rrvsh/pantheon
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(server/web-servers): change acme validation to DNS-01

Browse source
This commit is contained in:
Mohammad Rafiq 2025-06-12 13:41:41 +08:00
parent e8ec88bd57
commit 396925364b
No known key found for this signature in database
2 changed files with 75 additions and 67 deletions
Download patch file Download diff file Expand all files Collapse all files

77
modules/nixos/server/web-servers/default.nix
View file

@ -1,72 +1,15 @@
{ config, lib, ... }:
let
cfg = config.server.web-servers;
proxyPasses = builtins.listToAttrs (
builtins.map (proxy: {
name = proxy.source;
value = {
forceSSL = true;
enableACME = true;
locations."/" = {
proxyPass = proxy.target;
} // proxy.extraConfig;
};
}) cfg.nginx.proxies
);
in
{ config, ... }:
{
options.server.web-servers = {
nginx = {
enable = lib.mkEnableOption "the Nginx server";
proxies = lib.mkOption {
type =
with lib.types;
listOf (submodule {
options = {
source = lib.pantheon.mkStrOption;
target = lib.pantheon.mkStrOption;
extraConfig = lib.mkOption {
type = attrs;
default = { };
description = "Will be added to locations.\"/\"";
};
};
});
default = [ ];
example = [
{
source = "chat.bwfiq.com";
target = "http://helios:3080";
extraConfig = { };
}
];
config = {
security.acme = {
acceptTerms = true;
defaults = {
email = "rafiq@rrv.sh";
dnsProvider = "cloudflare";
credentialFiles = {
"CLOUDFLARE_DNS_API_TOKEN_FILE" = config.sops.secrets."keys/cloudflare".path;
};
};
};
};
config = lib.mkMerge [
{
security.acme = {
acceptTerms = true;
defaults.email = "rafiq@rrv.sh";
};
}
(lib.mkIf cfg.nginx.enable {
networking.firewall.allowedTCPPorts = [
443
80
];
services.nginx = {
enable = true;
virtualHosts = {
"_" = {
default = true;
rejectSSL = true;
locations."/" = {
return = "444";
};
};
} // proxyPasses;
};
})
];
}

65
modules/nixos/server/web-servers/nginx/default.nix Normal file
View file

@ -0,0 +1,65 @@
{ config, lib, ... }:
let
cfg = config.server.web-servers.nginx;
in
{
options.server.web-servers.nginx = {
enable = lib.mkEnableOption "the Nginx server";
proxies = lib.mkOption {
type =
with lib.types;
listOf (submodule {
options = {
source = lib.pantheon.mkStrOption;
target = lib.pantheon.mkStrOption;
extraConfig = lib.mkOption {
type = attrs;
default = { };
description = "Will be added to locations.\"/\"";
};
};
});
default = [ ];
example = [
{
source = "chat.bwfiq.com";
target = "http://helios:3080";
extraConfig = { };
}
];
};
};
config = lib.mkIf cfg.enable {
networking.firewall.allowedTCPPorts = [
443
80
];
services.nginx = {
enable = true;
virtualHosts =
{
"_" = {
default = true;
rejectSSL = true;
locations."/" = {
return = "444";
};
};
}
// (builtins.listToAttrs (
builtins.map (proxy: {
name = proxy.source;
value = {
forceSSL = true;
enableACME = true;
acmeRoot = null;
locations."/" = {
proxyPass = proxy.target;
} // proxy.extraConfig;
};
}) cfg.proxies
));
};
};
}