3rd

homelab-services/nimh-static/flake.nix

@@ -5,91 +5,93 @@
     nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.11";
   };
 
-  outputs = {
+  outputs =
-    nixosModules.nimh-static =
+    { }:
-      {
+    {
-        config,
+      nixosModules.nimh-static =
-        lib,
+        {
-        pkgs,
+          config,
-        ...
+          lib,
-      }:
+          pkgs,
-      let
+          ...
-        opts = config.services.nimh-static;
+        }:
-      in
+        let
-      {
+          opts = config.services.nimh-static;
-        options.services.nimh-static = {
+        in
-          enable = lib.mkEnableOption "serve nimh via k3s pod.";
+        {
+          options.services.nimh-static = {
+            enable = lib.mkEnableOption "serve nimh via k3s pod.";
 
-          default-nginx = {
+            default-nginx = {
-            enable = lib.mkEnableOption "Enable nginx reverse proxy.";
+              enable = lib.mkEnableOption "Enable nginx reverse proxy.";
-            hostname = lib.mkOption {
+              hostname = lib.mkOption {
-              type = lib.types.str;
+                type = lib.types.str;
-              default = "localhost";
+                default = "localhost";
-              description = "Hostname for reverse proxy";
+                description = "Hostname for reverse proxy";
-            };
+              };
 
-          };
-        };
-
-        config = lib.mkIf opts.enable {
-          users.groups.nimh = { };
-          users.users.nimh = {
-            isSystemUser = true;
-            createHome = false;
-            group = "nimh";
-          };
-
-          systemd.services.nimh-static = {
-            description = "oneshot apply service to k3s";
-            after = [ "k3s.servce" ];
-            wantedBy = [ "multi-user.target" ];
-
-            serviceConfig = {
-              Type = "oneshot";
-              ExecStart = ''
-                kubernetes_config=$(mktemp)
-                gomplate=${pkgs.gomplate}/bin/gomplate
-                gomplate --input-dir=./k3s --output-dir=$kubernetes_config
-                kubectl=${pkgs.kubectl}/bin/kubectl
-                kubectl apply -k $out
-              '';
-
-              User = "nimh";
-              Group = "nimh";
             };
           };
 
-          service.nginx = lib.mkIf opts.default-nginx.enable {
+          config = lib.mkIf opts.enable {
-            enable = true;
+            users.groups.nimh = { };
+            users.users.nimh = {
+              isSystemUser = true;
+              createHome = false;
+              group = "nimh";
+            };
 
-            virtualHosts.${opts.default-nginx.hostname} = {
+            systemd.services.nimh-static = {
-              forceSSL = true;
+              description = "oneshot apply service to k3s";
+              after = [ "k3s.servce" ];
+              wantedBy = [ "multi-user.target" ];
 
-              # Parse TLD from hostname to use wildcard cert (just takes last two elements separated by a period)
+              serviceConfig = {
-              useACMEHost =
+                Type = "oneshot";
-                let
+                ExecStart = ''
-                  b = builtins;
+                  kubernetes_config=$(mktemp)
-                  s = lib.strings;
+                  gomplate=${pkgs.gomplate}/bin/gomplate
-                  fl = s.splitString "." "${opts.default-nginx.hostname}";
+                  gomplate --input-dir=./k3s --output-dir=$kubernetes_config
-                in
+                  kubectl=${pkgs.kubectl}/bin/kubectl
-                b.concatStringsSep "." [
+                  kubectl apply -k $out
-                  (b.elemAt fl (b.length fl - 2))
+                '';
-                  (b.elemAt fl (b.length fl - 1))
-                ];
 
-              locations."/" = {
+                User = "nimh";
-                # Default k3s port?
+                Group = "nimh";
-                proxyPass = "http://localhost:30080";
               };
             };
+
+            service.nginx = lib.mkIf opts.default-nginx.enable {
+              enable = true;
+
+              virtualHosts.${opts.default-nginx.hostname} = {
+                forceSSL = true;
+
+                # Parse TLD from hostname to use wildcard cert (just takes last two elements separated by a period)
+                useACMEHost =
+                  let
+                    b = builtins;
+                    s = lib.strings;
+                    fl = s.splitString "." "${opts.default-nginx.hostname}";
+                  in
+                  b.concatStringsSep "." [
+                    (b.elemAt fl (b.length fl - 2))
+                    (b.elemAt fl (b.length fl - 1))
+                  ];
+
+                locations."/" = {
+                  # Default k3s port?
+                  proxyPass = "http://localhost:30080";
+                };
+              };
+            };
+
+            networking.firewall.allowedTCPPorts = lib.mkif opts.default-nginx.enable [
+              80
+              443
+            ];
           };
 
-          networking.firewall.allowedTCPPorts = lib.mkif opts.default-nginx.enable [
-            80
-            443
-          ];
         };
-
+    };
-      };
-  };
 }