Configure ACME

hosts/greatyamada/services/_port-definitions.nix

@@ -6,8 +6,6 @@
   coturn-minimum = 49192;
   coturn-maximum = 49200;
   forgejo-http = 3000;
-  inv-sig-helper = 12999;
-  invidious-http = 3002;
   jellyfin-http = 8096;
   matrix-http = 8008;
   matrix-https = 8448;

hosts/greatyamada/services/acme.nix

@@ -2,11 +2,13 @@
   security.acme = {
     acceptTerms = true;
     defaults.email = "aveeryy@protonmail.com";
+    # Temporarily use staging server for testing
+    defaults.server = "https://acme-staging-v02.api.letsencrypt.org/directory";
     certs."rcia.dev" = {
       credentialFiles.CLOUDFLARE_DNS_API_TOKEN_FILE =
         "/run/secrets/cloudflare_api_token";
       dnsProvider = "cloudflare";
-      extraDomainNames = [ "*.rcia.dev" ];
+      group = "nginx";
     };
   };
   sops.secrets."cloudflare/api_token" = {

hosts/greatyamada/services/adguardhome.nix

@@ -44,6 +44,7 @@ in {
       locations."/".proxyPass =
         "http://127.0.0.1:${toString portDefinitions.adguardhome-http}";
       extraConfig = nginxLocalServiceConfig;
+      useACMEHost = "rcia.dev";
     };
   };
 }

hosts/greatyamada/services/default.nix

@@ -3,7 +3,6 @@
     ./acme.nix
     ./ddclient.nix
     ./forgejo.nix
-    ./invidious
     ./jellyfin.nix
     ./minecraft
     ./nginx.nix

hosts/greatyamada/services/forgejo.nix

@@ -43,6 +43,7 @@ in {
       locations."/" = {
         proxyPass = "http://127.0.0.1:${toString portDefinitions.forgejo-http}";
       };
+      useACMEHost = "rcia.dev";
     };
   };
   systemd.services.forgejo.preStart = ''

hosts/greatyamada/services/invidious/default.nix

@@ -1,10 +0,0 @@
-{ ... }: {
-  imports = [ ./invidious.nix ./inv-sig-helper.nix ];
-  users = {
-    groups.invidious = { };
-    users.invidious = {
-      group = "invidious";
-      isSystemUser = true;
-    };
-  };
-}

hosts/greatyamada/services/invidious/inv-sig-helper.nix

@@ -1,83 +0,0 @@
-{ pkgs, ... }:
-let portDefinitions = import ../_port-definitions.nix;
-in {
-  environment.systemPackages = with pkgs; [ inv-sig-helper ];
-  systemd.services.inv-sig-helper = {
-    enable = true;
-    after = [ "syslog.target" "network.target" ];
-    wantedBy = [ "multi-user.target" ];
-    serviceConfig = {
-      User = "invidious";
-      Group = "invidious";
-      ExecStart =
-        "${pkgs.inv-sig-helper}/bin/inv_sig_helper_rust --tcp 127.0.0.1:${
-          toString portDefinitions.inv-sig-helper
-        }";
-      Restart = "always";
-      RestartSec = "2s";
-      Type = "simple";
-      WorkingDirectory = "/tmp";
-      BindPaths = "/tmp";
-      CapabilityBoundingSet = [
-        "~CAP_SETUID CAP_SETGID CAP_SETPCAP"
-        "~CAP_SYS_ADMIN"
-        "~CAP_SYS_PTRACE"
-        "~CAP_CHOWN CAP_FSETID CAP_SETFCAP"
-        "~CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_IPC_OWNER"
-        "~CAP_NET_ADMIN"
-        "~CAP_SYS_MODULE"
-        "~CAP_SYS_RAWIO"
-        "~CAP_SYS_TIME"
-        "~CAP_AUDIT_CONTROL CAP_AUDIT_READ CAP_AUDIT_WRITE"
-        "~CAP_KILL"
-        "~CAP_NET_BIND_SERVICE CAP_NET_BROADCAST CAP_NET_RAW"
-        "~CAP_SYSLOG"
-        "~CAP_SYS_NICE CAP_SYS_RESOURCE"
-        "~CAP_MAC_ADMIN CAP_MAC_OVERRIDE"
-        "~CAP_SYS_BOOT"
-        "~CAP_LINUX_IMMUTABLE"
-        "~CAP_IPC_LOCK"
-        "~CAP_SYS_CHROOT"
-        "~CAP_BLOCK_SUSPEND"
-        "~CAP_LEASE"
-        "~CAP_SYS_PACCT"
-        "~CAP_SYS_TTY_CONFIG"
-        "~CAP_WAKE_ALARM"
-      ];
-      LockPersonality = true;
-      MemoryDenyWriteExecute = true;
-      NoNewPrivileges = true;
-      PrivateDevices = true;
-      PrivateTmp = true;
-      PrivateUsers = true;
-      ProcSubset = "pid";
-      ProtectControlGroups = true;
-      ProtectHome = "tmpfs";
-      ProtectHostname = true;
-      ProtectKernelLogs = true;
-      ProtectKernelModules = true;
-      ProtectKernelTunables = true;
-      ProtectProc = "invisible";
-      ProtectSystem = "strict";
-      RemoveIPC = true;
-      RestrictAddressFamilies = "AF_INET AF_INET6 AF_UNIX";
-      RestrictNamespaces = true;
-      RestrictSUIDSGID = true;
-      RestrictRealtime = true;
-      SystemCallArchitectures = "native";
-      SystemCallFilter = [
-        "~@clock"
-        "~@debug"
-        "~@module"
-        "~@mount"
-        "~@raw-io"
-        "~@reboot"
-        "~@swap"
-        "~@privileged"
-        "~@resources"
-        "~@cpu-emulation"
-        "~@obsolete"
-      ];
-    };
-  };
-}

hosts/greatyamada/services/invidious/invidious.nix

@@ -1,51 +0,0 @@
-{ ... }:
-let
-  nginxLocalServiceConfig = import ../nginx-local-config.nix;
-  ports = import ../_port-definitions.nix;
-in {
-  services = {
-    invidious = {
-      enable = true;
-      port = ports.invidious-http;
-      extraSettingsFile = "/var/lib/invidious/extra_configuration";
-      settings = {
-        check_tables = true;
-        db.user = "invidious";
-        default_user_preferences = {
-          locale = "es";
-          dark_mode = "dark";
-          autoplay = true;
-          video_loop = true;
-          quality = "dash";
-          volume = 20;
-        };
-        signature_server = "localhost:${toString ports.inv-sig-helper}";
-      };
-      database = {
-        createLocally = false;
-        passwordFile = "/var/lib/invidious/db_password";
-      };
-      hmacKeyFile = "/var/lib/invidious/hmac_key";
-    };
-    nginx.virtualHosts."iv.rcia.dev" = {
-      locations."/" = {
-        proxyPass = "http://127.0.0.1:${toString ports.invidious-http}";
-      };
-      extraConfig = nginxLocalServiceConfig;
-    };
-  };
-  sops.secrets = {
-    "invidious/db_password" = {
-      path = "/var/lib/invidious/db_password";
-      owner = "invidious";
-    };
-    "invidious/hmac" = {
-      path = "/var/lib/invidious/hmac_key";
-      owner = "invidious";
-    };
-    "invidious/extra_secrets" = {
-      path = "/var/lib/invidious/extra_configuration";
-      owner = "invidious";
-    };
-  };
-}

hosts/greatyamada/services/jellyfin.nix

@@ -15,6 +15,7 @@ in {
           "http://127.0.0.1:${toString portDefinitions.jellyfin-http}";
       };
       extraConfig = nginxLocalServiceConfig;
+      useACMEHost = "rcia.dev";
     };
   };
 }

hosts/greatyamada/services/nginx.nix

@@ -2,7 +2,12 @@
   services.nginx = {
     enable = true;
     virtualHosts = {
-      "rcia.dev" = { locations."/" = { root = /var/www/public; }; };
+      "rcia.dev" = {
+        forceSSL = true;
+        enableACME = true;
+        serverAliases = [ "*.rcia.dev" ];
+        # locations."/" = { root = /var/www/public; };
+      };
     };
   };
 }

hosts/greatyamada/services/ntfy.nix

@@ -15,6 +15,7 @@ in {
         proxyPass = "http://127.0.0.1:${toString ports.ntfy-http}";
         recommendedProxySettings = true;
       };
+      useACMEHost = "rcia.dev";
     };
   };
 }

hosts/greatyamada/services/radicale.nix

@@ -24,6 +24,7 @@ in {
           "http://127.0.0.1:${toString portDefinitions.radicale-http}";
       };
       extraConfig = nginxLocalServiceConfig;
+      useACMEHost = "rcia.dev";
     };
   };
   sops.secrets."radicale/users" = {