From 279839289221b3da3d59e3b18f8088c003e43d90 Mon Sep 17 00:00:00 2001
From: Greg Hellings <greg.hellings@gmail.com>
Date: Wed, 20 Apr 2022 11:11:35 -0500
Subject: [PATCH] Move proxies to module

---
 flake.nix                           |  1 +
 hosts/2maccabees/home-assistant.nix | 15 ++----
 hosts/2maccabees/vhosts.nix         | 14 +++---
 modules/default.nix                 |  7 +++
 modules/proxy.nix                   | 72 +++++++++++++++++++++++++++++
 profiles/base.nix                   |  5 --
 6 files changed, 90 insertions(+), 24 deletions(-)
 create mode 100644 modules/default.nix
 create mode 100644 modules/proxy.nix

diff --git a/flake.nix b/flake.nix
index 5b3aa6e..8bd1166 100644
--- a/flake.nix
+++ b/flake.nix
@@ -17,6 +17,7 @@
 	let
 		mods = hostname: [
 			inputs.agenix.nixosModule
+			./modules
 			./profiles/base.nix
 			./hosts/${hostname}
 			inputs.home-manager.nixosModules.home-manager {
diff --git a/hosts/2maccabees/home-assistant.nix b/hosts/2maccabees/home-assistant.nix
index cb6c239..d935184 100755
--- a/hosts/2maccabees/home-assistant.nix
+++ b/hosts/2maccabees/home-assistant.nix
@@ -93,18 +93,9 @@ in
 	# multiple layers of proxies, then add more of them in the list. The list also accepts subnet notation in case you have
 	# multiple potentially incoming connections. So you could do "10.88.0.1/24", according to the docs. However, that has not
 	# worked in my testing, as Home Assistant throws an error on start up saying that value is invalid
-	services.nginx = {
-		enable= true;
-		virtualHosts."smart.thehellings.lan".locations."/" = {
-			proxyPass = "http://127.0.0.1:8123";
-			extraConfig = ''
-				proxy_set_header Host $host;
-				proxy_http_version 1.1;
-				proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-				proxy_set_header Upgrade $http_upgrade;
-				proxy_set_header Connection $connection_upgrade;
-			'';
-		};
+	greg.proxies."smart.thehellings.lan" = {
+		target = "http://127.0.0.1:8123";
+		ssl = false;
 	};
 
 	# Ensure that both ports are up and running. We keep 8123 directly open because we are on the LAN and sometimes want to connect
diff --git a/hosts/2maccabees/vhosts.nix b/hosts/2maccabees/vhosts.nix
index 8a21ed8..1d85381 100644
--- a/hosts/2maccabees/vhosts.nix
+++ b/hosts/2maccabees/vhosts.nix
@@ -5,12 +5,12 @@
 { ... }:
 
 {
-	services.nginx = {
-		enable = true;
-		# A proxy front-end for Syncthing
-		virtualHosts."dns.thehellings.lan" = {
-			locations."/sync/".proxyPass = "http://127.0.0.1:8384/";
-			serverAliases = [ "dns" ];
-		};
+	greg.proxies."dns.thehellings.lan" = {
+		target = "http://127.0.0.1:8384/";
+		ssl = false;
+		path = "/sync/";
 	};
+
+	# The module doesn't handle this
+	services.nginx.virtualHosts."dns.thehellings.lan".serverAliases = [ "dns" ];
 }
diff --git a/modules/default.nix b/modules/default.nix
new file mode 100644
index 0000000..0259dc0
--- /dev/null
+++ b/modules/default.nix
@@ -0,0 +1,7 @@
+{ ... }:
+
+{
+	imports = [
+		./proxy.nix
+	];
+}
diff --git a/modules/proxy.nix b/modules/proxy.nix
new file mode 100644
index 0000000..c13247f
--- /dev/null
+++ b/modules/proxy.nix
@@ -0,0 +1,72 @@
+{ config, lib, pkgs, ... }:
+
+let
+	cfg = config.greg.proxies;
+
+	makeHost = name: dest: {
+		forceSSL = dest.ssl;
+		enableACME = dest.ssl;
+		locations."${dest.path}" = {
+			proxyPass = dest.target;
+			extraConfig = ''
+proxy_http_version 1.1;
+proxy_set_header Upgrade $http_upgrade;
+proxy_set_header Connection $connection_upgrade;
+'';
+		};
+	};
+
+in with lib; {
+	options = {
+		greg.proxies = mkOption {
+			default = {};
+			example = literalExpression ''
+				{ host-name = {
+					target = proxyLocation;
+					ssl = true;
+				};
+			'';
+			description = ''
+				Quick and simple Nginx proxy configurations.
+				Use this to configure a very simple proxy that does not
+				need any extra customization options other than SSL
+				enablement.
+			'';
+
+			type = with types; attrsOf (submodule (
+				{ name, config, options, ... }:
+				{
+					options = {
+						target = mkOption {
+							type = types.str;
+							description = ''The destination that is being proxied.'';
+							example = "http://localhost:8080";
+						};
+
+						ssl = mkOption {
+							type = types.bool;
+							description = "Whether to enable SSL in front of the proxy";
+							default = false;
+						};
+
+						path = mkOption {
+							type = types.str;
+							description = "The path prefix for this proxy";
+							default = "/";
+						};
+					};
+				}));
+		};
+	};
+
+	config.services.nginx = mkIf ( ( attrValues cfg ) != [] ) {
+		enable = true;
+
+		recommendedGzipSettings = true;
+		recommendedOptimisation = true;
+		recommendedProxySettings = true;
+		recommendedTlsSettings = true;
+
+		virtualHosts = mapAttrs makeHost cfg;
+	};
+}
diff --git a/profiles/base.nix b/profiles/base.nix
index 90b778e..a918a69 100755
--- a/profiles/base.nix
+++ b/profiles/base.nix
@@ -76,11 +76,6 @@ in
 				path = "/home/greg/drive";
 				devices = syncs;
 			};
-			"pifvm-wdsh9" = {
-				enable = true;
-				path = "/home/greg/.ssh";
-				devices = syncs;
-			};
 		};
 	};