tlaternet-server/modules/nginxExtensions.nix

{
  config,
  pkgs,
  lib,
  ...
}:
{
  options = {
    services.nginx.domain = lib.mkOption {
      type = lib.types.str;
      description = "The base domain name to append to virtual domain names";
    };

    services.nginx.virtualHosts =
      let
        extraVirtualHostOptions =
          { name, config, ... }:
          {
            options = {
              enableHSTS = lib.mkEnableOption "Enable HSTS";

              addAccessLog = lib.mkOption {
                type = lib.types.bool;
                default = true;
                description = ''
                  Add special logging to `/var/log/nginx/''${serverName}`
                '';
              };
            };

            config = {
              extraConfig = lib.concatStringsSep "\n" [
                (lib.optionalString config.enableHSTS ''
                  add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
                '')
                (lib.optionalString config.addAccessLog ''
                  access_log /var/log/nginx/${name}/access.log upstream_time;
                '')
              ];
            };
          };
      in
      lib.mkOption { type = lib.types.attrsOf (lib.types.submodule extraVirtualHostOptions); };
  };

  config = {
    # Don't attempt to run acme if the domain name is not tlater.net
    systemd.services =
      let
        confirm = ''[[ "tlater.net" = ${config.services.nginx.domain} ]]'';
      in
      lib.mapAttrs' (
        cert: _:
        lib.nameValuePair "acme-${cert}" {
          serviceConfig.ExecCondition = ''${pkgs.runtimeShell} -c '${confirm}' '';
        }
      ) config.security.acme.certs;
  };
}