# NixOps configuration for deploying the Cyclone Ibis website

{ config, pkgs, ... }:

let
  cyclone-ibis = import (pkgs.fetchgit {
    name = "cyclone-ibis-src";
    url = "https://source.mcwhirter.io/craige/cyclone-ibis.git";
    branchName = "consensus";
    sha256 = "sha256-EmPwVuyOHVFtE9Od8elgjXBAs/Pu76sYmChRsuZKo0I=";
  }) { nixpkgs = pkgs; };
  webdomain = "cycloneibis.com";

in {

  environment.sessionVariables = {
    LOCALE_ARCHIVE = "/run/current-system/sw/lib/locale/locale-archive";
  };

  nixpkgs.config.allowBroken = true; # Hakyll is marked as broken in 20.09

  services.nginx = {
    enable = true; # Enable Nginx
    recommendedGzipSettings = true;
    recommendedOptimisation = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
    virtualHosts = {
      "${webdomain}" = { # website hostname
        enableACME = true; # Use ACME certs
        forceSSL = true; # Force SSL
        root = "${cyclone-ibis}"; # Wesbite root
      };
      "www.${webdomain}" = { # Respect our elders :-)
        forceSSL = true;
        enableACME = true;
        locations."/".extraConfig =
          "return 301 $scheme://${webdomain}$request_uri;";
      };
    };
  };

  security.acme = {
    acceptTerms = true;
    certs = {
      "${webdomain}".email = "admin@${webdomain}";
      "www.${webdomain}".email = "admin@${webdomain}";
    };
  };

  networking.firewall.allowedTCPPorts = [ 80 443 ];

}