From 117a9f08072d444ed0e8d40ae76ca645fc9fcb58 Mon Sep 17 00:00:00 2001
From: tux <t@tux.rs>
Date: Tue, 30 Jun 2026 17:03:21 +0530
Subject: [PATCH] feat: setup nginx and aiostreams for self-hosting

---
 modules/hosts/alpha/config.nix        | 32 ++++++++++++-
 modules/nixos/services/aiostreams.nix | 66 +++++++++++++++++++++++++++
 modules/nixos/services/nginx.nix      | 54 ++++++++++++++++++++++
 3 files changed, 151 insertions(+), 1 deletion(-)
 create mode 100644 modules/nixos/services/aiostreams.nix
 create mode 100644 modules/nixos/services/nginx.nix

diff --git a/modules/hosts/alpha/config.nix b/modules/hosts/alpha/config.nix
index 14e115a..ad897d7 100644
--- a/modules/hosts/alpha/config.nix
+++ b/modules/hosts/alpha/config.nix
@@ -5,7 +5,7 @@
       hostName,
       userName,
       ...
-    }:
+    }@innerArgs:
     {
       imports = with config.flake.modules.nixos; [
         boot
@@ -38,6 +38,24 @@
           netbird-client.enable = true;
         };
 
+        services = {
+          nginx = {
+            enable = true;
+            domain = "lab.tux.rs";
+          };
+          aiostreams = {
+            enable = true;
+            port = 4567;
+
+            environment = {
+              ADDON_ID = "aiostreams.lab.tux.rs";
+              BASE_URL = "https://aiostreams.lab.tux.rs";
+            };
+
+            environmentFile = innerArgs.config.sops.secrets."aiostreams".path;
+          };
+        };
+
         virtualisation = {
           docker.enable = true;
         };
@@ -68,6 +86,18 @@
           sopsFile = ./secrets.yaml;
           owner = userName;
         };
+
+        "cloudflare-credentials/email" = {
+          sopsFile = ./secrets.yaml;
+        };
+
+        "cloudflare-credentials/dns-api-token" = {
+          sopsFile = ./secrets.yaml;
+        };
+
+        aiostreams = {
+          sopsFile = ./secrets.yaml;
+        };
       };
 
       # --- Networking ---
diff --git a/modules/nixos/services/aiostreams.nix b/modules/nixos/services/aiostreams.nix
new file mode 100644
index 0000000..e2212b8
--- /dev/null
+++ b/modules/nixos/services/aiostreams.nix
@@ -0,0 +1,66 @@
+{
+  flake.modules.nixos.services =
+    {
+      config,
+      lib,
+      ...
+    }:
+    with lib;
+    let
+      cfg = config.tnix.services.aiostreams;
+    in
+    {
+      options.tnix.services.aiostreams = {
+        enable = mkEnableOption "Enable AIOStreams";
+
+        port = mkOption {
+          type = types.int;
+          default = 3000;
+        };
+
+        dataDir = mkOption {
+          type = types.path;
+          default = "/var/lib/aiostreams";
+          description = "Directory to store persistent AIOStreams data";
+        };
+
+        environment = mkOption {
+          type = with types; attrsOf str;
+          default = { };
+        };
+
+        environmentFile = mkOption {
+          type = with types; path;
+          default = "";
+        };
+      };
+
+      config = mkIf cfg.enable {
+        virtualisation.oci-containers.containers.aiostreams = {
+          autoStart = true;
+          image = "ghcr.io/viren070/aiostreams:latest";
+          ports = [
+            "${toString cfg.port}:3000"
+          ];
+
+          environment = cfg.environment;
+          environmentFiles = [ cfg.environmentFile ];
+          volumes = [
+            "${cfg.dataDir}:/app/data"
+          ];
+        };
+
+        services.nginx.virtualHosts = {
+          "${cfg.environment.ADDON_ID}" = {
+            forceSSL = true;
+            useACMEHost = "lab.tux.rs";
+            locations = {
+              "/" = {
+                proxyPass = "http://localhost:${toString cfg.port}";
+              };
+            };
+          };
+        };
+      };
+    };
+}
diff --git a/modules/nixos/services/nginx.nix b/modules/nixos/services/nginx.nix
new file mode 100644
index 0000000..986b411
--- /dev/null
+++ b/modules/nixos/services/nginx.nix
@@ -0,0 +1,54 @@
+{
+  flake.modules.nixos.services =
+    {
+      config,
+      lib,
+      userEmail,
+      ...
+    }:
+    with lib;
+    let
+      cfg = config.tnix.services.nginx;
+    in
+    {
+      options.tnix.services.nginx = {
+        enable = mkEnableOption "Enable Nginx";
+
+        domain = mkOption {
+          type = types.str;
+          default = "";
+        };
+      };
+
+      config = mkIf cfg.enable {
+        security = {
+          acme = {
+            acceptTerms = true;
+            defaults.email = "${userEmail}";
+            certs = {
+              "${cfg.domain}" = {
+                group = "nginx";
+                domain = "*.${cfg.domain}";
+                extraDomainNames = [ "${cfg.domain}" ];
+                dnsProvider = "cloudflare";
+                credentialFiles = {
+                  CLOUDFLARE_EMAIL_FILE = config.sops.secrets."cloudflare-credentials/email".path;
+                  CLOUDFLARE_DNS_API_TOKEN_FILE = config.sops.secrets."cloudflare-credentials/dns-api-token".path;
+                };
+              };
+            };
+          };
+        };
+
+        users.users.nginx.extraGroups = [ "acme" ];
+
+        services.nginx = {
+          enable = true;
+          recommendedGzipSettings = true;
+          recommendedOptimisation = true;
+          recommendedProxySettings = true;
+          recommendedTlsSettings = true;
+        };
+      };
+    };
+}