3rd

2026-05-27 00:46:48 -05:00
parent 75cf58db8a
commit 682b732b5d
1 changed files with 76 additions and 74 deletions
@@ -5,91 +5,93 @@
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
  };

-  outputs = {
-    nixosModules.nimh-static =
-      {
-        config,
-        lib,
-        pkgs,
-        ...
-      }:
-      let
-        opts = config.services.nimh-static;
-      in
-      {
-        options.services.nimh-static = {
-          enable = lib.mkEnableOption "serve nimh via k3s pod.";
+  outputs =
+    { }:
+    {
+      nixosModules.nimh-static =
+        {
+          config,
+          lib,
+          pkgs,
+          ...
+        }:
+        let
+          opts = config.services.nimh-static;
+        in
+        {
+          options.services.nimh-static = {
+            enable = lib.mkEnableOption "serve nimh via k3s pod.";

-          default-nginx = {
-            enable = lib.mkEnableOption "Enable nginx reverse proxy.";
-            hostname = lib.mkOption {
-              type = lib.types.str;
-              default = "localhost";
-              description = "Hostname for reverse proxy";
-            };
+            default-nginx = {
+              enable = lib.mkEnableOption "Enable nginx reverse proxy.";
+              hostname = lib.mkOption {
+                type = lib.types.str;
+                default = "localhost";
+                description = "Hostname for reverse proxy";
+              };

-          };
-        };
-
-        config = lib.mkIf opts.enable {
-          users.groups.nimh = { };
-          users.users.nimh = {
-            isSystemUser = true;
-            createHome = false;
-            group = "nimh";
-          };
-
-          systemd.services.nimh-static = {
-            description = "oneshot apply service to k3s";
-            after = [ "k3s.servce" ];
-            wantedBy = [ "multi-user.target" ];
-
-            serviceConfig = {
-              Type = "oneshot";
-              ExecStart = ''
-                kubernetes_config=$(mktemp)
-                gomplate=${pkgs.gomplate}/bin/gomplate
-                gomplate --input-dir=./k3s --output-dir=$kubernetes_config
-                kubectl=${pkgs.kubectl}/bin/kubectl
-                kubectl apply -k $out
-              '';
-
-              User = "nimh";
-              Group = "nimh";
            };
          };

-          service.nginx = lib.mkIf opts.default-nginx.enable {
-            enable = true;
+          config = lib.mkIf opts.enable {
+            users.groups.nimh = { };
+            users.users.nimh = {
+              isSystemUser = true;
+              createHome = false;
+              group = "nimh";
+            };

-            virtualHosts.${opts.default-nginx.hostname} = {
-              forceSSL = true;
+            systemd.services.nimh-static = {
+              description = "oneshot apply service to k3s";
+              after = [ "k3s.servce" ];
+              wantedBy = [ "multi-user.target" ];

-              # Parse TLD from hostname to use wildcard cert (just takes last two elements separated by a period)
-              useACMEHost =
-                let
-                  b = builtins;
-                  s = lib.strings;
-                  fl = s.splitString "." "${opts.default-nginx.hostname}";
-                in
-                b.concatStringsSep "." [
-                  (b.elemAt fl (b.length fl - 2))
-                  (b.elemAt fl (b.length fl - 1))
-                ];
+              serviceConfig = {
+                Type = "oneshot";
+                ExecStart = ''
+                  kubernetes_config=$(mktemp)
+                  gomplate=${pkgs.gomplate}/bin/gomplate
+                  gomplate --input-dir=./k3s --output-dir=$kubernetes_config
+                  kubectl=${pkgs.kubectl}/bin/kubectl
+                  kubectl apply -k $out
+                '';

-              locations."/" = {
-                # Default k3s port?
-                proxyPass = "http://localhost:30080";
+                User = "nimh";
+                Group = "nimh";
              };
            };
+
+            service.nginx = lib.mkIf opts.default-nginx.enable {
+              enable = true;
+
+              virtualHosts.${opts.default-nginx.hostname} = {
+                forceSSL = true;
+
+                # Parse TLD from hostname to use wildcard cert (just takes last two elements separated by a period)
+                useACMEHost =
+                  let
+                    b = builtins;
+                    s = lib.strings;
+                    fl = s.splitString "." "${opts.default-nginx.hostname}";
+                  in
+                  b.concatStringsSep "." [
+                    (b.elemAt fl (b.length fl - 2))
+                    (b.elemAt fl (b.length fl - 1))
+                  ];
+
+                locations."/" = {
+                  # Default k3s port?
+                  proxyPass = "http://localhost:30080";
+                };
+              };
+            };
+
+            networking.firewall.allowedTCPPorts = lib.mkif opts.default-nginx.enable [
+              80
+              443
+            ];
          };

-          networking.firewall.allowedTCPPorts = lib.mkif opts.default-nginx.enable [
-            80
-            443
-          ];
        };
-
-      };
-  };
+    };
 }