sombrero: Add nginx module

hosts/sombrero/configuration.nix

@@ -73,24 +73,12 @@
 
     firewall = {
       allowedTCPPorts = [
-        80
-        443
         1122  # ssh
       ];
     };
   };
 
-  security.acme.acceptTerms = true;
-  security.acme.defaults.email = "alex@a2x.se";
-
   services = {
-    nginx = {
-      enable = true;
-
-      recommendedProxySettings = true;
-      recommendedTlsSettings = true;
-    };
-
     openssh = {
       enable = true;
       ports = [ 1122 ];
@@ -183,6 +171,7 @@
 
   mod = {
     docker.enable = true;
+    nginx.enable = true;
     syncthing.enable = true;
     plex.enable = true;
     calibre-web.enable = true;

hosts/sombrero/modules/calibre-web/default.nix

@@ -1,6 +1,7 @@
 { lib, config, ... }:
 let
   enabled = config.mod.calibre-web.enable;
+  nginxEnabled = config.mod.nginx.enable;
 in
 {
   options = {
@@ -9,7 +10,7 @@ in
     };
   };
 
-  config = lib.mkIf enabled {
+  config = lib.mkIf (enabled && nginxEnabled) {
     services = {
       calibre-web = {
         enable = true;

hosts/sombrero/modules/nginx/default.nix

@@ -0,0 +1,38 @@
+{ lib, config, ... }:
+let
+  enabled = config.mod.nginx.enable;
+in
+{
+  options = {
+    mod.nginx = {
+      enable = lib.mkEnableOption "add nginx module";
+    };
+  };
+
+  config = lib.mkIf enabled {
+    security = {
+      acme = {
+        acceptTerms = true;
+
+        defaults = {
+          email = "alex@a2x.se";
+        };
+      };
+    };
+
+    services = {
+      nginx = {
+        enable = true;
+
+        recommendedProxySettings = true;
+        recommendedTlsSettings = true;
+      };
+    };
+
+    networking = {
+      firewall = {
+        allowedTCPPorts = [ 80 443 ];
+      };
+    };
+  };
+}

hosts/sombrero/modules/syncthing/default.nix

@@ -1,6 +1,7 @@
 { lib, config, ... }:
 let
   enabled = config.mod.syncthing.enable;
+  nginxEnabled = config.mod.nginx.enable;
 in
 {
   options = {
@@ -9,7 +10,7 @@ in
     };
   };
 
-  config = lib.mkIf enabled {
+  config = lib.mkIf (enabled && nginxEnabled) {
     networking = {
       firewall = {
         allowedTCPPorts = [ 8384 ];