proxy nginx behind k3s

homelab-services/minio-service/flake.nix

@@ -5,11 +5,20 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
   };
 
-  outputs = { self, nixpkgs, ... }: {
+  outputs =
-    nixosModules.minio-service = { config, lib, pkgs, ... }:
+    { self, nixpkgs, ... }:
+    {
+      nixosModules.minio-service =
+        {
+          config,
+          lib,
+          pkgs,
+          ...
+        }:
         let
           opts = config.services.minio-service;
-      in {
+        in
+        {
           options.services.minio-service = {
             enable = lib.mkEnableOption "MinIO object storage server";
 
@@ -40,7 +49,7 @@
               enable = lib.mkEnableOption "Enable bootstrapping minio creds";
               environments = lib.mkOption {
                 type = lib.types.listOf lib.types.str;
-              default = [];
+                default = [ ];
                 description = "list of environments to bootstrap (dev, prod, stage, etc)";
               };
             };
@@ -56,7 +65,7 @@
           };
 
           config = lib.mkIf opts.enable {
-          users.groups.minio = {};
+            users.groups.minio = { };
             users.users.minio = {
               isSystemUser = true;
               createHome = true;
@@ -137,7 +146,7 @@
                                     # Create policy JSON (full access to that bucket)
                                     policy_file=$(mktemp)
                                     cat > "$policy_file" <<EOF
-{
+                  {
                     "Version": "2012-10-17",
                     "Statement": [
                       {
@@ -149,8 +158,8 @@
                         ]
                       }
                     ]
-}
+                  }
-EOF
+                  EOF
 
                                     # Apply policy
                                     $mc_bin admin policy create "$alias_name" "$policy" "$policy_file"
@@ -180,9 +189,22 @@ EOF
               enable = true;
               virtualHosts.${opts.default-nginx.hostname} = {
                 forceSSL = true;
+
+                # allow proxy through k3s
+                defaultHTTPListenPort = 8080;
+                defaultSSLListenPort = 8443;
+
                 # Parse TLD from hostname to use wildcard cert (just takes last two elements separated by a period)
-              useACMEHost = let b = builtins; s = lib.strings; fl = s.splitString "." "${opts.default-nginx.hostname}";
+                useACMEHost =
-              in b.concatStringsSep "." [ (b.elemAt fl (b.length fl - 2)) (b.elemAt fl (b.length fl - 1)) ];
+                  let
+                    b = builtins;
+                    s = lib.strings;
+                    fl = s.splitString "." "${opts.default-nginx.hostname}";
+                  in
+                  b.concatStringsSep "." [
+                    (b.elemAt fl (b.length fl - 2))
+                    (b.elemAt fl (b.length fl - 1))
+                  ];
 
                 # This does not work even with the MINIO_BROWSER_REDIRECT_URL set
                 locations."/console" = {
@@ -211,11 +233,16 @@ EOF
             };
 
             networking.firewall.allowedTCPPorts = lib.mkMerge [
-            (lib.mkIf opts.enable [ opts.dataPort opts.consolePort ])
+              (lib.mkIf opts.enable [
-            (lib.mkIf opts.default-nginx.enable [ 80 443 ])
+                opts.dataPort
+                opts.consolePort
+              ])
+              (lib.mkIf opts.default-nginx.enable [
+                80
+                443
+              ])
             ];
           };
         };
     };
 }
-

nixos/configuration.nix

@@ -99,6 +99,10 @@ in
   services.nginx = {
     enable = true;
 
+    # allow proxy through k3s
+    defaultHTTPListenPort = 8080;
+    defaultSSLListenPort = 8443;
+
     virtualHosts."nimh.roypository.com" = {
       forceSSL = true;
       useACMEHost = "roypository.com";