Nix-Config/system/shared/services/nginx.nix

{ config, pkgs, inputs, ... }:

{
  services.nginx = {
    enable = true;

    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;

    gitweb = {
      enable = true;
      virtualHost = "git.tsvallender.co.uk";
      location = "/web";
    };
    virtualHosts."git.tsvallender.co.uk" = {
      forceSSL = true;
      enableACME = true;
    };

    virtualHosts."syncthing.tsvallender.co.uk" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://127.0.0.1:8384";
      };
    };

    virtualHosts."feeds.tsvallender.co.uk" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://127.0.0.1:8080";
      };
    };

    virtualHosts."cal.tsvallender.co.uk" = {
      forceSSL = true;
      enableACME = true;
      locations."/" = {
        proxyPass = "http://127.0.0.1:5232";
      };
    };
  };

  security.acme = {
    acceptTerms = true;
    defaults = {
      email = "t+acme@tsvallender.co.uk";
    };
  };
}