{ config, lib, pkgs, modulesPath, ... }: { #virtualisation.vmVariant.virtualisation.forwardPorts = [ # { from = "host"; host.port = 8001; guest.port = 8001; } #]; networking.hosts = { "127.0.0.1" = [ "hedgedoc.nixin.local" ]; }; networking.hostName = "demo"; #networking.firewall.enable = false; networking.firewall = { allowedTCPPorts = [ 80 443 ]; }; services.hedgedoc = { enable = true; settings.domain = "hedgedoc.nixin.local"; settings.port = 8001; settings.host = "0.0.0.0"; settings.protocolUseSSL = false; settings.allowOrigin = [ "localhost" "hedgedoc.nixin.local" ]; }; users.users.operator = { isNormalUser = true; extraGroups = [ "wheel" ]; initialPassword = "test"; }; security.acme.defaults.email = "contact@nixin.local"; security.acme.acceptTerms = true; services.nginx = { enable = true; # Use recommended settings recommendedGzipSettings = true; recommendedOptimisation = true; recommendedProxySettings = true; recommendedTlsSettings = true; # Only allow PFS-enabled ciphers with AES256 sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL"; virtualHosts."hedgedoc.nixin.local" = { forceSSL = true; enableACME = true; root = "/var/www/hedgedoc"; locations."/".proxyPass = "http://127.0.0.1:8001"; locations."/socket.io/" = { proxyPass = "http://127.0.0.1:8001"; proxyWebsockets = true; extraConfig = "proxy_ssl_server_name on;" ; }; }; }; environment.systemPackages = with pkgs; [ git wget tmux mosh htop ]; system.stateVersion = "24.05"; }