clan-infra/modules/web01/homepage.nix

49 lines
1.3 KiB
Nix
Raw Normal View History

{ config, pkgs, self, ... }: {
2023-07-04 17:40:45 +00:00
security.acme.defaults.email = "admins@clan.lol";
security.acme.acceptTerms = true;
# www user to push website artifacts via ssh
users.users.www = {
openssh.authorizedKeys.keys =
config.users.users.root.openssh.authorizedKeys.keys
++ [
# ssh-homepage-key
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMxZ3Av30M6Sh6NU1mnCskB16bYtNP8vskc/+ud0AU1C ssh-homepage-key"
];
2023-09-12 10:36:30 +00:00
isSystemUser = true;
2023-11-16 14:02:26 +00:00
shell = "/run/current-system/sw/bin/bash";
2023-09-12 10:36:30 +00:00
group = "www";
};
2023-09-12 10:36:30 +00:00
users.groups.www = { };
# ensure /var/www can be accessed by nginx and www user
systemd.tmpfiles.rules = [
"d /var/www 0755 www nginx"
];
2023-07-04 17:40:45 +00:00
services.nginx = {
virtualHosts."clan.lol" = {
forceSSL = true;
enableACME = true;
# to be deployed via rsync
root = "/var/www";
2023-07-04 17:40:45 +00:00
extraConfig = ''
charset utf-8;
source_charset utf-8;
'';
# Make sure to expire the cache after 1 hour
locations."/".extraConfig = ''
add_header Cache-Control "public, max-age=3600";
'';
locations."/thaigersprint".return = "307 https://pad.lassul.us/s/clan-thaigersprint";
2023-07-04 17:40:45 +00:00
};
virtualHosts."www.clan.lol" = {
forceSSL = true;
enableACME = true;
globalRedirect = "clan.lol";
};
};
}