diff --git a/hosts/aka/default.nix b/hosts/aka/default.nix index 100c2853..6258686e 100644 --- a/hosts/aka/default.nix +++ b/hosts/aka/default.nix @@ -9,13 +9,16 @@ ## Services - - # + # + + ]; my.zsh.rc = lib.readFile ; networking.networkmanager.enable = true; time.timeZone = "America/Toronto"; + + services.calibre-server.calibre-server = "/data/books"; } diff --git a/hosts/ao/default.nix b/hosts/ao/default.nix index f66b657b..4ff5c1ef 100644 --- a/hosts/ao/default.nix +++ b/hosts/ao/default.nix @@ -28,12 +28,12 @@ default = true; enableACME = true; forceSSL = true; - root = "/var/www/v0.io"; + root = "/home/${config.my.username}/www/v0.io"; }; "dl.v0.io" = { enableACME = true; addSSL = true; - root = "/var/www/dl.v0.io"; + root = "/home/${config.my.username}/www/dl.v0.io"; locations."~* \.(?:ico|css|js|gif|jpe?g|png|mp4)$".extraConfig = '' expires 30d; add_header Pragma public; @@ -45,52 +45,13 @@ forceSSL = true; locations."/".proxyPass = http://127.0.0.1:3000; }; - # "tv.v0.io" = { - # http2 = true; # more performant for streaming - # enableACME = true; - # forceSSL = true; - # extraConfig = '' - # add_header Content-Security-Policy "default-src https: data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'"; - - # # Some players don't reopen a socket and playback stops totally - # # instead of resuming after an extended pause - # send_timeout 100m; - - # # Intentionally not hardened for security for player support and - # # encryption video streams has a lot of overhead with something like - # # AES-256-GCM-SHA384. - # ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; - - # ssl_stapling on; - # ssl_stapling_verify on; - - # # Forward real ip and host to Plex - # proxy_set_header Referer $server_addr; - # proxy_set_header Origin $server_addr; - - # # Security / XSS Mitigation Headers - # add_header X-Frame-Options "SAMEORIGIN"; - # add_header X-XSS-Protection "1; mode=block"; - # add_header X-Content-Type-Options "nosniff"; - # ''; - # # locations."= /".return = "302 https://tv.v0.io/web/index.html"; - # locations."/socket" = { - # proxyPass = "http://192.168.1.13:8096"; - # proxyHttpVersion = "1.1"; - # # Buffering off send to the client as soon as the data is received - # # from JellyFin. - # proxyBuffering = "off"; - # }; - # locations."/" = { - # proxyWebsockets = true; - # proxyPass = "http://192.168.1.13:8096"; - # }; - # }; - "plex.v0.io" = { + "tv.v0.io" = { http2 = true; # more performant for streaming enableACME = true; forceSSL = true; extraConfig = '' + add_header Content-Security-Policy "default-src https: data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'"; + # Some players don't reopen a socket and playback stops totally # instead of resuming after an extended pause send_timeout 100m; @@ -100,38 +61,29 @@ # AES-256-GCM-SHA384. ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; + ssl_stapling on; + ssl_stapling_verify on; + # Forward real ip and host to Plex proxy_set_header Referer $server_addr; proxy_set_header Origin $server_addr; - # Nginx default client_max_body_size is 1MB, which breaks Camera - # Upload feature from the phones. Increasing the limit fixes the - # issue. Anyhow, if 4K videos are expected to be uploaded, the size - # might need to be increased even more - client_max_body_size 100M; - - # Plex headers - proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier; - proxy_set_header X-Plex-Device $http_x_plex_device; - proxy_set_header X-Plex-Device-Name $http_x_plex_device_name; - proxy_set_header X-Plex-Platform $http_x_plex_platform; - proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version; - proxy_set_header X-Plex-Product $http_x_plex_product; - proxy_set_header X-Plex-Token $http_x_plex_token; - proxy_set_header X-Plex-Version $http_x_plex_version; - proxy_set_header X-Plex-Nocache $http_x_plex_nocache; - proxy_set_header X-Plex-Provides $http_x_plex_provides; - proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor; - proxy_set_header X-Plex-Model $http_x_plex_model; - - # Buffering off send to the client as soon as the data is received - # from Plex. - proxy_buffering off; + # Security / XSS Mitigation Headers + add_header X-Frame-Options "SAMEORIGIN"; + add_header X-XSS-Protection "1; mode=block"; + add_header X-Content-Type-Options "nosniff"; ''; - locations."= /".return = "302 https://plex.v0.io/web/index.html"; + # locations."= /".return = "302 https://tv.v0.io/web/index.html"; + locations."/socket" = { + proxyPass = "http://192.168.1.13:8096"; + proxyHttpVersion = "1.1"; + # Buffering off send to the client as soon as the data is received + # from JellyFin. + proxyBuffering = "off"; + }; locations."/" = { proxyWebsockets = true; - proxyPass = "http://192.168.1.13:32400"; + proxyPass = "http://192.168.1.13:8096"; }; }; }; @@ -141,8 +93,7 @@ "v0.io".email = config.my.email; "dl.v0.io".email = config.my.email; "git.v0.io".email = config.my.email; - "plex.v0.io".email = config.my.email; - # "tv.v0.io".email = config.my.email; + "tv.v0.io".email = config.my.email; }; services.gitea = { diff --git a/hosts/ao/hardware-configuration.nix b/hosts/ao/hardware-configuration.nix index d137c41a..9286f937 100644 --- a/hosts/ao/hardware-configuration.nix +++ b/hosts/ao/hardware-configuration.nix @@ -23,6 +23,11 @@ device = "/dev/disk/by-label/boot"; fsType = "vfat"; }; + "/mnt/data" = { + device = "/dev/disk/by-label/data"; + fsType = "ext4"; + options = [ "noatime" ]; + }; }; swapDevices = [{ device = "/dev/disk/by-label/swap"; }]; } diff --git a/modules/services/calibre-server.nix b/modules/services/calibre-server.nix new file mode 100644 index 00000000..812ce5e0 --- /dev/null +++ b/modules/services/calibre-server.nix @@ -0,0 +1,6 @@ +{ config, lib, pkgs, ... }: + +{ + services.calibre-server.enable = true; + networking.firewall.allowedTCPPorts = [ 8080 ]; +}