From 25d035de777df95cd0c809e647d942a75d5a4906 Mon Sep 17 00:00:00 2001
From: lassulus <git@lassul.us>
Date: Tue, 12 Dec 2023 16:43:46 +0100
Subject: [PATCH] hotdog: add nginx config for acme in container

---
 krebs/1systems/hotdog/config.nix |  1 +
 krebs/2configs/nginx.nix         | 24 ++++++++++++++++++++++++
 2 files changed, 25 insertions(+)
 create mode 100644 krebs/2configs/nginx.nix

diff --git a/krebs/1systems/hotdog/config.nix b/krebs/1systems/hotdog/config.nix
index 75a8a0da1..0a103ed1a 100644
--- a/krebs/1systems/hotdog/config.nix
+++ b/krebs/1systems/hotdog/config.nix
@@ -4,6 +4,7 @@
   imports = [
     ../../../krebs
     ../../../krebs/2configs
+    ../../../krebs/2configs/nginx.nix
 
     ../../../krebs/2configs/buildbot-stockholm.nix
     ../../../krebs/2configs/binary-cache/nixos.nix
diff --git a/krebs/2configs/nginx.nix b/krebs/2configs/nginx.nix
new file mode 100644
index 000000000..812093a7e
--- /dev/null
+++ b/krebs/2configs/nginx.nix
@@ -0,0 +1,24 @@
+{
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  security.acme.acceptTerms = true;
+  security.acme.defaults.email = "spam@krebsco.de";
+
+  services.nginx = {
+    enable = true;
+    recommendedGzipSettings = true;
+    recommendedOptimisation = true;
+    recommendedTlsSettings = true;
+
+    enableReload = true;
+
+    virtualHosts.default = {
+      default = true;
+      locations."= /etc/os-release".extraConfig = ''
+        default_type text/plain;
+        alias /etc/os-release;
+      '';
+      # needed for acmeFallback in sync-containers, or other machines not reachable globally
+      locations."~ ^/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
+    };
+  };
+}