Closer

2026-07-08 16:24:11 +02:00
parent 3496b41d3c
commit 3f8eacc9a8
4 changed files with 118 additions and 9 deletions
@@ -0,0 +1,94 @@
+{ pkgs, ... }:
+
+let
+  proxyVhost = { upstream, websockets ? true, maxBodySize ? "1g" }: {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = upstream;
+      proxyWebsockets = websockets;
+      extraConfig = ''
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_read_timeout 3600;
+        proxy_send_timeout 3600;
+        proxy_buffering off;
+        client_max_body_size ${maxBodySize};
+      '';
+    };
+  };
+
+  dockerService = { name, description, dir }: {
+    inherit description;
+    after = [ "docker.service" "network.target" ];
+    requires = [ "docker.service" ];
+    wantedBy = [ "multi-user.target" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      WorkingDirectory = dir;
+      ExecStart = "${pkgs.docker-compose}/bin/docker-compose up -d --build";
+      ExecStop = "${pkgs.docker-compose}/bin/docker-compose down";
+    };
+  };
+in
+{
+  services.jellyfin.enable = true;
+
+  services.tailscale = {
+    enable = true;
+    openFirewall = true;
+    useRoutingFeatures = "server";
+  };
+
+  services.immich = {
+    enable = true;
+    mediaLocation = "/media/immich";
+  };
+
+  virtualisation.docker = {
+    enable = true;
+    enableOnBoot = true;
+  };
+
+  systemd.services.transmission = dockerService {
+    name = "transmission";
+    description = "Transmission via Mullvad VPN";
+    dir = "/home/ulve/code/transmission";
+  };
+
+  systemd.services.aftersummer = dockerService {
+    name = "aftersummer";
+    description = "Aftersummer";
+    dir = "/home/ulve/code/aftersummer";
+  };
+
+  systemd.services.spine = dockerService {
+    name = "spine";
+    description = "Spine ebook server";
+    dir = "/home/ulve/code/wargaming";
+  };
+
+  systemd.services.bookthing = dockerService {
+    name = "bookthing";
+    description = "Bookthing audiobook server";
+    dir = "/home/ulve/code/bookthing";
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "johansson.olov@gmail.com";
+  };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."transmission.maybec.at" = proxyVhost { upstream = "http://127.0.0.1:9091"; };
+    virtualHosts."aftersummer.maybec.at"  = proxyVhost { upstream = "http://127.0.0.1:5588"; };
+    virtualHosts."spine.maybec.at"       = proxyVhost { upstream = "http://localhost:3000"; };
+    virtualHosts."bookthing.maybec.at"   = proxyVhost { upstream = "http://127.0.0.1:8000"; };
+    virtualHosts."jelly.maybec.at"       = proxyVhost { upstream = "http://127.0.0.1:8096"; };
+    virtualHosts."photos.maybec.at"      = proxyVhost { upstream = "http://[::1]:2283"; maxBodySize = "50g"; };
+  };
+}