gistfile1.txt.nix

let
  domain = "netboot.gsc.io";
in
{ resources, config, options, pkgs, ... }: {
  systemd.tmpfiles.rules = [
    "d ${config.services.nginx.virtualHosts."${domain}".root} 0755 netboot nginx"
  ];

  networking.firewall.allowedTCPPorts = [
    80 # nginx
    443 # nginx
  ];

  security.acme.certs."${domain}".keyType = "rsa4096";

  services.nginx = {
    enable = true;
    recommendedTlsSettings = true;
    sslProtocols = "TLSv1.2";
    sslCiphers = "AES256-SHA256";
    virtualHosts = {
      "${domain}" = {
        root = "/var/lib/nginx/netboot/webroot";
        enableACME = true;
        forceSSL = true;
        http2 = false;
      };
    };
  };
}