From 93ccefc77ccc1e12baea3300db91b232b9c1960d Mon Sep 17 00:00:00 2001
From: Atridad Lahiji <me@atri.dad>
Date: Tue, 17 Feb 2026 15:34:01 -0700
Subject: [PATCH] Update nginx.nix

---
 modules/nginx.nix | 49 +++++++++++++++++++++++++++++------------------
 1 file changed, 30 insertions(+), 19 deletions(-)

diff --git a/modules/nginx.nix b/modules/nginx.nix
index 87d409e..9de192d 100644
--- a/modules/nginx.nix
+++ b/modules/nginx.nix
@@ -34,19 +34,24 @@ let
       websockets ? false,
       extraConfig ? "",
       locationExtraConfig ? "",
+      extraLocations ? { },
     }:
     {
       "${host}" = {
         enableACME = true;
         forceSSL = true;
         extraConfig = extraConfig;
-        locations."/" = {
-          proxyPass = upstream;
-          proxyWebsockets = websockets;
-          extraConfig = lib.concatStringsSep "\n" (
-            [ blockAi ] ++ lib.optional (locationExtraConfig != "") locationExtraConfig
-          );
-        };
+
+        locations = {
+          "/" = {
+            proxyPass = upstream;
+            proxyWebsockets = websockets;
+            extraConfig = lib.concatStringsSep "\n" (
+              [ blockAi ] ++ lib.optional (locationExtraConfig != "") locationExtraConfig
+            );
+          };
+        }
+        // extraLocations;
       };
     };
 
@@ -130,19 +135,24 @@ in
       (mkProxyVhost {
         host = rootDomain;
         upstream = "http://lloyd.tadpole-pain.ts.net:3000";
-      })
 
-      {
-        "${rootDomain}".locations."= /.well-known/matrix/server".extraConfig = ''
-          default_type application/json;
-          return 200 '${wellKnownServer}';
-        '';
-        "${rootDomain}".locations."= /.well-known/matrix/client".extraConfig = ''
-          default_type application/json;
-          add_header Access-Control-Allow-Origin "*";
-          return 200 '${wellKnownClient}';
-        '';
-      }
+        extraLocations = {
+          "= /.well-known/matrix/server" = {
+            extraConfig = ''
+              default_type application/json;
+              return 200 '${wellKnownServer}';
+            '';
+          };
+
+          "= /.well-known/matrix/client" = {
+            extraConfig = ''
+              default_type application/json;
+              add_header Access-Control-Allow-Origin "*";
+              return 200 '${wellKnownClient}';
+            '';
+          };
+        };
+      })
 
       (mkProxyVhost {
         host = "analytics.${rootDomain}";
@@ -286,6 +296,7 @@ in
         "${matrixRtcDomain}" = {
           enableACME = true;
           forceSSL = true;
+
           locations."/" = {
             proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}";
             proxyWebsockets = true;