haschel/modules/nginx.nix

{
  config,
  lib,
  ...
}:

let
  atriDotDad = "atri.dad";
  atashDotDev = "atash.dev";

  matrixDomain = "matrix.${atriDotDad}";
  matrixRtcDomain = "matrixrtc.${atriDotDad}";

  upstream = "lloyd.tadpole-pain.ts.net";

  wellKnownServer = builtins.toJSON {
    "m.server" = "${matrixDomain}:443";
  };

  wellKnownClient = builtins.toJSON {
    "m.homeserver" = {
      base_url = "https://${matrixDomain}";
    };
    "org.matrix.msc4143.rtc_foci" = [
      {
        type = "livekit";
        livekit_service_url = "https://${matrixDomain}/livekit/jwt";
      }
    ];
  };

  mkProxy = port: {
    enableACME = true;
    forceSSL = true;
    locations."/" = {
      proxyPass = "http://${upstream}:${toString port}";
      proxyWebsockets = true;
      extraConfig = "if ($fuckai) { return 444; }";
    };
  };

  mkStream = port: ''
    server {
      listen ${toString port};
      listen ${toString port} udp;
      proxy_pass ${upstream}:${toString port};
      proxy_timeout 300s;
      proxy_connect_timeout 10s;
    }
  '';
in
{
  security.acme = {
    acceptTerms = true;
    defaults.email = "me@${atriDotDad}";
  };

  services.nginx = {
    enable = true;

    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;

    clientMaxBodySize = "3g";

    commonHttpConfig = ''
      more_clear_headers Server;
      more_clear_headers X-Powered-By;

      map $http_user_agent $fuckai {
          default 0;

          "~*GPTBot" 1;
          "~*ChatGPT-User" 1;
          "~*OAI-SearchBot" 1;
          "~*ChatGPT-Browser" 1;
          "~*ClaudeBot" 1;
          "~*Claude-Web" 1;
          "~*Claude-SearchBot" 1;
          "~*anthropic-ai" 1;
          "~*Anthropic-Claude" 1;
          "~*xAI-Bot" 1;
          "~*DeepseekBot" 1;
          "~*Google-Extended" 1;
          "~*Gemini-Ai" 1;
          "~*Gemini-Deep-Research" 1;
          "~*Google-CloudVertexBot" 1;
          "~*Google-NotebookLM" 1;
          "~*GoogleAgent-Mariner" 1;
          "~*Bard-Ai" 1;
          "~*FacebookBot" 1;
          "~*Meta-ExternalAgent" 1;
          "~*meta-webindexer" 1;
          "~*Applebot-Extended" 1;
          "~*bingbot" 1;
          "~*CCBot" 1;
          "~*PerplexityBot" 1;
          "~*Perplexity-User" 1;
          "~*Bytespider" 1;
          "~*Diffbot" 1;
          "~*Amazonbot" 1;
          "~*cohere-ai" 1;
          "~*Cohere-Command" 1;
          "~*YouBot" 1;
          "~*Omgilibot" 1;
          "~*ImagesiftBot" 1;
          "~*AI2Bot" 1;
          "~*Andibot" 1;
          "~*bigsur.ai" 1;
          "~*Brightbot" 1;
          "~*TerraCotta" 1;
          "~*Character-AI" 1;
          "~*Devin" 1;
          "~*Crawlspace" 1;
          "~*DuckAssistBot" 1;
          "~*FirecrawlAgent" 1;
          "~*Groq-Bot" 1;
          "~*HuggingFace-Bot" 1;
          "~*IbouBot" 1;
          "~*MistralAI-User" 1;
          "~*Replicate-Bot" 1;
          "~*RunPod-Bot" 1;
          "~*TimpiBot" 1;
          "~*Together-Bot" 1;
          "~*Kangaroo Bot" 1;
          "~*PanguBot" 1;
          "~*Cotoyogi" 1;
          "~*Webzio-Extended" 1;
      }
    '';

    streamConfig = lib.concatStrings (
      map mkStream [
        69
        420
        25565
        25566
        25567
      ]
    );

    virtualHosts = {
      "${atriDotDad}" = {
        enableACME = true;
        forceSSL = true;
        locations."/" = {
          proxyPass = "http://${upstream}:3000";
          extraConfig = "if ($fuckai) { return 444; }";
        };
        locations."= /.well-known/matrix/server" = {
          extraConfig = ''
            default_type application/json;
            add_header X-Content-Type-Options nosniff;
            return 200 '${wellKnownServer}';
          '';
        };
        locations."= /.well-known/matrix/client" = {
          extraConfig = ''
            default_type application/json;
            add_header Access-Control-Allow-Origin "*";
            add_header Vary Origin;
            add_header X-Content-Type-Options nosniff;
            return 200 '${wellKnownClient}';
          '';
        };
      };

      "analytics.${atriDotDad}" = mkProxy 30060;
      "archive.${atriDotDad}" = mkProxy 30288;
      "ascently.${atriDotDad}" = mkProxy 8838;
      "chef.${atriDotDad}" = mkProxy 30111;
      "democlimb.${atriDotDad}" = mkProxy 8008;
      "fedi.${atriDotDad}" = mkProxy 8181;
      "gist.${atriDotDad}" = mkProxy 1227;
      "git.${atriDotDad}" = mkProxy 30010;
      "links.${atriDotDad}" = mkProxy 30243;
      "memos.${atriDotDad}" = mkProxy 30311;
      "mermaid.${atriDotDad}" = mkProxy 8280;
      "msrc.${atriDotDad}" = mkProxy 3311;
      "openclimb.${atriDotDad}" = mkProxy 1337;
      "photos.${atriDotDad}" = mkProxy 30041;
      "pods.${atriDotDad}" = mkProxy 30067;
      "requests.${atriDotDad}" = mkProxy 30042;
      "s3.${atriDotDad}" = mkProxy 30188;
      "search.${atriDotDad}" = mkProxy 30053;
      "vault.${atriDotDad}" = mkProxy 30032;
      "vids.${atriDotDad}" = mkProxy 31008;
      "music.${atriDotDad}" = mkProxy 30043;
      "books.${atriDotDad}" = mkProxy 31067;

      "tv.${atriDotDad}" = {
        enableACME = true;
        forceSSL = true;
        extraConfig = ''
          client_max_body_size 20g;
        '';
        locations."/" = {
          proxyPass = "http://${upstream}:30013";
          proxyWebsockets = true;
          extraConfig = ''
            # NOTE: `if` is safe here because the only statement is `return`.
            # Do NOT add other directives inside this if block.
            if ($fuckai) { return 444; }
            proxy_buffering off;
            proxy_request_buffering off;
            proxy_read_timeout 86400s;
            proxy_send_timeout 86400s;
            send_timeout 86400s;
          '';
        };
      };

      "${matrixDomain}" = {
        enableACME = true;
        forceSSL = true;
        locations."/" = {
          proxyPass = "http://[::1]:6167";
          proxyWebsockets = true;
          extraConfig = ''
            client_max_body_size 100M;
          '';
        };

        locations."^~ /livekit/jwt/" = {
          priority = 400;
          extraConfig = ''
            if ($uri !~ "^/livekit/jwt/(sfu/get|get_token|healthz)$") {
              return 404;
            }
          '';
          proxyPass = "http://[::1]:${toString config.services.lk-jwt-service.port}/";
        };
      };

      "${matrixRtcDomain}" = {
        enableACME = true;
        forceSSL = true;
        locations."/" = {
          proxyPass = "http://[::1]:${toString config.services.livekit.settings.port}";
          proxyWebsockets = true;
          extraConfig = ''
            proxy_send_timeout 120;
            proxy_read_timeout 120;
            proxy_buffering off;
          '';
        };
      };

      "ripkyle.org" = mkProxy 4321;
      "${atashDotDev}" = mkProxy 6969;
      "chronus.${atashDotDev}" = mkProxy 7337;
    };
  };

  networking.firewall.allowedTCPPorts = [
    80
    443
    69
    420
    25565
    25566
    25567
  ];
  networking.firewall.allowedUDPPorts = [
    69
    420
    25565
    25566
    25567
  ];
}