feat(pages): add proxy protocol

machines/gustave/pages.nix

@@ -5,6 +5,18 @@
   ...
 }:
 {
+  options.services.nginx.virtualHosts = lib.mkOption {
+    type = lib.types.attrsOf (
+      lib.types.submodule {
+        config.extraConfig = ''
+          real_ip_header proxy_protocol;
+          set_real_ip_from 127.0.0.1;
+        '';
+      }
+    );
+  };
+
+  config = {
     age.secrets."pages-settings-file".file = ../../secrets/pages-settings-file.age;
 
     services.codeberg-pages = {
@@ -17,8 +29,8 @@
           rev = "831ce3d913015e856351dc4d3fc983ada826ef7e";
           hash = "sha256-Ti9sOppHOaUU72A7Bxyfu4phJUed4m/5e9RyjmVino0=";
         };
-      patches = [ ./update-lego.patch ];
-      vendorHash = "sha256-MWT51u4rjZB/QcJn91CxpCP+/N+O6gbVWAk+PEQlcUA=";
+        patches = [ ./proxy-protocol.patch ];
+        vendorHash = "sha256-NHrohvZL7ie29xWpY3bO1BVWrqUywwaKAucZAwvEWto=";
       });
 
       settings = {
@@ -31,6 +43,7 @@
         PAGES_DOMAIN = "luj-static.page";
         RAW_DOMAIN = "raw.luj-static.page";
         PAGES_BRANCHES = "pages,main,master";
+        LOG_LEVEL = "trace";
         USE_PROXY_PROTOCOL = "true";
       };
 
@@ -40,24 +53,20 @@
     networking.firewall.allowedTCPPorts = [
       80
       443
+      8447
     ];
 
     services.nginx.defaultListen = [
       {
         addr = "127.0.0.1";
-      proxyProtocol = true;
+        port = 8446;
         ssl = true;
-    }
-    { addr = "127.0.0.2"; }
-    {
-      addr = "127.0.0.3";
-      ssl = false;
-    }
-    {
-      addr = "127.0.0.4";
-      ssl = false;
         proxyProtocol = true;
       }
+      {
+        addr = "0.0.0.0";
+        ssl = false;
+      }
     ];
 
     security.acme.acceptTerms = true;
@@ -65,10 +74,6 @@
     luj.nginx.enable = lib.mkForce false;
     services.nginx = {
       enable = true;
-    appendHttpConfig = ''
-      set_real_ip_from 127.0.0.1;
-      real_ip_header proxy_protocol;
-    '';
       recommendedGzipSettings = true;
       recommendedOptimisation = true;
       recommendedProxySettings = true;
@@ -76,22 +81,22 @@
       streamConfig = ''
         map $ssl_preread_server_name $sni_upstream {
           hostnames;
-        default 127.0.0.1:8010;
-      ${lib.concatMapStringsSep "\n" (vhost: "  ${vhost} 127.0.0.1:8447;") (
+          default 0.0.0.0:8010;
+        ${lib.concatMapStringsSep "\n" (vhost: "  ${vhost} 0.0.0.0:8446;") (
           lib.attrNames config.services.nginx.virtualHosts
         )}
         }
 
-      server {
-        listen 127.0.0.1:8447;
-        proxy_pass 127.0.0.1:8446;
-        proxy_protocol on;
-      }
-
         server {
           listen [::]:443;
           ssl_preread on;
           proxy_pass $sni_upstream;
+          proxy_protocol on;
+        }
+
+        server {
+          listen [::]:8447;
+          proxy_pass 0.0.0.0:8010;
         }
 
       '';
@@ -99,4 +104,5 @@
       defaultSSLListenPort = 8446;
 
     };
+  };
 }