char/topaz-flake

git clone https://git.t4t.associates/char/topaz-flake

Charlotte Somrun soju and use nginx to SNI-discriminate between soju and t4t ircd0b247a

main
branchesmainall refs →
934 B37 linesraw
1{ config, ... }:
2let
3  domain = "soju.char.lt";
4  cert = config.security.acme.certs.${domain};
5in
6{
7  services.nginx.virtualHosts.${domain} = {
8    enableACME = true;
9    locations."/".return = "404";
10  };
11
12  # soju expects PROXY headers inside TLS, so terminate TLS before forwarding.
13  services.nginx.streamConfig = ''
14    server {
15      listen 127.0.0.1:16698 ssl proxy_protocol;
16      set_real_ip_from 127.0.0.1;
17      ssl_certificate ${cert.directory}/fullchain.pem;
18      ssl_certificate_key ${cert.directory}/key.pem;
19      ssl_protocols TLSv1.2 TLSv1.3;
20      proxy_pass 127.0.0.1:16699;
21      proxy_protocol on;
22      proxy_timeout 1h;
23    }
24  '';
25
26  services.soju = {
27    enable = true;
28    hostName = domain;
29    listen = [ "irc+insecure://127.0.0.1:16699" ];
30    acceptProxyIP = [ "127.0.0.1/32" ];
31  };
32
33  systemd.services.soju.serviceConfig = {
34    StateDirectoryMode = "0700";
35    RuntimeDirectoryMode = "0700";
36  };
37}