This repository has no description
1.1 kB
35 lines
1{ config, ... }:
2let
3 cert = "wildcard.review.lassul.us";
4in
5{
6 # Public door to crit reviews on coaxmetal (configs/crit.nix): every review
7 # gets a random https://<id>.review.lassul.us, routed to its daemon by the
8 # nginx on coaxmetal:7720.
9 #
10 # Wildcard cert only: a per-name cert would publish every id in the
11 # Certificate Transparency logs. DNS-01 against our own knot, see the
12 # _acme-challenge.review.lassul.us zone in configs/dns/knot.nix.
13 security.acme.certs.${cert} = {
14 domain = "*.review.lassul.us";
15 dnsProvider = "rfc2136";
16 environmentFile = config.clan.core.vars.generators.knot-acme-review.files."lego.env".path;
17 group = config.services.nginx.group;
18 };
19
20 services.nginx.virtualHosts.crit-review = {
21 serverName = ''"~^[a-z0-9]{10}\.review\.lassul\.us$"'';
22 useACMEHost = cert;
23 forceSSL = true;
24 # crit streams review updates over SSE
25 locations."/" = {
26 recommendedProxySettings = true;
27 proxyPass = "http://coaxmetal.r:7720";
28 extraConfig = ''
29 proxy_buffering off;
30 proxy_read_timeout 1h;
31 proxy_connect_timeout 5s;
32 '';
33 };
34 };
35}