Cleanup now that I finally got the LSP working... so many warnings.

modules/nginx.nix

@@ -1,9 +1,13 @@
-{ config, pkgs, lib, ... }:
+{
+  config,
+  lib,
+  ...
+}:
 
 let
-  serverName = "atri.dad";
-  matrixDomain = "matrix.atri.dad";
-  matrixRtcDomain = "matrixrtc.atri.dad";
+  rootDomain = "atri.dad";
+  matrixDomain = "matrix.${rootDomain}";
+  matrixRtcDomain = "matrixrtc.${rootDomain}";
 
   wellKnownServer = builtins.toJSON {
     "m.server" = "${matrixDomain}:443";
@@ -20,13 +24,34 @@ let
       }
     ];
   };
+
+  blockAi = "if ($fuckai) { return 444; }";
+
+  mkProxyVhost =
+    {
+      host,
+      upstream,
+      websockets ? false,
+      extraConfig ? "",
+      locationExtraConfig ? "",
+    }:
+    {
+      "${host}" = {
+        enableACME = true;
+        forceSSL = true;
+        extraConfig = extraConfig;
+        locations."/" = {
+          proxyPass = upstream;
+          proxyWebsockets = websockets;
+          extraConfig = lib.concatStringsSep "\n" (
+            [ blockAi ] ++ lib.optional (locationExtraConfig != "") locationExtraConfig
+          );
+        };
+      };
+    };
+
 in
 {
-  security.acme = {
-    acceptTerms = true;
-    defaults.email = "me@atri.dad";
-  };
-
   services.nginx = {
     enable = true;
 
@@ -35,7 +60,6 @@ in
     recommendedProxySettings = true;
     recommendedTlsSettings = true;
 
-    # Fuck AI
     clientMaxBodySize = "3g";
 
     commonHttpConfig = ''
@@ -43,407 +67,250 @@ in
       more_clear_headers X-Powered-By;
 
       map $http_user_agent $fuckai {
-          default 0;
-
-          "~*GPTBot" 1;
-          "~*ChatGPT-User" 1;
-          "~*OAI-SearchBot" 1;
-          "~*ChatGPT-Browser" 1;
-          "~*ClaudeBot" 1;
-          "~*Claude-Web" 1;
-          "~*anthropic-ai" 1;
-          "~*Anthropic-Claude" 1;
-          "~*xAI-Bot" 1;
-          "~*DeepseekBot" 1;
-          "~*Google-Extended" 1;
-          "~*Gemini-Ai" 1;
-          "~*Gemini-Deep-Research" 1;
-          "~*Google-CloudVertexBot" 1;
-          "~*Google-NotebookLM" 1;
-          "~*GoogleAgent-Mariner" 1;
-          "~*Bard-Ai" 1;
-          "~*FacebookBot" 1;
-          "~*Meta-ExternalAgent" 1;
-          "~*meta-webindexer" 1;
-          "~*Applebot-Extended" 1;
-          "~*bingbot" 1;
-          "~*CCBot" 1;
-          "~*PerplexityBot" 1;
-          "~*Perplexity-User" 1;
-          "~*Bytespider" 1;
-          "~*Diffbot" 1;
-          "~*Amazonbot" 1;
-          "~*cohere-ai" 1;
-          "~*Cohere-Command" 1;
-          "~*YouBot" 1;
-          "~*Omgilibot" 1;
-          "~*ImagesiftBot" 1;
-          "~*AI2Bot" 1;
-          "~*Andibot" 1;
-          "~*bigsur.ai" 1;
-          "~*Brightbot" 1;
-          "~*TerraCotta" 1;
-          "~*Character-AI" 1;
-          "~*Devin" 1;
-          "~*Crawlspace" 1;
-          "~*DuckAssistBot" 1;
-          "~*FirecrawlAgent" 1;
-          "~*Groq-Bot" 1;
-          "~*HuggingFace-Bot" 1;
-          "~*IbouBot" 1;
-          "~*MistralAI-User" 1;
-          "~*Replicate-Bot" 1;
-          "~*RunPod-Bot" 1;
-          "~*TimpiBot" 1;
-          "~*Together-Bot" 1;
-          "~*Kangaroo Bot" 1;
-          "~*PanguBot" 1;
-          "~*Cotoyogi" 1;
-          "~*Webzio-Extended" 1;
+        default 0;
+        "~*GPTBot" 1;
+        "~*ChatGPT-User" 1;
+        "~*OAI-SearchBot" 1;
+        "~*ChatGPT-Browser" 1;
+        "~*ClaudeBot" 1;
+        "~*Claude-Web" 1;
+        "~*anthropic-ai" 1;
+        "~*Anthropic-Claude" 1;
+        "~*xAI-Bot" 1;
+        "~*DeepseekBot" 1;
+        "~*Google-Extended" 1;
+        "~*Gemini-Ai" 1;
+        "~*Gemini-Deep-Research" 1;
+        "~*Google-CloudVertexBot" 1;
+        "~*Google-NotebookLM" 1;
+        "~*GoogleAgent-Mariner" 1;
+        "~*Bard-Ai" 1;
+        "~*FacebookBot" 1;
+        "~*Meta-ExternalAgent" 1;
+        "~*meta-webindexer" 1;
+        "~*Applebot-Extended" 1;
+        "~*bingbot" 1;
+        "~*CCBot" 1;
+        "~*PerplexityBot" 1;
+        "~*Perplexity-User" 1;
+        "~*Bytespider" 1;
+        "~*Diffbot" 1;
+        "~*Amazonbot" 1;
+        "~*cohere-ai" 1;
+        "~*Cohere-Command" 1;
+        "~*YouBot" 1;
+        "~*Omgilibot" 1;
+        "~*ImagesiftBot" 1;
+        "~*AI2Bot" 1;
+        "~*Andibot" 1;
+        "~*bigsur.ai" 1;
+        "~*Brightbot" 1;
+        "~*TerraCotta" 1;
+        "~*Character-AI" 1;
+        "~*Devin" 1;
+        "~*Crawlspace" 1;
+        "~*DuckAssistBot" 1;
+        "~*FirecrawlAgent" 1;
+        "~*Groq-Bot" 1;
+        "~*HuggingFace-Bot" 1;
+        "~*IbouBot" 1;
+        "~*MistralAI-User" 1;
+        "~*Replicate-Bot" 1;
+        "~*RunPod-Bot" 1;
+        "~*TimpiBot" 1;
+        "~*Together-Bot" 1;
+        "~*Kangaroo Bot" 1;
+        "~*PanguBot" 1;
+        "~*Cotoyogi" 1;
+        "~*Webzio-Extended" 1;
       }
     '';
 
-    # Stream Hosts
-    streamConfig = ''
-      # Port 69
-      server {
-        listen 69;
-        listen 69 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:69;
+    virtualHosts = lib.mkMerge [
+      (mkProxyVhost {
+        host = rootDomain;
+        upstream = "http://lloyd.tadpole-pain.ts.net:3000";
+      })
+
+      {
+        "${rootDomain}".locations."= /.well-known/matrix/server".extraConfig = ''
+          default_type application/json;
+          return 200 '${wellKnownServer}';
+        '';
+        "${rootDomain}".locations."= /.well-known/matrix/client".extraConfig = ''
+          default_type application/json;
+          add_header Access-Control-Allow-Origin "*";
+          return 200 '${wellKnownClient}';
+        '';
       }
 
-      # Port 420
-      server {
-        listen 420;
-        listen 420 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:420;
-      }
+      (mkProxyVhost {
+        host = "analytics.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30060";
+      })
+      (mkProxyVhost {
+        host = "archive.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30288";
+      })
+      (mkProxyVhost {
+        host = "ascently.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:8838";
+      })
+      (mkProxyVhost {
+        host = "bsky.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:31173";
+      })
+      (mkProxyVhost {
+        host = "chef.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30111";
+      })
+      (mkProxyVhost {
+        host = "democlimb.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:8008";
+      })
+      (mkProxyVhost {
+        host = "fedi.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:8181";
+      })
+      (mkProxyVhost {
+        host = "gist.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:1227";
+      })
+      (mkProxyVhost {
+        host = "git.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30010";
+      })
+      (mkProxyVhost {
+        host = "links.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30243";
+      })
 
-      # Minecraft / Game Ports
-      server {
-        listen 25565;
-        listen 25565 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:25565;
-      }
-      server {
-        listen 25566;
-        listen 25566 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:25566;
-      }
-      server {
-        listen 25567;
-        listen 25567 udp;
-        proxy_pass lloyd.tadpole-pain.ts.net:25567;
-      }
-    '';
-
-    # Proxy Hosts
-    virtualHosts = {
-      # atri.dad hosts
-      "atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:3000";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-        locations."= /.well-known/matrix/server" = {
-          extraConfig = ''
-            default_type application/json;
-            return 200 '${wellKnownServer}';
-          '';
-        };
-        locations."= /.well-known/matrix/client" = {
-          extraConfig = ''
-            default_type application/json;
-            add_header Access-Control-Allow-Origin "*";
-            return 200 '${wellKnownClient}';
-          '';
-        };
-      };
-      "analytics.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30060";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "archive.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30288";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "ascently.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8838";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "bsky.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:31173";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "chef.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30111";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "democlimb.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8008";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "fedi.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8181";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "gist.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:1227";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "git.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30010";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "links.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30243";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "media.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
+      (mkProxyVhost {
+        host = "media.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30013";
+        websockets = true;
         extraConfig = ''
           client_max_body_size 0;
         '';
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30013";
-          proxyWebsockets = true;
-          extraConfig = ''
-            if ($fuckai) { return 444; }
-            proxy_buffering off;
-            proxy_request_buffering off;
-            proxy_read_timeout 86400s;
-            proxy_send_timeout 86400s;
-            send_timeout 86400s;
-          '';
-        };
-      };
-      "memos.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30311";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "mermaid.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8280";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "msrc.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:3311";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "n8n.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30109";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "ocr.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30070";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "openclimb.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:1337";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "photos.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30041";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "pods.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:8828";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "requests.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30042";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "ripkyle.org" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:4321";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "s3.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30188";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "search.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30053";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "sync.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:20910";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "travel.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30251";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "travelapi.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30250";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "vault.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:30032";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
+        locationExtraConfig = ''
+          proxy_buffering off;
+          proxy_request_buffering off;
+          proxy_read_timeout 86400s;
+          proxy_send_timeout 86400s;
+          send_timeout 86400s;
+        '';
+      })
 
-      "matrix.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
+      (mkProxyVhost {
+        host = "memos.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30311";
+      })
+      (mkProxyVhost {
+        host = "mermaid.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:8280";
+      })
+      (mkProxyVhost {
+        host = "msrc.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:3311";
+      })
+      (mkProxyVhost {
+        host = "n8n.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30109";
+      })
+      (mkProxyVhost {
+        host = "ocr.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30070";
+      })
+      (mkProxyVhost {
+        host = "openclimb.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:1337";
+      })
+      (mkProxyVhost {
+        host = "photos.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30041";
+      })
+      (mkProxyVhost {
+        host = "pods.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:8828";
+      })
+      (mkProxyVhost {
+        host = "requests.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30042";
+      })
+      (mkProxyVhost {
+        host = "s3.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30188";
+      })
+      (mkProxyVhost {
+        host = "search.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30053";
+      })
+      (mkProxyVhost {
+        host = "sync.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:20910";
+      })
+      (mkProxyVhost {
+        host = "travel.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30251";
+      })
+      (mkProxyVhost {
+        host = "travelapi.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30250";
+      })
+      (mkProxyVhost {
+        host = "vault.${rootDomain}";
+        upstream = "http://lloyd.tadpole-pain.ts.net:30032";
+      })
 
-        locations."/" = {
-          proxyPass = "http://[::1]:6167";
-          proxyWebsockets = true;
-          extraConfig = ''
-            client_max_body_size 100M;
-          '';
-        };
+      {
+        "${matrixDomain}" = {
+          enableACME = true;
+          forceSSL = true;
 
-        locations."^~ /livekit/jwt/" = {
-          priority = 400;
-          proxyPass = "http://[::1]:${toString config.services.lk-jwt-service.port}/";
-        };
-      };
+          locations."/" = {
+            proxyPass = "http://[::1]:6167";
+            proxyWebsockets = true;
+            extraConfig = ''
+              client_max_body_size 100M;
+            '';
+          };
 
-      "matrixrtc.atri.dad" = {
-        enableACME = true;
-        forceSSL = true;
+          locations."^~ /livekit/jwt/" = {
+            priority = 400;
+            proxyPass = "http://[::1]:${toString config.services.lk-jwt-service.port}/";
+          };
+        };
+      }
 
-        # livekit
-        locations."/" = {
-          proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}";
-          proxyWebsockets = true;
-          extraConfig = ''
-            proxy_send_timeout 120;
-            proxy_read_timeout 120;
-            proxy_buffering off;
-            proxy_set_header Accept-Encoding gzip;
-          '';
+      {
+        "${matrixRtcDomain}" = {
+          enableACME = true;
+          forceSSL = true;
+          locations."/" = {
+            proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}";
+            proxyWebsockets = true;
+            extraConfig = ''
+              proxy_send_timeout 120;
+              proxy_read_timeout 120;
+              proxy_buffering off;
+              proxy_set_header Accept-Encoding gzip;
+            '';
+          };
         };
-      };
+      }
 
-      "atash.dev" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:6969";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-      "chronus.atash.dev" = {
-        enableACME = true;
-        forceSSL = true;
-        locations."/" = {
-          proxyPass = "http://lloyd.tadpole-pain.ts.net:7337";
-          extraConfig = "if ($fuckai) { return 444; }";
-        };
-      };
-    };
+      (mkProxyVhost {
+        host = "ripkyle.org";
+        upstream = "http://lloyd.tadpole-pain.ts.net:4321";
+      })
+      (mkProxyVhost {
+        host = "atash.dev";
+        upstream = "http://lloyd.tadpole-pain.ts.net:6969";
+      })
+      (mkProxyVhost {
+        host = "chronus.atash.dev";
+        upstream = "http://lloyd.tadpole-pain.ts.net:7337";
+      })
+    ];
   };
-
-  # Open Ports
-  networking.firewall.allowedTCPPorts = [ 80 443 69 420 25565 25566 25567 ];
-  networking.firewall.allowedUDPPorts = [ 69 420 25565 25566 25567 ];
 }