feat: setup nginx and aiostreams for self-hosting

modules/nixos/services/aiostreams.nix

@@ -0,0 +1,66 @@
+{
+  flake.modules.nixos.services =
+    {
+      config,
+      lib,
+      ...
+    }:
+    with lib;
+    let
+      cfg = config.tnix.services.aiostreams;
+    in
+    {
+      options.tnix.services.aiostreams = {
+        enable = mkEnableOption "Enable AIOStreams";
+
+        port = mkOption {
+          type = types.int;
+          default = 3000;
+        };
+
+        dataDir = mkOption {
+          type = types.path;
+          default = "/var/lib/aiostreams";
+          description = "Directory to store persistent AIOStreams data";
+        };
+
+        environment = mkOption {
+          type = with types; attrsOf str;
+          default = { };
+        };
+
+        environmentFile = mkOption {
+          type = with types; path;
+          default = "";
+        };
+      };
+
+      config = mkIf cfg.enable {
+        virtualisation.oci-containers.containers.aiostreams = {
+          autoStart = true;
+          image = "ghcr.io/viren070/aiostreams:latest";
+          ports = [
+            "${toString cfg.port}:3000"
+          ];
+
+          environment = cfg.environment;
+          environmentFiles = [ cfg.environmentFile ];
+          volumes = [
+            "${cfg.dataDir}:/app/data"
+          ];
+        };
+
+        services.nginx.virtualHosts = {
+          "${cfg.environment.ADDON_ID}" = {
+            forceSSL = true;
+            useACMEHost = "lab.tux.rs";
+            locations = {
+              "/" = {
+                proxyPass = "http://localhost:${toString cfg.port}";
+              };
+            };
+          };
+        };
+      };
+    };
+}

modules/nixos/services/nginx.nix

@@ -0,0 +1,54 @@
+{
+  flake.modules.nixos.services =
+    {
+      config,
+      lib,
+      userEmail,
+      ...
+    }:
+    with lib;
+    let
+      cfg = config.tnix.services.nginx;
+    in
+    {
+      options.tnix.services.nginx = {
+        enable = mkEnableOption "Enable Nginx";
+
+        domain = mkOption {
+          type = types.str;
+          default = "";
+        };
+      };
+
+      config = mkIf cfg.enable {
+        security = {
+          acme = {
+            acceptTerms = true;
+            defaults.email = "${userEmail}";
+            certs = {
+              "${cfg.domain}" = {
+                group = "nginx";
+                domain = "*.${cfg.domain}";
+                extraDomainNames = [ "${cfg.domain}" ];
+                dnsProvider = "cloudflare";
+                credentialFiles = {
+                  CLOUDFLARE_EMAIL_FILE = config.sops.secrets."cloudflare-credentials/email".path;
+                  CLOUDFLARE_DNS_API_TOKEN_FILE = config.sops.secrets."cloudflare-credentials/dns-api-token".path;
+                };
+              };
+            };
+          };
+        };
+
+        users.users.nginx.extraGroups = [ "acme" ];
+
+        services.nginx = {
+          enable = true;
+          recommendedGzipSettings = true;
+          recommendedOptimisation = true;
+          recommendedProxySettings = true;
+          recommendedTlsSettings = true;
+        };
+      };
+    };
+}