Add *.home.heartles.xyz proxy

configuration.nix

@@ -1,5 +1,9 @@
 { pkgs, ... }@inputs: {
-  imports = [ ./hardware-configuration.nix ./misskey-service.nix ];
+  imports = [
+    ./hardware-configuration.nix
+    ./misskey-service.nix
+    ./heartles-xyz-proxy.nix
+  ];
 
   nix.settings = {
     experimental-features = [ "nix-command" "flakes" ];

heartles-xyz-proxy.nix

@@ -0,0 +1,54 @@
+{ config, lib, ... }: {
+  networking.firewall.allowedTCPPorts = [ 80 443 ];
+
+  security.acme = {
+    acceptTerms = true;
+    defaults.email = "admin+acme@heartles.xyz";
+    certs."STAR.home.heartles.xyz" = {
+      domain = "*.home.heartles.xyz";
+      dnsProvider = "namecheap";
+      credentialsFile = "/etc/nixos-secrets/namecheap-acme";
+      group = "nginx";
+    };
+  };
+
+  services.nginx = {
+    enable = true;
+    recommendedProxySettings = true;
+    virtualHosts = {
+      "*.home.heartles.xyz" = {
+        listen = [
+          {
+            port = 443;
+            addr = "0.0.0.0";
+            ssl = true;
+          }
+          {
+            port = 80;
+            addr = "0.0.0.0";
+          }
+          {
+            port = 443;
+            addr = "[::]";
+            ssl = true;
+          }
+          {
+            port = 80;
+            addr = "[::]";
+          }
+        ];
+
+        useACMEHost = "STAR.home.heartles.xyz";
+        forceSSL = true;
+
+        locations."/" = {
+          proxyWebsockets = true;
+          extraConfig = ''
+            proxy_ssl_name $host;
+            include /etc/nixos-secrets/nginx-proxy-pass-home.conf;
+          '';
+        };
+      };
+    };
+  };
+}