Add nginx to container

3 files changed, 109 insertions, 2 deletions

diff --git a/host/Rory-nginx/services/containers/pluralcontactbotpoc/root.nix b/host/Rory-nginx/services/containers/pluralcontactbotpoc/root.nix
index 537a438..2c0d901 100755
--- a/host/Rory-nginx/services/containers/pluralcontactbotpoc/root.nix
+++ b/host/Rory-nginx/services/containers/pluralcontactbotpoc/root.nix
@@ -3,8 +3,8 @@
 {
   imports =
     [
-      #./nginx.nix
-      ./conduit.nix
+      ./services/nginx.nix
+      ./services/conduit.nix
     ];
 
   system.stateVersion = "22.11"; # DO NOT EDIT!
diff --git a/host/Rory-nginx/services/containers/pluralcontactbotpoc/conduit.nix b/host/Rory-nginx/services/containers/pluralcontactbotpoc/services/conduit.nix
index f2fdad6..f2fdad6 100755
--- a/host/Rory-nginx/services/containers/pluralcontactbotpoc/conduit.nix
+++ b/host/Rory-nginx/services/containers/pluralcontactbotpoc/services/conduit.nix
diff --git a/host/Rory-nginx/services/containers/pluralcontactbotpoc/services/nginx.nix b/host/Rory-nginx/services/containers/pluralcontactbotpoc/services/nginx.nix
new file mode 100755
index 0000000..2f4d8cf
--- /dev/null
+++ b/host/Rory-nginx/services/containers/pluralcontactbotpoc/services/nginx.nix
@@ -0,0 +1,107 @@
+{ config, pkgs, lib, ... }:
+
+{
+  services = {
+    nginx = {
+      enable = true;
+      #package = pkgs.nginxQuic;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      recommendedZstdSettings = true;
+      recommendedGzipSettings = true;
+      recommendedBrotliSettings = true;
+      recommendedOptimisation = true;
+      appendConfig = ''
+        worker_processes 16;
+        '';
+       eventsConfig = ''
+        #use kqueue;
+        worker_connections 512;
+        '';
+      appendHttpConfig = ''
+        #sendfile on;
+        disable_symlinks off;
+      '';
+      additionalModules = with pkgs.nginxModules; [
+        moreheaders
+      ];
+      virtualHosts = {
+        "pcpoc.rory.gay" = {
+          enableACME = true;
+          addSSL = true;
+          locations."/" = {
+            proxyPass = "http://127.0.0.1:6167"; 
+            extraConfig = ''
+              if ($request_method = 'OPTIONS') {
+                more_set_headers 'Access-Control-Allow-Origin: *';
+                more_set_headers 'Access-Control-Allow-Methods: *';
+                #
+                # Custom headers and headers various browsers *should* be OK with but aren't
+                #
+                more_set_headers 'Access-Control-Allow-Headers: *';
+                #
+                # Tell client that this pre-flight info is valid for 20 days
+                #
+                more_set_headers 'Access-Control-Max-Age: 1728000';
+                more_set_headers 'Content-Type: text/plain; charset=utf-8';
+                more_set_headers 'Content-Length: 0';
+                return 204;
+              }
+            '';
+          };
+          locations."= /.well-known/matrix/server".extraConfig = ''
+            more_set_headers 'Content-Type application/json';
+            more_set_headers 'Access-Control-Allow-Origin *';
+            return 200 '${builtins.toJSON {
+              "m.server" = "pcpoc.rory.gay:443";
+            }}';
+          ''; 
+          locations."= /.well-known/matrix/client".extraConfig = ''
+            more_set_headers 'Content-Type application/json';
+            more_set_headers 'Access-Control-Allow-Origin *';
+            return 200 '${builtins.toJSON {
+              "m.homeserver".base_url = "https://pcpoc.rory.gay";
+            }
+            }';
+          ''; 
+          locations."= /.well-known/matrix/support".extraConfig = ''
+            more_set_headers 'Content-Type application/json';
+            more_set_headers 'Access-Control-Allow-Origin *';
+            return 200 '${builtins.toJSON {
+              admins = [
+                  {
+                    matrix_id = "@emma:rory.gay";
+                    role = "admin";
+                  }
+                  {
+                    matrix_id = "@alicia:rory.gay";
+                    role = "admin";
+                  }
+                  {
+                    matrix_id = "@root:rory.gay";
+                    role = "admin";
+                  }
+                  {
+                    matrix_id = "@rory:rory.gay";
+                    role = "admin";
+                  }
+                ];
+              }
+            }';
+          '';
+        };
+      };
+    };
+  };
+  systemd.services.nginx.serviceConfig = {
+    LimitNOFILE=5000000;
+  };
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "root@rory.gay";
+
+  environment.systemPackages = with pkgs; [
+    #gitfs
+  ];
+
+  system.stateVersion = "22.11"; # DO NOT EDIT!
+}