libreddit: Proxy through nginx

agenix/hosts/sail/config.nix

@@ -75,5 +75,11 @@
       owner = "nginx";
       group = "nginx";
     };
+
+    libreddit-auth = {
+      file = ./libreddit/auth.age;
+      owner = "nginx";
+      group = "nginx";
+    };
   };
 }

agenix/hosts/sail/libreddit/auth.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> ssh-ed25519 MtGp6g Kca/kAw3NelnfYaqjIdzKbqskpjGTc8T9+FfVt2u2iA
+H2dK0+x9ikbXk6XclKwN7kqnM5hxmfrRbYY2XSvuc8w
+-> ssh-ed25519 NbV4hw 1xdog4s7LvcvOg6C05OHVllNEzo9YDsX4/dMbweNmAY
+wplB3IDQ4jaVDq35Z2P1590gMvfBafYfqUb/ch6kMAs
+-> '=Q)e-grease Z yIg/F d9Xa
+RMB7vsSuW/KwwwXdZxN5ew
+--- l27qgWdPv4DuKVODegyMjXfBXjaJxee8+bmLTezYjxE
+çÈO{Â>»-t=wÇ™ù²UuÆ%í}µÉsþwf1ó+‹¹™!ÕC £ñKà<4B>š¬MŠË
+t"
 ˆ}–5äq…‘D

secrets.nix

@@ -24,4 +24,6 @@ in
 
   "agenix/hosts/sail/nitter/config.age".publicKeys = sail;
   "agenix/hosts/sail/nitter/auth.age".publicKeys = sail;
+
+  "agenix/hosts/sail/libreddit/auth.age".publicKeys = sail;
 }

system/nixos/libreddit.nix

@@ -1,3 +1,5 @@
+{ config, ... }:
+
 {
   services.libreddit = {
     enable = true;
@@ -5,4 +7,25 @@
     address = "127.0.0.1";
     port = 8002;
   };
+
+  services.nginx = {
+    enable = true;
+    virtualHosts."libreddit.only.internal" = {
+      listen = [
+        {
+          addr = "127.0.0.1";
+          port = 80;
+        }
+      ];
+
+      forceSSL = false;
+      enableACME = false;
+      basicAuthFile = config.age.secrets.libreddit-auth.path;
+
+      locations."/" = {
+        recommendedProxySettings = true;
+        proxyPass = "http://127.0.0.1:8002";
+      };
+    };
+  };
 }