nix-deploy/unstable/config/hosts/wind/services/nginx.nix

{
  imports = [ ../../../common/services/nginx.nix ];
  services.nginx.virtualHosts = {
    "graven.dev" = {
      useACMEHost = "graven.dev";
      forceSSL = true;
      locations."/".root = "/var/www/graven.dev/public";
      locations."/_matrix".proxyPass = "http://127.0.0.1:8008";
      locations."/_synapse".proxyPass = "http://127.0.0.1:8008";
      locations."/.well-known/matrix/" = {
        root = "/var/www/matrix/public";
        extraConfig = ''
          default_type application/json;
          add_header Access-Control-Allow-Origin "*";
          add_header Strict-Transport-Security $hsts_header;
          add_header Referrer-Policy "origin-when-cross-origin";
          add_header X-Frame-Options "DENY";
          add_header X-Content-Type-Options "nosniff";
          add_header X-XSS-Protection "1; mode=block";
        '';
      };
    };
    "rss.graven.dev" = {
      useACMEHost = "graven.dev";
      forceSSL = true;
    };
    "git.graven.dev" = {
      useACMEHost = "graven.dev";
      forceSSL = true;
      locations."/".proxyPass = "http://unix:/run/gitea/gitea.sock:";
    };
    "vault.graven.dev" = {
      forceSSL = true;
      useACMEHost = "graven.dev";
      locations."/" = {
        proxyPass = "http://localhost:8812";
        proxyWebsockets = true;
      };
      locations."/notifications/hub" = {
        proxyPass = "http://localhost:3012";
        proxyWebsockets = true;
      };
      locations."/notifications/hub/negotiate" = {
        proxyPass = "http://localhost:8812";
        proxyWebsockets = true;
      };
    };
    "mta-sts.graven.dev" = {
      forceSSL = true;
      enableACME = true;
      root = "/var/www/mta-sts/public";
    };
    "mta-sts.graven.se" = {
      forceSSL = true;
      enableACME = true;
      root = "/var/www/mta-sts/public";
    };
    "mta-sts.nao.sh" = {
      forceSSL = true;
      enableACME = true;
      root = "/var/www/mta-sts/public";
    };
    "mta-sts.amandag.net" = {
      forceSSL = true;
      enableACME = true;
      root = "/var/www/mta-sts/public";
    };
    "mta-sts.queersin.space" = {
      forceSSL = true;
      enableACME = true;
      root = "/var/www/mta-sts/public";
    };
    "mta-sts.anarkafem.dev" = {
      forceSSL = true;
      enableACME = true;
      root = "/var/www/mta-sts/public";
    };
  };
}