proxy nginx behind k3s

homelab-services/minio-service/flake.nix

@@ -5,11 +5,20 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
   };
 
-  outputs = { self, nixpkgs, ... }: {
-    nixosModules.minio-service = { config, lib, pkgs, ... }:
+  outputs =
+    { self, nixpkgs, ... }:
+    {
+      nixosModules.minio-service =
+        {
+          config,
+          lib,
+          pkgs,
+          ...
+        }:
         let
           opts = config.services.minio-service;
-      in {
+        in
+        {
           options.services.minio-service = {
             enable = lib.mkEnableOption "MinIO object storage server";
 
@@ -180,9 +189,22 @@ EOF
               enable = true;
               virtualHosts.${opts.default-nginx.hostname} = {
                 forceSSL = true;
+
+                # allow proxy through k3s
+                defaultHTTPListenPort = 8080;
+                defaultSSLListenPort = 8443;
+
                 # Parse TLD from hostname to use wildcard cert (just takes last two elements separated by a period)
-              useACMEHost = let b = builtins; s = lib.strings; fl = s.splitString "." "${opts.default-nginx.hostname}";
-              in b.concatStringsSep "." [ (b.elemAt fl (b.length fl - 2)) (b.elemAt fl (b.length fl - 1)) ];
+                useACMEHost =
+                  let
+                    b = builtins;
+                    s = lib.strings;
+                    fl = s.splitString "." "${opts.default-nginx.hostname}";
+                  in
+                  b.concatStringsSep "." [
+                    (b.elemAt fl (b.length fl - 2))
+                    (b.elemAt fl (b.length fl - 1))
+                  ];
 
                 # This does not work even with the MINIO_BROWSER_REDIRECT_URL set
                 locations."/console" = {
@@ -211,11 +233,16 @@ EOF
             };
 
             networking.firewall.allowedTCPPorts = lib.mkMerge [
-            (lib.mkIf opts.enable [ opts.dataPort opts.consolePort ])
-            (lib.mkIf opts.default-nginx.enable [ 80 443 ])
+              (lib.mkIf opts.enable [
+                opts.dataPort
+                opts.consolePort
+              ])
+              (lib.mkIf opts.default-nginx.enable [
+                80
+                443
+              ])
             ];
           };
         };
     };
 }
-

nixos/configuration.nix

@@ -99,6 +99,10 @@ in
   services.nginx = {
     enable = true;
 
+    # allow proxy through k3s
+    defaultHTTPListenPort = 8080;
+    defaultSSLListenPort = 8443;
+
     virtualHosts."nimh.roypository.com" = {
       forceSSL = true;
       useACMEHost = "roypository.com";