refactor

modules/services/webserver.nix

@@ -0,0 +1,94 @@
+{ lib, config, ... }:
+let
+  cfg = config.modules.services.webserver;
+
+  types = {
+    location = lib.types.submodule {
+      options = {
+        proxyPort = lib.mkOption {
+          type = lib.types.nullOr lib.types.int;
+          default = null;
+        };
+        extraConfig = lib.mkOption {
+          type = lib.types.str;
+          default = "";
+        };
+      };
+    };
+
+    vhost = lib.types.submodule {
+      options = {
+        proxyBuffering = lib.mkOption {
+          type = lib.types.bool;
+          default = true;
+        };
+        locations = lib.mkOption {
+          type = lib.types.attrsOf types.location;
+        };
+      };
+    };
+  };
+in
+{
+  options.modules.services.webserver = {
+    enable = lib.mkEnableOption "Enable nginx";
+    acme = {
+      dnsChallenge = lib.mkEnableOption "Enable DNS challenge";
+      dnsProvider = lib.mkOption {
+        type = lib.types.str;
+        default = "hetzner";
+      };
+      environmentFile = lib.mkOption {
+        type = lib.types.str;
+        default = "/var/secrets/lego";
+      };
+    };
+    vHosts = lib.mkOption {
+      type = lib.types.attrsOf types.vhost;
+      default = { };
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.nginx = {
+      enable = lib.mkDefault true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      recommendedBrotliSettings = true;
+      recommendedGzipSettings = true;
+      recommendedZstdSettings = true;
+      recommendedOptimisation = true;
+
+      virtualHosts = lib.mapAttrs
+        (_: { proxyBuffering, locations }: {
+          forceSSL = true;
+          enableACME = true;
+          http2 = true;
+          acmeRoot = lib.mkIf cfg.acme.dnsChallenge null;
+          extraConfig = lib.mkIf (!proxyBuffering) ''
+            proxy_buffering off;
+          '';
+          locations = lib.mapAttrs
+            (_: { proxyPort, extraConfig }: lib.mergeAttrsList [
+              { inherit extraConfig; }
+              (if (lib.isInt proxyPort) then {
+                proxyWebsockets = true;
+                proxyPass = "http://localhost:${toString proxyPort}";
+              } else { })
+            ])
+            locations;
+        })
+        cfg.vHosts;
+    };
+
+    security.acme = {
+      acceptTerms = true;
+      defaults = {
+        email = "admin@j.repomaa.com";
+        dnsProvider = lib.mkIf cfg.acme.dnsChallenge cfg.acme.dnsProvider;
+      };
+    };
+
+    modules.firewall.allInterfaces = [ "web" ];
+  };
+}