fix

hosts/abacus/nginx.nix

@@ -1,7 +1,4 @@
-{
-  config,
-  ...
-}: {
+{config, ...}: {
   services.nginx = {
     enable = true;
 
@@ -15,29 +12,11 @@
       access_log /var/log/nginx/access.log;
     '';
 
-    virtualHosts = let
-      inherit (config.networking) domain;
-    in {
-      "~.*" = {
-        default = true;
-        addSSL = false;
+    virtualHosts."~.*" = {
+      default = true;
+      rejectSSL = true;
 
-        globalRedirect = domain;
-      };
-
-      ${domain} = {
-        enableACME = true;
-        forceSSL = true;
-
-        root = "/var/www/${domain}";
-      };
-
-      "log.${domain}" = {
-        enableACME = true;
-        forceSSL = true;
-
-        root = "/var/www/log.${domain}";
-      };
+      globalRedirect = config.networking.domain;
     };
   };
 }

hosts/abacus/static/default.nix

@@ -0,0 +1,12 @@
+{
+  imports = [
+    ./log.nix
+    ./main.nix
+  ];
+
+  systemd.tmpfiles.settings."10-static-sites"."/var/www".d = {
+    user = "root";
+    group = "root";
+    mode = "0755";
+  };
+}

hosts/abacus/static/log.nix

@@ -0,0 +1,18 @@
+{config, ...}: let
+  inherit (config.networking) domain;
+  virtualHostName = "log.${domain}";
+  root = "/var/www/${virtualHostName}";
+in {
+  services.nginx.virtualHosts.${virtualHostName} = {
+    enableACME = true;
+    forceSSL = true;
+
+    inherit root;
+  };
+
+  systemd.tmpfiles.settings."10-static-sites".${root}.d = {
+    user = "lukas";
+    group = "lukas";
+    mode = "0755";
+  };
+}

hosts/abacus/static/main.nix

@@ -0,0 +1,18 @@
+{config, ...}: let
+  inherit (config.networking) domain;
+  virtualHostName = domain;
+  root = "/var/www/${virtualHostName}";
+in {
+  services.nginx.virtualHosts.${virtualHostName} = {
+    enableACME = true;
+    forceSSL = true;
+
+    inherit root;
+  };
+
+  systemd.tmpfiles.settings."10-static-sites".${root}.d = {
+    user = "lukas";
+    group = "lukas";
+    mode = "0755";
+  };
+}