orginase services

nixos/services/forgejo.nix

@@ -1,3 +1,7 @@
+{config, ...}:
+let
+  cfg = config.services.forgejo;
+in
 {
   services.forgejo = {
     enable = true;
@@ -5,8 +9,7 @@
     lfs.enable = true;
     settings = {
       server = {
-        DOMAIN = "git.tristans.cloud";
-        ROOT_URL = "https://git.tristans.cloud";
+        ROOT_URL = "https://${cfg.settings.server.DOMAIN}";
       };
       service = {
         DISABLE_REGISTRATION = true;
@@ -16,4 +19,9 @@
       };
     };
   };
+  services.nginx.virtualHosts.${cfg.settings.server.DOMAIN} = {
+    forceSSL = true;
+    enableACME = true;
+    locations."~".proxyPass = "http://localhost:${toString cfg.settings.server.HTTP_PORT}";
+  };
 }

nixos/services/grafana.nix

@@ -0,0 +1,18 @@
+{config, ...}:
+let
+  cfg = config.services.grafana;
+in
+{
+  services.grafana = {
+    enable = true;
+  };
+  services.nginx.virtualHosts = {
+    ${cfg.settings.server.domain} = {
+      forceSSL = true;
+      enableACME = true;
+      locations."/" = {
+        proxyPass = "http://localhost:${toString cfg.settings.server.http_port}";
+      };
+    };
+  };
+}

nixos/services/jellyfin.nix

@@ -2,4 +2,21 @@
   services.jellyfin = {
     enable = true;
   };
+  services.nginx.virtualHosts."movies.tristans.cloud" = {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://localhost:8096";
+      proxyWebsockets = true;
+      extraConfig = ''
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header X-Forwarded-Protocol $scheme;
+        proxy_set_header X-Forwarded-Host $http_host;
+        proxy_buffering off;
+      '';
+    };
+  };
 }

nixos/services/prometheus.nix

@@ -0,0 +1,5 @@
+{
+  services.prometheus = {
+    enable = true;
+  };
+}

nixos/services/vaultwarden.nix

@@ -1,5 +1,15 @@
+{config, ...}:
+let
+  cfg = config.services.vaultwarden;
+  domain = "vault.tristans.cloud";
+in
 {
   services.vaultwarden = {
     enable = true;
   };
+  services.nginx.virtualHosts.${domain} = {
+    forceSSL = true;
+    enableACME = true;
+    locations."~".proxyPass = "http://localhost:${toString cfg.config.ROCKET_PORT}";
+  };
 }