Luj/snowfield
1
0
Fork 0
mirror of https://github.com/JulienMalka/snowfield.git synced 2025-03-25 21:30:52 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

feat(pages): add proxy protocol

Browse source
This commit is contained in:
Julien Malka 2024-10-16 22:05:27 +02:00
parent a704658c03
commit 3cb8d27e5e
Signed by: Luj
GPG key ID: 6FC74C847011FD83
2 changed files with 1425 additions and 81 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

168
machines/gustave/pages.nix
View file

@ -5,98 +5,104 @@
...
}:
{
age.secrets."pages-settings-file".file = ../../secrets/pages-settings-file.age;
options.services.nginx.virtualHosts = lib.mkOption {
type = lib.types.attrsOf (
lib.types.submodule {
config.extraConfig = ''
real_ip_header proxy_protocol;
set_real_ip_from 127.0.0.1;
'';
}
);
};
services.codeberg-pages = {
enable = true;
package = pkgs.unstable.codeberg-pages.overrideAttrs (_: {
src = pkgs.fetchFromGitea {
domain = "codeberg.org";
owner = "Codeberg";
repo = "pages-server";
rev = "831ce3d913015e856351dc4d3fc983ada826ef7e";
hash = "sha256-Ti9sOppHOaUU72A7Bxyfu4phJUed4m/5e9RyjmVino0=";
config = {
age.secrets."pages-settings-file".file = ../../secrets/pages-settings-file.age;
services.codeberg-pages = {
enable = true;
package = pkgs.unstable.codeberg-pages.overrideAttrs (_: {
src = pkgs.fetchFromGitea {
domain = "codeberg.org";
owner = "Codeberg";
repo = "pages-server";
rev = "831ce3d913015e856351dc4d3fc983ada826ef7e";
hash = "sha256-Ti9sOppHOaUU72A7Bxyfu4phJUed4m/5e9RyjmVino0=";
};
patches = [ ./proxy-protocol.patch ];
vendorHash = "sha256-NHrohvZL7ie29xWpY3bO1BVWrqUywwaKAucZAwvEWto=";
});
settings = {
ACME_ACCEPT_TERMS = "true";
ACME_EMAIL = "julien@malka.sh";
DNS_PROVIDER = "gandiv5";
ENABLE_HTTP_SERVER = "false";
GITEA_ROOT = "https://git.luj.fr";
PORT = "8010";
PAGES_DOMAIN = "luj-static.page";
RAW_DOMAIN = "raw.luj-static.page";
PAGES_BRANCHES = "pages,main,master";
LOG_LEVEL = "trace";
USE_PROXY_PROTOCOL = "true";
};
patches = [ ./update-lego.patch ];
vendorHash = "sha256-MWT51u4rjZB/QcJn91CxpCP+/N+O6gbVWAk+PEQlcUA=";
});
settings = {
ACME_ACCEPT_TERMS = "true";
ACME_EMAIL = "julien@malka.sh";
DNS_PROVIDER = "gandiv5";
ENABLE_HTTP_SERVER = "false";
GITEA_ROOT = "https://git.luj.fr";
PORT = "8010";
PAGES_DOMAIN = "luj-static.page";
RAW_DOMAIN = "raw.luj-static.page";
PAGES_BRANCHES = "pages,main,master";
USE_PROXY_PROTOCOL = "true";
settingsFile = config.age.secrets."pages-settings-file".path;
};
settingsFile = config.age.secrets."pages-settings-file".path;
};
networking.firewall.allowedTCPPorts = [
80
443
8447
];
networking.firewall.allowedTCPPorts = [
80
443
];
services.nginx.defaultListen = [
{
addr = "127.0.0.1";
proxyProtocol = true;
ssl = true;
}
{ addr = "127.0.0.2"; }
{
addr = "127.0.0.3";
ssl = false;
}
{
addr = "127.0.0.4";
ssl = false;
proxyProtocol = true;
}
];
security.acme.acceptTerms = true;
security.acme.defaults.email = "julien@malka.sh";
luj.nginx.enable = lib.mkForce false;
services.nginx = {
enable = true;
appendHttpConfig = ''
set_real_ip_from 127.0.0.1;
real_ip_header proxy_protocol;
'';
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
streamConfig = ''
map $ssl_preread_server_name $sni_upstream {
hostnames;
default 127.0.0.1:8010;
${lib.concatMapStringsSep "\n" (vhost: " ${vhost} 127.0.0.1:8447;") (
lib.attrNames config.services.nginx.virtualHosts
)}
services.nginx.defaultListen = [
{
addr = "127.0.0.1";
port = 8446;
ssl = true;
proxyProtocol = true;
}
server {
listen 127.0.0.1:8447;
proxy_pass 127.0.0.1:8446;
proxy_protocol on;
{
addr = "0.0.0.0";
ssl = false;
}
];
server {
listen [::]:443;
ssl_preread on;
proxy_pass $sni_upstream;
}
security.acme.acceptTerms = true;
security.acme.defaults.email = "julien@malka.sh";
luj.nginx.enable = lib.mkForce false;
services.nginx = {
enable = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedProxySettings = true;
recommendedTlsSettings = true;
streamConfig = ''
map $ssl_preread_server_name $sni_upstream {
hostnames;
default 0.0.0.0:8010;
${lib.concatMapStringsSep "\n" (vhost: " ${vhost} 0.0.0.0:8446;") (
lib.attrNames config.services.nginx.virtualHosts
)}
}
'';
server {
listen [::]:443;
ssl_preread on;
proxy_pass $sni_upstream;
proxy_protocol on;
}
defaultSSLListenPort = 8446;
server {
listen [::]:8447;
proxy_pass 0.0.0.0:8010;
}
'';
defaultSSLListenPort = 8446;
};
};
}

1338
machines/gustave/proxy-protocol.patch Normal file
View file

File diff suppressed because it is too large Load diff