tlaternet/tlaternet-server
1
0
Fork 0
Code Issues 9 Pull requests Releases Activity

Compare commits

base: tlaternet:051d7dce95e1612c53895bb317dde53716437289
Branches Tags
tlaternet:master
tlaternet:tlater/with-minecraft
tlaternet:tlater/nixpkgs-formatting
tlaternet:tlater/authelia
..
compare: tlaternet:a98d63c20c5a8b90d22f76ce492e62bbe6545a0f
Branches Tags
tlaternet:tlater/with-minecraft
tlaternet:master
tlaternet:tlater/nixpkgs-formatting
tlaternet:tlater/authelia

2 commits
051d7dce95 ... a98d63c20c

Author SHA1 Message Date
Tristan Daniël Maat a98d63c20c
WIP: authelia: Add SSO 2024-04-16 01:26:44 +02:00
Tristan Daniël Maat e16f3be326
acme: Switch to a wildcard certificate 2024-04-16 01:25:59 +02:00
9 changed files with 18 additions and 7 deletions
Show stats Expand all files Collapse all files

7
configuration/nginx.nix
View file

@ -49,6 +49,13 @@
security.acme = { security.acme = {
defaults.email = "tm@tlater.net"; defaults.email = "tm@tlater.net";
acceptTerms = true; acceptTerms = true;
certs."tlater.net" = {
extraDomainNames = ["*.tlater.net"];
dnsProvider = "hetzner";
group = "nginx";
credentialFiles."HETZNER_API_KEY_FILE" = config.sops.secrets."hetzner-api".path;
};
}; };
services.backups.acme = { services.backups.acme = {

2
configuration/services/afvalcalendar.nix
View file

@ -44,7 +44,7 @@
services.nginx.virtualHosts."afvalcalendar.${config.services.nginx.domain}" = { services.nginx.virtualHosts."afvalcalendar.${config.services.nginx.domain}" = {
forceSSL = true; forceSSL = true;
enableACME = true; useACMEHost = "tlater.net";
enableHSTS = true; enableHSTS = true;
root = "/srv/afvalcalendar"; root = "/srv/afvalcalendar";

2
configuration/services/conduit.nix
View file

@ -178,7 +178,7 @@ in {
}; };
services.nginx.virtualHosts."${domain}" = { services.nginx.virtualHosts."${domain}" = {
enableACME = true; useACMEHost = "tlater.net";
listen = [ listen = [
{ {

2
configuration/services/foundryvtt.nix
View file

@ -24,7 +24,7 @@ in {
inherit (config.services.foundryvtt) port; inherit (config.services.foundryvtt) port;
in { in {
forceSSL = true; forceSSL = true;
enableACME = true; useACMEHost = "tlater.net";
enableHSTS = true; enableHSTS = true;
locations."/" = { locations."/" = {

2
configuration/services/gitea.nix
View file

@ -41,7 +41,7 @@ in {
httpPort = config.services.forgejo.settings.server.HTTP_PORT; httpPort = config.services.forgejo.settings.server.HTTP_PORT;
in { in {
forceSSL = true; forceSSL = true;
enableACME = true; useACMEHost = "tlater.net";
enableHSTS = true; enableHSTS = true;
locations."/".proxyPass = "http://${httpAddress}:${toString httpPort}"; locations."/".proxyPass = "http://${httpAddress}:${toString httpPort}";

2
configuration/services/metrics/grafana.nix
View file

@ -38,7 +38,7 @@ in {
services.nginx.virtualHosts."${domain}" = { services.nginx.virtualHosts."${domain}" = {
forceSSL = true; forceSSL = true;
enableACME = true; useACMEHost = "tlater.net";
enableHSTS = true; enableHSTS = true;
enableAuthorization = true; enableAuthorization = true;
locations."/".proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}"; locations."/".proxyPass = "http://localhost:${toString config.services.grafana.settings.server.http_port}";

2
configuration/services/nextcloud.nix
View file

@ -45,7 +45,7 @@ in {
# Set up SSL # Set up SSL
services.nginx.virtualHosts."${hostName}" = { services.nginx.virtualHosts."${hostName}" = {
forceSSL = true; forceSSL = true;
enableACME = true; useACMEHost = "tlater.net";
# The upstream module already adds HSTS # The upstream module already adds HSTS
}; };

2
configuration/services/webserver.nix
View file

@ -16,7 +16,7 @@ in {
serverAliases = ["www.${domain}"]; serverAliases = ["www.${domain}"];
forceSSL = true; forceSSL = true;
enableACME = true; useACMEHost = "tlater.net";
enableHSTS = true; enableHSTS = true;
locations."/".proxyPass = "http://${addr}:${toString port}"; locations."/".proxyPass = "http://${addr}:${toString port}";

4
configuration/sops.nix
View file

@ -34,6 +34,10 @@
"heisenbridge/as-token" = {}; "heisenbridge/as-token" = {};
"heisenbridge/hs-token" = {}; "heisenbridge/hs-token" = {};
"hetzner-api" = {
owner = "acme";
};
# Nextcloud # Nextcloud
"nextcloud/tlater" = { "nextcloud/tlater" = {
owner = "nextcloud"; owner = "nextcloud";