feat(wpcarro/website): Support SSL certs for wpcarro.dev r/4264

This has been sloppy for awhile...

While I'm at it modularize some of my Nginx configuration.

Side note: might be time to decouple the Terraform provisioning stuffs from the
NixOS configuration, and this feels *too* tightly coupled.

Change-Id: Ida0da5462d938b956571321a67ba1f026fb0a7de
Reviewed-on: https://cl.tvl.fyi/c/depot/+/5902
Reviewed-by: wpcarro <wpcarro@gmail.com>
Autosubmit: wpcarro <wpcarro@gmail.com>
Tested-by: BuildkiteCI

5 files changed, 74 insertions, 37 deletions

diff --git a/users/wpcarro/nixos/diogenes/default.nix b/users/wpcarro/nixos/diogenes/default.nix
index 022570e3d315..e83329e4c266 100644
--- a/users/wpcarro/nixos/diogenes/default.nix
+++ b/users/wpcarro/nixos/diogenes/default.nix
@@ -4,6 +4,9 @@ let
   inherit (depot.users) wpcarro;
   name = "diogenes";
   domainName = "billandhiscomputer.com";
+
+  mod = name: depot.path.origSrc + ("/ops/modules/" + name);
+  usermod = name: depot.path.origSrc + ("/users/wpcarro/nixos/modules/" + name);
 in
 wpcarro.terraform.googleCloudVM {
   project = "wpcarros-infrastructure";
@@ -36,7 +39,10 @@ wpcarro.terraform.googleCloudVM {
 
   configuration = {
     imports = [
-      (depot.path.origSrc + "/ops/modules/quassel.nix")
+      (mod "quassel.nix")
+      (usermod "nginx.nix")
+      (usermod "www/billandhiscomputer.com.nix")
+      (usermod "www/wpcarro.dev.nix")
     ];
 
     networking = {
@@ -117,42 +123,6 @@ wpcarro.terraform.googleCloudVM {
         googleCloudProject = "wpcarros-infrastructure";
         applicationCredentials = "/etc/gcp/key.json";
       };
-
-      nginx = {
-        enable = true;
-        enableReload = true;
-
-        recommendedTlsSettings = true;
-        recommendedGzipSettings = true;
-        recommendedProxySettings = true;
-
-        # for journaldriver
-        commonHttpConfig = ''
-          log_format json_combined escape=json
-          '{'
-              '"remote_addr":"$remote_addr",'
-              '"method":"$request_method",'
-              '"host":"$host",'
-              '"uri":"$request_uri",'
-              '"status":$status,'
-              '"request_size":$request_length,'
-              '"response_size":$body_bytes_sent,'
-              '"response_time":$request_time,'
-              '"referrer":"$http_referer",'
-              '"user_agent":"$http_user_agent"'
-          '}';
-
-          access_log syslog:server=unix:/dev/log,nohostname json_combined;
-        '';
-
-        virtualHosts = {
-          "${domainName}" = {
-            addSSL = true;
-            enableACME = true;
-            root = wpcarro.website.root;
-          };
-        };
-      };
     };
 
     system.stateVersion = "21.11";
diff --git a/users/wpcarro/nixos/modules/.skip-subtree b/users/wpcarro/nixos/modules/.skip-subtree
new file mode 100644
index 000000000000..09520f8c831f
--- /dev/null
+++ b/users/wpcarro/nixos/modules/.skip-subtree
@@ -0,0 +1 @@
+NixOS modules are not readTree compatible.
diff --git a/users/wpcarro/nixos/modules/nginx.nix b/users/wpcarro/nixos/modules/nginx.nix
new file mode 100644
index 000000000000..e6cc6b0febab
--- /dev/null
+++ b/users/wpcarro/nixos/modules/nginx.nix
@@ -0,0 +1,45 @@
+# Common configuration for Nginx.
+{ pkgs, ... }:
+
+{
+  config = {
+    security.acme = {
+      acceptTerms = true;
+      defaults.email = "wpcarro@gmail.com";
+    };
+
+    services.nginx = {
+      enable = true;
+      enableReload = true;
+
+      recommendedTlsSettings = true;
+      recommendedGzipSettings = true;
+
+      # Log errors to journald (i.e. /dev/log) with debug verbosity.
+      logError = "syslog:server=unix:/dev/log debug";
+
+      # for journaldriver
+      commonHttpConfig = ''
+        log_format json_combined escape=json
+        '{'
+            '"remote_addr":"$remote_addr",'
+            '"method":"$request_method",'
+            '"host":"$host",'
+            '"uri":"$request_uri",'
+            '"status":$status,'
+            '"request_size":$request_length,'
+            '"response_size":$body_bytes_sent,'
+            '"response_time":$request_time,'
+            '"referrer":"$http_referer",'
+            '"user_agent":"$http_user_agent"'
+        '}';
+
+        access_log syslog:server=unix:/dev/log,nohostname json_combined;
+      '';
+
+      appendHttpConfig = ''
+        add_header Permissions-Policy "interest-cohort=()";
+      '';
+    };
+  };
+}
diff --git a/users/wpcarro/nixos/modules/www/billandhiscomputer.com.nix b/users/wpcarro/nixos/modules/www/billandhiscomputer.com.nix
new file mode 100644
index 000000000000..ec4e5d7302fc
--- /dev/null
+++ b/users/wpcarro/nixos/modules/www/billandhiscomputer.com.nix
@@ -0,0 +1,11 @@
+{ pkgs, depot, ... }:
+
+{
+  config = {
+    services.nginx.virtualHosts."billandhiscomputer.com" = {
+      enableACME = true;
+      forceSSL = true;
+      root = depot.users.wpcarro.website.root;
+    };
+  };
+}
diff --git a/users/wpcarro/nixos/modules/www/wpcarro.dev.nix b/users/wpcarro/nixos/modules/www/wpcarro.dev.nix
new file mode 100644
index 000000000000..7c4af627edfd
--- /dev/null
+++ b/users/wpcarro/nixos/modules/www/wpcarro.dev.nix
@@ -0,0 +1,10 @@
+{ pkgs, ... }:
+
+{
+  config = {
+    services.nginx.virtualHosts."wpcarro.dev" = {
+      enableACME = true;
+      forceSSL = true;
+    };
+  };
+}