Set nginx settings globally

modules/common/default.nix

@@ -10,6 +10,7 @@
     ./acme.nix
     ./boot.nix
     ./exporters.nix
+    ./nginx.nix
     ./nix.nix
     ./ssh.nix
     ./tailscale.nix

modules/common/nginx.nix

@@ -0,0 +1,10 @@
+{
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+  services.nginx = {
+    recommendedTlsSettings = true;
+    recommendedOptimisation = true;
+    recommendedGzipSettings = true;
+    recommendedProxySettings = true;
+    enable = true;
+  };
+}

modules/monitoring/grafana.nix

@@ -14,21 +14,14 @@ in
 
   networking.domains.subDomains."${domain}" = { };
 
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-  services.nginx = {
-    enable = true;
-    recommendedTlsSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    virtualHosts."${domain}" = {
+  services.nginx.virtualHosts."${domain}" = {
       enableACME = true;
       forceSSL = true;
       locations."/" = {
         proxyPass = "http://${config.services.grafana.settings.server.http_addr}:${builtins.toString config.services.grafana.settings.server.http_port }";
         proxyWebsockets = true;
       };
     };
-  };
 
   services.grafana = {
     enable = true;

nodes/sync/syncthing.nix

@@ -3,26 +3,15 @@ let
   domain = "sync.xnee.net";
 in
 {
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-  security.acme = {
-    defaults.email = "[email protected]";
-    acceptTerms = true;
-    certs."${domain}" = { };
-  };
+  security.acme.certs."${domain}" = { };
 
-  services.nginx = {
-    enable = true;
-    recommendedTlsSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    virtualHosts."${domain}" = {
+  services.nginx.virtualHosts."${domain}" = {
       enableACME = true;
       forceSSL = true;
       locations."/" = {
         proxyPass = "http://${config.services.syncthing.guiAddress}";
       };
     };
-  };
 
   services.syncthing = {
     enable = true;