katja's git: nixfiles

configurations/nixos/configure/smarthome/mqtt-webui: don't require auth for webmanifest and favicon

diff --git a/configurations/nixos/configure/smarthome/mqtt-webui/default.nix b/configurations/nixos/configure/smarthome/mqtt-webui/default.nix
@@ -13,9 +13,10 @@
       extraConfig = ''
         ssl_crl /etc/ctucxCA.crl;
         ssl_client_certificate ${../../../../../secrets/certs/rootCA.crt};
-        ssl_verify_client on;
+        ssl_verify_client optional;
       '';
 
+
       locations  = {
         "/" = {
           root  = "${pkgs.buildEnv {

@@ -26,13 +27,25 @@
               (pkgs.writeTextDir "config.json" (builtins.toJSON (import ./config.nix)))
             ];
           }}/";
+          extraConfig = ''
+            location ~ ^/(?!(favicon-512x512\.png|manifest\.json)) {
+              if ($ssl_client_verify != SUCCESS) {
+                  return 403;
+              }
+            }
+          '';
         };
         "/mqtt" = {
           proxyPass       = "http://[::1]:9005";
           proxyWebsockets = true;
+          extraConfig = ''
+            if ($ssl_client_verify != SUCCESS) {
+                return 403;
+            }
+          '';
         };
       };
     };
   };
 
-}-
\ No newline at end of file
+}