Setup invidious on NixOS

configuration.nix

{ config, lib, pkgs, ... }: {
  networking.hostName = "mycloud-nixos";
  services.tailscale = {
    enable = true;
  };
  services.invidious = {
      enable = true;
      port = 8090;
  };
  networking.firewall = {
    enable = true;
    trustedInterfaces = [
      "tailscale0"
    ];
  };
  ## OPTIONAL: Expose to internet via nginx; automatic HTTPS cert fetching and renewal.
  services.nginx = {
    enable = true;
    recommendedProxySettings = true;
    recommendedTlsSettings = true;
    clientMaxBodySize = "40M";
    virtualHosts = {
      "invidious.romeov.me" = {
        forceSSL = true;
        enableACME = true;
        proxyPass = "http://127.0.0.1:${toString config.services.invidious.port}";
      };
    };
  };
  networking.firewall.allowedTCPPorts = [  # necessar for https certs
    80
    443
  ];
  security.acme = {
    acceptTerms = true;
    defaults.email = "contact@romeov.me";
  };
};