This repository has no description
1.6 kB
63 lines
1{
2 lib,
3 config,
4 ...
5}:
6{
7 options.clan.hedgedoc = {
8 domain = lib.mkOption {
9 type = lib.types.str;
10 description = "The domain of the hedgedoc instance.";
11 };
12 };
13 config = {
14
15 security.acme.certs.${config.clan.hedgedoc.domain}.group = "hedgecert";
16 users.groups.hedgecert.members = [
17 "hedgedoc"
18 "nginx"
19 ];
20
21 security.dhparams = {
22 enable = true;
23 params.hedgedoc = { };
24 };
25
26 services.hedgedoc = {
27 enable = true;
28 settings = {
29 allowOrigin = [
30 "localhost"
31 config.clan.hedgedoc.domain
32 ];
33 useCDN = false;
34 port = 3091;
35 domain = config.clan.hedgedoc.domain;
36 allowFreeURL = true;
37 defaultPermission = "freely";
38 # debug = true;
39 # useSSL = true;
40 # hsts.enable = false;
41 # protocolUseSSL = true;
42
43 useSSL = true;
44 protocolUseSSL = true;
45 sslCAPath = [ "/etc/ssl/certs/ca-certificates.crt" ];
46 sslCertPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/cert.pem";
47 sslKeyPath = "/var/lib/acme/${config.clan.hedgedoc.domain}/key.pem";
48 dhParamPath = config.security.dhparams.params.hedgedoc.path;
49 };
50 };
51
52 services.nginx.virtualHosts.${config.clan.hedgedoc.domain} = {
53 enableACME = true;
54 forceSSL = true;
55 locations."/" = {
56 proxyPass = "https://localhost:3091";
57 # proxyPass = "http://localhost:${toString config.services.hedgedoc.settings.port}";
58 proxyWebsockets = true;
59 };
60 };
61
62 };
63}