feat(pages): add proxy protocol

machines/gustave/pages.nix

@@ -5,98 +5,104 @@
   ...
 }:
 {
-  age.secrets."pages-settings-file".file = ../../secrets/pages-settings-file.age;
+  options.services.nginx.virtualHosts = lib.mkOption {
+    type = lib.types.attrsOf (
+      lib.types.submodule {
+        config.extraConfig = ''
+          real_ip_header proxy_protocol;
+          set_real_ip_from 127.0.0.1;
+        '';
+      }
+    );
+  };
 
-  services.codeberg-pages = {
+  config = {
-    enable = true;
+    age.secrets."pages-settings-file".file = ../../secrets/pages-settings-file.age;
-    package = pkgs.unstable.codeberg-pages.overrideAttrs (_: {
+
-      src = pkgs.fetchFromGitea {
+    services.codeberg-pages = {
-        domain = "codeberg.org";
+      enable = true;
-        owner = "Codeberg";
+      package = pkgs.unstable.codeberg-pages.overrideAttrs (_: {
-        repo = "pages-server";
+        src = pkgs.fetchFromGitea {
-        rev = "831ce3d913015e856351dc4d3fc983ada826ef7e";
+          domain = "codeberg.org";
-        hash = "sha256-Ti9sOppHOaUU72A7Bxyfu4phJUed4m/5e9RyjmVino0=";
+          owner = "Codeberg";
+          repo = "pages-server";
+          rev = "831ce3d913015e856351dc4d3fc983ada826ef7e";
+          hash = "sha256-Ti9sOppHOaUU72A7Bxyfu4phJUed4m/5e9RyjmVino0=";
+        };
+        patches = [ ./proxy-protocol.patch ];
+        vendorHash = "sha256-NHrohvZL7ie29xWpY3bO1BVWrqUywwaKAucZAwvEWto=";
+      });
+
+      settings = {
+        ACME_ACCEPT_TERMS = "true";
+        ACME_EMAIL = "julien@malka.sh";
+        DNS_PROVIDER = "gandiv5";
+        ENABLE_HTTP_SERVER = "false";
+        GITEA_ROOT = "https://git.luj.fr";
+        PORT = "8010";
+        PAGES_DOMAIN = "luj-static.page";
+        RAW_DOMAIN = "raw.luj-static.page";
+        PAGES_BRANCHES = "pages,main,master";
+        LOG_LEVEL = "trace";
+        USE_PROXY_PROTOCOL = "true";
       };
-      patches = [ ./update-lego.patch ];
-      vendorHash = "sha256-MWT51u4rjZB/QcJn91CxpCP+/N+O6gbVWAk+PEQlcUA=";
-    });
 
-    settings = {
+      settingsFile = config.age.secrets."pages-settings-file".path;
-      ACME_ACCEPT_TERMS = "true";
-      ACME_EMAIL = "julien@malka.sh";
-      DNS_PROVIDER = "gandiv5";
-      ENABLE_HTTP_SERVER = "false";
-      GITEA_ROOT = "https://git.luj.fr";
-      PORT = "8010";
-      PAGES_DOMAIN = "luj-static.page";
-      RAW_DOMAIN = "raw.luj-static.page";
-      PAGES_BRANCHES = "pages,main,master";
-      USE_PROXY_PROTOCOL = "true";
     };
 
-    settingsFile = config.age.secrets."pages-settings-file".path;
+    networking.firewall.allowedTCPPorts = [
-  };
+      80
+      443
+      8447
+    ];
 
-  networking.firewall.allowedTCPPorts = [
+    services.nginx.defaultListen = [
-    80
+      {
-    443
+        addr = "127.0.0.1";
-  ];
+        port = 8446;
-
+        ssl = true;
-  services.nginx.defaultListen = [
+        proxyProtocol = true;
-    {
-      addr = "127.0.0.1";
-      proxyProtocol = true;
-      ssl = true;
-    }
-    { addr = "127.0.0.2"; }
-    {
-      addr = "127.0.0.3";
-      ssl = false;
-    }
-    {
-      addr = "127.0.0.4";
-      ssl = false;
-      proxyProtocol = true;
-    }
-  ];
-
-  security.acme.acceptTerms = true;
-  security.acme.defaults.email = "julien@malka.sh";
-  luj.nginx.enable = lib.mkForce false;
-  services.nginx = {
-    enable = true;
-    appendHttpConfig = ''
-      set_real_ip_from 127.0.0.1;
-      real_ip_header proxy_protocol;
-    '';
-    recommendedGzipSettings = true;
-    recommendedOptimisation = true;
-    recommendedProxySettings = true;
-    recommendedTlsSettings = true;
-    streamConfig = ''
-      map $ssl_preread_server_name $sni_upstream {
-        hostnames;
-        default 127.0.0.1:8010;
-      ${lib.concatMapStringsSep "\n" (vhost: "  ${vhost} 127.0.0.1:8447;") (
-        lib.attrNames config.services.nginx.virtualHosts
-      )}
       }
-
+      {
-      server {
+        addr = "0.0.0.0";
-        listen 127.0.0.1:8447;
+        ssl = false;
-        proxy_pass 127.0.0.1:8446;
-        proxy_protocol on;
       }
+    ];
 
-      server {
+    security.acme.acceptTerms = true;
-        listen [::]:443;
+    security.acme.defaults.email = "julien@malka.sh";
-        ssl_preread on;
+    luj.nginx.enable = lib.mkForce false;
-        proxy_pass $sni_upstream;
+    services.nginx = {
-      }
+      enable = true;
+      recommendedGzipSettings = true;
+      recommendedOptimisation = true;
+      recommendedProxySettings = true;
+      recommendedTlsSettings = true;
+      streamConfig = ''
+        map $ssl_preread_server_name $sni_upstream {
+          hostnames;
+          default 0.0.0.0:8010;
+        ${lib.concatMapStringsSep "\n" (vhost: "  ${vhost} 0.0.0.0:8446;") (
+          lib.attrNames config.services.nginx.virtualHosts
+        )}
+        }
 
-    '';
+        server {
+          listen [::]:443;
+          ssl_preread on;
+          proxy_pass $sni_upstream;
+          proxy_protocol on;
+        }
 
-    defaultSSLListenPort = 8446;
+        server {
+          listen [::]:8447;
+          proxy_pass 0.0.0.0:8010;
+        }
 
+      '';
+
+      defaultSSLListenPort = 8446;
+
+    };
   };
 }