cluster/services/nginx: init from host-specific modules

cluster/services/nginx/default.nix

@@ -0,0 +1,6 @@
+{
+  services.nginx = {
+    nodes.host = [ "VEGAS" "prophet" ];
+    nixos.host = [ ./nginx.nix ];
+  };
+}

hosts/VEGAS/system.nix

@@ -8,7 +8,6 @@
 
       # Plumbing
       ./modules/database
-      ./modules/nginx
       ./modules/oauth2-proxy
       ./modules/redis
       ./modules/virtualisation

hosts/prophet/modules/nginx/default.nix

@@ -1,38 +0,0 @@
-{ config, tools, ... }:
-
-let
-  inherit (tools.meta) adminEmail;
-in {
-  security.acme.defaults.email = adminEmail;
-  security.acme.acceptTerms = true;
-  services.nginx = {
-    enable = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-    recommendedOptimisation = true;
-    recommendedGzipSettings = true;
-    proxyResolveWhileRunning = false;
-    resolver = {
-      addresses = [ "127.0.0.1" ];
-      valid = "30s";
-    };
-    appendHttpConfig = ''
-      server_names_hash_bucket_size 128;
-      proxy_headers_hash_max_size 4096;
-      proxy_headers_hash_bucket_size 128;
-      log_format fmt_loki 'host=$host remote_addr=$remote_addr remote_user=$remote_user request="$request" status=$status body_bytes_sent=$body_bytes_sent http_referer="$http_referer" http_user_agent="$http_user_agent"';
-      access_log syslog:server=unix:/dev/log,tag=nginx_access,nohostname fmt_loki;
-    '';
-  };
-  services.phpfpm.pools.www = {
-    inherit (config.services.nginx) user group;
-    settings = {
-      pm = "ondemand";
-      "pm.max_children" = 16;
-      "listen.owner" = config.services.nginx.user;
-      "listen.group" = config.services.nginx.group;
-    };
-  };
-  networking.firewall.allowedTCPPorts = [ 80 443 ];
-  systemd.services.nginx.after = [ "network-online.target" ];
-}

hosts/prophet/system.nix

@@ -6,7 +6,6 @@
       # Hardware
       ./hardware-configuration.nix
 
-      ./modules/nginx
       inputs.agenix.nixosModules.age
 
       ./services/cdn-shield