diff --git a/machines/aka.nix b/machines/aka.nix index ff2f53bc..75430e67 100644 --- a/machines/aka.nix +++ b/machines/aka.nix @@ -1,5 +1,4 @@ -# My HTPC. Runs all my user-facing services and gives me ssh -# access to my work files from anywhere. +# My HTPC. Mostly so family can organize their media collection. { config, ... }: { @@ -7,8 +6,8 @@ ./. # import common settings - # ./modules/services/plex.nix - + ./modules/services/plex.nix + # ]; diff --git a/machines/ao.nix b/machines/ao.nix index fad0998b..d5a04b27 100644 --- a/machines/ao.nix +++ b/machines/ao.nix @@ -46,52 +46,13 @@ forceSSL = true; locations."/".proxyPass = http://127.0.0.1:3000; }; - "tv.v0.io" = { - http2 = true; # more performant for streaming - enableACME = true; - forceSSL = true; - extraConfig = '' - add_header Content-Security-Policy "default-src https: data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'"; - - # Some players don't reopen a socket and playback stops totally - # instead of resuming after an extended pause - send_timeout 100m; - - # Intentionally not hardened for security for player support and - # encryption video streams has a lot of overhead with something like - # AES-256-GCM-SHA384. - ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; - - ssl_stapling on; - ssl_stapling_verify on; - - # Forward real ip and host to Plex - proxy_set_header Referer $server_addr; - proxy_set_header Origin $server_addr; - - # Security / XSS Mitigation Headers - add_header X-Frame-Options "SAMEORIGIN"; - add_header X-XSS-Protection "1; mode=block"; - add_header X-Content-Type-Options "nosniff"; - ''; - # locations."= /".return = "302 https://tv.v0.io/web/index.html"; - locations."/socket" = { - proxyPass = "http://192.168.1.13:8096"; - proxyHttpVersion = "1.1"; - # Buffering off send to the client as soon as the data is received - # from JellyFin. - proxyBuffering = "off"; - }; - locations."/" = { - proxyWebsockets = true; - proxyPass = "http://192.168.1.13:8096"; - }; - }; - # "plex.v0.io" = { + # "tv.v0.io" = { # http2 = true; # more performant for streaming # enableACME = true; # forceSSL = true; # extraConfig = '' + # add_header Content-Security-Policy "default-src https: data: blob:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com/cv/js/sender/v1/cast_sender.js; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'"; + # # Some players don't reopen a socket and playback stops totally # # instead of resuming after an extended pause # send_timeout 100m; @@ -101,48 +62,88 @@ # # AES-256-GCM-SHA384. # ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; + # ssl_stapling on; + # ssl_stapling_verify on; + # # Forward real ip and host to Plex # proxy_set_header Referer $server_addr; # proxy_set_header Origin $server_addr; - # # Nginx default client_max_body_size is 1MB, which breaks Camera - # # Upload feature from the phones. Increasing the limit fixes the - # # issue. Anyhow, if 4K videos are expected to be uploaded, the size - # # might need to be increased even more - # client_max_body_size 100M; - - # # Plex headers - # proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier; - # proxy_set_header X-Plex-Device $http_x_plex_device; - # proxy_set_header X-Plex-Device-Name $http_x_plex_device_name; - # proxy_set_header X-Plex-Platform $http_x_plex_platform; - # proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version; - # proxy_set_header X-Plex-Product $http_x_plex_product; - # proxy_set_header X-Plex-Token $http_x_plex_token; - # proxy_set_header X-Plex-Version $http_x_plex_version; - # proxy_set_header X-Plex-Nocache $http_x_plex_nocache; - # proxy_set_header X-Plex-Provides $http_x_plex_provides; - # proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor; - # proxy_set_header X-Plex-Model $http_x_plex_model; - - # # Buffering off send to the client as soon as the data is received - # # from Plex. - # proxy_buffering off; + # # Security / XSS Mitigation Headers + # add_header X-Frame-Options "SAMEORIGIN"; + # add_header X-XSS-Protection "1; mode=block"; + # add_header X-Content-Type-Options "nosniff"; # ''; - # locations."= /".return = "302 https://plex.v0.io/web/index.html"; + # # locations."= /".return = "302 https://tv.v0.io/web/index.html"; + # locations."/socket" = { + # proxyPass = "http://192.168.1.13:8096"; + # proxyHttpVersion = "1.1"; + # # Buffering off send to the client as soon as the data is received + # # from JellyFin. + # proxyBuffering = "off"; + # }; # locations."/" = { # proxyWebsockets = true; - # proxyPass = "http://192.168.1.13:32400"; + # proxyPass = "http://192.168.1.13:8096"; # }; # }; + "plex.v0.io" = { + http2 = true; # more performant for streaming + enableACME = true; + forceSSL = true; + extraConfig = '' + # Some players don't reopen a socket and playback stops totally + # instead of resuming after an extended pause + send_timeout 100m; + + # Intentionally not hardened for security for player support and + # encryption video streams has a lot of overhead with something like + # AES-256-GCM-SHA384. + ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:ECDHE-RSA-DES-CBC3-SHA:ECDHE-ECDSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA'; + + # Forward real ip and host to Plex + proxy_set_header Referer $server_addr; + proxy_set_header Origin $server_addr; + + # Nginx default client_max_body_size is 1MB, which breaks Camera + # Upload feature from the phones. Increasing the limit fixes the + # issue. Anyhow, if 4K videos are expected to be uploaded, the size + # might need to be increased even more + client_max_body_size 100M; + + # Plex headers + proxy_set_header X-Plex-Client-Identifier $http_x_plex_client_identifier; + proxy_set_header X-Plex-Device $http_x_plex_device; + proxy_set_header X-Plex-Device-Name $http_x_plex_device_name; + proxy_set_header X-Plex-Platform $http_x_plex_platform; + proxy_set_header X-Plex-Platform-Version $http_x_plex_platform_version; + proxy_set_header X-Plex-Product $http_x_plex_product; + proxy_set_header X-Plex-Token $http_x_plex_token; + proxy_set_header X-Plex-Version $http_x_plex_version; + proxy_set_header X-Plex-Nocache $http_x_plex_nocache; + proxy_set_header X-Plex-Provides $http_x_plex_provides; + proxy_set_header X-Plex-Device-Vendor $http_x_plex_device_vendor; + proxy_set_header X-Plex-Model $http_x_plex_model; + + # Buffering off send to the client as soon as the data is received + # from Plex. + proxy_buffering off; + ''; + locations."= /".return = "302 https://plex.v0.io/web/index.html"; + locations."/" = { + proxyWebsockets = true; + proxyPass = "http://192.168.1.13:32400"; + }; + }; }; }; security.acme.certs = { - "v0.io".email = "henrik@lissner.net"; - "dl.v0.io".email = "henrik@lissner.net"; - "git.v0.io".email = "henrik@lissner.net"; - "plex.v0.io".email = "henrik@lissner.net"; + "v0.io".email = config.my.email; + "dl.v0.io".email = config.my.email; + "git.v0.io".email = config.my.email; + "plex.v0.io".email = config.my.email; + # "tv.v0.io".email = config.my.email; }; services.gitea = { diff --git a/options/my.nix b/options/my.nix index 7e99fa38..6fa3e946 100644 --- a/options/my.nix +++ b/options/my.nix @@ -10,6 +10,11 @@ with lib; default = "hlissner"; }; + email = mkOption { + type = types.str; + default = "henrik@lissner.net"; + }; + home = mkOption { type = options.home-manager.users.type.functor.wrapped; default = {};