...

1 files changed, 31 insertions, 0 deletions

diff --git a/ullr.nix b/ullr.nix
index 71c5ee23..6717e913 100644
--- a/ullr.nix
+++ b/ullr.nix
@@ -28,7 +28,9 @@
       enable = true;
       allowPing = true;
       allowedTCPPorts = [ 22 # ssh
+                          64738 # murmur
                         ];
+      allowedUDPPorts = [ 64738 # murmur
       allowedUDPPortRanges = [ { from = 60000; to = 61000; } # mosh
                              ];
     };
@@ -89,6 +91,35 @@
   users.groups."games" = {};
   nixpkgs.config.allowUnfree = true;
 
+  services.murmur = {
+    enable = true;
+    bandwidth = 288000;
+    sslKey = "/var/lib/acme/yggdrasil.li/key.pem";
+    sslCert = "/var/lib/acme/yggdrasil.li/fullchain.pem";
+    passwort = builtins.readFile /etc/murmur-password;
+  };
+  users.groups."ssl" = {
+    members = [ "murmur" ];
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    certs."ullr.yggdrasil.li" = {
+      allowKeysForGroup = true;
+      group = "ssl";
+    };
+  };
+
+  services.nginx.enable = true;
+  services.nginx.virtualHosts."ullr.yggdrasil.li" = {
+    default = true;
+    addSSL = true;
+    enableACME = true;
+    root = "/var/www/";
+    locations."/".return = "404";
+    useACMEHost= "ullr.yggdrasil.li";
+  };
+
   # This value determines the NixOS release from which the default
   # settings for stateful data, like file locations and database versions
   # on your system were taken. It‘s perfectly fine and recommended to leave