Modularized nginx config.

machines/Ophanim/options.nix

@@ -7,7 +7,7 @@ with lib;
     ../../options/machine.nix 
   ];
 
-  config.machine = {
+  config.machine = rec {
     hostName = "Ophanim";
     administrators = [ { name = "derped"; id = 1337; } ];
     domain = "ophanim.de";
@@ -32,6 +32,14 @@ with lib;
       "openssh"
       "webblog"
     ];
+    vHosts = (let base = domain; in [
+      { domain = base; service = "simple"; }
+      { domain = "builder.${base}"; service = "hydra"; }
+      { domain = "cache.${base}"; service = "cache"; }
+      { domain = "storage.${base}"; service = "nextcloud"; }
+      { domain = "mail.${base}"; service = "mail"; }
+      { domain = "git.${base}"; service = "gitea"; }
+    ]);
     firewall = {
       allowPing = false;
       allowedUDPPorts = [ 22 80 443 ];

options/machine.nix

@@ -47,6 +47,12 @@ with lib;
         The Machines domain name.
       '';
     };
+    vHosts = mkOption {
+      type = types.listOf types.attrs;
+      description = ''
+        Domain - Service mappings for nginx vHost config.
+      '';
+    };
     firewall = {
         allowPing = mkOption {
           type = types.bool;

services/nginx.nix

@@ -10,9 +10,26 @@
 { config, lib, pkgs, ... }:
 
 with lib;
+with builtins;
 
 mkIf (elem "nginx" config.machine.services) {
-  services.nginx = {
+  services.nginx = let
+    vHostConfigs = listToAttrs (map
+      (name: {
+        name = (replaceStrings [ ".nix" ] [ "" ] name);
+        value = (import (./. + (toPath "/nginx_vHosts/${name}")) { inherit config lib pkgs; });})
+      (attrNames (readDir ./nginx_vHosts)));
+
+    mkVHost = vHost: {
+      name = vHost.domain;
+      value = {
+        enableACME = true;
+        forceSSL = true;
+      } // vHostConfigs."${vHost.service}"; };
+
+    vHosts = listToAttrs (map mkVHost config.machine.vHosts);
+
+  in {
     enable = true;
     recommendedGzipSettings = true;
     recommendedOptimisation = true;
@@ -30,171 +47,6 @@ mkIf (elem "nginx" config.machine.services) {
       add_header X-Content-Type-Options nosniff;
       add_header X-XSS-Protection "1; mode=block";
     '';
-    virtualHosts = {
+    virtualHosts = vHosts;
-      "${config.machine.domain}" = {
-        enableACME = true;
-        forceSSL = true;
-        root = "/var/www";
-      };
-      "builder.${config.machine.domain}" = mkIf config.services.hydra.enable {
-        enableACME = true;
-        forceSSL = true;
-        extraConfig = ''
-          location / {
-            proxy_pass http://${config.services.hydra.listenHost}:${toString config.services.hydra.port};
-            proxy_set_header Host $http_host;
-            proxy_set_header REMOTE_ADDR $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto https;
-          }
-        '';
-      };
-      "cache.${config.machine.domain}" = mkIf config.services.nix-serve.enable {
-        enableACME = true;
-        forceSSL = true;
-        extraConfig = ''
-          location / {
-            proxy_pass http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port};
-            proxy_set_header Host $http_host;
-            proxy_set_header REMOTE_ADDR $remote_addr;
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Forwarded-Proto https;
-          }
-        '';
-      };
-      "mail.${config.machine.domain}" = mkIf config.mailserver.enable {
-        serverName = config.mailserver.fqdn;
-        enableACME = true;
-        forceSSL = true;
-      };
-
-      "storage.${config.machine.domain}" = mkIf config.services.nextcloud.enable {
-        root = pkgs.nextcloud;
-        enableACME = config.services.nextcloud.https;
-        forceSSL = config.services.nextcloud.https;
-        locations = {
-          "= /robots.txt" = {
-            priority = 100;
-            extraConfig = ''
-              allow all;
-              log_not_found off;
-              access_log off;
-            '';
-          };
-          "/" = {
-            priority = 200;
-            extraConfig = "rewrite ^ /index.php$request_uri;";
-          };
-          "~ ^/store-apps" = {
-            priority = 201;
-            extraConfig = "root ${config.services.nextcloud.home};";
-          };
-          "= /.well-known/carddav" = {
-            priority = 210;
-            extraConfig = "return 301 $scheme://$host/remote.php/dav;";
-          };
-          "= /.well-known/caldav" = {
-            priority = 210;
-            extraConfig = "return 301 $scheme://$host/remote.php/dav;";
-          };
-          "~ ^\\/(?:build|tests|config|lib|3rdparty|templates|data)\\/" = {
-            priority = 300;
-            extraConfig = "deny all;";
-          };
-          "~ ^\\/(?:\\.|autotest|occ|issue|indie|db_|console)" = {
-            priority = 300;
-            extraConfig = "deny all;";
-          };
-          "~ ^\\/(?:index|remote|public|cron|core/ajax\\/update|status|ocs\\/v[12]|updater\\/.+|ocs-provider\\/.+|ocm-provider\\/.+)\\.php(?:$|\\/)" = {
-            priority = 500;
-            extraConfig = ''
-              include ${config.services.nginx.package}/conf/fastcgi.conf;
-              fastcgi_split_path_info ^(.+\.php)(\\/.*)$;
-              fastcgi_param PATH_INFO $fastcgi_path_info;
-              fastcgi_param HTTPS ${if config.services.nextcloud.https then "on" else "off"};
-              fastcgi_param modHeadersAvailable true;
-              fastcgi_param front_controller_active true;
-              fastcgi_pass unix:/run/phpfpm/nextcloud;
-              fastcgi_intercept_errors on;
-              fastcgi_request_buffering off;
-              fastcgi_read_timeout 120s;
-            '';
-          };
-          "~ ^/(?:updater|ocs-provider|ocm-provider)(?:$|\\/)".extraConfig = ''
-            try_files $uri/ =404;
-            index index.php;
-          '';
-          "~ \\.(?:css|js|woff2?|svg|gif)$".extraConfig = ''
-            try_files $uri /index.php$request_uri;
-            add_header Cache-Control "public, max-age=15778463";
-            add_header X-Content-Type-Options nosniff;
-            add_header X-XSS-Protection "1; mode=block";
-            add_header X-Robots-Tag none;
-            add_header X-Download-Options noopen;
-            add_header X-Permitted-Cross-Domain-Policies none;
-            add_header Referrer-Policy no-referrer;
-            access_log off;
-          '';
-          "~ \\.(?:png|html|ttf|ico|jpg|jpeg)$".extraConfig = ''
-            try_files $uri /index.php$request_uri;
-            access_log off;
-          '';
-        };
-        extraConfig = ''
-          add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
-          add_header X-Content-Type-Options nosniff;
-          add_header X-XSS-Protection "1; mode=block";
-          add_header X-Robots-Tag none;
-          add_header X-Download-Options noopen;
-          add_header X-Permitted-Cross-Domain-Policies none;
-          add_header Referrer-Policy no-referrer;
-          error_page 403 /core/templates/403.php;
-          error_page 404 /core/templates/404.php;
-          client_max_body_size ${config.services.nextcloud.maxUploadSize};
-          fastcgi_buffers 64 4K;
-          fastcgi_hide_header X-Powered-By;
-          gzip on;
-          gzip_vary on;
-          gzip_comp_level 4;
-          gzip_min_length 256;
-          gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
-          gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
-          ${optionalString config.services.nextcloud.webfinger ''
-            rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
-            rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
-          ''}
-        '';
-      };
-
-      "blog.${config.machine.domain}" = mkIf (elem "webblog" config.machine.services) {
-        enableACME = true;
-        forceSSL = true;
-        root = "/var/lib/webblog/";
-      };
-
-      "git.${config.machine.domain}" = mkIf config.services.gitea.enable {
-        enableACME = true;
-        forceSSL = true;
-        root = "${config.services.gitea.stateDir}/public";
-        extraConfig = ''
-          location / {
-            try_files maintain.html $uri $uri/index.html @node;
-          }
-
-          location @node {
-            client_max_body_size 0;
-            proxy_pass http://${config.services.gitea.httpAddress}:${toString config.services.gitea.httpPort};
-            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-            proxy_set_header X-Real-IP $remote_addr;
-            proxy_set_header Host $http_host;
-            proxy_set_header X-Forwarded-Ssl on;
-            proxy_set_header X-Forwarded-Proto $scheme;
-            proxy_max_temp_file_size 0;
-            proxy_redirect off;
-            proxy_read_timeout 120;
-          }
-        '';
-      };
-    };
   };
 }

services/nginx_vHosts/cache.nix

@@ -0,0 +1,17 @@
+{ config, lib, ... }:
+
+with lib;
+
+{
+  vHost = if config.services.nix-serve.enable then {
+    extraConfig = ''
+      location / {
+        proxy_pass http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port};
+        proxy_set_header Host $http_host;
+        proxy_set_header REMOTE_ADDR $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+      }
+    '';
+  } else {};
+}.vHost

services/nginx_vHosts/gitea.nix

@@ -0,0 +1,27 @@
+{ config, lib, ... }:
+
+with lib;
+
+{
+  vHost = if config.services.gitea.enable then {
+    root = "${config.services.gitea.stateDir}/public";
+    extraConfig = ''
+      location / {
+        try_files maintain.html $uri $uri/index.html @node;
+      }
+
+      location @node {
+        client_max_body_size 0;
+        proxy_pass http://${config.services.gitea.httpAddress}:${toString config.services.gitea.httpPort};
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header Host $http_host;
+        proxy_set_header X-Forwarded-Ssl on;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_max_temp_file_size 0;
+        proxy_redirect off;
+        proxy_read_timeout 120;
+      }
+    '';
+  } else {};
+}.vHost

services/nginx_vHosts/hydra.nix

@@ -0,0 +1,17 @@
+{ config, lib, ... }:
+
+with lib;
+
+{
+  vHost = if config.services.hydra.enable then {
+    extraConfig = ''
+      location / {
+        proxy_pass http://${config.services.hydra.listenHost}:${toString config.services.hydra.port};
+        proxy_set_header Host $http_host;
+        proxy_set_header REMOTE_ADDR $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto https;
+      }
+    '';
+  } else {};
+}.vHost

services/nginx_vHosts/mail.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+
+with lib;
+
+{
+  vHost = if config.mailserver.enable then {
+    serverName = config.mailserver.fqdn;
+    enableACME = true;
+    forceSSL = true;
+  } else {};
+}.vHost

services/nginx_vHosts/nextcloud.nix

@@ -0,0 +1,103 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+
+{
+  vHost = {
+    root = pkgs.nextcloud;
+    enableACME = config.services.nextcloud.https;
+    forceSSL = config.services.nextcloud.https;
+    locations = {
+      "= /robots.txt" = {
+        priority = 100;
+        extraConfig = ''
+          allow all;
+          log_not_found off;
+          access_log off;
+        '';
+      };
+      "/" = {
+        priority = 200;
+        extraConfig = "rewrite ^ /index.php$request_uri;";
+      };
+      "~ ^/store-apps" = {
+        priority = 201;
+        extraConfig = "root ${config.services.nextcloud.home};";
+      };
+      "= /.well-known/carddav" = {
+        priority = 210;
+        extraConfig = "return 301 $scheme://$host/remote.php/dav;";
+      };
+      "= /.well-known/caldav" = {
+        priority = 210;
+        extraConfig = "return 301 $scheme://$host/remote.php/dav;";
+      };
+      "~ ^\\/(?:build|tests|config|lib|3rdparty|templates|data)\\/" = {
+        priority = 300;
+        extraConfig = "deny all;";
+      };
+      "~ ^\\/(?:\\.|autotest|occ|issue|indie|db_|console)" = {
+        priority = 300;
+        extraConfig = "deny all;";
+      };
+      "~ ^\\/(?:index|remote|public|cron|core/ajax\\/update|status|ocs\\/v[12]|updater\\/.+|ocs-provider\\/.+|ocm-provider\\/.+)\\.php(?:$|\\/)" = {
+        priority = 500;
+        extraConfig = ''
+          include ${config.services.nginx.package}/conf/fastcgi.conf;
+          fastcgi_split_path_info ^(.+\.php)(\\/.*)$;
+          fastcgi_param PATH_INFO $fastcgi_path_info;
+          fastcgi_param HTTPS ${if config.services.nextcloud.https then "on" else "off"};
+          fastcgi_param modHeadersAvailable true;
+          fastcgi_param front_controller_active true;
+          fastcgi_pass unix:/run/phpfpm/nextcloud;
+          fastcgi_intercept_errors on;
+          fastcgi_request_buffering off;
+          fastcgi_read_timeout 120s;
+        '';
+      };
+      "~ ^/(?:updater|ocs-provider|ocm-provider)(?:$|\\/)".extraConfig = ''
+        try_files $uri/ =404;
+        index index.php;
+      '';
+      "~ \\.(?:css|js|woff2?|svg|gif)$".extraConfig = ''
+        try_files $uri /index.php$request_uri;
+        add_header Cache-Control "public, max-age=15778463";
+        add_header X-Content-Type-Options nosniff;
+        add_header X-XSS-Protection "1; mode=block";
+        add_header X-Robots-Tag none;
+        add_header X-Download-Options noopen;
+        add_header X-Permitted-Cross-Domain-Policies none;
+        add_header Referrer-Policy no-referrer;
+        access_log off;
+      '';
+      "~ \\.(?:png|html|ttf|ico|jpg|jpeg)$".extraConfig = ''
+        try_files $uri /index.php$request_uri;
+        access_log off;
+      '';
+    };
+    extraConfig = ''
+      add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
+      add_header X-Content-Type-Options nosniff;
+      add_header X-XSS-Protection "1; mode=block";
+      add_header X-Robots-Tag none;
+      add_header X-Download-Options noopen;
+      add_header X-Permitted-Cross-Domain-Policies none;
+      add_header Referrer-Policy no-referrer;
+      error_page 403 /core/templates/403.php;
+      error_page 404 /core/templates/404.php;
+      client_max_body_size ${config.services.nextcloud.maxUploadSize};
+      fastcgi_buffers 64 4K;
+      fastcgi_hide_header X-Powered-By;
+      gzip on;
+      gzip_vary on;
+      gzip_comp_level 4;
+      gzip_min_length 256;
+      gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
+      gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
+      ${optionalString config.services.nextcloud.webfinger ''
+        rewrite ^/.well-known/host-meta /public.php?service=host-meta last;
+        rewrite ^/.well-known/host-meta.json /public.php?service=host-meta-json last;
+      ''}
+    '';
+  };
+}.vHost

services/nginx_vHosts/simple.nix

@@ -0,0 +1,9 @@
+{ config, lib, ... }:
+
+with lib;
+
+{
+  vHost = {
+    root = "/var/www";
+  };
+}.vHost