nixos-configuration/services/portfolio/default.nix

50 lines
1.2 KiB
Nix

{ system, ... }:
let
portfolio = (
builtins.getFlake "github:jrpotter/portfolio/a0b45733bc23da3d98dc1f7f5a69d8e3a0a166b2"
).packages.${system}.app;
in
{
services.nginx = {
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
virtualHosts."www.jrpotter.com" = {
forceSSL = true;
enableACME = true;
serverAliases = [ "jrpotter.com" ];
locations."/" = {
proxyPass = "http://127.0.0.1:4000";
proxyWebsockets = true;
};
};
};
systemd.services.portfolio = {
enable = true;
description = "Portfolio Server";
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
requires = [ "network-online.target" ];
environment = {
PHX_HOST = "jrpotter.com";
};
serviceConfig = {
Type = "exec";
EnvironmentFile = "/run/secrets/PORTFOLIO_SECRET_KEY_BASE";
ExecStart = "${portfolio}/bin/server start";
ExecStop = "${portfolio}/bin/server stop";
ExecReload = "${portfolio}/bin/server restart";
Restart = "on-failure";
};
};
sops = {
secrets.PORTFOLIO_SECRET_KEY_BASE = {
sopsFile = ./secrets.yaml;
};
};
}