Update nginx

hosts/mups/configuration.nix

@@ -1,15 +1,20 @@
-{ config, lib, pkgs, inputs, system, ... }:
+{
-let
+  config,
+  lib,
+  pkgs,
+  inputs,
+  system,
+  ...
+}: let
   cfg = config.mods;
   keys = [
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKEio+Y5wBVD1wILaH2R3wV10FvVjiqy/4gGBWHOITTB muon@muon"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKevYmkH7xvYoquBjnYZ7PJiVqf+GOh9fxAJBN6wZGBB gin4@hi.is"
     "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILmAOd9VbhyJeibt6Vrb101MNTk5W8+rh94Djv/C+pyu muon@muho"
   ];
-
 in {
   # Hardware
-  imports = [ ./hardware-configuration.nix ../ports.nix ];
+  imports = [./hardware-configuration.nix ../ports.nix];
 
   # System
   mods.user.name = "muon";
@@ -46,29 +51,82 @@ in {
     enable = true;
     listen = "[::]:8008";
     root = "/var/www";
-    configuration = { general = { directory-listing = true; }; };
+    configuration = {general = {directory-listing = true;};};
   };
   services.nginx.virtualHosts = {
     "muon.host" = {
       enableACME = true;
       forceSSL = true;
       default = true;
-      locations."/" = { proxyPass = "http://localhost:8008"; };
+      locations."/" = {proxyPass = "http://localhost:8008";};
     };
     "nvr.muon.host" = {
       enableACME = true;
       forceSSL = true;
-      locations."/" = { proxyPass = "http://10.0.0.2:8095"; };
+      locations."/" = {proxyPass = "http://10.0.0.2:8095";};
     };
     "tetterodesportcomplex.nl" = {
       enableACME = true;
       forceSSL = true;
-      locations."/" = { proxyPass = "http://10.0.0.3:5001"; };
+      locations."/" = {proxyPass = "http://10.0.0.3:5001";};
     };
     "www.tetterodesportcomplex.nl" = {
       enableACME = true;
       forceSSL = true;
-      locations."/" = { proxyPass = "http://10.0.0.3:5001"; };
+      locations."/" = {proxyPass = "http://10.0.0.3:5001";};
+    };
+    "seedbox.muon.host" = {
+      forceSSL = true;
+      enableACME = true;
+      locations = {
+        "/" = {
+          proxyPass = "http://10.0.0.3:3013";
+        };
+        "/api" = {
+          proxyPass = "http://10.0.0.3:3014";
+          extraConfig =
+            #sh
+            ''
+              limit_req zone=api burst=20 nodelay;
+
+              # CORS headers
+              add_header Access-Control-Allow-Origin "*" always;
+              add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS" always;
+              add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization" always;
+              add_header Access-Control-Expose-Headers "Content-Length,Content-Range" always;
+
+              # Handle preflight requests
+              if ($request_method = 'OPTIONS') {
+                  add_header Access-Control-Allow-Origin "*";
+                  add_header Access-Control-Allow-Methods "GET, POST, PUT, DELETE, OPTIONS";
+                  add_header Access-Control-Allow-Headers "DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization";
+                  add_header Content-Type text/plain;
+                  add_header Content-Length 0;
+                  return 204;
+              }
+            '';
+        };
+        "/api/stream" = {
+          proxyPass = "http://10.0.0.3:3014";
+          extraConfig =
+            #sh
+            ''
+              limit_req zone=download burst=10 nodelay;
+              proxy_set_header Range $http_range;
+
+              # Streaming optimizations
+              proxy_buffering off;
+              proxy_cache off;
+              proxy_read_timeout 300s;
+              proxy_connect_timeout 30s;
+              proxy_send_timeout 300s;
+
+              # Allow large file streaming
+              client_max_body_size 0;
+              proxy_max_temp_file_size 0;
+            '';
+        };
+      };
     };
   };
 
@@ -79,9 +137,8 @@ in {
 
   networking.firewall = {
     enable = true;
-    allowedTCPPorts = [ 80 8080 ];
+    allowedTCPPorts = [80 8080];
   };
 
   system.stateVersion = "24.05"; # Did you read the comment?
 }
-

hosts/ports.nix

@@ -24,8 +24,8 @@
       ntfy = 3010;
       audio = 3011;
       atuin = 3012;
-      stream = 3013; # seedbox-frontend
+      # stream = 3013; # seedbox-frontend
-      seedbox = 3014; # seedbox-backend
+      # seedbox = 3014; # seedbox-backend
 
       search = 8081;
       videos = 8082;

modules/nixos/server/containers/seedbox.nix

@@ -6,8 +6,8 @@
   ...
 }: let
   cfg = config.mods.server.seedbox;
-  port = config.mods.server.nginx.ports.stream;
+  port = 3013;
-  backend-port = config.mods.server.nginx.ports.seedbox;
+  bport = 3014;
 in
   with lib; {
     options.mods.server.seedbox = {
@@ -17,7 +17,15 @@ in
       };
     };
 
-    config = mkIf cfg.enable {
+    config =
+      mkIf config.mods.server.nginx.enable {
+      }
+      // mkIf cfg.enable {
+        networking.firewall = {
+          allowedTCPPorts = [port bport];
+          allowedUDPPorts = [port bport];
+        };
+
         # Runtime
         virtualisation.docker = {
           enable = true;
@@ -33,7 +41,7 @@ in
             "seedbox-lite_seedbox_data:/app/data:rw"
           ];
           ports = [
-          "${toString backend-port}:3001/tcp"
+            "${toString bport}:3001/tcp"
           ];
           log-driver = "journald";
           extraOptions = [
@@ -43,6 +51,7 @@ in
           environment = {
             NODE_ENV = "production";
             ACCESS_PASSWORD = "temp_pass";
+            FRONTEND_URL = "http://localhost:${toString port}";
           };
         };
         systemd.services."docker-seedbox-backend" = {
@@ -171,7 +180,7 @@ in
           script = ''
             cd /tmp
             git clone https://github.com/hotheadhacker/seedbox-lite.git && cd seedbox-lite/client || cd seedbox-lite/client
-          podman build -t compose2nix/seedbox-frontend --build-arg VITE_API_BASE_URL=http://localhost:${toString backend-port} .
+            podman build -t compose2nix/seedbox-frontend --build-arg VITE_API_BASE_URL=http://localhost:${toString bport} .
           '';
         };