nix-config/modules/domains/bad.net.ru.nix

{ config, pkgs, inputs, ... }:
let
  dns = "regru";
  domain = "bad.net.ru";
  email = "badya65@gmail.com";
  homepage.root = "/system/data/homepage";
  public = {
    alias = "/system/data/pub/";
    extraConfig = ''
      fancyindex on;
      fancyindex_exact_size on;
      directio 4M;
    '';
  };
in {
  roles.server = {
    inherit domain;
    forgejo.enable = true;
    miniflux = {
      enable = true;
      adminCredentialsFile = config.age.secrets.miniflux.path;
    };
    nginx.enable = true;
  };

  age.secrets = with inputs.self.modules; {
    ${dns}.file = secrets.${dns};
    miniflux.file = secrets.miniflux;
    nix-serve.file = secrets."nix.bad.net.ru-1";
  };

  services.nix-serve = {
    enable = true;
    package = pkgs.nix-serve;
    secretKeyFile = config.age.secrets.nix-serve.path;
  };

  security.acme.certs.${domain} = {
    credentialFiles.REGRU_PASSWORD_FILE = config.age.secrets.${dns}.path;
    environmentFile = pkgs.writeText "${dns}-env" ''
      REGRU_USERNAME=${email}
      REGRU_POLLING_INTERVAL=10
      REGRU_PROPAGATION_TIMEOUT=3600
    '';
    domain = "*." + domain;
    dnsPropagationCheck = true;
    dnsProvider = dns;
    dnsResolver = "ns1.reg.ru:53";
    inherit email;
    extraDomainNames = [ domain ];
    inherit (config.security.acme.defaults) group;
    # server = "https://acme-staging-v02.api.letsencrypt.org/directory";
  };

  services.nginx.virtualHosts = {
    ${domain} = {
      forceSSL = true;
      enableACME = true;
      acmeRoot = null;
      locations."/" = homepage;
      locations."/pub/" = public;
      extraConfig = ''
        add_header Strict-Transport-Security "max-age=15552000; includeSubDomains" always;
      '';
    };

    "nix.${domain}" = {
      forceSSL = true;
      useACMEHost = domain;
      locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
    };

    "*.${domain}" = {
      default = true;
      forceSSL = true;
      useACMEHost = domain;
      globalRedirect = domain;
    };
  };
}