firefox sync

host/roam/default.nix

@@ -1,5 +1,4 @@
-{ lib', ... }:
-{
+_: {
   networking.hostName = "roam";
 
   age.identityPaths = [
@@ -8,6 +7,7 @@
 
   imports = [
     ./backup.nix
+    ./firefox-sync.nix
     ./git.nix
     ./hardware-configuration.nix
     ./networking.nix

host/roam/firefox-sync.nix

@@ -0,0 +1,32 @@
+{
+  pkgs,
+  config,
+  secrets,
+  ...
+}:
+{
+  services.mysql.package = pkgs.mariadb;
+
+  age.secrets.roam-firefox-sync-secret = {
+    file = secrets.roam."firefox-sync-secret.age";
+    mode = "440";
+    owner = "root";
+    group = "root";
+  };
+
+  services.firefox-syncserver = {
+    enable = true;
+    secrets = config.age.secrets.roam-firefox-sync-secret.path;
+    singleNode = {
+      enable = true;
+      hostname = "fx-sync.lan";
+      enableTLS = false;
+    };
+  };
+  services.nginx.virtualHostsPriv."fx-sync.lan" = {
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString config.services.firefox-syncserver.settings.port}";
+      recommendedProxySettings = true;
+    };
+  };
+}

host/roam/services.nix

@@ -6,16 +6,16 @@
   services = {
     nginx = {
       enable = true;
-      defaultListen = [
-        {
-          addr = var.wg.ips.roam;
-          ssl = true;
-        }
-      ];
-      virtualHosts."roam.lan" = {
+      virtualHosts.default = {
+        serverName = "_";
+        default = true;
+        rejectSSL = true;
+        locations."/".return = "444";
+      };
+      virtualHostsPriv."roam.lan" = {
         locations."/" = { };
       };
-      virtualHostsPub."roam.hdohmen.de" = {
+      virtualHosts."roam.hdohmen.de" = {
         enableACME = true;
         locations."/" = { };
       };