{ config, lib, pkgs, ... }: let port = 8888; services = { "media" = config.sops.secrets.media-proxy-auth.path; "media-sb" = config.sops.secrets.media-proxy-auth.path; "torrent" = config.sops.secrets.torrent-proxy-auth.path; "sturzbach" = config.sops.secrets.torrent-proxy-auth.path; }; in { options.sbruder.media-proxy.enable = lib.mkEnableOption "media proxy"; config = lib.mkIf config.sbruder.media-proxy.enable { sops.secrets = { torrent-proxy-auth.owner = "nginx"; media-proxy-auth.owner = "nginx"; }; systemd.services.nginx.serviceConfig.SupplementaryGroups = lib.singleton config.users.groups.keys.name; # otherwise name resolution fails systemd.services.nginx.after = [ "network-online.target" ]; services.nginx = { enable = true; commonHttpConfig = '' map $http_referer $media_proxy_referer { ~^http://localhost:8888/ ""; default $http_referer; } ''; virtualHosts.media-proxy = { serverName = "localhost"; listen = [ { inherit port; addr = "127.0.0.1"; } { inherit port; addr = "[::1]"; } ]; locations = { "/".extraConfig = '' rewrite ^/__nginx-interactive-index-assets__/(.*)$ /media/__nginx-interactive-index-assets__/$1; ''; } // lib.mapAttrs' (name: secret: { name = "/${name}/"; value = { proxyPass = "https://${name}.sbruder.de/"; proxyWebsockets = true; extraConfig = '' proxy_buffering off; include ${secret}; charset utf-8; proxy_set_header Referer $media_proxy_referer; proxy_set_header Origin $media_proxy_referer; ''; }; }) services; }; }; }; }