yadunut/clan-core
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Revert "Merge pull request 'clanModules: Init nginx module. matrix-synapse: don't assume domain names' (#1906) from Qubasa/clan-core:Qubasa-new-main into main"

Browse Source 
This reverts commit b29f649343, reversing
changes made to 9c8be387fa.

Apparently this breaks assumptions about matrix: https://git.clan.lol/clan/clan-core/pulls/1906#issuecomment-13184
This commit is contained in:
Jörg Thalheim
2024-08-21 10:03:13 +02:00
parent 4a06ea9391
commit 2fc4bccfd5
9 changed files with 27 additions and 278 deletions
Download Patch File Download Diff File Expand all files Collapse all files

75
clanModules/nginx/default.nix
View File

@@ -1,75 +0,0 @@
{ config, lib, ... }:
let
nginx_acme_email = "nginx-acme";
in
{
imports = [
(lib.mkRemovedOptionModule [
"clan"
"nginx"
"enable"
] "Importing the module will already enable the service.")
];
config = {
clan.core.facts.services."${nginx_acme_email}" = {
public."${nginx_acme_email}" = { };
generator.prompt = "Please enter your email address for Let's Encrypt certificate generation";
generator.script = ''
echo -n $prompt_value | tr -d "\n" > "$facts"/${nginx_acme_email}
'';
};
security.acme.acceptTerms = true;
security.acme.defaults.email = lib.mkDefault (
let
path = config.clan.core.facts.services."${nginx_acme_email}".public."${nginx_acme_email}".path;
in
if builtins.pathExists path then builtins.readFile path else null
);
networking.firewall.allowedTCPPorts = [
443
80
];
services.nginx = {
enable = true;
statusPage = lib.mkDefault true;
recommendedBrotliSettings = lib.mkDefault true;
recommendedGzipSettings = lib.mkDefault true;
recommendedOptimisation = lib.mkDefault true;
recommendedProxySettings = lib.mkDefault true;
recommendedTlsSettings = lib.mkDefault true;
recommendedZstdSettings = lib.mkDefault true;
# Nginx sends all the access logs to /var/log/nginx/access.log by default.
# instead of going to the journal!
commonHttpConfig = "access_log syslog:server=unix:/dev/log;";
resolver.addresses =
let
isIPv6 = addr: builtins.match ".*:.*:.*" addr != null;
escapeIPv6 = addr: if isIPv6 addr then "[${addr}]" else addr;
cloudflare = [
"1.1.1.1"
"2606:4700:4700::1111"
];
resolvers =
if config.networking.nameservers == [ ] then cloudflare else config.networking.nameservers;
in
map escapeIPv6 resolvers;
sslDhparam = config.security.dhparams.params.nginx.path;
};
security.dhparams = {
enable = true;
params.nginx = { };
};
};
}