nixos/modules/services/nginx/default.nix

inputs:
{
  imports = inputs.localLib.mkModules
  [
    ./applications
  ];
  options.nixos.services.nginx = let inherit (inputs.lib) mkOption types; in
  {
    enable = mkOption { type = types.bool; default = false; };
    transparentProxy =
    {
      enable = mkOption { type = types.bool; default = true; };
      externalIp = mkOption { type = types.listOf types.nonEmptyStr; };
      map = mkOption { type = types.attrsOf types.ints.unsigned; default = {};};
    };
    http = mkOption
    {
      type = types.attrsOf (types.submodule { options =
      {
        rewriteHttps = mkOption { type = types.bool; default = false; };
        http2 = mkOption { type = types.bool; default = true; };
        addAuth = mkOption { type = types.bool; default = false; };
        detectAuth = mkOption { type = types.bool; default = false; };
        locations = mkOption
        {
          type = types.attrsOf (types.submodule { options =
          {
            proxy = mkOption
            {
              type = types.nullOr (types.submodule { options =
              {
                upstream = mkOption { type = types.nonEmptyStr; };
                websocket = mkOption { type = types.bool; default = false; };
                setHeaders = mkOption { type = types.attrsOf types.str; default = {}; };
              };});
              default = null;
            };
            static = mkOption
            {
              type = types.nullOr (types.submodule { options =
              {
                root = mkOption { type = types.nonEmptyStr; };
                index = mkOption { type = types.listOf types.nonEmptyStr; default = [ "index.html" ]; };
                tryFiles = mkOption { type = types.listOf types.nonEmptyStr; default = []; };
              };});
              default = null;
            };
            php = mkOption
            {
              type = types.nullOr (types.submodule { options =
              {
                root = mkOption { type = types.nonEmptyStr; };
                fastcgiPass = mkOption { type = types.nonEmptyStr; };
              };});
              default = null;
            };
          };});
          default = {};
        };
      };});
      default = {};
    };
    streamProxy =
    {
      enable = mkOption { type = types.bool; default = false; };
      port = mkOption { type = types.ints.unsigned; default = 5575; };
      portWithProxyProtocol = mkOption { type = types.ints.unsigned; default = 5576; };
      map = mkOption
      {
        type = types.attrsOf (types.oneOf
        [
          types.nonEmptyStr
          (types.submodule { options =
          {
            upstream = mkOption { type = types.nonEmptyStr; };
            rewriteHttps = mkOption { type = types.bool; default = false; };
            proxyProtocol = mkOption { type = types.bool; default = false; };
          };})
        ]);
        default = {};
      };
    };
  };
  config =
    let
      inherit (inputs.lib) mkMerge mkIf;
      inherit (inputs.localLib) stripeTabs attrsToList;
      inherit (inputs.config.nixos.services) nginx;
      inherit (builtins) map listToAttrs concatStringsSep toString filter attrValues concatLists;
    in mkMerge
    [
      (mkIf nginx.enable
      {
        assertions =
        [{
          assertion = builtins.all
            (path: (inputs.lib.count (x: x != null) (map (type: path.${type}) [ "proxy" "static" "php" ])) == 1)
            (concatLists (map (http: attrValues http.locations) (attrValues nginx.http)));
          message = "";
        }];
        services =
        {
          nginx =
          {
            enable = true;
            enableReload = true;
            eventsConfig =
            ''
              worker_connections 524288;
              use epoll;
            '';
            commonHttpConfig =
            ''
              geoip2 ${inputs.config.services.geoipupdate.settings.DatabaseDirectory}/GeoLite2-Country.mmdb {
                $geoip2_data_country_code country iso_code;
              }
              log_format http '[$time_local] $remote_addr-$geoip2_data_country_code "$host"'
                ' $request_length $bytes_sent $status "$request" referer: "$http_referer" ua: "$http_user_agent"';
              access_log syslog:server=unix:/dev/log http;
              proxy_ssl_server_name on;
              proxy_ssl_session_reuse off;
              send_timeout 10m;
            '';
            proxyTimeout = "10m";
            virtualHosts = listToAttrs (map
              (site:
              {
                inherit (site) name;
                value =
                {
                  serverName = site.name;
                  listen = [ { addr = "127.0.0.1"; port = (if site.value.http2 then 443 else 3065); ssl = true; } ]
                    ++ (if site.value.rewriteHttps then [ { addr = "0.0.0.0"; port = 80; } ] else []);
                  useACMEHost = site.name;
                  locations = listToAttrs (map
                    (location:
                    {
                      inherit (location) name;
                      value =
                        if (location.value.proxy != null) then
                        {
                          proxyPass = location.value.proxy.upstream;
                          proxyWebsockets = location.value.proxy.websocket;
                          recommendedProxySettings = false;
                          recommendedProxySettingsNoHost = true;
                          extraConfig = concatStringsSep "\n"
                          (
                            (map
                              (header: ''proxy_set_header ${header.name} "${header.value}";'')
                              (attrsToList location.value.proxy.setHeaders))
                            ++ (if site.value.detectAuth then ["proxy_hide_header Authorization;"] else [])
                            ++ (
                              if site.value.addAuth then
                                ["include ${inputs.config.sops.templates."nginx/addAuth/${site.name}-template".path};"]
                              else [])
                          );
                        }
                        else if (location.value.static != null) then
                        {
                          root = location.value.static.root;
                          index = mkIf (location.value.static.index != [])
                            (concatStringsSep " " location.value.static.index);
                          tryFiles = mkIf (location.value.static.tryFiles != [])
                            (concatStringsSep " " location.value.static.tryFiles);
                        }
                        else if (location.value.php != null) then
                        {
                          root = location.value.php.root;
                          extraConfig =
                          ''
                            fastcgi_pass ${location.value.php.fastcgiPass};
                            fastcgi_split_path_info ^(.+\.php)(/.*)$;
                            fastcgi_param PATH_INFO $fastcgi_path_info;
                            include ${inputs.config.services.nginx.package}/conf/fastcgi.conf;
                          '';
                        }
                        else {};
                    })
                    (attrsToList site.value.locations));
                  forceSSL = site.value.rewriteHttps;
                  http2 = site.value.http2;
                  basicAuthFile =
                    if site.value.detectAuth then inputs.config.sops.secrets."nginx/detectAuth/${site.name}".path
                    else null;
                };
              })
              (attrsToList nginx.http));
            recommendedZstdSettings = true;
            recommendedTlsSettings = true;
            recommendedProxySettings = true;
            recommendedOptimisation = true;
            recommendedGzipSettings = true;
            recommendedBrotliSettings = true;
            clientMaxBodySize = "0";
            package =
              let
                nginx-geoip2 =
                {
                  name = "ngx_http_geoip2_module";
                  src = inputs.pkgs.fetchFromGitHub
                  {
                    owner = "leev";
                    repo = "ngx_http_geoip2_module";
                    rev = "a607a41a8115fecfc05b5c283c81532a3d605425";
                    hash = "sha256-CkmaeEa1iEAabJEDu3FhBUR7QF38koGYlyx+pyKZV9Y=";
                  };
                  meta.license = [];
                };
              in
                (inputs.pkgs.nginxMainline.override (prev: { modules = prev.modules ++ [ nginx-geoip2 ]; }))
                  .overrideAttrs (prev: { buildInputs = prev.buildInputs ++ [ inputs.pkgs.libmaxminddb ]; });
            streamConfig =
            ''
              geoip2 ${inputs.config.services.geoipupdate.settings.DatabaseDirectory}/GeoLite2-Country.mmdb
              {
                $geoip2_data_country_code country iso_code;
              }
              resolver 8.8.8.8;
            '';
            # todo: use host dns
            resolver.addresses = [ "8.8.8.8" ];
          };
          geoipupdate =
          {
            enable = true;
            settings =
            {
              AccountID = 901296;
              LicenseKey = inputs.config.sops.secrets."nginx/maxmind-license".path;
              EditionIDs = [ "GeoLite2-ASN" "GeoLite2-City" "GeoLite2-Country" ];
            };
          };
        };
        sops =
        {
          templates = listToAttrs (map
            (site:
            {
              name = "nginx/addAuth/${site.name}-template";
              value =
              {
                content =
                  let placeholder = inputs.config.sops.placeholder."nginx/addAuth/${site.name}";
                  in ''proxy_set_header Authorization "Basic ${placeholder}";'';
                owner = inputs.config.users.users.nginx.name;
              };
            })
            (filter (site: site.value.addAuth) (attrsToList nginx.http)));
          secrets = { "nginx/maxmind-license".owner = inputs.config.users.users.nginx.name; }
            // (listToAttrs (map
              (site: { name = "nginx/detectAuth/${site.name}"; value.owner = inputs.config.users.users.nginx.name; })
              (filter (site: site.value.detectAuth) (attrsToList nginx.http))))
            // (listToAttrs (map
              (site: { name = "nginx/addAuth/${site.name}"; value = {}; })
              (filter (site: site.value.addAuth) (attrsToList nginx.http))));
        };
        systemd.services.nginx.serviceConfig =
        {
          CapabilityBoundingSet = [ "CAP_NET_ADMIN" ];
          AmbientCapabilities = [ "CAP_NET_ADMIN" ];
          LimitNPROC = 65536;
          LimitNOFILE = 524288;
        };
        nixos.services.acme =
        {
          enable = true;
          certs = map (cert: cert.name) (attrsToList nginx.http);
        };
        security.acme.certs = listToAttrs (map
          (cert: { inherit (cert) name; value.group = inputs.config.services.nginx.group; })
          (attrsToList nginx.http));
      })
      (mkIf (nginx.enable && nginx.transparentProxy.enable)
      {
        services.nginx.streamConfig =
        ''
          log_format transparent_proxy '[$time_local] $remote_addr-$geoip2_data_country_code '
            '"$ssl_preread_server_name"->$transparent_proxy_backend $bytes_sent $bytes_received';
          map $ssl_preread_server_name $transparent_proxy_backend
          {
            ${concatStringsSep "\n" (map
              (x: ''                  "${x.name}" 127.0.0.1:${toString x.value};'')
              (
                (attrsToList nginx.transparentProxy.map)
                ++ (map
                  (site: { name = site.name; value = (if site.value.http2 then 443 else 3065); })
                  (attrsToList nginx.http)
                )
              ))}
            default 127.0.0.1:443;
          }
          server
          {
            ${concatStringsSep "\n            " (map (ip: "listen ${ip}:443;") nginx.transparentProxy.externalIp)}
            ssl_preread on;
            proxy_bind $remote_addr transparent;
            proxy_pass $transparent_proxy_backend;
            proxy_connect_timeout 1s;
            proxy_socket_keepalive on;
            proxy_buffer_size 128k;
            access_log syslog:server=unix:/dev/log transparent_proxy;
          }
        '';
        networking.firewall.allowedTCPPorts = [ 80 443 ];
        systemd.services.nginx-proxy =
          let
            ipset = "${inputs.pkgs.ipset}/bin/ipset";
            iptables = "${inputs.pkgs.iptables}/bin/iptables";
            ip = "${inputs.pkgs.iproute}/bin/ip";
            start = inputs.pkgs.writeShellScript "nginx-proxy.start"
            (
              ''
                ${ipset} create nginx_proxy_port bitmap:port range 0-65535
                ${iptables} -t mangle -N nginx_proxy_mark
                ${iptables} -t mangle -A OUTPUT -j nginx_proxy_mark
                ${iptables} -t mangle -A nginx_proxy_mark -s 127.0.0.1 -p tcp \
                  -m set --match-set nginx_proxy_port src -j MARK --set-mark 2/2
                ${iptables} -t mangle -N nginx_proxy
                ${iptables} -t mangle -A PREROUTING -j nginx_proxy
                ${iptables} -t mangle -A nginx_proxy -s 127.0.0.1 -p tcp \
                  -m set --match-set nginx_proxy_port src -j MARK --set-mark 2/2
                ${ip} rule add fwmark 2/2 table 200
                ${ip} route add local 0.0.0.0/0 dev lo table 200
              ''
              + concatStringsSep "\n" (map
                (port: ''${ipset} add nginx_proxy_port ${toString port}'')
                (inputs.lib.unique ((attrValues nginx.transparentProxy.map) ++ [ 443 3065 ])))
            );
            stop = inputs.pkgs.writeShellScript "nginx-proxy.stop"
            ''
              ${iptables} -t mangle -F nginx_proxy_mark
              ${iptables} -t mangle -D OUTPUT -j nginx_proxy_mark
              ${iptables} -t mangle -X nginx_proxy_mark
              ${iptables} -t mangle -F nginx_proxy
              ${iptables} -t mangle -D PREROUTING -j nginx_proxy
              ${iptables} -t mangle -X nginx_proxy
              ${ip} rule del fwmark 2/2 table 200
              ${ip} route del local 0.0.0.0/0 dev lo table 200
              ${ipset} destroy nginx_proxy_port
            '';
          in
          {
            description = "nginx transparent proxy";
            after = [ "network.target" ];
            serviceConfig =
            {
              Type = "simple";
              RemainAfterExit = true;
              ExecStart = start;
              ExecStop = stop;
            };
            wants = [ "network.target" ];
            wantedBy= [ "multi-user.target" ];
          };
      })
      (mkIf (nginx.enable && nginx.streamProxy.enable)
      {
        services.nginx =
        {
          streamConfig =
          ''
            log_format stream_proxy '[$time_local] $remote_addr-$geoip2_data_country_code '
              '"$ssl_preread_server_name"->$stream_proxy_backend $bytes_sent $bytes_received';
            map $ssl_preread_server_name $stream_proxy_backend
            {
              ${concatStringsSep "\n" (map
                (x: ''                  "${x.name}" "${x.value.upstream or x.value}";'')
                (attrsToList nginx.streamProxy.map))}
            }
            server
            {
              listen 127.0.0.1:${toString nginx.streamProxy.port};
              ssl_preread on;
              proxy_pass $stream_proxy_backend;
              proxy_connect_timeout 10s;
              proxy_socket_keepalive on;
              proxy_buffer_size 128k;
              access_log syslog:server=unix:/dev/log stream_proxy;
            }
            server
            {
              listen 127.0.0.1:${toString nginx.streamProxy.portWithProxyProtocol};
              proxy_protocol on;
              ssl_preread on;
              proxy_pass $stream_proxy_backend;
              proxy_connect_timeout 10s;
              proxy_socket_keepalive on;
              proxy_buffer_size 128k;
              access_log syslog:server=unix:/dev/log stream_proxy;
            }
          '';
          virtualHosts = listToAttrs (map
            (site:
            {
              inherit (site) name;
              value =
              {
                serverName = site.name;
                listen = [ { addr = "0.0.0.0"; port = 80; } ];
                locations."/".return = "301 https://${site.name}$request_uri";
              };
            })
            (filter (site: site.value.rewriteHttps or false) (attrsToList nginx.streamProxy.map)));
        };
        nixos.services.nginx.transparentProxy.map = listToAttrs
        (
          (map
            (site: { name = site.name; value = nginx.streamProxy.port; })
            (filter (site: !(site.value.proxyProtocol or false)) (attrsToList nginx.streamProxy.map)))
          ++ (map
            (site: { name = site.name; value = nginx.streamProxy.portWithProxyProtocol; })
            (filter (site: site.value.proxyProtocol or false) (attrsToList nginx.streamProxy.map)))
        );
      })
    ];
}