diff --git a/nixbld-etc-nixos/configuration.nix b/nixbld-etc-nixos/configuration.nix index 409a22d..1b8e8b7 100644 --- a/nixbld-etc-nixos/configuration.nix +++ b/nixbld-etc-nixos/configuration.nix @@ -49,7 +49,7 @@ services.openssh.enable = true; # Open ports in the firewall. - networking.firewall.allowedTCPPorts = [ 631 3000 5801 5901 6001 80 ]; + networking.firewall.allowedTCPPorts = [ 631 5901 80 443 ]; networking.firewall.allowedUDPPorts = [ 631 ]; # Or disable the firewall altogether. # networking.firewall.enable = false; @@ -135,6 +135,9 @@ ACTION=="add", SUBSYSTEM=="tty", \ services.gitlab = { enable = true; + host = "gitlab.m-labs.hk"; + port = 443; + https = true; databasePassword = pkgs.lib.fileContents /etc/nixos/secret/gitlab-db-password; secrets = import /etc/nixos/secret/gitlab.nix; initialRootPassword = pkgs.lib.fileContents /etc/nixos/secret/gitlab-default-root; @@ -144,7 +147,24 @@ ACTION=="add", SUBSYSTEM=="tty", \ enable = true; recommendedProxySettings = true; virtualHosts = { - "nixbld.lab.m-labs.hk" = { + "buildbot.m-labs.hk" = { + addSSL = true; + enableACME = true; + locations."/".proxyPass = "http://192.168.1.100"; + }; + "lab.m-labs.hk" = { + addSSL = true; + enableACME = true; + locations."/".proxyPass = "http://192.168.1.100"; + }; + "nixbld.m-labs.hk" = { + forceSSL = true; + enableACME = true; + locations."/".proxyPass = "http://127.0.0.1:3000"; + }; + "gitlab.m-labs.hk" = { + forceSSL = true; + enableACME = true; locations."/".proxyPass = "http://unix:/run/gitlab/gitlab-workhorse.socket"; }; };