| { pkgs, ... }: |
| let lib = pkgs.lib; |
| in { |
| Host = host: service: { |
| inherit host service; |
| extraHosts = [ ]; |
| secure = true; |
| specific = false; |
| type = "hosts"; |
| }; |
| SpecificHost = host: service: { |
| inherit host service; |
| extraHosts = [ ]; |
| secure = true; |
| specific = true; |
| type = "hosts"; |
| }; |
| Hosts = hosts: service: { |
| inherit service; |
| host = builtins.elemAt hosts 0; |
| extraHosts = builtins.tail hosts; |
| secure = true; |
| specific = false; |
| type = "hosts"; |
| }; |
| InsecureHost = host: service: { |
| inherit host service; |
| extraHosts = [ ]; |
| secure = false; |
| specific = false; |
| type = "hosts"; |
| }; |
| InsecureHosts = hosts: service: { |
| inherit service; |
| host = builtins.elemAt hosts 0; |
| extraHosts = builtins.tail hosts; |
| secure = false; |
| specific = false; |
| type = "hosts"; |
| }; |
| ReverseProxy = to: { |
| inherit to; |
| type = "reverseproxy"; |
| }; |
| PHP = root: socket: { |
| inherit root socket; |
| type = "php"; |
| }; |
| Redirect = to: { |
| inherit to; |
| permanent = false; |
| type = "redirect"; |
| }; |
| RedirectPermanent = to: { |
| inherit to; |
| permanent = true; |
| type = "redirect"; |
| }; |
| Directory = root: { |
| inherit root; |
| private = false; |
| type = "directory"; |
| }; |
| PrivateDirectory = root: { |
| inherit root; |
| private = true; |
| type = "directory"; |
| }; |
| File = path: { |
| inherit path; |
| type = "file"; |
| }; |
| Compose = services: { |
| inherit services; |
| type = "compose"; |
| }; |
| Path = path: service: { |
| inherit path service; |
| type = "path"; |
| }; |
| Status = statusCode: { |
| inherit statusCode; |
| type = "status"; |
| }; |
| Header = header: value: service: { |
| inherit header value service; |
| type = "header"; |
| }; |
| CrossOrigin = service: { |
| inherit service; |
| header = "Access-Control-Allow-Origin"; |
| value = "*"; |
| type = "header"; |
| }; |
| |
| Merge = let |
| # builtins.length and count up |
| _iterateCompose = services: currentConfig: currentPath: secure: priority: i: |
| if i < builtins.length services then |
| _iterateCompose services |
| (_merge (builtins.elemAt services i) currentConfig currentPath secure |
| (priority + i)) currentPath secure priority (i + 1) |
| else |
| currentConfig; |
| |
| _iterateMerge = i: current: services: |
| if i < builtins.length services then |
| _iterateMerge (i + 1) |
| (current ++ [ (_merge (builtins.elemAt services i) { } "/" true 1000) ]) |
| services |
| else |
| current; |
| |
| _merge = service: currentConfig: currentPath: secure: priority: |
| if service.type == "hosts" then |
| _merge service.service (lib.recursiveUpdate currentConfig { |
| name = service.host; |
| value = { |
| serverAliases = service.extraHosts ++ (if service.specific |
| then [] |
| else [ "www.${service.host}" ] ++ (map (host: "www.${host}") service.extraHosts)); |
| enableACME = true; |
| forceSSL = service.secure; |
| addSSL = !service.secure; |
| listenAddresses = [ "0.0.0.0" ]; |
| }; |
| }) currentPath service.secure priority |
| else if service.type == "reverseproxy" then |
| (lib.recursiveUpdate currentConfig { |
| value.locations.${currentPath} = { |
| proxyPass = if currentPath == "/" then |
| "http://${service.to}" |
| else |
| "http://${service.to}/"; |
| proxyWebsockets = true; |
| recommendedProxySettings = true; |
| }; |
| }) |
| else if service.type == "php" then |
| (lib.recursiveUpdate currentConfig { |
| value.locations.${currentPath} = { |
| root = service.root; |
| index = "index.php index.html index.htm"; |
| tryFiles = "$uri $uri/ ${currentPath}index.php?$query_string =404"; |
| }; |
| value.locations."~ ^${currentPath}.*.php$" = { |
| tryFiles = "$uri $uri/ ${currentPath}index.php?$query_string =404"; |
| extraConfig = '' |
| include ${pkgs.nginx}/conf/fastcgi_params; |
| fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; |
| fastcgi_param REDIRECT_STATUS 200; |
| fastcgi_pass unix:${service.socket}; |
| fastcgi_intercept_errors on; |
| ${lib.optionalString secure "fastcgi_param HTTPS on;"} |
| ''; |
| }; |
| }) |
| else if service.type == "redirect" then |
| (lib.recursiveUpdate currentConfig { |
| value.locations.${currentPath}.return = if service.permanent then |
| "308 ${service.to}" |
| else |
| "307 ${service.to}"; |
| }) |
| else if service.type == "directory" then |
| (lib.recursiveUpdate currentConfig { |
| value.locations.${currentPath} = { |
| root = service.root; |
| index = "index.html index.htm"; |
| tryFiles = "$uri $uri/ =404"; |
| extraConfig = lib.optionalString (!service.private) "autoindex on;"; |
| }; |
| }) |
| else if service.type == "file" then |
| (lib.recursiveUpdate currentConfig { |
| value.locations.${currentPath} = { |
| root = "/"; |
| tryFiles = "${service.path} =404"; |
| }; |
| }) |
| else if service.type == "path" then |
| _merge service.service currentConfig service.path service.secure |
| priority |
| else if service.type == "header" then |
| _merge service.service |
| (lib.recursiveUpdate currentConfig { |
| value.locations.${currentPath} = { |
| extraConfig = |
| (if |
| builtins.hasAttr "value" currentConfig |
| && builtins.hasAttr "locations" currentConfig.value |
| && builtins.hasAttr currentPath currentConfig.value.locations |
| && builtins.hasAttr "extraConfig" currentConfig.value.locations.${currentPath} |
| then currentConfig.value.locations.${currentPath}.extraConfig else "") + |
| '' |
| add_header ${service.header} "${service.value}"; |
| ''; |
| }; |
| }) currentPath secure priority |
| else if service.type == "compose" then |
| (_iterateCompose service.services currentConfig currentPath secure |
| priority 0) |
| else if service.type == "status" then |
| (lib.recursiveUpdate currentConfig { |
| value.locations.${currentPath} = { |
| return = "${builtins.toString service.statusCode}"; |
| }; |
| }) |
| else |
| throw "Unknown service type: ${service.type}"; |
| in (services: |
| lib.pipe services [ (_iterateMerge 0 [ ]) builtins.listToAttrs ]); |
| |
| # https://www.nginx.com/resources/wiki/start/topics/examples/full/ |
| |
| /* * |
| Internal needs to be a string that is both a host and a port, e.g. generic:1000 |
| External should only be a port |
| Protocol should be TCP or UDP |
| */ |
| ProxyStream = external: internal: protocol: { |
| inherit external internal protocol; |
| haproxy = true; |
| }; |
| Stream = external: internal: protocol: { |
| inherit external internal protocol; |
| haproxy = false; |
| }; |
| |
| Alias = host: alias: { |
| inherit host; |
| aliases = [ alias ]; |
| type = "aliases"; |
| }; |
| |
| Aliases = host: aliases: { |
| inherit host aliases; |
| type = "aliases"; |
| }; |
| } |
| |