global/utils.nix

@@ -84,16 +84,4 @@
 
       systemd.services."${backend}-mc-${name}".serviceConfig.TimeoutSec = "300";
     };
-
-  mkFrpPassthrough = name: port: {
-    services.frp.settings.proxies = [
-      {
-        inherit name;
-        type = "tcp";
-        localIp = "localhost";
-        localPort = port;
-        remotePort = port;
-      }
-    ];
-  };
 }

systems/etna/immich.nix

@@ -1,9 +1,6 @@
-{ config, _utils, ... }:
+{ config, ... }:
-let
-  frp = _utils.mkFrpPassthrough "immich" config.services.immich.port;
-in
 {
-  imports = [ frp ];
+  cfTunnels."im.uku.moe" = "http://localhost:${builtins.toString config.services.immich.port}";
 
   services.immich = {
     enable = true;

systems/vesuvio/certificates.nix

@@ -1,25 +0,0 @@
-{ config, ... }:
-{
-  security.acme = {
-    acceptTerms = true;
-    defaults = {
-      email = "acme@uku.moe";
-      webroot = "/var/lib/acme/acme-challenge";
-    };
-  };
-
-  services.nginx.virtualHosts = {
-    "acme.uku3lig.net" = {
-      serverAliases = [
-        "*.uku3lig.net"
-        "*.uku.moe"
-      ];
-
-      locations."/.well-known/acme-challenge".root = config.security.acme.defaults.webroot;
-    };
-  };
-
-  # /var/lib/acme/acme-challenge must be writable by the ACME user and readable by the Nginx user.
-  # The easiest way to achieve this is to add the Nginx user to the ACME group.
-  users.users.nginx.extraGroups = [ "acme" ];
-}

systems/vesuvio/default.nix

@@ -1,10 +1,8 @@
 { pkgs, ... }:
 {
   imports = [
-    ./certificates.nix
     ./frp.nix
     ./hetzner.nix
-    ./nginx.nix
   ];
 
   environment.systemPackages = with pkgs; [
@@ -12,16 +10,8 @@
     traceroute
   ];
 
-  services = {
+  services.openssh = {
-    nginx.enable = true;
+    ports = [ 4269 ];
-    openssh = {
+    openFirewall = true;
-      ports = [ 4269 ];
-      openFirewall = true;
-    };
   };
-
-  networking.firewall.allowedTCPPorts = [
-    80
-    443
-  ];
 }

systems/vesuvio/nginx.nix

@@ -1,20 +0,0 @@
-{
-  services.nginx.virtualHosts = {
-    # immich
-    "im.uku.moe" = {
-      forceSSL = true;
-      enableACME = true;
-      locations."/" = {
-        proxyPass = "http://localhost:2283";
-        proxyWebsockets = true;
-      };
-
-      extraConfig = ''
-        client_max_body_size 5000M;
-        proxy_read_timeout 600s;
-        proxy_send_timeout 600s;
-        send_timeout 600s;
-      '';
-    };
-  };
-}