diff --git a/hosts/hainich/services/murmur.nix b/hosts/hainich/services/murmur.nix index 82e0718..836b4a5 100644 --- a/hosts/hainich/services/murmur.nix +++ b/hosts/hainich/services/murmur.nix @@ -1,5 +1,23 @@ { config, lib, pkgs, ... }: + +let + mumblesite = pkgs.stdenv.mkDerivation { + name = "mumble.hacc.space-website"; + src = pkgs.fetchgit { + url = "https://gitlab.infra4future.de/hacc/infra4future/mumble.infra4future.de"; + rev = "597c4a2fa7a146f2fd58924cb2b181d530a2a866"; + sha256 = "15vh0xqx0xcm09ij877jxkd6gb5nm2hbmyz47y5019xywa766s3h"; + }; + buildPhase = '' + ${pkgs.jekyll.outPath}/bin/jekyll build + ''; + installPhase = '' + mkdir -p $out + cp -r _site/* $out + ''; + }; +in { services.murmur = { enable = true; @@ -14,18 +32,16 @@ networking.firewall.allowedTCPPorts = [ config.services.murmur.port ]; networking.firewall.allowedUDPPorts = [ config.services.murmur.port ]; - services.nginx.virtualHosts = let - vhost = { - forceSSL = true; - enableACME = true; - locations."/" = { - proxyPass = "https://hacc.4future.dev/infra4future/mumble.infra4future.de/"; - }; - }; - in { - "mumble.infra4future.de" = vhost; - "mumble.hacc.space" = vhost; + services.nginx.virtualHosts = + let vhost = { + forceSSL = true; + enableACME = true; + root = mumblesite.outPath; }; + in { + "mumble.infra4future.de" = vhost; + "mumble.hacc.space" = vhost; + }; # set ACLs so that the murmur user can read the certificates security.acme.certs."mumble.hacc.space".postRun = "setfacl -Rm u:murmur:rX /var/lib/acme/mumble.hacc.space";