alyraffauf/nixcfg
1
0
Fork 0
mirror of https://github.com/alyraffauf/nixcfg.git synced 2024-11-25 15:51:54 -05:00
Code Issues Actions 7 Packages Projects Releases Wiki Activity

split proxy settings into their own file

Browse source
This commit is contained in:
Aly Raffauf 2024-03-11 18:37:33 -04:00
parent 9d1b32d288
commit 2ed96a0604
2 changed files with 121 additions and 114 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

154
modules/homelab/default.nix
View file

@ -3,50 +3,59 @@
{ {
imports = [ imports = [
../virtualization ../virtualization
./reverse_proxy
]; ];
# services.ddclient.enable = true; # services.ddclient.enable = true;
# services.ddclient.configFile = "/etc/ddclient/ddclient.conf"; # services.ddclient.configFile = "/etc/ddclient/ddclient.conf";
# Open TCP ports for audiobookshelf, plex-server, and transmission-server. # Open TCP ports for transmission-server.
networking.firewall.allowedTCPPorts = [ 80 443 51413 13378 32400 9091 ]; networking.firewall.allowedTCPPorts = [ 51413 9091 ];
networking.firewall.allowedUDPPorts = [ 51413 ]; networking.firewall.allowedUDPPorts = [ 51413 ];
virtualisation = {
oci-containers.containers = { virtualisation.oci-containers.containers = {
plex-server = { audiobookshelf = {
ports = ["0.0.0.0:32400:32400"]; ports = ["0.0.0.0:13378:80"];
image = "plexinc/pms-docker:public"; image = "ghcr.io/advplyr/audiobookshelf:latest";
environment = { environment = {
TZ = "America/New_York"; TZ = "America/New_York";
};
volumes = [
"plex_config:/config"
"plex_transcode:/transcode"
"/mnt/Media:/Media"
];
}; };
transmission-server = { volumes = [
ports = ["0.0.0.0:9091:9091" "0.0.0.0:51413:51413"]; "abs_config:/config"
image = "linuxserver/transmission:latest"; "abs_metadata:/metadata"
environment = { "/mnt/Media:/Media"
TZ = "America/New_York"; ];
}; };
volumes = [ plex-server = {
"transmission_config:/config" ports = ["0.0.0.0:32400:32400"];
"/mnt/Media/Torrents:/watch" image = "plexinc/pms-docker:public";
"/mnt/Media:/Media" environment = {
]; TZ = "America/New_York";
}; };
volumes = [
"plex_config:/config"
"plex_transcode:/transcode"
"/mnt/Media:/Media"
];
};
transmission-server = {
ports = ["0.0.0.0:9091:9091" "0.0.0.0:51413:51413"];
image = "linuxserver/transmission:latest";
environment = {
TZ = "America/New_York";
};
volumes = [
"transmission_config:/config"
"/mnt/Media/Torrents:/watch"
"/mnt/Media:/Media"
];
}; };
}; };
containers.navidrome = { containers.navidrome = {
autoStart = true; autoStart = true;
bindMounts = { bindMounts."/Music".hostPath = "/mnt/Media/Music";
"/Music" = { hostPath = "/mnt/Media/Music";
isReadOnly = true;
};
}; };
config = { config, pkgs, lib, ... }: { config = { config, pkgs, lib, ... }: {
services.navidrome = { services.navidrome = {
@ -58,93 +67,10 @@
MusicFolder = "/Music"; MusicFolder = "/Music";
DefaultTheme = "Auto"; DefaultTheme = "Auto";
SubsonicArtistParticipations = true; SubsonicArtistParticipations = true;
DefaultDownsamplingFormat = "aac"; UIWelcomeMessage = "Welcome to Navidrome on Raffauf Labs."
}; };
}; };
system.stateVersion = "24.05"; system.stateVersion = "24.05";
}; };
}; };
containers.audiobookshelf = {
autoStart = true;
bindMounts = {
"/Media" = { hostPath = "/mnt/Media";
isReadOnly = false;
};
};
config = { config, pkgs, lib, ... }: {
services.audiobookshelf = {
enable = true;
openFirewall = true;
port = 13378;
host = "0.0.0.0";
};
system.stateVersion = "24.05";
};
};
security.acme = {
acceptTerms = true;
defaults.email = "alyraffauf@gmail.com";
};
services.nginx = {
enable = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
recommendedGzipSettings = true;
# other Nginx options
virtualHosts."raffauflabs.com" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:12345";
proxyWebsockets = true; # needed if you need to use WebSocket
extraConfig = ''
# required when the target is also TLS server with multiple hosts
proxy_ssl_server_name on;
# required when the server wants to use HTTP Authentication
proxy_pass_header Authorization;
'';
};
};
virtualHosts."podcasts.raffauflabs.com" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:13378";
# proxyWebsockets = true; # This breaks audiobookshelf.
extraConfig = ''
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_redirect http:// https://;
proxy_buffering off;
'';
};
};
virtualHosts."plex.raffauflabs.com" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:32400";
proxyWebsockets = true; # needed if you need to use WebSocket
extraConfig = ''
proxy_buffering off;
'';
};
};
virtualHosts."music.raffauflabs.com" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:4533";
proxyWebsockets = true; # needed if you need to use WebSocket
extraConfig = ''
proxy_buffering off;
'';
};
};
};
} }

81
modules/homelab/reverse_proxy/default.nix Normal file
View file

@ -0,0 +1,81 @@
{ config, pkgs, ... }:
{
# services.ddclient.enable = true;
# services.ddclient.configFile = "/etc/ddclient/ddclient.conf";
# Open TCP ports for audiobookshelf, plex-server, and transmission-server.
networking.firewall.allowedTCPPorts = [ 80 443 51413 9091 ];
networking.firewall.allowedUDPPorts = [ 51413 ];
networking.extraHosts = ''
127.0.0.1 music.raffauflabs.com
127.0.0.1 podcasts.raffauflabs.com
127.0.0.1 plex.raffauflabs.com
'';
security.acme = {
acceptTerms = true;
defaults.email = "alyraffauf@gmail.com";
};
services.nginx = {
enable = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
recommendedGzipSettings = true;
# other Nginx options
# virtualHosts."raffauflabs.com" = {
# enableACME = true;
# forceSSL = true;
# locations."/" = {
# proxyPass = "http://127.0.0.1:12345";
# proxyWebsockets = true; # needed if you need to use WebSocket
# extraConfig = ''
# # required when the target is also TLS server with multiple hosts
# proxy_ssl_server_name on;
# # required when the server wants to use HTTP Authentication
# proxy_pass_header Authorization;
# '';
# };
# };
virtualHosts."podcasts.raffauflabs.com" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:13378";
# proxyWebsockets = true; # This breaks audiobookshelf.
extraConfig = ''
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header Host $host;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_redirect http:// https://;
proxy_buffering off;
'';
};
};
virtualHosts."plex.raffauflabs.com" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:32400";
proxyWebsockets = true; # needed if you need to use WebSocket
extraConfig = ''
proxy_buffering off;
'';
};
};
virtualHosts."music.raffauflabs.com" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:4533";
proxyWebsockets = true; # needed if you need to use WebSocket
extraConfig = ''
proxy_buffering off;
'';
};
};
};
}