1 files changed, 83 insertions, 0 deletions
diff --git a/modules/vhack/ng/nginx/module.nix b/modules/vhack/ng/nginx/module.nix
new file mode 100644
index 0000000..1317d4d
--- /dev/null
+++ b/modules/vhack/ng/nginx/module.nix
@@ -0,0 +1,83 @@
+{
+  lib,
+  config,
+  ...
+}: let
+  mkRedirect = _: value: {
+    forceSSL = true;
+    enableACME = true;
+    locations."/".return = "301 ${value}$request_uri";
+  };
+
+  redirects = builtins.mapAttrs mkRedirect cfg.redirects;
+
+  cfg = config.vhack.nginx;
+in {
+  options.vhack.nginx = {
+    enable = lib.mkEnableOption ''
+      a default nginx config.
+    '';
+
+    redirects = lib.mkOption {
+      type = lib.types.attrsOf lib.types.str;
+      default = {};
+      description = ''
+        An attrset of redirects to add.
+        The keys are the domain that should than be redirected to the url specified as
+        value.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    vhack = {
+      persist.directories = [
+        "/var/lib/acme"
+      ];
+
+      monitoring.prometheus = {
+        sources = [
+          {
+            name = "nginx";
+            target = "127.0.0.1:${toString config.services.prometheus.exporters.nginx.port}";
+          }
+        ];
+      };
+    };
+
+    services.prometheus.exporters.nginx = {
+      enable = true;
+      port = 9111;
+      listenAddress = "127.0.0.1";
+      scrapeUri = "http://localhost:80/nginx_status";
+    };
+
+    users = {
+      users.acme = {
+        uid = config.vhack.constants.ids.uids.acme;
+        group = "acme";
+      };
+      groups.acme.gid = config.vhack.constants.ids.gids.acme;
+    };
+
+    security.acme = {
+      acceptTerms = true;
+      defaults = {
+        email = "admin@vhack.eu";
+        webroot = "/var/lib/acme/acme-challenge";
+      };
+    };
+
+    networking.firewall = {
+      allowedTCPPorts = [80 443];
+    };
+    services.nginx = {
+      enable = true;
+
+      # Enable the status page for the prometheus exporter.
+      statusPage = lib.mkIf config.services.prometheus.enable true;
+
+      virtualHosts = redirects;
+    };
+  };
+}