initial commit

services/nginx/acme.nix

@@ -0,0 +1,10 @@
+{ lib, config, ... }:
+with lib; mkIf (config.nginx.enable) {
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      email = "admin@ruject.fun";
+      webroot = "/var/lib/acme/acme-challenge/";
+    };
+  };
+}

services/nginx/default.nix

@@ -0,0 +1,7 @@
+{
+  imports = [
+    ./acme.nix
+    ./firewall.nix
+    ./service.nix
+  ];
+}

services/nginx/firewall.nix

@@ -0,0 +1,14 @@
+{
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (config.services.nginx) enable;
+in
+with lib; mkIf enable {
+  networking.firewall.allowedTCPPorts = [
+    80
+    443
+  ];
+}

services/nginx/service.nix

@@ -0,0 +1,12 @@
+{
+  users.groups.acme.members = [
+    "nginx"
+  ];
+
+  services.nginx = {
+    recommendedProxySettings = true;
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+  };
+}