nixcfg/modules/homelab/nginx_proxy.nix

{ config, pkgs, ... }:

{
    # services.ddclient.enable = true;
    # services.ddclient.configFile = "/etc/ddclient/ddclient.conf";

    # Open TCP ports for audiobookshelf, plex-server, and transmission-server.
    networking = {
        firewall = {
            allowedTCPPorts = [ 80 443 51413 9091 ];
            allowedUDPPorts = [ 51413 ];
        };
        # My router doesn't expose settings for NAT loopback
        # So we have to use this workaround.
        extraHosts = ''
            127.0.0.1 music.raffauflabs.com
            127.0.0.1 nixcache.raffauflabs.com
            127.0.0.1 plex.raffauflabs.com
            127.0.0.1 podcasts.raffauflabs.com
        '';
    };

    security.acme = {
        acceptTerms = true;
        defaults.email = "alyraffauf@gmail.com";
    };
    services.nginx = {
        enable = true;
        recommendedProxySettings = true;
        recommendedTlsSettings = true;
        recommendedGzipSettings = true;

        virtualHosts."music.raffauflabs.com" =  {
            enableACME = true;
            forceSSL = true;
            locations."/" = {
                proxyPass = "http://127.0.0.1:4533";
                proxyWebsockets = true; # needed if you need to use WebSocket
                extraConfig = ''
                    proxy_buffering off;
                '';
            };
        };

        virtualHosts."nixcache.raffauflabs.com" = {
            enableACME = true;
            forceSSL = true;
            locations."/".proxyPass = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
        };

        virtualHosts."plex.raffauflabs.com" =  {
            enableACME = true;
            forceSSL = true;
            locations."/" = {
                proxyPass = "http://127.0.0.1:32400";
                proxyWebsockets = true; # needed if you need to use WebSocket
                extraConfig = ''
                    proxy_buffering off;
                '';
            };
        };

        virtualHosts."podcasts.raffauflabs.com" =  {
            enableACME = true;
            forceSSL = true;
            locations."/" = {
                proxyPass = "http://127.0.0.1:13378";
                # proxyWebsockets = true; # This breaks audiobookshelf.
                extraConfig = ''
                    proxy_set_header X-Forwarded-For    $proxy_add_x_forwarded_for;
                    proxy_set_header  X-Forwarded-Proto $scheme;
                    proxy_set_header  Host              $host;
                    proxy_set_header Upgrade            $http_upgrade;
                    proxy_set_header Connection         "upgrade";
                    proxy_redirect                      http:// https://;
                    proxy_buffering off;
                    client_max_body_size 500M;
                '';
            };
        };
    };
}