nix-config/hosts/buzzrelay/default.nix

{ ... }:
{
  deployment = {
    mem = 2 * 1024;
    vcpu = 8;
    needForSpeed = true;
  };
  system.stateVersion = "22.11";
  networking = {
    hostName = "buzzrelay";
    firewall.allowedTCPPorts = [ 80 443 ];
  };

  services.nginx = {
    enable = true;
    virtualHosts."relay.fedi.buzz" = {
      forceSSL = true;
      enableACME = true;
      locations."/".proxyPass = "http://127.0.0.1:${toString 3000}/";
    };
  };
  services.postgresql = {
    enable = true;
    ensureDatabases = [ "buzzrelay" ];
    ensureUsers = [ {
      name = "relay";
      ensurePermissions = {
        "DATABASE buzzrelay" = "ALL PRIVILEGES";
      };
    } ];
  };
}