forked from the-distro/infra
38 lines
987 B
Nix
38 lines
987 B
Nix
|
{ config, lib, ... }:
|
||
|
|
let
|
||
|
|
inherit (lib) mkIf;
|
||
|
|
cfg = config.bagel.services.gerrit;
|
||
|
|
in
|
||
|
|
{
|
||
|
|
config = mkIf cfg.enable {
|
||
|
|
services.nginx = {
|
||
|
|
enable = true;
|
||
|
|
enableReload = true;
|
||
|
|
appendHttpConfig = ''
|
||
|
|
add_header Permissions-Policy "interest-cohort=()";
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
services.nginx.virtualHosts.gerrit = {
|
||
|
|
serverName = builtins.head cfg.domains;
|
||
|
|
serverAliases = builtins.tail cfg.domains;
|
||
|
|
enableACME = true;
|
||
|
|
forceSSL = true;
|
||
|
|
|
||
|
|
extraConfig = ''
|
||
|
|
location / {
|
||
|
|
proxy_pass http://localhost:4778;
|
||
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
||
|
|
# The :443 suffix is a workaround for https://b.tvl.fyi/issues/88.
|
||
|
|
proxy_set_header Host $host:443;
|
||
|
|
}
|
||
|
|
|
||
|
|
location = /robots.txt {
|
||
|
|
return 200 'User-agent: *\nAllow: /';
|
||
|
|
}
|
||
|
|
'';
|
||
|
|
};
|
||
|
|
|
||
|
|
networking.firewall.allowedTCPPorts = [ 443 80 ];
|
||
|
|
};
|
||
|
|
}
|