Compare commits
2 commits
d472424a4e
...
006daa6ebc
Author | SHA1 | Date | |
---|---|---|---|
006daa6ebc | |||
6c75a3644f |
3 changed files with 55 additions and 3 deletions
|
@ -4,7 +4,9 @@ in {
|
|||
imports = [
|
||||
./hardware-configuration.nix
|
||||
./networking.nix # generated at runtime by nixos-infect
|
||||
|
||||
"${mod}/services/forgejo.nix"
|
||||
"${mod}/services/searx.nix"
|
||||
];
|
||||
|
||||
boot.tmp.cleanOnBoot = true;
|
||||
|
|
|
@ -1,6 +1,5 @@
|
|||
{
|
||||
config,
|
||||
lib,
|
||||
pkgs,
|
||||
...
|
||||
}: let
|
||||
|
@ -21,7 +20,7 @@ in {
|
|||
DOMAIN = "git.nezia.dev";
|
||||
HTTP_PORT = 1849;
|
||||
ROOT_URL = "https://${srv.DOMAIN}/";
|
||||
HTTP_ADDR = "::1";
|
||||
HTTP_ADDR = "localhost";
|
||||
};
|
||||
service = {
|
||||
DISABLE_REGISTRATION = true;
|
||||
|
@ -35,7 +34,7 @@ in {
|
|||
caddy = {
|
||||
enable = true;
|
||||
virtualHosts."git.nezia.dev".extraConfig = ''
|
||||
reverse_proxy * [::1]:${toString srv.HTTP_PORT}
|
||||
reverse_proxy * localhost:${toString srv.HTTP_PORT}
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
|
51
system/services/searx.nix
Normal file
51
system/services/searx.nix
Normal file
|
@ -0,0 +1,51 @@
|
|||
{pkgs, ...}: {
|
||||
services = {
|
||||
searx = {
|
||||
enable = true;
|
||||
package = pkgs.searxng;
|
||||
settings = {
|
||||
server = {
|
||||
secret_key = "TODO_USE_SOPS_INSTEAD";
|
||||
port = 8888; # Internal port
|
||||
bind_address = "localhost"; # Only listen locally
|
||||
base_url = "https://search.nezia.dev/";
|
||||
image_proxy = true;
|
||||
default_http_headers = {
|
||||
X-Content-Type-Options = "nosniff";
|
||||
X-XSS-Protection = "1; mode=block";
|
||||
X-Download-Options = "noopen";
|
||||
X-Robots-Tag = "noindex, nofollow";
|
||||
Referrer-Policy = "no-referrer";
|
||||
};
|
||||
};
|
||||
engines = [
|
||||
{
|
||||
name = "qwant";
|
||||
disabled = true;
|
||||
}
|
||||
];
|
||||
};
|
||||
};
|
||||
|
||||
caddy = {
|
||||
enable = true;
|
||||
virtualHosts."search.nezia.dev" = {
|
||||
extraConfig = ''
|
||||
encode gzip
|
||||
reverse_proxy localhost:8888 {
|
||||
header_up Host {host}
|
||||
header_up X-Real-IP {remote_addr}
|
||||
header_up X-Forwarded-For {remote_addr}
|
||||
header_up X-Forwarded-Proto {scheme}
|
||||
}
|
||||
'';
|
||||
};
|
||||
};
|
||||
};
|
||||
|
||||
# Open required ports
|
||||
networking.firewall = {
|
||||
allowedTCPPorts = [80 443]; # For Caddy
|
||||
};
|
||||
}
|
||||
|
Loading…
Reference in a new issue