freshlybakedca.ke
a.starrysky.fyi
+42
packetmix/systems/common/nginx.nix
+42
packetmix/systems/common/nginx.nix
···
1
+
# SPDX-FileCopyrightText: 2025 FreshlyBakedCake
2
+
#
3
+
# SPDX-License-Identifier: MIT
4
+
5
+
{ config, lib, ... }:
6
+
{
7
+
# By default, nginx will serve a "best-effort" site even if there is no matching vhost
8
+
# We can disable this by making a matching vhost and returning 444...
9
+
# Notice how we don't enable nginx here: that makes this safe to deploy even on places that don't currently run nginx. We're effectively changing the default behavior
10
+
services.nginx.virtualHosts."missinghost.invalid" = {
11
+
default = true;
12
+
13
+
addSSL = true;
14
+
enableACME = true;
15
+
acmeRoot = null;
16
+
17
+
locations."/".return = "444";
18
+
19
+
extraConfig = ''
20
+
ssl_reject_handshake on;
21
+
'';
22
+
};
23
+
24
+
systemd.services."acme-missinghost.invalid".enable = false;
25
+
systemd.timers."acme-missinghost.invalid".enable = false;
26
+
27
+
systemd.targets."acme-finished-missinghost.invalid" = {
28
+
requires = lib.mkForce [ "acme-selfsigned-missinghost.invalid.service" ];
29
+
after = lib.mkForce [ "acme-selfsigned-missinghost.invalid.service" ];
30
+
};
31
+
32
+
security.acme.acceptTerms = true;
33
+
security.acme.certs = lib.mkIf config.services.nginx.enable {
34
+
"missinghost.invalid" = {
35
+
dnsProvider = null;
36
+
listenHTTP = null;
37
+
s3Bucket = null;
38
+
webroot = "/dev/null";
39
+
email = "invalid@missinghost.invalid";
40
+
}; # Nix requires some values, even if we're actually disabling the acme-missinghost.invalid service... that's problematic if there are no defaults for the system
41
+
};
42
+
}