From 25d035de777df95cd0c809e647d942a75d5a4906 Mon Sep 17 00:00:00 2001 From: lassulus Date: Tue, 12 Dec 2023 16:43:46 +0100 Subject: hotdog: add nginx config for acme in container --- krebs/1systems/hotdog/config.nix | 1 + krebs/2configs/nginx.nix | 24 ++++++++++++++++++++++++ 2 files changed, 25 insertions(+) create mode 100644 krebs/2configs/nginx.nix diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix index 75a8a0da1..0a103ed1a 100644 --- a/krebs/1systems/hotdog/config.nix +++ b/krebs/1systems/hotdog/config.nix @@ -4,6 +4,7 @@ imports = [ ../../../krebs ../../../krebs/2configs + ../../../krebs/2configs/nginx.nix ../../../krebs/2configs/buildbot-stockholm.nix ../../../krebs/2configs/binary-cache/nixos.nix diff --git a/krebs/2configs/nginx.nix b/krebs/2configs/nginx.nix new file mode 100644 index 000000000..812093a7e --- /dev/null +++ b/krebs/2configs/nginx.nix @@ -0,0 +1,24 @@ +{ + networking.firewall.allowedTCPPorts = [ 80 443 ]; + security.acme.acceptTerms = true; + security.acme.defaults.email = "spam@krebsco.de"; + + services.nginx = { + enable = true; + recommendedGzipSettings = true; + recommendedOptimisation = true; + recommendedTlsSettings = true; + + enableReload = true; + + virtualHosts.default = { + default = true; + locations."= /etc/os-release".extraConfig = '' + default_type text/plain; + alias /etc/os-release; + ''; + # needed for acmeFallback in sync-containers, or other machines not reachable globally + locations."~ ^/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge"; + }; + }; +} -- cgit v1.2.3