "timers.target" ];
-        timerConfig = {
-          OnCalendar = "20:00";
-        };
-      };
-    };
-  };
 }

modules/servers/keycloak.nix

@@ -10,35 +10,38 @@ let
 in
 {
   options.my.servers.keycloak = setup.mkOptions "keycloak" "auth" 8090;
-  config = lib.mkIf (cfg.enable && config.my.secureHost) {
+  config = lib.mkMerge [
-    sops.secrets.postgres-password.sopsFile = ../../secrets/secrets.yaml;
+    (lib.mkIf (cfg.enable && config.my.secureHost) {
-    sops.secrets.keycloak = {
+      sops.secrets.postgres-password.sopsFile = ../../secrets/secrets.yaml;
-      sopsFile = ../../secrets/env.yaml;
+      sops.secrets.keycloak = {
-      restartUnits = [ "keycloak.service" ];
+        sopsFile = ../../secrets/env.yaml;
-    };
+        restartUnits = [ "keycloak.service" ];
-    services.keycloak = {
-      inherit (cfg) enable;
-      database = {
-        type = "postgresql";
-        host = "localhost";
-        createLocally = false;
-        username = "keycloak";
-        name = "keycloak";
-        passwordFile = config.sops.secrets.postgres-password.path;
       };
-      settings = {
+      services.keycloak = {
-        hostname = cfg.host;
+        inherit (cfg) enable;
-        hostname-strict = true;
+        database = {
-        hostname-strict-https = false;
+          type = "postgresql";
-        http-enabled = true;
+          host = "localhost";
-        http-port = cfg.port;
+          createLocally = false;
-        http-host = cfg.ip;
+          username = "keycloak";
-        proxy-headers = "xforwarded";
+          name = "keycloak";
+          passwordFile = config.sops.secrets.postgres-password.path;
+        };
+        settings = {
+          hostname = cfg.host;
+          hostname-strict = true;
+          hostname-strict-https = false;
+          http-enabled = true;
+          http-port = cfg.port;
+          http-host = cfg.ip;
+          proxy-headers = "xforwarded";
+        };
       };
-    };
+      systemd.services.keycloak.serviceConfig.EnvironmentFile = config.sops.secrets.keycloak.path;
-    systemd.services.keycloak.serviceConfig.EnvironmentFile = config.sops.secrets.keycloak.path;
+    })
-    services.nginx.virtualHosts.${cfg.host} = lib.mkIf (cfg.enableProxy && config.my.enableProxy) (
+    (lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
-      inputs.self.lib.proxyReverseFix cfg
+      my.servers.keycloak.useDefaultProxy = false;
-    );
+      services.nginx.virtualHosts.${cfg.host} = inputs.self.lib.proxyReverseFix cfg;
-  };
+    })
+  ];
 }

modules/servers/nextcloud.nix

@@ -42,128 +42,203 @@ in
     collabora = setup.mkOptions "collabora" "collabora" 9980;
     go-vod.enable = lib.mkEnableOption "Go-VOD video transcoding service";
   };
-  config = lib.mkIf (cfg.enable && config.my.servers.postgres.enable && config.my.secureHost) {
+  config = lib.mkMerge [
-    sops.secrets.nextcloud-adminpass = {
+    (lib.mkIf (cfg.enable && config.my.servers.postgres.enable && config.my.secureHost) {
-      owner = config.users.users.nextcloud.name;
+      sops.secrets.nextcloud-adminpass = {
-      inherit (config.users.users.nextcloud) group;
+        owner = config.users.users.nextcloud.name;
-    };
+        inherit (config.users.users.nextcloud) group;
-    nixpkgs.config.permittedInsecurePackages = [
-      "nodejs-14.21.3"
-      "openssl-1.1.1v"
-    ];
-    users.groups.nextcloud = { inherit gid; };
-    users.users.nextcloud = {
-      inherit uid;
-      isSystemUser = true;
-      group = "nextcloud";
-      extraGroups = [ "render" ];
-      packages = builtins.attrValues {
-        inherit exiftool pytensorflow;
-        inherit (pkgs)
-          ffmpeg
-          mediainfo
-          nodejs
-          perl
-          ;
       };
-    };
+      nixpkgs.config.permittedInsecurePackages = [
-    services = {
+        "nodejs-14.21.3"
-      nextcloud = {
+        "openssl-1.1.1v"
-        enable = true;
+      ];
-        https = false; # vps
+      users.groups.nextcloud = { inherit gid; };
-        package = pkgs.nextcloud32;
+      users.users.nextcloud = {
-        appstoreEnable = true;
+        inherit uid;
-        configureRedis = true;
+        isSystemUser = true;
-        extraAppsEnable = true;
+        group = "nextcloud";
-        enableImagemagick = true;
+        extraGroups = [ "render" ];
-        maxUploadSize = "4096M";
+        packages = builtins.attrValues {
-        hostName = cfg.host;
+          inherit exiftool pytensorflow;
-        caching = {
+          inherit (pkgs)
-          redis = true;
+            ffmpeg
-          memcached = true;
+            mediainfo
-          apcu = true;
+            nodejs
+            perl
+            ;
         };
-        config = {
-          adminpassFile = config.sops.secrets.nextcloud-adminpass.path;
-          dbtype = "pgsql";
-          dbhost = config.my.postgresSocket;
-          dbname = "nextcloud";
-        };
-        phpOptions = {
-          catch_workers_output = "yes";
-          display_errors = "stderr";
-          error_reporting = "E_ALL & ~E_DEPRECATED & ~E_STRICT";
-          expose_php = "Off";
-          preview_max_x = 2048;
-          preview_max_y = 2048;
-          short_open_tag = "Off";
-          "opcache.enable_cli" = "1";
-          "opcache.fast_shutdown" = "1";
-          "opcache.interned_strings_buffer" = "16";
-          "opcache.jit" = "1255";
-          "opcache.jit_buffer_size" = "256M";
-          "opcache.max_accelerated_files" = "10000";
-          "opcache.huge_code_pages" = "1";
-          "opcache.enable_file_override" = "1";
-          "opcache.memory_consumption" = "256";
-          "opcache.revalidate_freq" = "60";
-          "opcache.save_comments" = "1";
-          "opcache.validate_timestamps" = "0";
-          "openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
-        };
-        settings = {
-          log_type = "file";
-          loglevel = 1;
-          trusted_proxies = [
-            config.my.localhost
-            config.my.localhost6
-            config.my.ips.router
-            config.my.ips.wg-vps
-          ];
-          trusted_domains = [
-            cfg.host
-            config.my.ips.${config.networking.hostName}
-            "localhost"
-            "cloud.rotehaare.art"
-          ];
-          overwriteprotocol = "https";
-          "overwrite.cli.url" = "${cfg.url}";
-          forwarded_for_headers = [ "HTTP_X_FORWARDED_FOR" ];
-          default_phone_region = "MX";
-          allow_local_remote_servers = true;
-          mail_smtpmode = "sendmail";
-          mail_sendmailmode = "pipe";
-          preview_ffmpeg_path = "${pkgs.ffmpeg}/bin/ffmpeg";
-          "memories.exiftool" = "${exiftool}/bin/exiftool";
-          "memories.ffmpeg_path" = "${pkgs.ffmpeg}/bin/ffmpeg";
-          "memories.ffprobe_path" = "${pkgs.ffmpeg}/bin/ffprobe";
-          enabledPreviewProviders = [
-            "OC\\Preview\\AVI"
-            "OC\\Preview\\BMP"
-            "OC\\Preview\\GIF"
-            "OC\\Preview\\HEIC"
-            "OC\\Preview\\Image"
-            "OC\\Preview\\JPEG"
-            "OC\\Preview\\Krita"
-            "OC\\Preview\\MKV"
-            "OC\\Preview\\MP3"
-            "OC\\Preview\\MP4"
-            "OC\\Preview\\MarkDown"
-            "OC\\Preview\\Movie"
-            "OC\\Preview\\OpenDocument"
-            "OC\\Preview\\PNG"
-            "OC\\Preview\\TIFF"
-            "OC\\Preview\\TXT"
-            "OC\\Preview\\XBitmap"
-          ];
-        };
-        phpExtraExtensions = all: [
-          all.pdlib
-          all.bz2
-        ];
       };
-      nginx.virtualHosts = {
+      services = {
-        "${cfg.host}" = lib.mkIf cfg.enableProxy {
+        nextcloud = {
+          enable = true;
+          https = false; # vps
+          package = pkgs.nextcloud32;
+          appstoreEnable = true;
+          configureRedis = true;
+          extraAppsEnable = true;
+          enableImagemagick = true;
+          maxUploadSize = "4096M";
+          hostName = cfg.host;
+          caching = {
+            redis = true;
+            memcached = true;
+            apcu = true;
+          };
+          config = {
+            adminpassFile = config.sops.secrets.nextcloud-adminpass.path;
+            dbtype = "pgsql";
+            dbhost = config.my.postgresSocket;
+            dbname = "nextcloud";
+          };
+          phpOptions = {
+            catch_workers_output = "yes";
+            display_errors = "stderr";
+            error_reporting = "E_ALL & ~E_DEPRECATED & ~E_STRICT";
+            expose_php = "Off";
+            preview_max_x = 2048;
+            preview_max_y = 2048;
+            short_open_tag = "Off";
+            "opcache.enable_cli" = "1";
+            "opcache.fast_shutdown" = "1";
+            "opcache.interned_strings_buffer" = "16";
+            "opcache.jit" = "1255";
+            "opcache.jit_buffer_size" = "256M";
+            "opcache.max_accelerated_files" = "10000";
+            "opcache.huge_code_pages" = "1";
+            "opcache.enable_file_override" = "1";
+            "opcache.memory_consumption" = "256";
+            "opcache.revalidate_freq" = "60";
+            "opcache.save_comments" = "1";
+            "opcache.validate_timestamps" = "0";
+            "openssl.cafile" = "/etc/ssl/certs/ca-certificates.crt";
+          };
+          settings = {
+            log_type = "file";
+            loglevel = 1;
+            trusted_proxies = [
+              config.my.localhost
+              config.my.localhost6
+              config.my.ips.router
+              config.my.ips.wg-vps
+            ];
+            trusted_domains = [
+              cfg.host
+              config.my.ips.${config.networking.hostName}
+              "localhost"
+              "cloud.rotehaare.art"
+            ];
+            overwriteprotocol = "https";
+            "overwrite.cli.url" = "${cfg.url}";
+            forwarded_for_headers = [ "HTTP_X_FORWARDED_FOR" ];
+            default_phone_region = "MX";
+            allow_local_remote_servers = true;
+            mail_smtpmode = "sendmail";
+            mail_sendmailmode = "pipe";
+            preview_ffmpeg_path = "${pkgs.ffmpeg}/bin/ffmpeg";
+            "memories.exiftool" = "${exiftool}/bin/exiftool";
+            "memories.ffmpeg_path" = "${pkgs.ffmpeg}/bin/ffmpeg";
+            "memories.ffprobe_path" = "${pkgs.ffmpeg}/bin/ffprobe";
+            enabledPreviewProviders = [
+              "OC\\Preview\\AVI"
+              "OC\\Preview\\BMP"
+              "OC\\Preview\\GIF"
+              "OC\\Preview\\HEIC"
+              "OC\\Preview\\Image"
+              "OC\\Preview\\JPEG"
+              "OC\\Preview\\Krita"
+              "OC\\Preview\\MKV"
+              "OC\\Preview\\MP3"
+              "OC\\Preview\\MP4"
+              "OC\\Preview\\MarkDown"
+              "OC\\Preview\\Movie"
+              "OC\\Preview\\OpenDocument"
+              "OC\\Preview\\PNG"
+              "OC\\Preview\\TIFF"
+              "OC\\Preview\\TXT"
+              "OC\\Preview\\XBitmap"
+            ];
+          };
+          phpExtraExtensions = all: [
+            all.pdlib
+            all.bz2
+          ];
+        };
+      };
+      virtualisation.oci-containers.containers = {
+        go-vod = lib.mkIf config.my.servers.go-vod.enable {
+          autoStart = true;
+          image = "radialapps/go-vod";
+          environment = {
+            TZ = config.my.timeZone;
+            NEXTCLOUD_HOST = "https://${config.services.nextcloud.hostName}";
+            NVIDIA_VISIBLE_DEVICES = "all";
+          };
+          volumes = [ "ncdata:/var/www/html:ro" ];
+          extraOptions = [
+            "--device=/dev/dri" # VA-API (omit for NVENC)
+          ];
+        };
+        collabora = lib.mkIf cfgC.enable {
+          autoStart = true;
+          image = "collabora/code:latest";
+          ports = [ "${toString cfgC.port}:${toString cfgC.port}" ];
+          environment = {
+            TZ = config.my.timeZone;
+            domain = cfg.host;
+            aliasgroup1 = "${cfg.url}:443";
+            aliasgroup2 = "https://cloud.rotehaare.art:443";
+            server_name = cfgC.host;
+            dictionaries = "en_CA en_US es_MX es_ES fr_FR it pt_BR ru";
+            extra_params = ''
+              --o:ssl.enable=false
+              --o:ssl.termination=true
+              --o:remote_font_config.url=${cfg.url}/apps/richdocuments/settings/fonts.json
+              --o:logging.level=information
+            '';
+            DONT_GEN_SSL_CERT = "1";
+            SLEEPFORDEBUGGER = "0";
+          };
+          extraOptions = [
+            "--cap-add"
+            "MKNOD"
+          ];
+        };
+      };
+      systemd = lib.mkIf cfg.enableCron {
+        services = {
+          nextcloud-cron.path = [ pkgs.perl ];
+          nextcloud-cronjob =
+            let
+              inherit (inputs.jawz-scripts.packages.x86_64-linux) nextcloud-cronjob;
+            in
+            {
+              description = "Runs various nextcloud-related cronjobs";
+              wantedBy = [ "multi-user.target" ];
+              path = [
+                pkgs.bash
+                nextcloud-cronjob
+              ];
+              serviceConfig = {
+                Restart = "on-failure";
+                RestartSec = 30;
+                ExecStart = "${nextcloud-cronjob}/bin/nextcloud-cronjob";
+              };
+            };
+        };
+        timers.nextcloud-cronjob = {
+          enable = true;
+          description = "Runs various nextcloud-related cronjobs";
+          wantedBy = [ "timers.target" ];
+          timerConfig = {
+            OnCalendar = "*:0/10";
+          };
+        };
+      };
+    })
+    (lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
+      my.servers.nextcloud.useDefaultProxy = false;
+      services.nginx.virtualHosts = {
+        "${cfg.host}" = {
           forceSSL = false; # vps
           enableACME = false; # vps
           http2 = false; # vps
@@ -243,76 +318,6 @@ in
           };
         };
       };
-    };
+    })
-    virtualisation.oci-containers.containers = {
+  ];
-      go-vod = lib.mkIf config.my.servers.go-vod.enable {
-        autoStart = true;
-        image = "radialapps/go-vod";
-        environment = {
-          TZ = config.my.timeZone;
-          NEXTCLOUD_HOST = "https://${config.services.nextcloud.hostName}";
-          NVIDIA_VISIBLE_DEVICES = "all";
-        };
-        volumes = [ "ncdata:/var/www/html:ro" ];
-        extraOptions = [
-          "--device=/dev/dri" # VA-API (omit for NVENC)
-        ];
-      };
-      collabora = lib.mkIf cfgC.enable {
-        autoStart = true;
-        image = "collabora/code:latest";
-        ports = [ "${toString cfgC.port}:${toString cfgC.port}" ];
-        environment = {
-          TZ = config.my.timeZone;
-          domain = cfg.host;
-          aliasgroup1 = "${cfg.url}:443";
-          aliasgroup2 = "https://cloud.rotehaare.art:443";
-          server_name = cfgC.host;
-          dictionaries = "en_CA en_US es_MX es_ES fr_FR it pt_BR ru";
-          extra_params = ''
-            --o:ssl.enable=false
-            --o:ssl.termination=true
-            --o:remote_font_config.url=${cfg.url}/apps/richdocuments/settings/fonts.json
-            --o:logging.level=information
-          '';
-          DONT_GEN_SSL_CERT = "1";
-          SLEEPFORDEBUGGER = "0";
-        };
-        extraOptions = [
-          "--cap-add"
-          "MKNOD"
-        ];
-      };
-    };
-    systemd = lib.mkIf cfg.enableCron {
-      services = {
-        nextcloud-cron.path = [ pkgs.perl ];
-        nextcloud-cronjob =
-          let
-            inherit (inputs.jawz-scripts.packages.x86_64-linux) nextcloud-cronjob;
-          in
-          {
-            description = "Runs various nextcloud-related cronjobs";
-            wantedBy = [ "multi-user.target" ];
-            path = [
-              pkgs.bash
-              nextcloud-cronjob
-            ];
-            serviceConfig = {
-              Restart = "on-failure";
-              RestartSec = 30;
-              ExecStart = "${nextcloud-cronjob}/bin/nextcloud-cronjob";
-            };
-          };
-      };
-      timers.nextcloud-cronjob = {
-        enable = true;
-        description = "Runs various nextcloud-related cronjobs";
-        wantedBy = [ "timers.target" ];
-        timerConfig = {
-          OnCalendar = "*:0/10";
-        };
-      };
-    };
-  };
 }

modules/servers/plex.nix

@@ -9,51 +9,52 @@ let
 in
 {
   options.my.servers.plex = setup.mkOptions "plex" "plex" 32400;
-  config = lib.mkIf (cfg.enable && config.my.secureHost) {
+  config = lib.mkMerge [
-    users.users.plex = {
+    (lib.mkIf (cfg.enable && config.my.secureHost) {
-      uid = 193;
+      users.users.plex = {
-      group = "piracy";
+        uid = 193;
-      isSystemUser = true;
+        group = "piracy";
-    };
+        isSystemUser = true;
-    services = {
+      };
-      plex = {
+      services.plex = {
         inherit (cfg) enable;
         group = "piracy";
       };
-      nginx = lib.mkIf cfg.enableProxy {
+    })
-        virtualHosts."${cfg.host}" = {
+    (lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
-          forceSSL = true;
+      my.servers.plex.useDefaultProxy = false;
-          enableACME = true;
+      services.nginx.virtualHosts."${cfg.host}" = {
-          http2 = true;
+        forceSSL = true;
-          serverAliases = [
+        enableACME = true;
-            "plex.rotehaare.art"
+        http2 = true;
-          ];
+        serverAliases = [
-          extraConfig = ''
+          "plex.rotehaare.art"
-            # Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause
+        ];
-            send_timeout 100m;
+        extraConfig = ''
-            # Plex headers
+          # Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause
-            proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier;
+          send_timeout 100m;
-            proxy_set_header X-Plex-Device $http_x_plex_device;
+          # Plex headers
-            proxy_set_header X-Plex-Device-Name $http_x_plex_device_name;
+          proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier;
-            proxy_set_header X-Plex-Platform $http_x_plex_platform;
+          proxy_set_header X-Plex-Device $http_x_plex_device;
-            proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version;
+          proxy_set_header X-Plex-Device-Name $http_x_plex_device_name;
-            proxy_set_header X-Plex-Product $http_x_plex_product;
+          proxy_set_header X-Plex-Platform $http_x_plex_platform;
-            proxy_set_header X-Plex-Token $http_x_plex_token;
+          proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version;
-            proxy_set_header X-Plex-Version $http_x_plex_version;
+          proxy_set_header X-Plex-Product $http_x_plex_product;
-            proxy_set_header X-Plex-Nocache $http_x_plex_nocache;
+          proxy_set_header X-Plex-Token $http_x_plex_token;
-            proxy_set_header X-Plex-Provides $http_x_plex_provides;
+          proxy_set_header X-Plex-Version $http_x_plex_version;
-            proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor;
+          proxy_set_header X-Plex-Nocache $http_x_plex_nocache;
-            proxy_set_header X-Plex-Model $http_x_plex_model;
+          proxy_set_header X-Plex-Provides $http_x_plex_provides;
-            # Buffering off send to the client as soon as the data is received from Plex.
+          proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor;
-            proxy_redirect off;
+          proxy_set_header X-Plex-Model $http_x_plex_model;
-            proxy_buffering off;
+          # Buffering off send to the client as soon as the data is received from Plex.
-          '';
+          proxy_redirect off;
-          locations."/" = {
+          proxy_buffering off;
-            proxyPass = cfg.local;
+        '';
-            proxyWebsockets = true;
+        locations."/" = {
-          };
+          proxyPass = cfg.local;
+          proxyWebsockets = true;
         };
       };
-    };
+    })
-  };
+  ];
 }

modules/servers/synapse.nix

@@ -25,42 +25,42 @@ in
     synapse = setup.mkOptions "synapse" "pYLemuAfsrzNBaH77xSu" 8008;
     element = setup.mkOptions "element" "55a608953f6d64c199" 5345;
   };
-  config = lib.mkIf (cfg.enable && config.my.secureHost) {
+  config = lib.mkMerge [
-    my.servers = {
+    (lib.mkIf (cfg.enable && config.my.secureHost) {
-      synapse = { inherit domain; };
+      my.servers = {
-      element = { inherit domain; };
+        synapse = { inherit domain; };
-    };
+        element = { inherit domain; };
-    users.groups.matrix-synapse = { inherit gid; };
+      };
-    users.users.matrix-synapse = {
+      users.groups.matrix-synapse = { inherit gid; };
-      inherit uid;
+      users.users.matrix-synapse = {
-      isSystemUser = true;
+        inherit uid;
-      group = "matrix-synapse";
+        isSystemUser = true;
-    };
-    sops.secrets = {
-      synapse = {
-        sopsFile = ../../secrets/env.yaml;
-        owner = "matrix-synapse";
         group = "matrix-synapse";
       };
-      "iqQCY4iAWO-ca/pem" = {
+      sops.secrets = {
-        sopsFile = ../../secrets/certs.yaml;
+        synapse = {
-        owner = "nginx";
+          sopsFile = ../../secrets/env.yaml;
-        group = "nginx";
+          owner = "matrix-synapse";
+          group = "matrix-synapse";
+        };
+        "iqQCY4iAWO-ca/pem" = {
+          sopsFile = ../../secrets/certs.yaml;
+          owner = "nginx";
+          group = "nginx";
+        };
+        "matrix/key" = {
+          sopsFile = ../../secrets/certs.yaml;
+          owner = "matrix-synapse";
+          group = "matrix-synapse";
+        };
+        "matrix/cert" = {
+          sopsFile = ../../secrets/certs.yaml;
+          owner = "matrix-synapse";
+          group = "matrix-synapse";
+        };
       };
-      "matrix/key" = {
+      networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
-        sopsFile = ../../secrets/certs.yaml;
+      services.matrix-synapse = {
-        owner = "matrix-synapse";
-        group = "matrix-synapse";
-      };
-      "matrix/cert" = {
-        sopsFile = ../../secrets/certs.yaml;
-        owner = "matrix-synapse";
-        group = "matrix-synapse";
-      };
-    };
-    networking.firewall.allowedTCPPorts = lib.mkIf (!cfg.isLocal) [ cfg.port ];
-    services = {
-      matrix-synapse = {
         inherit (cfg) enable;
         extraConfigFiles = [
           config.sops.secrets.synapse.path
@@ -100,7 +100,10 @@ in
           ];
         };
       };
-      nginx.virtualHosts = lib.mkIf cfg.enableProxy {
+    })
+    (lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
+      my.servers.synapse.useDefaultProxy = false;
+      services.nginx.virtualHosts = {
         "${cfgE.host}" = {
           enableACME = true;
           forceSSL = true;
@@ -132,6 +135,6 @@ in
           # '';
         };
       };
-    };
+    })
-  };
+  ];
 }