From df5aba5fa5563a98f035ea5ca2b2e7afeb16a3a0 Mon Sep 17 00:00:00 2001
From: inexcode <inex.code@selfprivacy.org>
Date: Tue, 15 Feb 2022 15:48:42 +0300
Subject: [PATCH] Revert "Merge pull request 'Fixed Jitsi functionality and
 Jitsi certificate resolution' (#14) from jitsi-fixes into master"

This reverts commit dc767677d85133dae069e8c8e8f063d2549fb29e, reversing
changes made to d4bb3816934356051c3a83909c268ee438d18029.
---
 configuration.nix    |  4 ++--
 letsencrypt/acme.nix |  6 ------
 videomeet/jitsi.nix  |  2 +-
 webserver/nginx.nix  | 43 +++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 46 insertions(+), 9 deletions(-)

diff --git a/configuration.nix b/configuration.nix
index 5062c44..1281ac4 100644
--- a/configuration.nix
+++ b/configuration.nix
@@ -35,8 +35,8 @@ in
   networking = {
     hostName = config.services.userdata.hostname;
     firewall = {
-      allowedTCPPorts = lib.mkForce [ 22 25 80 143 443 465 587 993 4443 8443 ];
-      allowedUDPPorts = lib.mkForce [ 8443 10000 ];
+      allowedTCPPorts = lib.mkForce [ 22 25 80 143 443 465 587 993 8443 ];
+      allowedUDPPorts = lib.mkForce [ 8443 ];
     };
     nameservers = [ "1.1.1.1" "1.0.0.1" ];
   };
diff --git a/letsencrypt/acme.nix b/letsencrypt/acme.nix
index ea2467e..2e9c99b 100644
--- a/letsencrypt/acme.nix
+++ b/letsencrypt/acme.nix
@@ -17,12 +17,6 @@ in
         dnsProvider = "cloudflare";
         credentialsFile = "/var/lib/cloudflare/Credentials.ini";
       };
-      "meet.${cfg.domain}" = {
-        domain = "meet.${cfg.domain}";
-        group = "acmerecievers";
-        dnsProvider = "cloudflare";
-        credentialsFile = "/var/lib/cloudflare/Credentials.ini";
-      };
     };
   };
 }
diff --git a/videomeet/jitsi.nix b/videomeet/jitsi.nix
index c3fbd3d..27ed438 100644
--- a/videomeet/jitsi.nix
+++ b/videomeet/jitsi.nix
@@ -6,7 +6,7 @@ in
   services.jitsi-meet = {
     enable = config.services.userdata.jitsi.enable;
     hostName = "meet.${domain}";
-    nginx.enable = true;
+    nginx.enable = false;
     interfaceConfig = {
       SHOW_JITSI_WATERMARK = false;
       SHOW_WATERMARK_FOR_GUESTS = false;
diff --git a/webserver/nginx.nix b/webserver/nginx.nix
index cdd6936..4536c5f 100644
--- a/webserver/nginx.nix
+++ b/webserver/nginx.nix
@@ -89,6 +89,49 @@ in
           };
         };
       };
+      "meet.${domain}" = {
+        forceSSL = true;
+        sslCertificate = "/var/lib/acme/${domain}/fullchain.pem";
+        sslCertificateKey = "/var/lib/acme/${domain}/key.pem";
+        root = pkgs.jitsi-meet;
+        extraConfig = ''
+          ssi on;
+          add_header Strict-Transport-Security $hsts_header;
+          #add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always;
+          add_header 'Referrer-Policy' 'origin-when-cross-origin';
+          add_header X-Frame-Options DENY;
+          add_header X-Content-Type-Options nosniff;
+          add_header X-XSS-Protection "1; mode=block";
+          proxy_cookie_path / "/; secure; HttpOnly; SameSite=strict";
+          expires 10m;
+        '';
+        locations = {
+          "@root_path" = {
+            extraConfig = ''
+              rewrite ^/(.*)$ / break;
+            '';
+          };
+          "~ ^/([^/\\?&:'\"]+)$" = {
+            tryFiles = "$uri @root_path";
+          };
+          "=/http-bind" = {
+            proxyPass = "http://localhost:5280/http-bind";
+            extraConfig = ''
+              proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+              proxy_set_header Host $host;
+            '';
+          };
+          "=/external_api.js" = {
+            alias = "${pkgs.jitsi-meet}/libs/external_api.min.js";
+          };
+          "=/config.js" = {
+            alias = "${pkgs.jitsi-meet}/config.js";
+          };
+          "=/interface_config.js" = {
+            alias = "${pkgs.jitsi-meet}/interface_config.js";
+          };
+        };
+      };
       "password.${domain}" = {
         sslCertificate = "/var/lib/acme/${domain}/fullchain.pem";
         sslCertificateKey = "/var/lib/acme/${domain}/key.pem";