1 files changed, 44 insertions, 20 deletions
diff --git a/tv/1systems/cd.nix b/tv/1systems/cd.nix
index 32d956b8a..2ad4a1505 100644
--- a/tv/1systems/cd.nix
+++ b/tv/1systems/cd.nix
@@ -18,7 +18,7 @@ with config.krebs.lib;
         enable = true;
         ssl_cert = ../Zcerts/charybdis_cd.crt.pem;
       };
-      tv.iptables.input-retiolum-accept-new-tcp = [
+      tv.iptables.input-retiolum-accept-tcp = [
         config.tv.charybdis.port
         config.tv.charybdis.sslport
       ];
@@ -28,14 +28,14 @@ with config.krebs.lib;
         enable = true;
         hosts = [ "jabber.viljetic.de" ];
       };
-      tv.iptables.input-internet-accept-new-tcp = [
+      tv.iptables.input-internet-accept-tcp = [
         "xmpp-client"
         "xmpp-server"
       ];
     }
     {
       krebs.github-hosts-sync.enable = true;
-      tv.iptables.input-internet-accept-new-tcp =
+      tv.iptables.input-internet-accept-tcp =
         singleton config.krebs.github-hosts-sync.port;
     }
     {
@@ -44,20 +44,50 @@ with config.krebs.lib;
         "cgit.cd.viljetic.de"
       ];
       # TODO make public_html also available to cd, cd.retiolum (AKA default)
-      krebs.nginx.servers.public_html = {
-        server-names = singleton "cd.viljetic.de";
-        locations = singleton (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
-          alias /home/$1/public_html$2;
-        '');
+      krebs.nginx.servers."https://viljetic.de" = {
+        server-names = singleton "viljetic.de";
+        listen = mkForce []; # disable default
+        ssl = {
+          enable = true;
+          certificate = "/var/lib/acme/viljetic.de/fullchain.pem";
+          certificate_key = "/var/lib/acme/viljetic.de/key.pem";
+        };
+        locations = [
+          (nameValuePair "/" ''
+            root ${pkgs.viljetic-pages};
+          '')
+          (nameValuePair "~ ^/~(.+?)(/.*)?\$" ''
+            alias /home/$1/public_html$2;
+          '')
+        ];
       };
-      krebs.nginx.servers.viljetic = {
+      krebs.nginx.servers."http://viljetic.de" = {
         server-names = singleton "viljetic.de";
-        # TODO directly set root (instead via location)
-        locations = singleton (nameValuePair "/" ''
-          root ${pkgs.viljetic-pages};
-        '');
+        locations = [
+          (nameValuePair "/.well-known/acme-challenge/" ''
+            root /var/lib/acme/challenges/viljetic.de/;
+          '')
+          (nameValuePair "/" ''
+            return 301 https://viljetic.de$request_uri;
+          '')
+        ];
+      };
+      security.acme = {
+        certs."viljetic.de" = {
+          email = "tomislav@viljetic.de";
+          webroot = "/var/lib/acme/challenges/viljetic.de";
+          plugins = [
+            "account_key.json"
+            "key.pem"
+            "fullchain.pem"
+          ];
+          user = "nginx";
+        };
       };
-      tv.iptables.input-internet-accept-new-tcp = singleton "http";
+      tv.iptables.input-internet-accept-tcp = [
+        "http"
+        "https"
+      ];
     }
   ];
 
@@ -78,13 +108,7 @@ with config.krebs.lib;
     iotop
     iptables
     nethogs
-    ntp     # ntpate
     rxvt_unicode.terminfo
     tcpdump
   ];
-
-  services.journald.extraConfig = ''
-    SystemMaxUse=1G
-    RuntimeMaxUse=128M
-  '';
 }