diff options
Diffstat (limited to 'hosts/cloud/proxy')
| -rw-r--r-- | hosts/cloud/proxy/auth.nix | 24 | ||||
| -rw-r--r-- | hosts/cloud/proxy/authentik.nix | 31 | ||||
| -rw-r--r-- | hosts/cloud/proxy/default.nix | 27 |
3 files changed, 29 insertions, 53 deletions
diff --git a/hosts/cloud/proxy/auth.nix b/hosts/cloud/proxy/auth.nix new file mode 100644 index 0000000..27ee2ee --- /dev/null +++ b/hosts/cloud/proxy/auth.nix @@ -0,0 +1,24 @@ +{ ... }: +{ + services.nginx.upstreams.keycloak = { + servers = { + "10.89.88.11:38080" = {}; + "[fd31:185d:722f::11]:38080" = {}; + }; + }; + + services.nginx.virtualHosts."auth.oxapentane.com" = { + forceSSL = true; + enableACME = true; + locations."/" = { + proxyPass = "http://keycloak"; + extraConfig = '' + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header Host $host; + proxy_set_header X-Forwarded-Host $host; + proxy_set_header X-Forwarded-Port 433; + ''; + }; + }; +} diff --git a/hosts/cloud/proxy/authentik.nix b/hosts/cloud/proxy/authentik.nix deleted file mode 100644 index c6c9685..0000000 --- a/hosts/cloud/proxy/authentik.nix +++ /dev/null @@ -1,31 +0,0 @@ -# TODO: integrade with oxalab-wg -{ config, ... }: -{ - # authentik - services.nginx.upstreams.authentik = { - extraConfig = '' - keepalive 10; - ''; - servers = - { - "10.89.88.2:9000" = { }; - "[fd31:185d:722f::2]:9000" = { }; - }; - }; - - services.nginx.virtualHosts."sso.oxapentane.com" = { - forceSSL = true; - enableACME = true; - locations."/" = { - proxyWebsockets = true; - proxyPass = "http://authentik"; - extraConfig = '' - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header Host $host; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection $connection_upgrade; - ''; - }; - }; - } diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix index 046c807..798b34d 100644 --- a/hosts/cloud/proxy/default.nix +++ b/hosts/cloud/proxy/default.nix @@ -1,7 +1,7 @@ { config, ... }: { imports = [ - ./authentik.nix + ./auth.nix ]; networking.firewall.allowedTCPPorts = [ 80 443 ]; @@ -12,24 +12,11 @@ recommendedGzipSettings = true; recommendedOptimisation = true; recommendedTlsSettings = true; + recommendedProxySettings = true; sslCiphers = "AES256+EECDH:AES256+EDH:!aNULL"; appendHttpConfig = '' - ### recommendedProxySettings minus proxy_redirect (breaks authentik) - # proxy_redirect off; - proxy_connect_timeout 60s; - proxy_send_timeout 60s; - proxy_read_timeout 60s; - proxy_http_version 1.1; - proxy_set_header "Connection" ""; - proxy_set_header Host $host; - proxy_set_header X-Real-IP $remote_addr; - proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; - proxy_set_header X-Forwarded-Proto $scheme; - proxy_set_header X-Forwarded-Host $host; - proxy_set_header X-Forwarded-Server $host; - ### TLS # Add HSTS header with preloading to HTTPS requests. # Adding this header to HTTP requests is discouraged @@ -39,13 +26,13 @@ add_header Strict-Transport-Security $hsts_header; # Enable CSP for your services. - add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always; + # add_header Content-Security-Policy "script-src 'self'; object-src 'none'; base-uri 'none';" always; # Minimize information leaked to other domains add_header 'Referrer-Policy' 'origin-when-cross-origin'; # Disable embedding as a frame - add_header X-Frame-Options DENY; + # add_header X-Frame-Options DENY; # Prevent injection of code in other mime types (XSS Attacks) add_header X-Content-Type-Options nosniff; @@ -56,11 +43,7 @@ enableACME = true; # default = true; locations."/" = { - return = "200 '<html><body><h1>¯\\_(ツ)_/¯</h1></body></html>'"; - extraConfig = '' - default_type text/html; - ''; - + return = "503"; }; }; }; |