path: root/hosts/icon/web.nix

{
  config,
  inputs,
  ips,
  pkgs,
  ...
}: {
  # https://nixos.org/manual/nixos/stable/#module-security-acme
  security = {
    acme = {
      acceptTerms = true;
      defaults.email = "andrew+acme@montgomery.systems";

      certs = {
        "mail.skullheadx.ca" = {
          webroot = "/var/lib/acme/acme-challenge/";
          # extraDomainNames = ["www.example.com" "foo.example.com"];
        };
        "git.skullheadx.com" = {
          webroot = "/var/lib/acme/acme-challenge/";
          extraDomainNames = ["cdn.skullheadx.com" "nix-cache.skullheadx.com" "git.montgomery.systems"];
        };
      };
    };
  };

  services.nginx = {
    enable = true;
    recommendedProxySettings = true;
    recommendedOptimisation = true;
    experimentalZstdSettings = true;
    recommendedBrotliSettings = true;
    recommendedGzipSettings = true;
    validateConfigFile = true;
    statusPage = true;
    appendHttpConfig = ''
      log_format main '$remote_addr - $remote_user [$time_local] "$request" '
                       '$status $body_bytes_sent "$http_referer" '
                       '"$http_user_agent" $request_time';

      access_log /var/log/nginx/access.log main;

      set_real_ip_from ${ips.ip_wg0_vps};
      set_real_ip_from ${ips.ip_local_router};
      real_ip_recursive on;
      real_ip_header X-Forwarded-For;

      map $request_uri $limit_key {
        default "";
        ~^/nixpkgs/atom  $binary_remote_addr;
      }

      limit_req_zone $limit_key zone=expensive:10m rate=1r/m;

      map $http_user_agent $bot_class {
          default                        "";
          ~*GPTBot                       "gptbot";
          ~*Amazonbot                    "amazonbot";
          ~*meta-externalagent           "metabot";
          ~*meta-webindexer              "metabot";
      }

      limit_req_zone $bot_class zone=bots:10m rate=1r/m;

      map $http_origin $cors_origin {
        default "";
        "http://skullheadx.com" $http_origin;
        "https://skullheadx.com" $http_origin;
        "http://test.skullheadx.com" $http_origin;
        "https://test.skullheadx.com" $http_origin;
        "~^http://localhost:[0-9]+$" $http_origin;
        "~^http://127\.0\.0\.1:[0-9]+$" $http_origin";
      }
    '';
    virtualHosts = {
      "mail.skullheadx.ca" = {
        listen = [
          {
            addr = "0.0.0.0";
            port = 80;
          }
          {
            addr = "0.0.0.0";
            port = 443;
            ssl = true;
          }
        ];
        forceSSL = true;
        enableACME = true;
        locations."/" = {
          root = "/var/www";
        };
      };

      "nix-cache.skullheadx.com" = {
        addSSL = true;
        useACMEHost = "git.skullheadx.com";
        listen = [
          {
            addr = "0.0.0.0";
            port = 80;
          }
          {
            addr = "0.0.0.0";
            port = 443;
            ssl = true;
          }
        ];
        locations = {
          "/" = {
            proxyPass = "http://localhost:5000";
          };
        };
      };

      "git.skullheadx.com" = {
        serverAliases = ["git.montgomery.systems"];
        useACMEHost = "git.skullheadx.com";
        addSSL = true;
        listen = [
          {
            addr = "0.0.0.0";
            port = 80;
          }
          {
            addr = "0.0.0.0";
            port = 443;
            ssl = true;
          }
        ];

        extraConfig = ''
          limit_req zone=expensive burst=1 nodelay;
          limit_req zone=bots burst=3 nodelay;
        '';
        locations = {
          "/cgit/" = {
            alias = "/srv/git/cgit/";
          };
          "= /robots.txt" = {
            alias = "/srv/git/cgit/robots.txt";
          };
        };
      };

      "cdn.skullheadx.com" = {
        root = "/var/cdn/skullheadx.com";

        useACMEHost = "git.skullheadx.com";
        addSSL = true;
        listen = [
          {
            addr = "0.0.0.0";
            port = 80;
          }
          {
            addr = "0.0.0.0";
            port = 443;
            ssl = true;
          }
        ];
        locations = {
          "/" = {
            tryFiles = "$uri =404";
          };
          "~* \\.(mp4|m4v|webm|ogv|mp3|wav|flac|ogg|opus|m3u8|ts)$" = {
            extraConfig = ''
              expires 30d;

              add_header Cache-Control "public, no-transform";
              add_header Vary "Origin" always;

              # mp4;
              # mp4_buffer_size 4m;
              # mp4_max_buffer_size 20m;

              aio threads;
              # output_buffers 2 1m;

              limit_rate 6m;
            '';
          };
        };

        extraConfig = ''
          autoindex off;
          add_header Access-Control-Allow-Origin $cors_origin always;
          add_header Access-Control-Allow-Methods "GET, OPTIONS" always;
          add_header Access-Control-Allow-Headers "Range" always;
          if ($request_method = 'OPTIONS') {
              return 204;
          }
          sendfile on;
          sendfile_max_chunk 512k;
          tcp_nopush on;
          tcp_nodelay on;
          keepalive_timeout 65;
        '';
      };

      "prometheus.internal" = {
        listen = [
          {
            addr = "${ips.ip_wg2_homelab}";
            port = 80;
          }
        ];
        locations."/" = {
          proxyPass = "http://127.0.0.1:9090";
          proxyWebsockets = true;
          recommendedProxySettings = true;
        };
      };
      "grafana.internal" = {
        listen = [
          {
            addr = "${ips.ip_wg2_homelab}";
            port = 80;
          }
        ];
        locations."/" = {
          proxyPass = "http://127.0.0.1:3000";
          proxyWebsockets = true;
          recommendedProxySettings = true;
        };
      };
      "alloy.internal" = {
        listen = [
          {
            addr = "${ips.ip_wg2_homelab}";
            port = 80;
          }
        ];
        locations."/" = {
          proxyPass = "http://127.0.0.1:12345";
          proxyWebsockets = true;
          recommendedProxySettings = true;
        };
      };
    };
  };
  systemd.services.nginx.serviceConfig = {
    SupplementaryGroups = ["git" "acme"];
    ReadOnlyPaths = [
      "/srv/git"
      "/srv"
    ];
    InaccessiblePaths = [
      "/srv/git/.ssh"
      # "/srv/git/migrate_from_gh.sh"
      # "/srv/git/make_new_repo.sh"
    ];
  };

  fileSystems."/srv/git" = {
    device = "prod/git";
    fsType = "zfs";
  };

  fileSystems."/var/cdn" = {
    device = "prod/cdn";
    fsType = "zfs";
    neededForBoot = true;
    options = ["noatime"];
  };

  services.gitDaemon = {
    enable = true;
    basePath = "/srv/git";
    listenAddress = "0.0.0.0";
    exportAll = false;
  };

  # Must redirect git to go over localhost to avoid fetching errors trying to get the router to reroute the source and dest ip addrs being the same (homelab)
  programs.git.config.url."git://127.0.0.1/" = {
    insteadOf = [
      "git://git.skullheadx.com/"
    ];
  };

  # Git web frontend
  services.cgit."cgit" = {
    enable = true;
    scanPath = "/srv/git";
    group = "nginx";
    settings = {
      # readme = "";
      remove-suffix = true;
      root-title = "Skullheadx's Git Forge";
      root-desc = "Source code for various projects";
      repository-sort = "age";
      enable-follow-links = true;
      source-filter = "${pkgs.cgit}/lib/cgit/filters/syntax-highlighting.py";
      strict-export = "git-daemon-export-ok";
      cache-size = 1000;
      cache-root = "/srv/git/.cache";
      clone-url = "git://git.skullheadx.com/$CGIT_REPO_URL";
      enable-http-clone = true;
      enable-index-links = true;
      enable-blame = true;
      enable-commit-graph = true;
      enable-log-filecount = true;
      enable-log-linecount = true;
      enable-subject-links = true;
      # enable-owner-index = false;
      enable-git-config = true;
      local-time = true;
      branch-sort = "age";
      max-stats = "quarter";
      snapshots = "tar.gz tar.bz2 zip";
      logo-link = "https://git.skullheadx.com";
      favicon = "/cgit/favicon.ico";
      logo = "/cgit/logo.webp";
      css = "/cgit/cgit.css";
    };
    extraConfig = ''
      mimetype.gif=image/gif
      mimetype.html=text/html
      mimetype.jpg=image/jpeg
      mimetype.jpeg=image/jpeg
      mimetype.pdf=application/pdf
      mimetype.png=image/png
      mimetype.webp=image/webp
      mimetype.svg=image/svg+xml

      readme=:README.md
      readme=:readme.md
      readme=:README.mkd
      readme=:readme.mkd
      readme=:README.rst
      readme=:readme.rst
      readme=:README.html
      readme=:readme.html
      readme=:README.htm
      readme=:readme.htm
      readme=:README.txt
      readme=:readme.txt
      readme=:README
      readme=:readme
      readme=:INSTALL.md
      readme=:install.md
      readme=:INSTALL.mkd
      readme=:install.mkd
      readme=:INSTALL.rst
      readme=:install.rst
      readme=:INSTALL.html
      readme=:install.html
      readme=:INSTALL.htm
      readme=:install.htm
      readme=:INSTALL.txt
      readme=:install.txt
      readme=:INSTALL
      readme=:install


    '';

    gitHttpBackend = {
      enable = true;
      checkExportOkFiles = true;
    };
    nginx = {
      location = "";
      virtualHost = "git.skullheadx.com";
    };
  };

  services.fcgiwrap.instances."cgit-cgit".process.prefork = 8;
}