commit c631fb4cfa6d221db6ab02e5bccac980e137b729
parent c2e3fb49fe4771c9e6e7eb057075492575b74e5f
Author: Silas Brack <silasbrack@gmail.com>
Date: Tue, 30 Sep 2025 20:54:53 +0200
Refactor and clean up
Diffstat:
3 files changed, 21 insertions(+), 65 deletions(-)
diff --git a/nixos/configuration-debian-2gb-hel1-1.nix b/nixos/configuration-debian-2gb-hel1-1.nix
@@ -54,7 +54,6 @@
imports = [
./simple-web-app.nix
- # (modulesPath + "/virtualisation/digital-ocean-image.nix")
# ./vpn.nix
];
@@ -104,72 +103,14 @@
acceptTerms = true;
defaults.email = "silasbrack@gmail.com";
};
- services.nginx = {
- enable = true;
- # virtualHosts."freshrss.fnarglebeast.com" = {
- # forceSSL = true;
- # enableACME = true;
- # };
- # virtualHosts."livebook.fnarglebeast.com" = {
- # forceSSL = true;
- # enableACME = true;
- # locations."/" = {
- # proxyPass = "http://127.0.0.1:20123";
- # proxyWebsockets = true; # needed if you need to use WebSocket
- # extraConfig =
- # # required when the target is also TLS server with multiple hosts
- # "proxy_ssl_server_name on;"
- # +
- # # required when the server wants to use HTTP Authentication
- # "proxy_pass_header Authorization;";
- # };
- # };
- virtualHosts."karakeep.fnarglebeast.com" = {
- forceSSL = true;
- enableACME = true;
- locations."/" = {
- proxyPass = "http://127.0.0.1:8360";
- };
- };
- virtualHosts."simple.fnarglebeast.com" = {
- forceSSL = true;
- enableACME = true;
- locations."/" = {
- proxyPass = "http://127.0.0.1:8000";
- };
- };
- };
+ services.nginx.enable = true;
services.simple-web-app = {
enable = true;
package = simple-web-app.packages."x86_64-linux".default;
+ port = 8032;
};
- # sops.secrets.livebook_password_env_file = { };
- # services.livebook = {
- # enableUserService = true;
- # environment = {
- # LIVEBOOK_PORT = 20123;
- # LIVEBOOK_IFRAME_PORT = 20124;
- # };
- # environmentFile = "/run/secrets/livebook_password_env_file";
- # extraPackages = with pkgs; [
- # gcc
- # gnumake
- # ];
- # };
-
- # sops.secrets.freshrss_password = {
- # owner = "freshrss";
- # };
- # services.freshrss = {
- # enable = true;
- # defaultUser = "silas";
- # passwordFile = "/run/secrets/freshrss_password";
- # baseUrl = "http://localhost:8080";
- # virtualHost = "freshrss.fnarglebeast.com";
- # };
-
services.karakeep = {
enable = true;
extraEnvironment = {
@@ -177,4 +118,11 @@
DISABLE_SIGNUPS = "true";
};
};
+ services.nginx.virtualHosts."karakeep.fnarglebeast.com" = {
+ forceSSL = true;
+ enableACME = true;
+ locations."/" = {
+ proxyPass = "http://127.0.0.1:8360";
+ };
+ };
}
diff --git a/nixos/simple-web-app.nix b/nixos/simple-web-app.nix
@@ -31,8 +31,6 @@ in
};
config = mkIf cfg.enable {
- networking.firewall.allowedTCPPorts = [ cfg.port ];
-
# Run service
systemd.services.simple-web-app = {
wantedBy = [ "multi-user.target" ];
@@ -52,6 +50,16 @@ in
};
};
+ # Route requests to the API via nginx
+ networking.firewall.allowedTCPPorts = [ cfg.port ];
+ services.nginx.virtualHosts."simple.fnarglebeast.com" = {
+ forceSSL = true;
+ enableACME = true;
+ locations."/" = {
+ proxyPass = "http://127.0.0.1:${builtins.toString cfg.port}";
+ };
+ };
+
# Archive logs to volume
systemd.services.simple-web-app-log-collection = {
script = ''
diff --git a/secrets.yaml b/secrets.yaml
@@ -31,7 +31,7 @@ sops:
dXNXQkF5SXZjWHRPNjZaR29YZ1pRQ3MKJvGVAm8M9oIQBHJH1o0NG8x0c4qvgvHr
1T/ghKHZWIpbXzct1LNy+5T10OgRxm5++NKuuuiAXW2XmnkJu1Bc3Q==
-----END AGE ENCRYPTED FILE-----
- lastmodified: "2025-07-20T16:06:58Z"
- mac: ENC[AES256_GCM,data:yX2QNz2QFXP9jHAiJ++hpxXeI253fFmF/93WPybxpHSzwHPsgMMby+jgPQkQ16xR+9OXN5qUAOk/EsCaV6nWBXPPM41nL843Paz3vabddJwhvxQoGsS47KbrnFJGZDluT5GA6cU6H+yEGelvmeKeyOyXx9jVn75sFXRNK8elUzU=,iv:OQnoRLmKVVlo1/bakPB3MciZM8gB2xtjvYYKxMdYBpA=,tag:+bVG8ZI5rVXI0ORRda1ThA==,type:str]
+ lastmodified: "2025-09-30T18:54:33Z"
+ mac: ENC[AES256_GCM,data:SRpWQDznuwGoy95soxciTCuJdD/To2PJzusR/t6G/QPPwWoR3JcR2vZz4q5n4RmHnneJdXkWhMU+x0Gu116A5q2jIrfE51weGjyL8nhVsdvyp5Y12tLsFmqy588jHGaVTWxN/Z20bmmvNIh/gmFP7E0z1a9nt2NwRQVhhibWbXg=,iv:34cdBBgRd89sEyN3PoGdrRLfn9RSW6hN+mWQSLtB6fs=,tag:dg89FnuaCRYAhq6IoLDOZQ==,type:str]
unencrypted_suffix: _unencrypted
version: 3.10.2
