modules/nixos-modules/server/actual.nix

@@ -18,6 +18,11 @@ in {
       systemd.tmpfiles.rules = [
         "d ${dataDirectory} 2770 actual actual"
       ];
+      host = {
+        reverse_proxy.subdomains.${config.services.actual.subdomain} = {
+          target = "http://localhost:${toString config.services.actual.settings.port}";
+        };
+      };
 
       services.actual = {
         settings = {
@@ -25,13 +30,6 @@ in {
         };
       };
     }
-    (lib.mkIf config.host.reverse_proxy.enable {
-      host = {
-        reverse_proxy.subdomains.${config.services.actual.subdomain} = {
-          target = "http://localhost:${toString config.services.actual.settings.port}";
-        };
-      };
-    })
     (lib.mkIf config.services.fail2ban.enable {
       # TODO: configuration for fail2ban for actual
     })

modules/nixos-modules/server/forgejo.nix

@@ -26,6 +26,9 @@ in {
         }
       ];
       host = {
+        reverse_proxy.subdomains.${config.services.forgejo.subdomain} = {
+          target = "http://localhost:${toString forgejoPort}";
+        };
         postgres = {
           enable = true;
           extraUsers = {
@@ -73,13 +76,6 @@ in {
         config.services.forgejo.settings.server.SSH_LISTEN_PORT
       ];
     }
-    (lib.mkIf config.host.reverse_proxy.enable {
-      host = {
-        reverse_proxy.subdomains.${config.services.forgejo.subdomain} = {
-          target = "http://localhost:${toString forgejoPort}";
-        };
-      };
-    })
     (lib.mkIf config.services.fail2ban.enable {
       environment.etc = {
         "fail2ban/filter.d/forgejo.local".text = lib.mkIf config.services.forgejo.enable (

modules/nixos-modules/server/home-assistant.nix

@@ -43,6 +43,24 @@ in {
 
   config = lib.mkIf config.services.home-assistant.enable (lib.mkMerge [
     {
+      host = {
+        reverse_proxy.subdomains.${config.services.home-assistant.subdomain} = {
+          target = "http://localhost:${toString config.services.home-assistant.config.http.server_port}";
+
+          websockets.enable = true;
+          forwardHeaders.enable = true;
+
+          extraConfig = ''
+            add_header Upgrade $http_upgrade;
+            add_header Connection \"upgrade\";
+
+            proxy_buffering off;
+
+            proxy_read_timeout 90;
+          '';
+        };
+      };
+
       services.home-assistant = {
         configDir = configDir;
         extraComponents = [
@@ -155,25 +173,6 @@ in {
         ];
       };
     })
-    (lib.mkIf config.host.reverse_proxy.enable {
-      host = {
-        reverse_proxy.subdomains.${config.services.home-assistant.subdomain} = {
-          target = "http://localhost:${toString config.services.home-assistant.config.http.server_port}";
-
-          websockets.enable = true;
-          forwardHeaders.enable = true;
-
-          extraConfig = ''
-            add_header Upgrade $http_upgrade;
-            add_header Connection \"upgrade\";
-
-            proxy_buffering off;
-
-            proxy_read_timeout 90;
-          '';
-        };
-      };
-    })
     (lib.mkIf config.services.fail2ban.enable {
       environment.etc = {
         "fail2ban/filter.d/hass.local".text = lib.mkIf config.services.home-assistant.enable (

modules/nixos-modules/server/immich.nix

@@ -17,6 +17,23 @@ in {
   config = lib.mkIf config.services.immich.enable (lib.mkMerge [
     {
       host = {
+        reverse_proxy.subdomains.${config.services.immich.subdomain} = {
+          target = "http://localhost:${toString config.services.immich.port}";
+
+          websockets.enable = true;
+          forwardHeaders.enable = true;
+
+          extraConfig = ''
+            # allow large file uploads
+            client_max_body_size 50000M;
+
+            # set timeout
+            proxy_read_timeout 600s;
+            proxy_send_timeout 600s;
+            send_timeout       600s;
+            proxy_redirect     off;
+          '';
+        };
         postgres = {
           enable = true;
           extraUsers = {
@@ -36,27 +53,6 @@ in {
         ];
       };
     }
-    (lib.mkIf config.host.reverse_proxy.enable {
-      host = {
-        reverse_proxy.subdomains.${config.services.immich.subdomain} = {
-          target = "http://localhost:${toString config.services.immich.port}";
-
-          websockets.enable = true;
-          forwardHeaders.enable = true;
-
-          extraConfig = ''
-            # allow large file uploads
-            client_max_body_size 50000M;
-
-            # set timeout
-            proxy_read_timeout 600s;
-            proxy_send_timeout 600s;
-            send_timeout       600s;
-            proxy_redirect     off;
-          '';
-        };
-      };
-    })
     (lib.mkIf config.services.fail2ban.enable {
       environment.etc = {
         "fail2ban/filter.d/immich.local".text = lib.mkIf config.services.immich.enable (

modules/nixos-modules/server/jellyfin.nix

@@ -30,20 +30,6 @@ in {
   config = lib.mkIf config.services.jellyfin.enable (
     lib.mkMerge [
       {
-        environment.systemPackages = [
-          pkgs.jellyfin
-          pkgs.jellyfin-web
-          pkgs.jellyfin-ffmpeg
-        ];
-
-        networking.firewall.allowedTCPPorts = [jellyfinPort dlanPort];
-
-        systemd.tmpfiles.rules = [
-          "d ${config.services.jellyfin.media_directory} 2770 jellyfin jellyfin_media"
-          "A ${config.services.jellyfin.media_directory} -    -        -               - u:jellyfin:rwX,g:jellyfin_media:rwX,o::-"
-        ];
-      }
-      (lib.mkIf config.host.reverse_proxy.enable {
         host.reverse_proxy.subdomains.jellyfin = {
           target = "http://localhost:${toString jellyfinPort}";
 
@@ -59,7 +45,19 @@ in {
             proxy_buffering off;
           '';
         };
-      })
+        environment.systemPackages = [
+          pkgs.jellyfin
+          pkgs.jellyfin-web
+          pkgs.jellyfin-ffmpeg
+        ];
+
+        networking.firewall.allowedTCPPorts = [jellyfinPort dlanPort];
+
+        systemd.tmpfiles.rules = [
+          "d ${config.services.jellyfin.media_directory} 2770 jellyfin jellyfin_media"
+          "A ${config.services.jellyfin.media_directory} -    -        -               - u:jellyfin:rwX,g:jellyfin_media:rwX,o::-"
+        ];
+      }
       (lib.mkIf config.services.fail2ban.enable {
         environment.etc = {
           "fail2ban/filter.d/jellyfin.local".text = (

modules/nixos-modules/server/panoramax.nix

@@ -33,11 +33,6 @@ in {
       {
         # TODO: configure options for the package
       }
-      (
-        lib.mkIf config.services.fail2ban {
-          # TODO: configure options for fail2ban
-        }
-      )
       (
         lib.mkIf osConfig.host.impermanence.enable {
           # TODO: configure impermanence for panoramax data

modules/nixos-modules/server/paperless.nix

@@ -24,6 +24,17 @@ in {
   config = lib.mkIf config.services.paperless.enable (lib.mkMerge [
     {
       host = {
+        reverse_proxy.subdomains.${config.services.paperless.subdomain} = {
+          target = "http://${config.services.paperless.address}:${toString config.services.paperless.port}";
+
+          websockets.enable = true;
+          forwardHeaders.enable = true;
+
+          extraConfig = ''
+            # allow large file uploads
+            client_max_body_size 50000M;
+          '';
+        };
         postgres = {
           enable = true;
           extraUsers = {
@@ -50,21 +61,6 @@ in {
         };
       };
     }
-    (lib.mkIf config.host.reverse_proxy.enable {
-      host = {
-        reverse_proxy.subdomains.${config.services.paperless.subdomain} = {
-          target = "http://${config.services.paperless.address}:${toString config.services.paperless.port}";
-
-          websockets.enable = true;
-          forwardHeaders.enable = true;
-
-          extraConfig = ''
-            # allow large file uploads
-            client_max_body_size 50000M;
-          '';
-        };
-      };
-    })
     (lib.mkIf config.services.fail2ban.enable {
       environment.etc = {
         "fail2ban/filter.d/paperless.local".text = (

modules/nixos-modules/server/searx.nix

@@ -12,14 +12,18 @@
     };
   };
 
-  config = lib.mkIf config.services.searx.enable (
+  config = lib.mkIf config.services.searx.enable {
-    lib.mkMerge [
-      {
     sops.secrets = {
       "services/searx" = {
         sopsFile = "${inputs.secrets}/defiant-services.yaml";
       };
     };
+    host = {
+      reverse_proxy.subdomains.searx = {
+        subdomain = config.services.searx.subdomain;
+        target = "http://localhost:${toString config.services.searx.settings.server.port}";
+      };
+    };
     services.searx = {
       environmentFile = config.sops.secrets."services/searx".path;
 
@@ -64,15 +68,5 @@
         ];
       };
     };
-      }
-      (lib.mkIf config.host.reverse_proxy.enable {
-        host = {
-          reverse_proxy.subdomains.searx = {
-            subdomain = config.services.searx.subdomain;
-            target = "http://localhost:${toString config.services.searx.settings.server.port}";
   };
-        };
-      })
-    ]
-  );
 }