ntfy-sh + mollysocket follow nixos wiki suggests

1 files changed, 14 insertions, 31 deletions

diff --git a/adonis/push/default.nix b/adonis/push/default.nix
index cc2eff3..8b16f26 100644
--- a/adonis/push/default.nix
+++ b/adonis/push/default.nix
@@ -2,21 +2,6 @@
   domain = "push.${config.customOps.domain.fqdn}";
   ntfyPort = "8080";
   mollyPort = "8020";
-  nginxConf = ''
-    proxy_http_version                   1.1;
-    proxy_set_header   Host              $host;
-    proxy_set_header   Upgrade           $http_upgrade;
-    proxy_set_header   Connection        "upgrade";
-    proxy_set_header   X-Forwarded-For   $proxy_add_x_forwarded_for;
-    proxy_set_header   X-Forwarded-Proto $scheme;
-    proxy_buffering                      off;
-    proxy_request_buffering              off;
-    proxy_redirect                       off;
-    proxy_connect_timeout                3m;
-    proxy_send_timeout                   3m;
-    proxy_read_timeout                   3m;
-    client_max_body_size                 0;
-  '';
 in {
   sops.secrets = {
     "push/mollysocket" = {};
@@ -29,17 +14,23 @@ in {
       base-url = "https://${domain}";
       behind-proxy = true;
       auth-file = "/var/lib/ntfy-sh/user.db";
-      auth-access = ["*:up*:write-only"];
+      auth-default-access = "deny-all";
+      enable-signup = false;
+      auth-access = [
+        "user:*:rw"
+        "backup-service:backups:*:rw"
+        "*:up*:write-only"
+      ];
     };
   };
 
   services.mollysocket = {
     enable = true;
     settings = {
+      host = "127.0.0.1";
       allowed_endpoints = [
         "https://${domain}"
       ];
-      webserver = true;
     };
     environmentFile = config.sops.secrets."push/mollysocket".path;
   };
@@ -49,19 +40,7 @@ in {
     enableACME = true;
     locations."/" = {
       proxyPass = "http://127.0.0.1:${ntfyPort}";
-      extraConfig = ''
-        set $redirect_https "";
-        if ($request_method = GET) {
-            set $redirect_https "yes";
-        }
-        if ($request_uri ~* "^/([-_a-z0-9]{0,64}$|docs/|static/)") {
-            set $redirect_https "''${redirect_https}yes";
-        }
-        if ($redirect_https = "yesyes") {
-            return 302 https://$http_host$request_uri$is_args$query_string;
-        }
-        ${nginxConf}
-      '';
+      proxyWebsockets = true;
     };
   };
 
@@ -70,7 +49,11 @@ in {
     enableACME = true;
     locations."/" = {
       proxyPass = "http://127.0.0.1:${mollyPort}";
-      extraConfig = nginxConf;
+      proxyWebsockets = true;
+      extraConfig = ''
+        proxy_set_header Host $host;
+        proxy_set_header X-Original-URL $request_uri;
+      '';
     };
   };
 }