services/website: init

hosts/dandelion/default.nix

@@ -22,6 +22,7 @@
     modules.services.nginx
     modules.services.postgres
     modules.services.unbound
+    modules.services.website
 
     ./filesystem.nix
     ./kernel.nix

modules/default.nix

@@ -26,6 +26,7 @@ in {
     ./services/transmission.nix
     ./services/unbound.nix
     ./services/vaultwarden.nix
+    ./services/website.nix
   ];
   system = mkAttrsFromPaths [
     ./system/aagl.nix

modules/services/nginx.nix

@@ -1,4 +1,4 @@
-{ config, inputs, ... }: {
+{ config, ... }: {
   networking.firewall.allowedTCPPorts = [ 80 443 ];
   security.acme = {
     acceptTerms = true;

modules/services/website.nix

@@ -0,0 +1,24 @@
+{ inputs, ... }: {
+  services.nginx.virtualHosts = {
+    "lava.moe" = {
+      useACMEHost = "lava.moe";
+      forceSSL = true;
+      root = inputs.website.outPath;
+    };
+    "cdn.lava.moe" = {
+      useACMEHost = "lava.moe";
+      forceSSL = true;
+      root = "/persist/cdn";
+    };
+    "_" = {
+      default = true;
+      addSSL = true;
+      # TODO generate this somewhere
+      sslCertificate = "/persist/fakeCerts/fake.crt";
+      sslCertificateKey = "/persist/fakeCerts/fake.key";
+      extraConfig = ''
+        return 444;
+      '';
+    };
+  };
+}