diff --git a/config/hosts/public-web-static/virtualHosts/default.nix b/config/hosts/public-web-static/virtualHosts/default.nix index 61008d2..d1c1355 100644 --- a/config/hosts/public-web-static/virtualHosts/default.nix +++ b/config/hosts/public-web-static/virtualHosts/default.nix @@ -27,6 +27,5 @@ ./diday.org.nix ./staging.diday.org.nix ./historic-easterhegg - ./ueberwachungsfrei-kundgebung.nix ]; } diff --git a/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix b/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix deleted file mode 100644 index ce87788..0000000 --- a/config/hosts/public-web-static/virtualHosts/ueberwachungsfrei-kundgebung.nix +++ /dev/null @@ -1,82 +0,0 @@ -{ pkgs, ... }: - -let - domain = "ueberwachungsfrei.eu"; - dataDir = "/var/www/${domain}"; - deployUser = "ueberwachungsfrei-deploy"; -in { - security.acme.certs."${domain}".extraDomainNames = [ - "xn--berwachungsfrei-yvb.eu" - ]; - - services.nginx.virtualHosts = { - "acme-${domain}" = { - enableACME = true; - serverName = "${domain}"; - serverAliases = [ - "xn--berwachungsfrei-yvb.eu" - ]; - - listen = [ - { - addr = "[::]"; - port = 31820; - } - { - addr = "0.0.0.0"; - port = 31820; - } - ]; - }; - - "${domain}" = { - forceSSL = true; - useACMEHost = "${domain}"; - serverAliases = [ - "überwachungsfrei.eu" - "xn--berwachungsfrei-yvb.eu" - ]; - - listen = [ - { - addr = "[::]"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - { - addr = "0.0.0.0"; - port = 8443; - ssl = true; - proxyProtocol = true; - } - ]; - - root = "${dataDir}"; - - extraConfig = '' - # Make use of the ngx_http_realip_module to set the $remote_addr and - # $remote_port to the client address and client port, when using proxy - # protocol. - # First set our proxy protocol proxy as trusted. - set_real_ip_from 172.31.17.140; - # Then tell the realip_module to get the addreses from the proxy protocol - # header. - real_ip_header proxy_protocol; - ''; - }; - }; - - systemd.tmpfiles.rules = [ - "d ${dataDir} 0755 ${deployUser} ${deployUser}" - ]; - - users.users."${deployUser}" = { - isNormalUser = true; - group = "${deployUser}"; - openssh.authorizedKeys.keys = [ - # TODO: Maybe add a deploy key if we want CI/CD - ]; - }; - users.groups."${deployUser}" = { }; -}