Mic92/stockholm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

retiolum-bootstrap: krebs.nginx -> services.nginx

Browse Source
This commit is contained in:
tv 2017-04-17 16:20:05 +02:00
parent 9cb758c1cb
commit 4424a4b159
1 changed files with 20 additions and 38 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

58
krebs/3modules/retiolum-bootstrap.nix
View File

@ -1,53 +1,38 @@
{ config, lib, pkgs, ... }: { config, pkgs, ... }:
with import <stockholm/lib>; with import <stockholm/lib>;
let let
cfg = config.krebs.retiolum-bootstrap; cfg = config.krebs.retiolum-bootstrap;
in
out = { {
options.krebs.retiolum-bootstrap = api; options.krebs.retiolum-bootstrap = {
config = lib.mkIf cfg.enable imp; enable = mkEnableOption "retiolum boot strap for ${cfg.serverName}";
}; serverName = mkOption {
api = {
enable = mkEnableOption "retiolum boot strap for tinc.krebsco.de";
hostname = mkOption {
type = types.str; type = types.str;
description = "hostname which serves tinc boot"; description = "hostname which serves tinc boot";
default = "tinc.krebsco.de" ; default = "tinc.krebsco.de" ;
}; };
listen = mkOption { sslCertificate = mkOption {
type = with types; listOf str;
description = ''Addresses to listen on (nginx-syntax).
ssl will be configured, http will be redirected to ssl.
Make sure to have at least 1 ssl port configured.
'';
default = [ "80" "443 ssl" ] ;
};
ssl_certificate_key = mkOption {
type = types.str;
description = "Certificate key to use for ssl";
default = "${toString <secrets>}/tinc.krebsco.de.key";
};
ssl_certificate = mkOption {
type = types.str; type = types.str;
description = "Certificate file to use for ssl"; description = "Certificate file to use for ssl";
default = "${toString <secrets>}/tinc.krebsco.de.crt" ; default = "${toString <secrets>}/tinc.krebsco.de.crt" ;
}; };
sslCertificateKey = mkOption {
type = types.str;
description = "Certificate key to use for ssl";
default = "${toString <secrets>}/tinc.krebsco.de.key";
};
# in use: # in use:
# <secrets/tinc.krebsco.de.crt> # <secrets/tinc.krebsco.de.crt>
# <secrets/tinc.krebsco.de.key> # <secrets/tinc.krebsco.de.key>
}; };
imp = { config = mkIf cfg.enable {
krebs.nginx.servers = assert config.krebs.nginx.enable; { services.nginx = {
retiolum-boot-ssl = { enable = mkDefault true;
server-names = singleton cfg.hostname; virtualHosts.retiolum-bootstrap = {
listen = cfg.listen; inherit (cfg) serverName sslCertificate sslCertificateKey;
extraConfig = '' enableSSL = true;
ssl_certificate ${cfg.ssl_certificate}; extraConfig =''
ssl_certificate_key ${cfg.ssl_certificate_key};
if ($scheme = http){ if ($scheme = http){
return 301 https://$server_name$request_uri; return 301 https://$server_name$request_uri;
} }
@ -55,10 +40,7 @@ let
root ${pkgs.retiolum-bootstrap}; root ${pkgs.retiolum-bootstrap};
try_files $uri $uri/retiolum.sh; try_files $uri $uri/retiolum.sh;
''; '';
locations = [];
}; };
}; };
}; };
}
in
out