ltadeu6/Nixos-Config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

NixOracle: add nginx + ACME for jupyter.tadix.dev

Browse source 
Expose JupyterLab via HTTPS with Let's Encrypt. Jupyter now listens
only on localhost; nginx handles TLS termination and WebSocket proxying.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
ltadeu6 2026-05-24 14:31:23 -03:00
parent f449606038
commit 6365aede39
No known key found for this signature in database
GPG key ID: FB9FDAB6B6F3418D
1 changed files with 25 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

27
hosts/NixOracle/configuration.nix
View file

@ -58,7 +58,7 @@ in {
];
environment.etc."jupyter/jupyter_server_config.py".text = ''
c.ServerApp.ip = "0.0.0.0"
c.ServerApp.ip = "127.0.0.1"
c.ServerApp.port = 8888
c.ServerApp.open_browser = False
c.ServerApp.allow_remote_access = True
@ -67,7 +67,30 @@ in {
c.PasswordIdentityProvider.password_required = True
'';
networking.firewall.allowedTCPPorts = [ 8888 ];
networking.firewall.allowedTCPPorts = [ 80 443 ];
security.acme = {
acceptTerms = true;
defaults.email = "ltadeu6@gmail.com";
};
services.nginx = {
enable = true;
virtualHosts."jupyter.tadix.dev" = {
enableACME = true;
forceSSL = true;
locations."/" = {
proxyPass = "http://127.0.0.1:8888";
proxyWebsockets = true;
extraConfig = ''
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_read_timeout 300s;
'';
};
};
};
systemd.services.jupyter-lab = {
description = "Single-user JupyterLab";