99 lines
2.7 KiB
Nix
99 lines
2.7 KiB
Nix
{
|
|
lib,
|
|
config,
|
|
...
|
|
}:
|
|
let
|
|
cfg = config.my.websites.portfolio;
|
|
issoCfg = config.my.servers.isso;
|
|
hugoSecurityHeaders = ''
|
|
add_header X-Frame-Options "SAMEORIGIN" always;
|
|
add_header X-Content-Type-Options "nosniff" always;
|
|
add_header X-XSS-Protection "1; mode=block" always;
|
|
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
|
|
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
|
|
'';
|
|
hugoLocations = {
|
|
"/" = {
|
|
extraConfig = ''
|
|
try_files $uri $uri/ /index.html;
|
|
${hugoSecurityHeaders}
|
|
'';
|
|
};
|
|
"~* \\.html$" = {
|
|
extraConfig = ''
|
|
try_files $uri $uri/ /index.html;
|
|
${hugoSecurityHeaders}
|
|
'';
|
|
};
|
|
"~* \\.(jpg|jpeg|png|gif|ico|css|js|svg|woff|woff2|ttf|xml)$" = {
|
|
extraConfig = ''
|
|
expires 1y;
|
|
add_header Cache-Control "public, max-age=31536000, immutable";
|
|
${hugoSecurityHeaders}
|
|
'';
|
|
};
|
|
"~ /\\.(?!well-known).*" = {
|
|
extraConfig = ''
|
|
return 404;
|
|
${hugoSecurityHeaders}
|
|
'';
|
|
};
|
|
"= /js/script.js" = {
|
|
proxyPass = "https://analytics.lebubu.org";
|
|
extraConfig = ''
|
|
proxy_set_header Host analytics.lebubu.org;
|
|
rewrite ^ /js/script.file-downloads.hash.outbound-links.js break;
|
|
${hugoSecurityHeaders}
|
|
'';
|
|
};
|
|
"= /api/event" = {
|
|
proxyPass = "https://analytics.lebubu.org";
|
|
extraConfig = ''
|
|
proxy_set_header Host analytics.lebubu.org;
|
|
${hugoSecurityHeaders}
|
|
'';
|
|
};
|
|
};
|
|
in
|
|
{
|
|
options.my.websites.portfolio = {
|
|
enableProxy = lib.mkEnableOption "portfolio and blog static sites";
|
|
};
|
|
config = lib.mkIf (cfg.enableProxy && config.my.enableProxy) {
|
|
services.nginx.virtualHosts = {
|
|
"www.danilo-reyes.com" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
globalRedirect = "danilo-reyes.com";
|
|
};
|
|
"www.blog.danilo-reyes.com" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
globalRedirect = "blog.danilo-reyes.com";
|
|
};
|
|
"danilo-reyes.com" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
root = "/var/www/html/portfolio";
|
|
locations = hugoLocations;
|
|
};
|
|
"blog.danilo-reyes.com" = {
|
|
forceSSL = true;
|
|
enableACME = true;
|
|
root = "/var/www/html/blog";
|
|
locations = hugoLocations // {
|
|
"^~ /isso" = {
|
|
proxyPass = "http://${issoCfg.ip}:${toString issoCfg.port}";
|
|
extraConfig = ''
|
|
rewrite ^/isso/?(.*)$ /$1 break;
|
|
proxy_set_header Host $host;
|
|
${hugoSecurityHeaders}
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|