nixos-config/services/nginx.nix

{ config, pkgs, secrets, ... }:

{
  sops.secrets."acme/token" = {
    sopsFile = ../secrets/sops/acme.yaml;
    owner = "acme";
    inherit (config.security.acme.defaults) group;
    mode = "0440";
  };

  services.nginx = {
    enable = true;
    enableReload = true;
    package = pkgs.nginxMainline;
    recommendedBrotliSettings = true;
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
    recommendedZstdSettings = true;
  };

  users.users.nginx.extraGroups = [ config.security.acme.defaults.group ];

  networking.firewall.allowedTCPPorts = [ 80 443 ];

  security.acme = {
    acceptTerms = true;
    defaults = {
      email = "contact@christoph-heiss.at";
      dnsProvider = "hetzner";
      dnsResolver = "hydrogen.ns.hetzner.com:53";
      reloadServices = [ "nginx" ];
      environmentFile = secrets."acme/token".path;
    };
    certs."c8h4.io" = {
      domain = "*.c8h4.io";
      extraDomainNames = [ "c8h4.io" ];
    };
  };

  systemd.services.nginx = {
    after = [ "network-online.target" ];
    wants = [ "network-online.target" ];
  };
}