systems/etna/dendrite.nix

@@ -91,5 +91,35 @@ in
         }
       ];
     };
+
+    nginx.virtualHosts."m.uku.moe".locations =
+      let
+        server = {
+          "m.server" = "m.uku.moe:443";
+        };
+        client = {
+          "m.homeserver"."base_url" = "https://m.uku.moe";
+        };
+      in
+      {
+        "=/.well-known/matrix/server" = {
+          return = "200 '${builtins.toJSON server}'";
+        };
+
+        "=/.well-known/matrix/client" = {
+          return = "200 '${builtins.toJSON client}'";
+        };
+
+        "/" = {
+          proxyPass = "http://localhost:8008";
+          proxyWebsockets = true;
+          extraConfig = ''
+            proxy_set_header Host      $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_read_timeout         600;
+            client_max_body_size       100M;
+          '';
+        };
+      };
   };
 }

systems/etna/forgejo.nix

@@ -20,6 +20,8 @@ in
 {
   imports = [ secrets.generate ];
 
+  cfTunnels."git.uku3lig.net" = "http://localhost:3000";
+
   services = {
     forgejo = {
       enable = true;
@@ -40,11 +42,9 @@ in
 
         server = {
           ROOT_URL = "https://git.uku3lig.net";
-          HTTP_ADDR = "0.0.0.0";
-          HTTP_PORT = 3000;
           START_SSH_SERVER = true;
           BUILTIN_SSH_SERVER_USER = "git";
-          SSH_DOMAIN = "git.uku3lig.net";
+          SSH_DOMAIN = "ssh.uku.moe";
           SSH_LISTEN_PORT = 2222;
         };
 
@@ -120,7 +120,7 @@ in
         name = "forgejo-ssh";
         type = "tcp";
         localIp = "127.0.0.1";
-        localPort = config.services.forgejo.settings.server.SSH_LISTEN_PORT;
+        localPort = 2222;
         remotePort = 22;
       }
     ];

systems/etna/immich.nix

@@ -1,7 +1,12 @@
+{ config, _utils, ... }:
+let
+  frp = _utils.mkFrpPassthrough "immich" config.services.immich.port;
+in
 {
+  imports = [ frp ];
+
   services.immich = {
     enable = true;
-    host = "0.0.0.0";
 
     settings = null;
     mediaLocation = "/data/immich";

systems/vesuvio/default.nix

@@ -16,6 +16,7 @@
   ];
 
   services = {
+    nginx.enable = true;
     openssh = {
       ports = [ 4269 ];
       openFirewall = true;

systems/vesuvio/nginx.nix

@@ -1,7 +1,5 @@
 {
-  services.nginx = {
+  services.nginx.virtualHosts = {
-    enable = true;
-    virtualHosts = {
     # default server
     "vps.uku3lig.net" = {
       default = true;
@@ -15,7 +13,7 @@
       forceSSL = true;
       enableACME = true;
       locations."/" = {
-          proxyPass = "http://etna:2283";
+        proxyPass = "http://localhost:2283";
         proxyWebsockets = true;
       };
 
@@ -31,34 +29,9 @@
     "m.uku.moe" = {
       forceSSL = true;
       enableACME = true;
-        locations =
+      locations."/" = {
-          let
+        proxyPass = "http://etna:80";
-            server = {
+        recommendedProxySettings = true;
-              "m.server" = "m.uku.moe:443";
-            };
-            client = {
-              "m.homeserver"."base_url" = "https://m.uku.moe";
-            };
-          in
-          {
-            "=/.well-known/matrix/server" = {
-              return = "200 '${builtins.toJSON server}'";
-            };
-
-            "=/.well-known/matrix/client" = {
-              return = "200 '${builtins.toJSON client}'";
-            };
-
-            "/" = {
-              proxyPass = "http://etna:8008";
-              proxyWebsockets = true;
-              extraConfig = ''
-                proxy_set_header Host      $host;
-                proxy_set_header X-Real-IP $remote_addr;
-                proxy_read_timeout         600;
-                client_max_body_size       100M;
-              '';
-            };
       };
     };
 
@@ -75,18 +48,5 @@
         client_max_body_size 1000M;
       '';
     };
-
-      "git.uku3lig.net" = {
-        forceSSL = true;
-        enableACME = true;
-        locations."/" = {
-          proxyPass = "http://etna:3000";
-          recommendedProxySettings = true;
   };
-      };
-    };
-  };
-
-  # we depend on etna, which makes nginx fail if it's started before tailscale
-  systemd.services.nginx.after = [ "tailscaled.service" ];
 }