Enable SSL for nginx port forward

hosts/web-2/configuration.nix

@@ -8,6 +8,7 @@
       ./bubblesort.nix
       ./ip.nix
       ./meow.nix
+      ./znc.nix
     ];
 
   boot.loader.grub.enable = true;

hosts/web-2/znc.nix

@@ -0,0 +1,29 @@
+{ ... }:
+
+{
+  services.znc = {
+    enable = true;
+    mutable = true;
+    dataDir = "/var/lib/znc";
+    configFile = "/var/lib/znc/configs/znc.conf";
+  };
+
+  services.nginx.virtualHosts = {
+    "znc.clerie.de" = {
+      enableACME = true;
+      forceSSL = true;
+      locations."/" = {
+        proxyPass = "http://127.0.0.1:1313";
+      };
+    };
+  };
+
+  clerie.nginx-port-forward = {
+    enable = true;
+    tcpPorts."6697" = {
+      host = "127.0.0.1";
+      port = 1311;
+      certName = "znc.clerie.de";
+    };
+  };
+}

modules/nginx-port-forward/default.nix

@@ -4,11 +4,20 @@ with lib;
 
 let
   cfg = config.clerie.nginx-port-forward;
+  certs = config.security.acme.certs;
+  sslDhparam = config.services.nginx.sslDhparam;
 
   mkServerBlock = isUDP: port: forward: ''
     server {
-      listen ${port}${optionalString isUDP " udp"};
+      listen ${port}${optionalString isUDP " udp"}${optionalString (forward.certName != null) " ssl"};
-      listen [::]:${port}${optionalString isUDP " udp"};
+      listen [::]:${port}${optionalString isUDP " udp"}${optionalString (forward.certName != null) " ssl"};
+
+      ${ optionalString (forward.certName != null) ''
+        ssl_certificate ${certs.${forward.certName}.directory}/fullchain.pem;
+        ssl_certificate_key ${certs.${forward.certName}.directory}/key.pem;
+        ${ optionalString (sslDhparam != null) "ssl_dhparam ${sslDhparam};" }
+      '' }
+
       proxy_pass ${forward.host}:${toString forward.port};
     }
   '';
@@ -28,6 +37,10 @@ let
       port = mkOption {
         type = types.int;
       };
+      certName = mkOption {
+        type = with types; nullOr str;
+        default = null;
+      };
     };
   };