Add minio to nginx

config/services/minio.nix

@@ -1,10 +1,29 @@
-{ ... }: {
+{ config, ... }:
+let
+  listenIPs = (import ../../utils/getInternalIP.nix config).listenIPs;
+in
+{
   services.minio = {
     enable = true;
     rootCredentialsFile = "/run/secrets/security/minio/credentials_file";
   };
   services.prometheus.exporters.minio = {
+    # TODO: doesn't work
     enable = true;
   };
-  networking.firewall.interfaces."wg0".allowedTCPPorts = [ 9000 9001 ];
+  services.nginx.virtualHosts."minio.int.chir.rs" = {
+    forceSSL = true;
+    http2 = true;
+    listenAddresses = listenIPs;
+    sslCertificate = "/var/lib/acme/int.chir.rs/cert.pem";
+    sslCertificateKey = "/var/lib/acme/int.chir.rs/key.pem";
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:9000";
+      proxyWebsockets = true;
+    };
+    locations."/web" = {
+      proxyPass = "http://127.0.0.1:9001";
+      proxyWebsockets = true;
+    };
+  };
 }

flake.lock

@@ -7,11 +7,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1642117744,
-        "narHash": "sha256-/SvxBe/m6JiRSlKIrgD6LQxee9GGewFyq+lsPxoViMY=",
+        "lastModified": 1642379981,
+        "narHash": "sha256-FE0RIZmrG2ScKGRthNzcFAssLW7MgMLun0g7Qg2zZMA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "a5dd5d5f197724f3065fd39c59c7ccea3c8dcb8f",
+        "rev": "f71d41ba360cd49b3647bf91402c7479e859fd2e",
         "type": "github"
       },
       "original": {
@@ -22,11 +22,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1642323669,
-        "narHash": "sha256-BiSAPmmg9nAT82WjEeI2AUJyC6Fd2BuexwJdnGaOXOA=",
+        "lastModified": 1642388995,
+        "narHash": "sha256-GfKADdPH4vDBFGZ1nS9rfpX/cb3dY9XAqHh4j++5NYw=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "f0996f2d22216c9468205b1ae207d89bfa48fd8e",
+        "rev": "9e779f01cadea02806b59d3b1dfa285f8f129f48",
         "type": "github"
       },
       "original": {