DGNum/infrastructure
13
6
Fork 3
Code Issues 20 Pull requests 8 Projects 1 Releases Packages Wiki Activity Actions

feat(nginx): Add default real_ip decoding for all vhosts
All checks were successful
build configuration / build_and_cache_geo01 (pull_request) Successful in 1m6s
Details
build configuration / build_and_cache_geo02 (pull_request) Successful in 1m5s
Details
build configuration / build_and_cache_storage01 (pull_request) Successful in 1m25s
Details
build configuration / build_and_cache_rescue01 (pull_request) Successful in 1m8s
Details
build configuration / build_and_cache_compute01 (pull_request) Successful in 1m43s
Details
build configuration / build_and_cache_krz01 (pull_request) Successful in 2m7s
Details
lint / check (pull_request) Successful in 24s
Details
build configuration / build_and_cache_bridge01 (pull_request) Successful in 1m7s
Details
build configuration / build_and_cache_web02 (pull_request) Successful in 1m14s
Details
build configuration / build_and_cache_vault01 (pull_request) Successful in 1m25s
Details
build configuration / build_and_cache_web01 (pull_request) Successful in 1m51s
Details
Check meta / check_meta (pull_request) Successful in 19s
Details
Check meta / check_dns (pull_request) Successful in 19s
Details
lint / check (push) Successful in 23s
Details

Browse source
This commit is contained in:
Tom Hubrecht 2024-10-12 12:30:52 +02:00
parent e4cc002f6f
commit 40b8b8eabc
Signed by: thubrecht
SSH key fingerprint: SHA256:r+nK/SIcWlJ0zFZJGHtlAoRwq1Rm+WcKAm5ADYMoQPc
1 changed files with 73 additions and 63 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

136
machines/compute01/pages.nix
View file

@ -36,70 +36,80 @@ let
in
{
options.services.nginx.virtualHosts = lib.mkOption {
type = lib.types.attrsOf (
lib.types.submodule {
config.extraConfig = ''
real_ip_header proxy_protocol;
set_real_ip_from 127.0.0.1;
'';
}
);
};
systemd.services.codeberg-pages = {
inherit environment;
description = "Codeberg pages server";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
StateDirectory = "codeberg-pages";
EnvironmentFile = config.age.secrets."pages-environment_file".path;
WorkingDirectory = "/var/lib/codeberg-pages";
DynamicUser = true;
ExecStart = lib.getExe package;
Restart = "on-failure";
ProtectHome = true;
ProtectSystem = "strict";
PrivateTmp = true;
PrivateDevices = true;
ProtectHostname = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
NoNewPrivileges = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
RemoveIPC = true;
PrivateMounts = true;
config = {
systemd.services.codeberg-pages = {
inherit environment;
description = "Codeberg pages server";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
serviceConfig = {
Type = "simple";
StateDirectory = "codeberg-pages";
EnvironmentFile = config.age.secrets."pages-environment_file".path;
WorkingDirectory = "/var/lib/codeberg-pages";
DynamicUser = true;
ExecStart = lib.getExe package;
Restart = "on-failure";
ProtectHome = true;
ProtectSystem = "strict";
PrivateTmp = true;
PrivateDevices = true;
ProtectHostname = true;
ProtectClock = true;
ProtectKernelTunables = true;
ProtectKernelModules = true;
ProtectKernelLogs = true;
ProtectControlGroups = true;
NoNewPrivileges = true;
RestrictRealtime = true;
RestrictSUIDSGID = true;
RemoveIPC = true;
PrivateMounts = true;
};
};
services.nginx = {
defaultListen = [
{
addr = "127.0.0.1";
port = 8446;
ssl = true;
proxyProtocol = true;
}
{
addr = "0.0.0.0";
ssl = false;
}
];
streamConfig = ''
map $ssl_preread_server_name $sni_upstream {
default 127.0.0.1:8010;
${
lib.concatMapStringsSep "\n " (vhost: "${vhost} 127.0.0.1:8446;") (
lib.attrNames config.services.nginx.virtualHosts
)
}
}
server {
listen 443;
ssl_preread on;
proxy_pass $sni_upstream;
proxy_protocol on;
}
'';
};
};
services.nginx = {
defaultListen = [
{
addr = "127.0.0.1";
port = 8446;
ssl = true;
proxyProtocol = true;
}
{
addr = "0.0.0.0";
ssl = false;
}
];
streamConfig = ''
map $ssl_preread_server_name $sni_upstream {
default 127.0.0.1:8010;
${
lib.concatMapStringsSep "\n " (vhost: "${vhost} 127.0.0.1:8446;") (
lib.attrNames config.services.nginx.virtualHosts
)
}
}
server {
listen 443;
ssl_preread on;
proxy_pass $sni_upstream;
proxy_protocol on;
}
'';
defaultSSLListenPort = 8446;
};
}