strato-infra/nixos/machines/nginx/default.nix

{ config, pkgs, ... }:
let
  proxy = path: {
    http2 = true;
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = path;
      proxyWebsockets = true;
    };
  };
  bigProxy = path: {
    http2 = true;
    forceSSL = true;
    enableACME = true;
    locations."/" = {
      proxyPass = path;
      proxyWebsockets = true;
      extraConfig = ''
        client_max_body_size 0;
      '';
    };
  };
  redirect = dest: {
    forceSSL = true;
    enableACME = true;
    http2 = true;
    globalRedirect = dest;
  };
  k8sProxy = proxy "http://kubernetes.lxd:8080/";
in {
  imports = [ ../../common ../../common/lxc.nix ];
  networking.hostName = "nginx";
  system.stateVersion = "21.11";
  networking.firewall.enable = true;
  networking.firewall.allowedTCPPorts = [ 80 443 9113 9117 ];
  services.nginx = {
    enable = true;
    commonHttpConfig = ''
      log_format custom   '$remote_addr - $remote_user [$time_local] '
                          '"$host" "$request" $status $body_bytes_sent '
                          '"$http_referer" "$http_user_agent" "$http_x_forwarded_for"';

      access_log /var/log/nginx/access.log custom;
    '';
    recommendedOptimisation = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
    recommendedGzipSettings = true;
    package = pkgs.nginxMainline;
    statusPage = true;

    virtualHosts."asraphiel.dev" = {
      forceSSL = true;
      http2 = true;
      enableACME = true;
      root = "/etc/main";
    };
    virtualHosts."auth.asraphiel.dev" = k8sProxy;

    virtualHosts."git.asraphiel.dev" = proxy "http://gitea.lxd:3000/";
    virtualHosts."drone.asraphiel.dev" = k8sProxy;

    virtualHosts."vault.asraphiel.dev" = proxy "http://vault.lxd:8200/";

    virtualHosts."s3.asraphiel.dev" = bigProxy "http://minio.lxd:9000/";
    virtualHosts."shell.s3.asraphiel.dev" = proxy "http://minio.lxd:9001/";
    virtualHosts."cdn.voidcorp.nl" = redirect "s3.asraphiel.dev";
    virtualHosts."cdn.asraphiel.dev" = k8sProxy;

    virtualHosts."registry.asraphiel.dev" = proxy "http://registry.lxd:5000/";
    virtualHosts."vaultwarden.asraphiel.dev" =
      proxy "http://vaultwarden.lxd:8000/";
    virtualHosts."analytics.asraphiel.dev" = redirect "ikaros.asraphiel.dev";
    virtualHosts."ikaros.asraphiel.dev" = k8sProxy;
    virtualHosts."whoami.asraphiel.dev" = k8sProxy;

    virtualHosts."stats.asraphiel.dev" = proxy "http://grafana.lxd:2345/";

    virtualHosts."groenehartansichtkaarten.nl" = k8sProxy;
    virtualHosts."ansichtkaarten.asraphiel.dev" = k8sProxy;

    virtualHosts."galerievanslagmaat.nl" = k8sProxy;
    virtualHosts."galerie.asraphiel.dev" = k8sProxy;
    virtualHosts."staging.galerievanslagmaat.nl" = k8sProxy;
    virtualHosts."galerie-staging.asraphiel.dev" = k8sProxy;
    virtualHosts."www.galerievanslagmaat.nl" = {
      forceSSL = true;
      enableACME = true;
      http2 = true;
      globalRedirect = "galerievanslagmaat.nl";
    };
  };

  services.prometheus.exporters.nginx.enable = true;
  services.prometheus.exporters.nginxlog.enable = true;
  services.prometheus.exporters.nginxlog.user = config.services.nginx.user;
  services.prometheus.exporters.nginxlog.settings = {
    consul = { enable = false; };

    namespaces = [{
      name = "asraphiel";
      format = ''
        $remote_addr - $remote_user [$time_local] "$host" "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent" "$http_x_forwarded_for"'';
      source = {

        files = [ "/var/log/nginx/access.log" ];
      };
      relabel_configs = [
        {
          target_label = "remote_addr";
          from = "remote_addr";
        }
        {
          target_label = "host";
          from = "host";
        }
      ];
    }];
  };

  security.acme.defaults.email = "acme@voidcorp.nl";
  security.acme.acceptTerms = true;
  environment.etc."main/index.html" = {
    enable = true;
    source = ./index.html;
  };

}