diff options
author | makefu <github@syntax-fehler.de> | 2015-10-19 21:50:08 +0200 |
---|---|---|
committer | makefu <github@syntax-fehler.de> | 2015-10-19 21:50:25 +0200 |
commit | 754ea55ab89cdeffaac7b4b66ca792558fed9237 (patch) | |
tree | 72e201f515ecc8da7e28119f6353b9d7912a8bae /krebs/3modules/retiolum-bootstrap.nix | |
parent | 5a1808617aa121b8fc66389d8e92e387bb25a64c (diff) |
krebs 3 retiolum-bootstrap: init module
Diffstat (limited to 'krebs/3modules/retiolum-bootstrap.nix')
-rw-r--r-- | krebs/3modules/retiolum-bootstrap.nix | 60 |
1 files changed, 60 insertions, 0 deletions
diff --git a/krebs/3modules/retiolum-bootstrap.nix b/krebs/3modules/retiolum-bootstrap.nix new file mode 100644 index 000000000..5cce4c2af --- /dev/null +++ b/krebs/3modules/retiolum-bootstrap.nix @@ -0,0 +1,60 @@ +{ config, lib, pkgs, ... }: + +with lib; +let + cfg = config.krebs.retiolum-bootstrap; + + out = { + options.krebs.retiolum-bootstrap = api; + config = mkIf cfg.enable imp ; + }; + + api = { + enable = mkEnableOption "retiolum boot strap for tinc.krebsco.de"; + hostname = mkOption { + type = types.str; + description = "hostname which serves tinc boot"; + default = "tinc.krebsco.de" ; + }; + ssl_certificate_key = mkOption { + type = types.str; + description = "Certificate key to use for ssl"; + default = "/root/secrets/tinc.krebsco.de.key"; + }; + ssl_certificate = mkOption { + type = types.str; + description = "Certificate file to use for ssl"; + default = "/root/secrets/tinc.krebsco.de.crt" ; + }; + # in use: + # <secrets/tinc.krebsco.de.crt> + # <secrets/tinc.krebsco.de.key> + }; + + imp = { + # TODO: assert krebs nginx + + krebs.nginx.servers = { + retiolum-boot-redir = { + server-names = singleton cfg.hostname; + extraConfig = '' + return 301 https://$server_name$request_uri; + ''; + locations = []; + }; + retiolum-boot-ssl = { + server-names = singleton cfg.hostname; + listen = "443 ssl"; + extraConfig = '' + ssl_certificate ${cfg.ssl_certificate}; + ssl_certificate_key ${cfg.ssl_certificate_key}; + root ${pkgs.retiolum-bootstrap}; + try_files $uri $uri/retiolum.sh; + ''; + locations = []; + }; + }; + }; + +in +out |