vps-public: Enable screego

hosts/vps-public/default.nix

@@ -41,9 +41,7 @@
         caddy.virtualHosts."dav.${sproutedDomain}" = {
           inherit (config.custom.web-services.radicale) port;
           extraConfig = ''
-            respond /.web/ "Access denied" 403 {
+            respond /.web/ "Access denied" 403 { close }
-            	close
-            }
           '';
         };
       };
@@ -82,6 +80,11 @@
             branding.name = "SproutedBin";
           };
 
+          screego = {
+            enable = true;
+            domain = "mirror.${sproutedDomain}";
+          };
+
           radicale = {
             enable = true;
             domain = "dav.${privateDomain}";

modules/system/web-services/screego.nix

@@ -0,0 +1,31 @@
+{ config, lib, ... }:
+let
+  cfg = config.custom.web-services.screego;
+in
+{
+  options.custom.web-services.screego = {
+    enable = lib.mkEnableOption "";
+    domain = lib.mkOption {
+      type = lib.types.nonEmptyStr;
+      default = "";
+    };
+    port = lib.mkOption {
+      type = lib.types.port;
+      default = 5050;
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    services.screego = {
+      enable = true;
+      openFirewall = true;
+      settings = {
+        SCREEGO_EXTERNAL_IP = config.custom.networking.underlay.address;
+        SCREEGO_SERVER_ADDRESS = "127.0.0.1:${toString cfg.port}";
+        SCREEGO_TURN_ADDRESS = "${config.custom.networking.underlay.address}:3478";
+      };
+    };
+
+    custom.services.caddy.virtualHosts.${cfg.domain}.port = cfg.port;
+  };
+}