forked from lukas/nixos-config
69d862833f
Commented the launcher-auth wiring, not deleted -- oauth2-proxy stays declared and running so this is a one-line swap to re-enable later.
78 lines
2.2 KiB
Nix
78 lines
2.2 KiB
Nix
{ config, pkgs, ... }:
|
|
|
|
{
|
|
systemd.services.launcher = {
|
|
description = "Main public website and landing page (0ff.space)";
|
|
wantedBy = [ "multi-user.target" ];
|
|
before = [ "traefik.service" ];
|
|
serviceConfig = {
|
|
User = "drone";
|
|
Group = "users";
|
|
ExecStart = "${pkgs.static-web-server}/bin/static-web-server --host 127.0.0.1 --port 8001 --root /var/www/launcher";
|
|
Restart = "always";
|
|
RestartSec = "5s";
|
|
};
|
|
};
|
|
|
|
services.traefik.dynamicConfigOptions.http = {
|
|
|
|
services.launcher.loadBalancer.servers = [
|
|
{
|
|
url = "http://127.0.0.1:8001/";
|
|
}
|
|
];
|
|
|
|
services.launcher-auth.loadBalancer.servers = [
|
|
{
|
|
url = "http://127.0.0.1:4180/";
|
|
}
|
|
];
|
|
|
|
middlewares = {
|
|
gts-wf = {
|
|
redirectRegex = {
|
|
permanent = true;
|
|
regex = "https://${config.domain}/.well-known/webfinger(\\?.*)?$";
|
|
replacement = "https://social.${config.domain}/.well-known/webfinger$1";
|
|
};
|
|
};
|
|
gts-ni = {
|
|
redirectRegex = {
|
|
permanent = true;
|
|
regex = "https://${config.domain}/.well-known/nodeinfo(\\?.*)?$";
|
|
replacement = "https://social.${config.domain}/.well-known/nodeinfo$1";
|
|
};
|
|
};
|
|
gts-hm = {
|
|
redirectRegex = {
|
|
permanent = true;
|
|
regex = "https://${config.domain}/.well-known/host-meta(\\?.*)?$";
|
|
replacement = "https://social.${config.domain}/.well-known/host-meta$1";
|
|
};
|
|
};
|
|
};
|
|
routers.launcher-federation = {
|
|
rule = "Host(`${config.domain}`) && (Path(`/.well-known/webfinger`) || Path(`/.well-known/nodeinfo`) || Path(`/.well-known/host-meta`))";
|
|
priority = 100;
|
|
tls = {
|
|
certResolver = "cloudflare";
|
|
};
|
|
service = "launcher";
|
|
middlewares = [ "gts-wf" "gts-ni" "gts-hm" ];
|
|
entrypoints = [ "websecure" ];
|
|
};
|
|
|
|
routers.launcher = {
|
|
rule = "Host(`${config.domain}`)";
|
|
priority = 1;
|
|
tls = {
|
|
certResolver = "cloudflare";
|
|
};
|
|
# OAuth-Schutz für 0ff.space deaktiviert (29.07.2026). Zum
|
|
# Reaktivieren: "launcher" gegen "launcher-auth" tauschen -- der
|
|
# oauth2-proxy-Service bleibt unten deklariert und läuft weiter.
|
|
service = "launcher";
|
|
entrypoints = [ "websecure" ];
|
|
};
|
|
};
|
|
}
|