yisroelbaum/home-server-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Compare commits

base: yisroelbaum:d40a163d24ee93a832fee564abdca260e8a0ca3c
Branches Tags
yisroelbaum:master
..
compare: yisroelbaum:48cb3982a24e7ecbe6b518e51939df31d83d2982
Branches Tags
yisroelbaum:master

No commits in common. "d40a163d24ee93a832fee564abdca260e8a0ca3c" and "48cb3982a24e7ecbe6b518e51939df31d83d2982" have entirely different histories.
d40a163d24 ... 48cb3982a2

2 changed files with 12 additions and 15 deletions
Download patch file Download diff file Expand all files Collapse all files

21
checks/rabbi-gerzi-domains.nix
View file

@ -9,8 +9,6 @@ let
backendConfig = config.services.rabbi-gerzi.backend; backendConfig = config.services.rabbi-gerzi.backend;
frontendVirtualHost = config.services.nginx.virtualHosts.${frontendConfig.hostName}; frontendVirtualHost = config.services.nginx.virtualHosts.${frontendConfig.hostName};
backendVirtualHost = config.services.nginx.virtualHosts.${backendConfig.hostName}; backendVirtualHost = config.services.nginx.virtualHosts.${backendConfig.hostName};
frontendCertificate = config.security.acme.certs.${frontendConfig.hostName};
backendCertificate = config.security.acme.certs.${backendConfig.hostName};
redirectVirtualHost = lib.attrByPath [ redirectVirtualHost = lib.attrByPath [
"www.rabbigerzi.com" "www.rabbigerzi.com"
] { } config.services.nginx.virtualHosts; ] { } config.services.nginx.virtualHosts;
@ -36,24 +34,17 @@ let
assertion = assertion =
backendConfig.corsAllowedOrigins == [ backendConfig.corsAllowedOrigins == [
"https://rabbigerzi.com" "https://rabbigerzi.com"
"https://rabbigerzi.yisroelbaum.com"
]; ];
message = "Rabbi Gerzi CORS origins are not production-only"; message = "Rabbi Gerzi CORS origins do not cover production and staging";
} }
{ {
assertion = !builtins.elem "rabbigerzi.yisroelbaum.com" frontendVirtualHost.serverAliases; assertion = builtins.elem "rabbigerzi.yisroelbaum.com" frontendVirtualHost.serverAliases;
message = "Rabbi Gerzi frontend still serves the staging alias"; message = "Rabbi Gerzi frontend staging alias is missing";
} }
{ {
assertion = !builtins.elem "rabbigerziapi.yisroelbaum.com" backendVirtualHost.serverAliases; assertion = builtins.elem "rabbigerziapi.yisroelbaum.com" backendVirtualHost.serverAliases;
message = "Rabbi Gerzi backend still serves the staging alias"; message = "Rabbi Gerzi backend staging alias is missing";
}
{
assertion = !builtins.elem "rabbigerzi.yisroelbaum.com" frontendCertificate.extraDomainNames;
message = "Rabbi Gerzi frontend certificate still covers staging";
}
{
assertion = !builtins.elem "rabbigerziapi.yisroelbaum.com" backendCertificate.extraDomainNames;
message = "Rabbi Gerzi backend certificate still covers staging";
} }
{ {
assertion = redirectVirtualHost.globalRedirect or null == "rabbigerzi.com"; assertion = redirectVirtualHost.globalRedirect or null == "rabbigerzi.com";

6
rabbi-gerzi.nix
View file

@ -15,14 +15,20 @@
nginx = { nginx = {
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
serverAliases = [ "rabbigerzi.yisroelbaum.com" ];
}; };
}; };
backend = { backend = {
hostName = "api.rabbigerzi.com"; hostName = "api.rabbigerzi.com";
environmentFile = config.sops.secrets."rabbi-gerzi-env".path; environmentFile = config.sops.secrets."rabbi-gerzi-env".path;
corsAllowedOrigins = [
"https://rabbigerzi.com"
"https://rabbigerzi.yisroelbaum.com"
];
nginx = { nginx = {
forceSSL = true; forceSSL = true;
enableACME = true; enableACME = true;
serverAliases = [ "rabbigerziapi.yisroelbaum.com" ];
}; };
}; };
}; };