attic: nginx+attic cli

system/nixos/atticd.nix

@@ -1,6 +1,11 @@
-{ config, secret, ... }:
+{ pkgs, config, secret, ... }:
 
+let
+  fqdn = "attic.cache.daniel.sx";
+in
 {
+  environment.systemPackages = [ pkgs.attic ];
+
   services.atticd = {
     enable = true;
 
@@ -9,6 +14,9 @@
     settings = {
       listen = "127.0.0.1:8080";
 
+      allowed-hosts = [ "${fqdn}" ];
+      api-endpoint = "https://${fqdn}/";
+
       storage = {
         type = "s3";
         region = "eu-central-1";
@@ -29,4 +37,17 @@
       };
     };
   };
+
+  services.nginx.virtualHosts."${fqdn}" = {
+    quic = true;
+    http3 = true;
+
+    onlySSL = true;
+    useACMEHost = "cache.daniel.sx";
+
+    locations."/" = {
+      recommendedProxySettings = true;
+      proxyPass = "http://127.0.0.1:8080";
+    };
+  };
 }