From e5477915a7bbc9df8fad74b4790af7c6f22cc9e4 Mon Sep 17 00:00:00 2001
From: bogale <git@bogaledev.ru>
Date: Sat, 19 Sep 2026 00:39:59 +0900
Subject: [PATCH] nginx, phpfpm, tls, vaultwarden configured

---
 home/common.nix          |  2 +
 home/desktop/common.nix  |  4 --
 home/server/common.nix   |  4 --
 server/configuration.nix | 89 ++++++++++++++++++++++++++--------------
 4 files changed, 61 insertions(+), 38 deletions(-)

diff --git a/home/common.nix b/home/common.nix
index fdc2d90..f8166fb 100644
--- a/home/common.nix
+++ b/home/common.nix
@@ -39,9 +39,11 @@
       extraConfig = ''
         unbind C-b
         set -g mouse on
+        set -g prefix M-f
         set-option -g focus-events on
         set -s set-clipboard external
         set-option -a terminal-features "xterm-256color:RGB"
+        bind f send-prefix
         bind h select-pane -L
         bind j select-pane -D
         bind k select-pane -U
diff --git a/home/desktop/common.nix b/home/desktop/common.nix
index c6d00b0..0da09e2 100644
--- a/home/desktop/common.nix
+++ b/home/desktop/common.nix
@@ -1,7 +1,3 @@
 { config, pkgs, ... }:
 {
-  programs.tmux.extraConfig = ''
-    set -g prefix M-f
-    bind f send-prefix
-  '';
 }
diff --git a/home/server/common.nix b/home/server/common.nix
index 4c8896f..0da09e2 100644
--- a/home/server/common.nix
+++ b/home/server/common.nix
@@ -1,7 +1,3 @@
 { config, pkgs, ... }:
 {
-  programs.tmux.extraConfig = ''
-    set -g prefix M-d
-    bind d send-prefix
-  '';
 }
diff --git a/server/configuration.nix b/server/configuration.nix
index 9b5efd1..1f6ec8c 100644
--- a/server/configuration.nix
+++ b/server/configuration.nix
@@ -2,6 +2,7 @@
 {
   imports = [ ../common.nix ./hardware-configuration.nix ];
   boot.kernelParams = [ "memmap=0x4000%0xbfb76000-4" "memmap=0x4000%0xbfb7a000-4" ];
+  users.users.nginx.extraGroups = [ "acme" ];
   users.users.bogale.openssh.authorizedKeys.keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKH8f3tKQQFFCkLS76TcY7oPzmbVrTkMZN7KSDHPX4o1"
   ];
@@ -12,17 +13,25 @@
       wifi-security.psk = "$BOGALE_2_4_PSK";
     };
     firewall = {
-      allowedTCPPorts = [ 80 ];
-      extraInputRules = ''
-        ip saddr 192.168.1.0/24 tcp dport 22 accept
-      '';
+      allowedTCPPorts = [ 80 443 ];
+      allowedUDPPorts = [ 443 ];
+    };
+  };
+  security.acme = {
+    acceptTerms = true;
+    certs."bogaledev.ru" = {
+      validMinDays = 3;
+      dnsProvider = "cloudflare";
+      email = "acme-tls@bogaledev.ru";
+      reloadServices = [ "nginx.service" ];
+      extraDomainNames = [ "*.bogaledev.ru" ];
+      credentialFiles = { "CF_DNS_API_TOKEN_FILE" = "/root/secrets/cf-token"; };
     };
   };
   services = {
     postgresql.enable = true;
     openssh = {
       enable = true;
-      openFirewall = false;
       settings = {
         PermitRootLogin = "no";
         PasswordAuthentication = false;
@@ -38,6 +47,26 @@
         "listen.group" = "nginx";
       };
     };
+    vaultwarden = {
+      enable = true;
+      configureNginx = true;
+      dbBackend = "postgresql";
+      configurePostgres = true;
+      domain = "vw.bogaledev.ru";
+      package = pkgs.vaultwarden-postgresql;
+      environmentFile = "/root/secrets/vaultwarden.env";
+      config = {
+        #EMAIL_TOKEN_SIZE = 8;
+        #SMTP_SECURITY = "off";
+        #SMTP_HOST = "localhost";
+        SIGNUPS_ALLOWED = false;
+        #REQUIRE_DEVICE_EMAIL = true;
+        TRASH_AUTO_DELETE_DAYS = 90;
+        PASSWORD_HINTS_ALLOWED = false;
+        EMERGENCY_ACCESS_ALLOWED = false;
+        #SMTP_FROM = "vaultwarden@bogaledev.ru";
+      };
+    };
     nginx = {
       enable = true;
       recommendedTlsSettings = true;
@@ -45,34 +74,34 @@
       recommendedOptimisation = true;
       recommendedProxySettings = true;
       recommendedBrotliSettings = true;
-      virtualHosts."_" = {
+      virtualHosts."bogaledev.ru" = {
+        quic = true;
         default = true;
-        root = "/srv/http/_";
-        locations."~ \\.php$".extraConfig = ''
-          fastcgi_pass unix:${config.services.phpfpm.pools.main.socket};
+        forceSSL = true;
+        root = "/srv/http";
+        useACMEHost = "bogaledev.ru";
+        extraConfig = ''
+          add_header Alt-Svc 'h3=":443"; ma=86400' always;
+        '';
+        locations = {
+          "/".index = "index.php index.html";
+          "~ \\.php$".extraConfig = ''
+            fastcgi_pass unix:${config.services.phpfpm.pools.main.socket};
+          '';
+        };
+      };
+      virtualHosts."vw.bogaledev.ru" = {
+        quic = true;
+        forceSSL = true;
+        useACMEHost = "bogaledev.ru";
+        extraConfig = ''
+          allow fc00::/64;
+          allow 10.0.0.0/24;
+          allow 192.168.1.0/24;
+          deny all;
+          add_header Alt-Svc 'h3=":443"; ma=86400' always;
         '';
       };
     };
-    #vaultwarden = {
-      #enable = true;
-      #configureNginx = true;
-      #dbBackend = "postgresql";
-      #configurePostgres = true;
-      #package = pkgs.vaultwarden-postgresql;
-      #domain = "https://wg.bogaledev.ru/vault";
-      #environmentFile = "/root/secrets/vaultwarden.env";
-      #config = {
-        #EMAIL_TOKEN_SIZE = 8;
-        #SMTP_SECURITY = "off";
-        #SMTP_HOST = "localhost";
-        #SIGNUPS_ALLOWED = false;
-        #REQUIRE_DEVICE_EMAIL = true;
-        #TRASH_AUTO_DELETE_DAYS = 90;
-        #ROCKET_ADDRESS = "127.0.0.1";
-        #PASSWORD_HINTS_ALLOWED = false;
-        #EMERGENCY_ACCESS_ALLOWED = false;
-        #SMTP_FROM = "vaultwarden@bogaledev.ru";
-      #};
-    #};
   };
 }