machine/catacomb/default.nix

@@ -4,6 +4,7 @@
   imports = [
     ./hardware-configuration.nix
     ./fileserver.nix
+    ./mirror.nix
   ];
 
   beatific.hostName = "catacomb";

machine/catacomb/mirror.nix

@@ -0,0 +1,22 @@
+{ ... }:
+
+{
+  # Configure nginx to serve /nas/doc/website/mirror/
+  services.nginx = {
+    enable = true;
+    virtualHosts."mirror.catacomb.home" = {
+      listen = [
+        { addr = "10.22.20.2"; }
+        # Binding to 10.22.20.2:80 here confuses the empyrean revproxy, even when the revproxy
+        # is configured with the same hostname, and it serves from fileserver.nix instead.
+        # This nonstandard port supports the revproxy use case.
+        { addr = "10.22.20.2"; port = 7474; }
+      ];
+      root = "/nas/doc/website/mirror";
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 7474 ];
+
+  users.users.nginx.extraGroups = ["nas"];
+}

machine/empyrean/default.nix

@@ -78,7 +78,7 @@
         extraConfig = ''
           access_log /var/log/nginx/access_mirror.alogoulogoi.com.log;
         '';
-        locations."/".proxyPass = "http://mirror.backyard.home:7474/";
+        locations."/".proxyPass = "http://mirror.catacomb.home:7474/";
       };
       # Deny all other subdomains
       "alogoulogoi.com" = {