Merge branch 'master' of git.yggdrasil.li:nixos

2 files changed, 69 insertions, 2 deletions

diff --git a/custom/ymir.nginx b/custom/ymir.nginx
new file mode 100644
index 00000000..1fb0afcb
--- /dev/null
+++ b/custom/ymir.nginx
@@ -0,0 +1,62 @@
+default_type application/octet-stream;
+
+log_format main
+        '$remote_addr - $remote_user [$time_local] '
+        '"$request" $status $bytes_sent '
+        '"$http_referer" "$http_user_agent" '
+        '"$gzip_ratio"';
+
+client_header_timeout 10m;
+client_body_timeout 10m;
+send_timeout 10m;
+
+connection_pool_size 256;
+client_header_buffer_size 1k;
+large_client_header_buffers 4 2k;
+request_pool_size 4k;
+
+gzip on;
+gzip_min_length 1100;
+gzip_buffers 4 8k;
+gzip_types text/plain;
+
+output_buffers 1 32k;
+postpone_output 1460;
+
+sendfile on;
+tcp_nopush on;
+tcp_nodelay on;
+
+keepalive_timeout 75 20;
+
+ignore_invalid_headers on;
+
+server {
+  listen *:80;
+  listen [::]:80;
+  server_name dirty-haskell.org www.dirty-haskell.org;
+
+  root /srv/www/dirty-haskell.org;
+}
+
+server {
+  listen *:443 ssl;
+  listen [::]:443 ssl;
+  server_name dirty-haskell.org;
+
+  ssl_certificate /etc/nginx/ssl/dirty-haskell.org/fullchain.pem;
+  ssl_certificate_key /etc/nginx/ssl/dirty-haskell.org/privkey.pem;
+
+  root /srv/www/dirty-haskell.org;
+}
+
+server {
+  listen *:443 ssl;
+  listen [::]:443 ssl;
+  server_name www.dirty-haskell.org;
+
+  ssl_certificate /etc/nginx/ssl/www.dirty-haskell.org/fullchain.pem;
+  ssl_certificate_key /etc/nginx/ssl/www.dirty-haskell.org/privkey.pem;
+
+  root /srv/www/dirty-haskell.org;
+}
diff --git a/ymir.nix b/ymir.nix
index c64dea38..808b11bb 100644
--- a/ymir.nix
+++ b/ymir.nix
@@ -64,6 +64,8 @@ in {
                           5269 # xmpp.s2s
                           655 # tinc.yggdrasil
                           656 # tinc.laeradhr
+                          80 # http
+                          443 # https
                         ];
       allowedUDPPortRanges = [ { from = 60000; to = 61000; } # mosh
                              ];
@@ -88,10 +90,8 @@ in {
   };
 
   nix.binaryCaches = [ "https://cache.nixos.org/"
-                       "https://hydra.nixos.org/"
                      ];
   nix.binaryCachePublicKeys = [ "cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY="
-                                "hydra.nixos.org-1:CNHJZBh9K4tP3EKF6FkkgeVYsS3ohTl+oS0Qa8bezVs="
                               ];
 
   # List services that you want to enable:
@@ -164,4 +164,9 @@ in {
       ip4 = [ { address = "10.142.0.3"; prefixLength = 16; } ];
     };
     });
+
+  services.nginx = {
+    enable = true;
+    httpConfig = builtins.readFile ./custom/ymir.nginx;
+  };
 }