From 68fa845a73d7372574680918ed9483eba7da8a06 Mon Sep 17 00:00:00 2001
From: Henrik Lissner <henrik@lissner.net>
Date: Sun, 31 Jan 2021 18:20:17 -0500
Subject: [PATCH] Add comments & remove redundant config

IS_TLS_ENABLED = true is implied if HOST's port is 465
---
 hosts/ao/modules/gitea.nix            |  1 -
 hosts/kuro/hardware-configuration.nix |  3 +++
 modules/services/fail2ban.nix         |  2 ++
 modules/services/gitea.nix            | 10 ++++++++++
 modules/services/nginx.nix            | 12 ++++++++++++
 5 files changed, 27 insertions(+), 1 deletion(-)

diff --git a/hosts/ao/modules/gitea.nix b/hosts/ao/modules/gitea.nix
index ab4929a9..cda45c4d 100644
--- a/hosts/ao/modules/gitea.nix
+++ b/hosts/ao/modules/gitea.nix
@@ -16,7 +16,6 @@
         HOST = "mail.gmail.com:465";
         USER = "hlissner@gmail.com";
         MAILER_TYPE = "smtp";
-        IS_TLS_ENABLED = "true";
       };
     };
     mailerPasswordFile = config.age.secrets.gitea-smtp.path;
diff --git a/hosts/kuro/hardware-configuration.nix b/hosts/kuro/hardware-configuration.nix
index 14e2f41a..41fd281c 100644
--- a/hosts/kuro/hardware-configuration.nix
+++ b/hosts/kuro/hardware-configuration.nix
@@ -27,6 +27,9 @@
 
   # Displays
   services.xserver = {
+    # This must be done manually to ensure my screen spaces are arranged exactly
+    # as I need them to be *and* the correct monitor is "primary". Using
+    # xrandrHeads does not work.
     monitorSection = ''
       VendorName  "Unknown"
       ModelName   "DELL U2515H"
diff --git a/modules/services/fail2ban.nix b/modules/services/fail2ban.nix
index 038ef2d9..4a036125 100644
--- a/modules/services/fail2ban.nix
+++ b/modules/services/fail2ban.nix
@@ -19,6 +19,8 @@ in {
           bantime = 6h
           findtime = 15m
         '';
+        # Harsher defaults for sshd because it's all key based. Auth failures
+        # are less likely to be legit here.
         sshd = ''
           bantime = 24h
           findtime = 1h
diff --git a/modules/services/gitea.nix b/modules/services/gitea.nix
index c718e462..e2ef7b0a 100644
--- a/modules/services/gitea.nix
+++ b/modules/services/gitea.nix
@@ -1,3 +1,13 @@
+# modules/services/gitea.nix
+#
+# Gitea is essentially a self-hosted github. This modules configures it with the
+# expectation that it will be served over an SSL-secured reverse proxy (best
+# paired with my modules.services.nginx module).
+#
+# Resources
+#   Config: https://docs.gitea.io/en-us/config-cheat-sheet/
+#   API:    https://docs.gitea.io/en-us/api-usage/
+
 { options, config, lib, pkgs, ... }:
 
 with lib;
diff --git a/modules/services/nginx.nix b/modules/services/nginx.nix
index d587de26..ffb145e5 100644
--- a/modules/services/nginx.nix
+++ b/modules/services/nginx.nix
@@ -33,3 +33,15 @@ in {
     };
   };
 }
+
+# Helpful nginx snippets
+#
+# Set expires headers for static files and turn off logging.
+#   location ~* ^.+\.(js|css|swf|xml|txt|ogg|ogv|svg|svgz|eot|otf|woff|mp4|ttf|r ss|atom|jpg|jpeg|gif|png|ico|zip|tgz|gz|rar|bz2|doc|xls|exe|ppt|tar|mid|midi|wav |bmp|rtf)$ {
+#     access_log off; log_not_found off; expires 30d;
+#   }
+#
+# Deny all attempts to access PHP Files in the uploads directory
+#   location ~* /(?:uploads|files)/.*\.php$ {
+#     deny all;
+#   }