revamped flake.nix, removed homelab specific modulesstaging

1 files changed, 0 insertions, 75 deletions

diff --git a/os/srv/nginx.nix b/os/srv/nginx.nix
deleted file mode 100644
index 2194ecb..0000000
--- a/os/srv/nginx.nix
+++ /dev/null
@@ -1,75 +0,0 @@
-{
-  config,
-  lib,
-  pkgs,
-  ...
-}:
-
-let
-  cfg = config.os.srv.nginx;
-in
-{
-  options.os.srv.nginx = {
-    enable = lib.mkEnableOption "the NGINX reverse proxy service";
-
-    openFirewall = lib.mkOption {
-      type = lib.types.bool;
-      default = true;
-      description = "Whether to open ports 80 and 443 in the firewall.";
-    };
-  };
-
-  config = lib.mkMerge [
-    {
-      _module.args.securityTemplates.restrictToInternal = ''
-        allow 127.0.0.1;
-        allow ::1;
-
-        allow ${config.os.core.network.lan.range};
-        allow 10.1.0.0/24;
-        allow ${config.os.core.network.wg.range};
-        allow ${config.os.core.network.hs.range};
-
-        deny all;
-      '';
-    }
-
-    (lib.mkIf cfg.enable {
-      services.nginx = {
-        enable = true;
-        package = pkgs.nginx.override { openssl = pkgs.libressl; };
-
-        recommendedProxySettings = true;
-        recommendedTlsSettings = true;
-        recommendedOptimisation = true;
-        recommendedGzipSettings = true;
-        virtualHosts = lib.mkMerge [
-          {
-            "_" = {
-              default = true;
-              rejectSSL = true;
-              locations."/".return = "444";
-            };
-          }
-          config.os.cluster.nginxProxies
-        ];
-      };
-
-      security.acme = {
-        acceptTerms = true;
-        defaults.email = "adikro@disroot.org";
-      };
-
-      users.users.nginx.extraGroups = [ "acme" ];
-
-      networking.firewall.allowedTCPPorts = lib.mkIf cfg.openFirewall [
-        80
-        443
-      ];
-
-      systemd.tmpfiles.rules = [
-        "d /var/log/nginx 0750 nginx adm -"
-      ];
-    })
-  ];
-}