{ pkgs, ... }: { services.nginx.virtualHosts = { "acme-spaceapi.hamburg.ccc.de" = { enableACME = true; serverName = "spaceapi.hamburg.ccc.de"; listen = [ { addr = "0.0.0.0"; port = 31820; } ]; }; "spaceapi.hamburg.ccc.de" = { forceSSL = true; useACMEHost = "spaceapi.hamburg.ccc.de"; listen = [ { addr = "0.0.0.0"; port = 8443; ssl = true; extraParameters = [ "proxy_protocol" ]; } ]; locations."/" = { proxyPass = "http://127.0.0.1:8080"; }; extraConfig = '' # Make use of the ngx_http_realip_module to set the $remote_addr and # $remote_port to the client address and client port, when using proxy # protocol. # First set our proxy protocol proxy as trusted. set_real_ip_from 172.31.17.140; # Then tell the realip_module to get the addreses from the proxy protocol # header. real_ip_header proxy_protocol; ''; }; }; }