c3d2/nix-config
c3d2
/
nix-config
24
7
Fork 3
Code Issues 12 Pull Requests 2 Releases Wiki Activity

Move nginx allow only hq network to lib

This commit is contained in:
Sandro - 2023-05-25 22:17:51 +02:00
parent 66666660e0
commit 3333332a03
Signed by: sandro
GPG Key ID: 3AF5A43A3EECC2E5
3 changed files with 17 additions and 28 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
hosts/matemat/default.nix
View File

@ -1,4 +1,4 @@
{ config, lib, pkgs, ... }:
{ config, lib, libC, pkgs, ... }:
{
c3d2.deployment.server = "server10";
@ -16,19 +16,7 @@
enableACME = true;
locations."/" = {
proxyPass = "http://localhost:3000";
# ip ranges duplicated with prometheus node exporter
extraConfig = ''
satisfy any;
auth_basic secured;
auth_basic_user_file ${config.sops.secrets."nginx/basic-auth".path};
allow 2a00:8180:2c00:200::/56;
allow 2a0f:5382:acab:1400::/56;
allow fd23:42:c3d2:500::/56;
allow 30c:c3d2:b946:76d0::/64;
allow 172.22.99.0/24;
allow 172.20.72.0/21;
deny all;
'';
extraConfig = libC.hqNetworkOnly;
};
};
};

13
lib/nginx.nix
View File

@ -26,4 +26,17 @@ _:
];
in
map (x: (x // { addr = "0.0.0.0"; })) listen ++ listen;
hqNetworkOnly = ''
satisfy any;
allow 2a00:8180:2c00:200::/56;
allow 2a0f:5382:acab:1400::/56;
allow fd23:42:c3d2:500::/56;
allow 30c:c3d2:b946:76d0::/64;
allow ::1/128;
allow 172.22.99.0/24;
allow 172.20.72.0/21;
allow 127.0.0.0/8;
deny all;
'';
}

16
modules/stats.nix
View File

@ -1,4 +1,4 @@
{ config, lib, pkgs, ... }:
{ config, lib, libC, pkgs, ... }:
let
cfg = config.c3d2.hq.statistics;
@ -89,19 +89,7 @@ in
];
locations."/metrics" = {
proxyPass = "http://127.0.0.1:${toString config.services.prometheus.exporters.node.port}/metrics";
# ip ranges duplicated with matemat
extraConfig = ''
satisfy any;
allow 2a00:8180:2c00:200::/56;
allow 2a0f:5382:acab:1400::/56;
allow fd23:42:c3d2:500::/56;
allow 30c:c3d2:b946:76d0::/64;
allow ::1/128;
allow 172.22.99.0/24;
allow 172.20.72.0/21;
allow 127.0.0.0/8;
deny all;
'';
extraConfig = libC.hqNetworkOnly;
};
};
};