nginx

host/roam/default.nix

@@ -7,7 +7,6 @@
     ./networking.nix
     ./security.nix
     ./services.nix
-    ./wireguard.nix
   ];
 
   # ====== DON'T CHANGE ======

host/roam/networking.nix

@@ -1,4 +1,8 @@
-{ ... }:
+{ var, ... }:
+let
+  wireguard-port = 51820;
+in
+
 {
   networking = {
     enableIPv6 = true;
@@ -16,10 +20,25 @@
       address = "fe80::1";
       interface = "ens3";
     };
+
+    nat = {
+      enable = true;
+      externalInterface = "ens3";
+      internalInterfaces = [ "wg0" ];
+    };
+
+    firewall.allowedUDPPorts = [ wireguard-port ];
+
+    wireguard = {
+      enable = true;
+      interfaces."wg0" = {
+        ips = var.wg.wireguard-network."roam".ips;
+        listenPort = wireguard-port;
+        privateKeyFile = var.wg.keyFile;
+        peers = var.wg.peers-for "roam";
+      };
+    };
+
   };
 
-  services.openssh = {
-    enable = true;
-    settings.PasswordAuthentication = false;
-  };
 }

host/roam/services.nix

@@ -1,4 +1,4 @@
-{ config, ... }:
+{ var, config, ... }:
 let
   headscale-domain = "headscale.hdohmen.de";
 in
@@ -6,6 +6,24 @@ in
   services = {
     nginx = {
       enable = true;
+      defaultListen = [
+        {
+          addr = var.wg.ips.roam;
+          ssl = true;
+        }
+      ];
+      virtualHosts."roam.lan" = {
+        locations."/" = { };
+      };
+      virtualHostsPub."roam.hdohmen.de" = {
+        enableACME = true;
+        locations."/" = { };
+      };
+    };
+
+    openssh = {
+      enable = true;
+      settings.PasswordAuthentication = false;
     };
   };
 

host/roam/wireguard.nix

@@ -1,25 +0,0 @@
-{ var, lib, ... }:
-let
-  wireguard-port = 51820;
-in
-{
-  networking = {
-    nat = {
-      enable = true;
-      externalInterface = "ens3";
-      internalInterfaces = [ "wg0" ];
-    };
-
-    firewall.allowedUDPPorts = [ wireguard-port ];
-
-    wireguard = {
-      enable = true;
-      interfaces."wg0" = {
-        ips = var.wg.wireguard-network."roam".ips;
-        listenPort = wireguard-port;
-        privateKeyFile = var.wg.keyFile;
-        peers = var.wg.peers-for "roam";
-      };
-    };
-  };
-}