58 lines
1.4 KiB
Nix
58 lines
1.4 KiB
Nix
{ services, pkgs, lib, ... }:
|
|
|
|
{
|
|
services.nginx = {
|
|
enable = true;
|
|
package = pkgs.openresty;
|
|
recommendedGzipSettings = true;
|
|
recommendedOptimisation = true;
|
|
recommendedProxySettings = true;
|
|
recommendedTlsSettings = true;
|
|
|
|
virtualHosts."architect.devs.giugl.io" = {
|
|
default = true;
|
|
enableACME = true;
|
|
addSSL = true;
|
|
root = "/var/lib/nginx/error_pages";
|
|
extraConfig = "error_page 404 /index.htm;";
|
|
|
|
locations = {
|
|
"/" = { return = "404"; };
|
|
|
|
"/index.htm" = { };
|
|
|
|
"/style.css" = { };
|
|
|
|
"/wat.jpg" = { };
|
|
};
|
|
};
|
|
appendHttpConfig = let
|
|
extraPureLuaPackages = with pkgs.luajitPackages; [
|
|
lua-resty-openidc
|
|
lua-resty-http
|
|
lua-resty-session
|
|
lua-resty-jwt
|
|
lua-resty-openssl
|
|
];
|
|
luaPath = pkg: "${pkg}/share/lua/5.1/?.lua";
|
|
makeLuaPath = lib.concatMapStringsSep ";" luaPath;
|
|
in ''
|
|
lua_package_path '${makeLuaPath extraPureLuaPackages};;';
|
|
lua_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.crt;
|
|
lua_ssl_verify_depth 5;
|
|
|
|
# cache for OIDC discovery metadata
|
|
lua_shared_dict discovery 1m;
|
|
lua_shared_dict jwks 1m;
|
|
|
|
# https://github.com/openresty/lua-resty-redis/issues/159
|
|
resolver local=on ipv6=off;
|
|
'';
|
|
|
|
appendConfig = ''
|
|
worker_processes 24;
|
|
'';
|
|
};
|
|
users.groups.acme.members = [ "nginx" ];
|
|
}
|