From f31ede7625ac41f2f594308022c2883d21daeb81 Mon Sep 17 00:00:00 2001 From: Daniel Kempkens Date: Sat, 21 Oct 2023 20:43:00 +0200 Subject: [PATCH] tanker: move main site and blog --- system/nixos/acme-tanker.nix | 2 +- system/nixos/websites-tanker.nix | 159 ++++++++++++++++++++++++++++++- 2 files changed, 157 insertions(+), 4 deletions(-) diff --git a/system/nixos/acme-tanker.nix b/system/nixos/acme-tanker.nix index dc987ed..a61fb91 100644 --- a/system/nixos/acme-tanker.nix +++ b/system/nixos/acme-tanker.nix @@ -16,7 +16,7 @@ certs = { "kempkens.io" = { - domain = "*.kempkens.io"; + extraDomainNames = [ "*.kempkens.io" ]; }; "daniel.sx" = { diff --git a/system/nixos/websites-tanker.nix b/system/nixos/websites-tanker.nix index acf3f5d..8d69c34 100644 --- a/system/nixos/websites-tanker.nix +++ b/system/nixos/websites-tanker.nix @@ -1,9 +1,162 @@ { pkgs, ... }: +let + kempkens-io = pkgs.stdenvNoCC.mkDerivation { + pname = "website-kempkens-io"; + version = "2023-09-18"; + + src = pkgs.fetchFromGitea { + domain = "git.kempkens.io"; + owner = "daniel"; + repo = "kempkens.io"; + rev = "3a6ca5be1709ce26772e9cf0e6a9ff7474712e40"; + hash = "sha256-gMjUH/baPWlRfdkt991H5qf1GcQTZWpJQwpKua0at9c="; + fetchSubmodules = true; + }; + + nativeBuildInputs = with pkgs; [ brotli hugo ]; + + installPhase = '' + mkdir $out + + hugo + + find public -type f -regextype posix-extended -iregex '.*\.(css|js|json|html|txt|woff|woff2|xml)' \ + -exec gzip --best --keep {} ';' + find public -type f -regextype posix-extended -iregex '.*\.(css|js|json|html|txt|woff|woff2|xml)' \ + -exec brotli --best --keep {} ';' + + mv public $out/ + ''; + }; + + blog-kempkens-io = pkgs.stdenvNoCC.mkDerivation { + pname = "website-blog-kempkens-io"; + version = "2023-09-18"; + + src = pkgs.fetchFromGitea { + domain = "git.kempkens.io"; + owner = "daniel"; + repo = "blog.kempkens.io"; + rev = "781c9479051ec7a096a36f51b96030b8cd49b165"; + hash = "sha256-H/To8dcbEbYklpZAr5mQxAjneNd7vPsNBhfeocJ9amo="; + fetchSubmodules = true; + }; + + nativeBuildInputs = with pkgs; [ brotli hugo ]; + + installPhase = '' + mkdir $out + + hugo + + find public -type f -regextype posix-extended -iregex '.*\.(css|js|json|html|txt|woff|woff2|xml)' \ + -exec gzip --best --keep {} ';' + find public -type f -regextype posix-extended -iregex '.*\.(css|js|json|html|txt|woff|woff2|xml)' \ + -exec brotli --best --keep {} ';' + + mv public $out/ + ''; + }; + + docs-nifoc-pw = pkgs.stdenvNoCC.mkDerivation { + pname = "website-docs-nifoc-pw"; + version = "2021-08-30"; + + src = pkgs.fetchFromGitHub { + owner = "nifoc"; + repo = "nifoc.pw-docs"; + rev = "24034da912e3d7fddc447734ca4c9a5951a0fa32"; + sha256 = "sha256-GwVwbLUbxpFidOU1CTHFbYs/MscHpsqiYmnyvLtnYjM="; + fetchSubmodules = false; + }; + + nativeBuildInputs = with pkgs; [ brotli ]; + + installPhase = '' + mkdir $out + + find site -type f -regextype posix-extended -iregex '.*\.(css|js|json|html|txt|woff|woff2|xml)' \ + -exec gzip --best --keep {} ';' + find site -type f -regextype posix-extended -iregex '.*\.(css|js|json|html|txt|woff|woff2|xml)' \ + -exec brotli --best --keep {} ';' + + mv site $out/ + ''; + }; +in { services.nginx = { - # Documentation - virtualHosts = builtins.listToAttrs (builtins.map + virtualHosts = { + # kempkens.io + "kempkens.io" = { + quic = true; + http3 = true; + kTLS = true; + + root = "${kempkens-io}/public"; + forceSSL = true; + useACMEHost = "kempkens.io"; + + extraConfig = '' + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; + add_header X-Frame-Options DENY; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Content-Type-Options nosniff; + add_header Referrer-Policy no-referrer; + add_header Content-Security-Policy "default-src 'none'; manifest-src https://kempkens.io; script-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; font-src 'self'; form-action 'none'; frame-ancestors 'none'; base-uri 'self'"; + ''; + + locations = { + "/id".return = "307 https://keyoxide.org/028BCE9BABB5145AAAA1FB8410BE1D47E5ADFF92"; + "/.well-known/host-meta".return = "301 https://mastodon.kempkens.io/.well-known/host-meta"; + "/.well-known/webfinger".return = "301 https://mastodon.kempkens.io$request_uri"; + + "/.well-known/matrix/server".extraConfig = '' + default_type application/json; + ''; + + "/.well-known/matrix/client".extraConfig = '' + default_type application/json; + ''; + }; + }; + + "www.kempkens.io" = { + quic = true; + http3 = true; + + addSSL = true; + useACMEHost = "kempkens.io"; + + extraConfig = '' + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; + ''; + + globalRedirect = "kempkens.io"; + }; + + # blog.kempkens.io + "blog.kempkens.io" = { + quic = true; + http3 = true; + kTLS = true; + + root = "${blog-kempkens-io}/public"; + forceSSL = true; + useACMEHost = "kempkens.io"; + + extraConfig = '' + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; + add_header X-Frame-Options DENY; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Content-Type-Options nosniff; + add_header Referrer-Policy no-referrer; + add_header Content-Security-Policy "default-src 'none'; manifest-src https://blog.kempkens.io; script-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; form-action 'none'; frame-ancestors 'none'; base-uri 'self'"; + ''; + }; + } // builtins.listToAttrs (builtins.map + # Documentation (domain: { name = domain; value = { @@ -11,7 +164,7 @@ http3 = true; kTLS = true; - root = "${pkgs.website-docs-nifoc-pw}/site/${domain}"; + root = "${docs-nifoc-pw}/site/${domain}"; forceSSL = true; useACMEHost = "nifoc.pw";