nix-infra/config/hosts/hydra/nginx.nix

{ config, pkgs, ... }:

let
  domain = "hydra.hamburg.ccc.de";
in
{
  services.nginx = {
    enable = true;

    virtualHosts = {
      "acme-${domain}" = {
        default = true;
        enableACME = true;
        serverName = "${domain}";

        listen = [
          {
            addr = "0.0.0.0";
            port = 31820;
          }
        ];
      };

      "${domain}" = {
        default = true;
        forceSSL = true;
        useACMEHost = "${domain}";

        listen = [
          {
            addr = "0.0.0.0";
            port = 8443;
            ssl = true;
            proxyProtocol = true;
          }
        ];

        locations."/" = {
          proxyPass = "http://${config.services.hydra.listenHost}:${builtins.toString config.services.hydra.port}";
        };

        extraConfig = ''
          # Make use of the ngx_http_realip_module to set the $remote_addr and
          # $remote_port to the client address and client port, when using proxy
          # protocol.
          # First set our proxy protocol proxy as trusted.
          set_real_ip_from 172.31.17.140;
          # Then tell the realip_module to get the addreses from the proxy protocol
          # header.
          real_ip_header proxy_protocol;
        '';
      };
    };
  };

  networking.firewall.allowedTCPPorts = [ 8443 31820 ];
  networking.firewall.allowedUDPPorts = [ 8443 ];
}