feat: setup nginx and aiostreams for self-hosting

modules/hosts/alpha/config.nix

@@ -5,7 +5,7 @@
       hostName,
       userName,
       ...
-    }:
+    }@innerArgs:
     {
       imports = with config.flake.modules.nixos; [
         boot
@@ -38,6 +38,24 @@
           netbird-client.enable = true;
         };
 
+        services = {
+          nginx = {
+            enable = true;
+            domain = "lab.tux.rs";
+          };
+          aiostreams = {
+            enable = true;
+            port = 4567;
+
+            environment = {
+              ADDON_ID = "aiostreams.lab.tux.rs";
+              BASE_URL = "https://aiostreams.lab.tux.rs";
+            };
+
+            environmentFile = innerArgs.config.sops.secrets."aiostreams".path;
+          };
+        };
+
         virtualisation = {
           docker.enable = true;
         };
@@ -68,6 +86,18 @@
           sopsFile = ./secrets.yaml;
           owner = userName;
         };
+
+        "cloudflare-credentials/email" = {
+          sopsFile = ./secrets.yaml;
+        };
+
+        "cloudflare-credentials/dns-api-token" = {
+          sopsFile = ./secrets.yaml;
+        };
+
+        aiostreams = {
+          sopsFile = ./secrets.yaml;
+        };
       };
 
       # --- Networking ---

modules/nixos/services/aiostreams.nix

@@ -0,0 +1,66 @@
+{
+  flake.modules.nixos.services =
+    {
+      config,
+      lib,
+      ...
+    }:
+    with lib;
+    let
+      cfg = config.tnix.services.aiostreams;
+    in
+    {
+      options.tnix.services.aiostreams = {
+        enable = mkEnableOption "Enable AIOStreams";
+
+        port = mkOption {
+          type = types.int;
+          default = 3000;
+        };
+
+        dataDir = mkOption {
+          type = types.path;
+          default = "/var/lib/aiostreams";
+          description = "Directory to store persistent AIOStreams data";
+        };
+
+        environment = mkOption {
+          type = with types; attrsOf str;
+          default = { };
+        };
+
+        environmentFile = mkOption {
+          type = with types; path;
+          default = "";
+        };
+      };
+
+      config = mkIf cfg.enable {
+        virtualisation.oci-containers.containers.aiostreams = {
+          autoStart = true;
+          image = "ghcr.io/viren070/aiostreams:latest";
+          ports = [
+            "${toString cfg.port}:3000"
+          ];
+
+          environment = cfg.environment;
+          environmentFiles = [ cfg.environmentFile ];
+          volumes = [
+            "${cfg.dataDir}:/app/data"
+          ];
+        };
+
+        services.nginx.virtualHosts = {
+          "${cfg.environment.ADDON_ID}" = {
+            forceSSL = true;
+            useACMEHost = "lab.tux.rs";
+            locations = {
+              "/" = {
+                proxyPass = "http://localhost:${toString cfg.port}";
+              };
+            };
+          };
+        };
+      };
+    };
+}

modules/nixos/services/nginx.nix

@@ -0,0 +1,54 @@
+{
+  flake.modules.nixos.services =
+    {
+      config,
+      lib,
+      userEmail,
+      ...
+    }:
+    with lib;
+    let
+      cfg = config.tnix.services.nginx;
+    in
+    {
+      options.tnix.services.nginx = {
+        enable = mkEnableOption "Enable Nginx";
+
+        domain = mkOption {
+          type = types.str;
+          default = "";
+        };
+      };
+
+      config = mkIf cfg.enable {
+        security = {
+          acme = {
+            acceptTerms = true;
+            defaults.email = "${userEmail}";
+            certs = {
+              "${cfg.domain}" = {
+                group = "nginx";
+                domain = "*.${cfg.domain}";
+                extraDomainNames = [ "${cfg.domain}" ];
+                dnsProvider = "cloudflare";
+                credentialFiles = {
+                  CLOUDFLARE_EMAIL_FILE = config.sops.secrets."cloudflare-credentials/email".path;
+                  CLOUDFLARE_DNS_API_TOKEN_FILE = config.sops.secrets."cloudflare-credentials/dns-api-token".path;
+                };
+              };
+            };
+          };
+        };
+
+        users.users.nginx.extraGroups = [ "acme" ];
+
+        services.nginx = {
+          enable = true;
+          recommendedGzipSettings = true;
+          recommendedOptimisation = true;
+          recommendedProxySettings = true;
+          recommendedTlsSettings = true;
+        };
+      };
+    };
+}