blob: dbeab9a434e08fc2d27b8099472066f29e2c423a (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
|
{ inputs, ... }:
let
website = inputs.website.packages."x86_64-linux".default;
in
{
imports = [
./git.nix
];
networking.firewall.allowedTCPPorts = [
80
443
];
services.caddy = {
enable = true;
virtualHosts."oxapentane.com" = {
serverAliases = [ "www.oxapentane.com" ];
extraConfig = ''
# conduit
@matrix {
path /.well-known/matrix/*
path /_matrix/*
}
route {
header /.well-known/matrix/* Access-Control-Allow-Origin *
reverse_proxy @matrix 10.89.88.16:6167
# file server
file_server {
root ${website}
index index.html
}
}
'';
};
virtualHosts."auth.oxapentane.com".extraConfig = ''
reverse_proxy 10.89.88.11:9000 [fd31:185d:722f::11]:9000
'';
virtualHosts."dav.oxapentane.com".extraConfig = ''
route {
reverse_proxy /outpost.goauthentik.io/* 10.89.88.11:9000 [fd31:185d:722f::11]:9000
forward_auth 10.89.88.11:9000 {
uri /outpost.goauthentik.io/auth/caddy
copy_headers X-Authentik-Username X-Authentik-Groups X-Authentik-Entitlements X-Authentik-Email X-Authentik-Name X-Authentik-Uid X-Authentik-Jwt X-Authentik-Meta-Jwks X-Authentik-Meta-Outpost X-Authentik-Meta-Provider X-Authentik-Meta-App X-Authentik-Meta-Version X-Authentik-Username>X-Remote-User
trusted_proxies 10.89.88.11 fd31:185d:722f::11
}
}
reverse_proxy 10.89.88.12:5232 [fd31:185d:722f::12]:5232
'';
virtualHosts."immich.oxapentane.com".extraConfig = ''
reverse_proxy 10.89.88.13:2283
'';
virtualHosts."news.oxapentane.com".extraConfig = "reverse_proxy http://10.89.88.14:8080";
virtualHosts."music.oxapentane.com".extraConfig = ''
route {
reverse_proxy /outpost.goauthentik.io/* 10.89.88.11:9000 [fd31:185d:722f::11]:9000
@protected not path /share/* /rest/*
forward_auth @protected 10.89.88.11:9000 {
uri /outpost.goauthentik.io/auth/caddy
copy_headers X-Authentik-Username>Remote-User
trusted_proxies 10.89.88.11 fd31:185d:722f::11
}
@subsonic path /rest/*
forward_auth @subsonic 10.89.88.11:9000 {
uri /outpost.goauthentik.io/auth/caddy
copy_headers X-Authentik-Username>Remote-User
@error status 1xx 3xx 4xx 5xx
handle_response @error {
respond <<SUBSONICERR
<subsonic-response xmlns="http://subsonic.org/restapi" status="failed" version="1.16.1" type="proxy-auth" serverVersion="n/a" openSubsonic="true">
<error code="40" message="Invalid credentials or unsupported client"></error>
</subsonic-response>
SUBSONICERR 200
}
trusted_proxies 10.89.88.11 fd31:185d:722f::11
}
}
reverse_proxy 10.89.88.17:4533
'';
};
}
|
