diff options
Diffstat (limited to 'hosts/cloud')
| -rw-r--r-- | hosts/cloud/networking.nix | 2 | ||||
| -rw-r--r-- | hosts/cloud/proxy/default.nix | 4 | ||||
| -rw-r--r-- | hosts/cloud/proxy/git.nix | 68 |
3 files changed, 72 insertions, 2 deletions
diff --git a/hosts/cloud/networking.nix b/hosts/cloud/networking.nix index 71af8e1..3c5c08d 100644 --- a/hosts/cloud/networking.nix +++ b/hosts/cloud/networking.nix @@ -19,7 +19,9 @@ networkConfig = { Address = [ "188.245.196.27/32" + "116.202.5.66/32" "2a01:4f8:c17:7f8a::1/64" + "2a01:4f8:c17:7f8a::617/64" ]; DNS = [ "2a01:4ff:ff00::add:1" diff --git a/hosts/cloud/proxy/default.nix b/hosts/cloud/proxy/default.nix index 42430b1..d092b02 100644 --- a/hosts/cloud/proxy/default.nix +++ b/hosts/cloud/proxy/default.nix @@ -6,6 +6,7 @@ in imports = [ ./auth.nix ./dav.nix + ./git.nix ./immich.nix ./news.nix ]; @@ -51,8 +52,7 @@ in # Prevent injection of code in other mime types (XSS Attacks) add_header X-Content-Type-Options nosniff; ''; - # default vhost - + virtualHosts."oxapentane.com" = { forceSSL = true; enableACME = true; diff --git a/hosts/cloud/proxy/git.nix b/hosts/cloud/proxy/git.nix new file mode 100644 index 0000000..ac53f4c --- /dev/null +++ b/hosts/cloud/proxy/git.nix @@ -0,0 +1,68 @@ +{ ... }: +{ + # ssh config for forgejo + # need ip forward for nat + boot.kernel.sysctl = { + "net.ipv4.ip_forward" = 1; + }; + + networking.firewall = { + # open port explicitly + allowedTCPPorts = [ 22 ]; + # git.oxapentane.com: port forward 22 to forgejo + # TODO do a proper thing with ipv6 + extraCommands = '' + iptables -t nat -I PREROUTING -p tcp --dport 22 -d 116.202.5.66 -j DNAT --to-destination 10.89.88.15:2222 + iptables ! -o lo -t nat -A POSTROUTING -j MASQUERADE + ''; + extraStopCommands = '' + iptables -t nat -D PREROUTING -p tcp --dport 22 -d 116.202.5.66 -j DNAT --to-destination 10.89.88.15:2222 || true + ''; + }; + # host sshd: only listen on oxapentane.com and mgmt vpn + services.openssh.listenAddresses = + map + (a: { + addr = a; + port = 22; + }) + [ + # enp1s0 + "188.245.196.27" + "2a01:4f8:c17:7f8a::1" + # wg-0xa-mgmt + "10.89.87.1" + "fd31:185d:722e::1" + ]; + + services.nginx.upstreams.forgejo = { + servers = { + "10.89.88.15:3000" = { }; + "[fd31:185d:722f::15]:3000" = { }; + }; + }; + + services.nginx.virtualHosts."git.oxapentane.com" = { + enableACME = true; + forceSSL = true; + locations."/" = { + proxyPass = "http://forgejo"; + extraConfig = '' + client_max_body_size 50000M; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + + proxy_http_version 1.1; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + + proxy_read_timeout 600s; + proxy_send_timeout 600s; + send_timeout 600s; + ''; + }; + }; +} |