peperunas/nixos
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

nginx: Add default runas.rocks virtualhost

Browse Source
This commit is contained in:
Giulio De Pasquale 2022-11-27 11:24:35 +01:00
parent b93d3a33b0
commit 7ffddeca09
1 changed files with 55 additions and 49 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

104
hosts/architect/nginx.nix
View File

@ -1,6 +1,24 @@
{ services, pkgs, lib, ... }: { services, pkgs, lib, ... }:
let
serviceSkeleton = { default ? false }: {
inherit default;
{ enableACME = true;
forceSSL = true;
root = "/var/lib/nginx/error_pages";
extraConfig = "error_page 404 /index.htm;";
locations = {
"/" = { return = "404"; };
"/index.htm" = { };
"/style.css" = { };
"/wat.jpg" = { };
};
};
in {
services.nginx = { services.nginx = {
enable = true; enable = true;
package = pkgs.openresty; package = pkgs.openresty;
@ -9,61 +27,49 @@
recommendedProxySettings = true; recommendedProxySettings = true;
recommendedTlsSettings = true; recommendedTlsSettings = true;
virtualHosts."architect.devs.giugl.io" = { virtualHosts."architect.devs.giugl.io" = serviceSkeleton { default = true; };
default = true; virtualHosts."runas.rocks" = serviceSkeleton {};
enableACME = true;
addSSL = true; appendHttpConfig =
root = "/var/lib/nginx/error_pages"; let
extraConfig = "error_page 404 /index.htm;"; extraPureLuaPackages = with pkgs.luajitPackages; [
lua-resty-openidc
lua-resty-http
lua-resty-session
lua-resty-jwt
lua-resty-openssl
];
luaPath = pkg: "${pkg}/share/lua/5.1/?.lua";
makeLuaPath = lib.concatMapStringsSep ";" luaPath;
in
''
lua_package_path '${makeLuaPath extraPureLuaPackages};;';
lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
lua_ssl_verify_depth 5;
locations = { # cache for OIDC discovery metadata
"/" = { return = "404"; }; lua_shared_dict discovery 1m;
lua_shared_dict jwks 1m;
"/index.htm" = { }; # https://github.com/openresty/lua-resty-redis/issues/159
resolver local=on ipv6=off;
"/style.css" = { }; init_worker_by_lua_block {
function check_role (res, role)
if res.user.roles == nil then
return false
end
"/wat.jpg" = { }; for _,v in pairs(res.user.roles) do
}; if string.lower(v) == role then
}; return true
appendHttpConfig = let end
extraPureLuaPackages = with pkgs.luajitPackages; [ end
lua-resty-openidc
lua-resty-http
lua-resty-session
lua-resty-jwt
lua-resty-openssl
];
luaPath = pkg: "${pkg}/share/lua/5.1/?.lua";
makeLuaPath = lib.concatMapStringsSep ";" luaPath;
in ''
lua_package_path '${makeLuaPath extraPureLuaPackages};;';
lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
lua_ssl_verify_depth 5;
# cache for OIDC discovery metadata
lua_shared_dict discovery 1m;
lua_shared_dict jwks 1m;
# https://github.com/openresty/lua-resty-redis/issues/159
resolver local=on ipv6=off;
init_worker_by_lua_block {
function check_role (res, role)
if res.user.roles == nil then
return false return false
end end
}
for _,v in pairs(res.user.roles) do '';
if string.lower(v) == role then
return true
end
end
return false
end
}
'';
appendConfig = '' appendConfig = ''
worker_processes 24; worker_processes 24;