Move nginx allow only hq network to lib
This commit is contained in:
parent
66666660e0
commit
3333332a03
|
@ -1,4 +1,4 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, libC, pkgs, ... }:
|
||||||
|
|
||||||
{
|
{
|
||||||
c3d2.deployment.server = "server10";
|
c3d2.deployment.server = "server10";
|
||||||
|
@ -16,19 +16,7 @@
|
||||||
enableACME = true;
|
enableACME = true;
|
||||||
locations."/" = {
|
locations."/" = {
|
||||||
proxyPass = "http://localhost:3000";
|
proxyPass = "http://localhost:3000";
|
||||||
# ip ranges duplicated with prometheus node exporter
|
extraConfig = libC.hqNetworkOnly;
|
||||||
extraConfig = ''
|
|
||||||
satisfy any;
|
|
||||||
auth_basic secured;
|
|
||||||
auth_basic_user_file ${config.sops.secrets."nginx/basic-auth".path};
|
|
||||||
allow 2a00:8180:2c00:200::/56;
|
|
||||||
allow 2a0f:5382:acab:1400::/56;
|
|
||||||
allow fd23:42:c3d2:500::/56;
|
|
||||||
allow 30c:c3d2:b946:76d0::/64;
|
|
||||||
allow 172.22.99.0/24;
|
|
||||||
allow 172.20.72.0/21;
|
|
||||||
deny all;
|
|
||||||
'';
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
|
@ -26,4 +26,17 @@ _:
|
||||||
];
|
];
|
||||||
in
|
in
|
||||||
map (x: (x // { addr = "0.0.0.0"; })) listen ++ listen;
|
map (x: (x // { addr = "0.0.0.0"; })) listen ++ listen;
|
||||||
|
|
||||||
|
hqNetworkOnly = ''
|
||||||
|
satisfy any;
|
||||||
|
allow 2a00:8180:2c00:200::/56;
|
||||||
|
allow 2a0f:5382:acab:1400::/56;
|
||||||
|
allow fd23:42:c3d2:500::/56;
|
||||||
|
allow 30c:c3d2:b946:76d0::/64;
|
||||||
|
allow ::1/128;
|
||||||
|
allow 172.22.99.0/24;
|
||||||
|
allow 172.20.72.0/21;
|
||||||
|
allow 127.0.0.0/8;
|
||||||
|
deny all;
|
||||||
|
'';
|
||||||
}
|
}
|
||||||
|
|
|
@ -1,4 +1,4 @@
|
||||||
{ config, lib, pkgs, ... }:
|
{ config, lib, libC, pkgs, ... }:
|
||||||
|
|
||||||
let
|
let
|
||||||
cfg = config.c3d2.hq.statistics;
|
cfg = config.c3d2.hq.statistics;
|
||||||
|
@ -89,19 +89,7 @@ in
|
||||||
];
|
];
|
||||||
locations."/metrics" = {
|
locations."/metrics" = {
|
||||||
proxyPass = "http://127.0.0.1:${toString config.services.prometheus.exporters.node.port}/metrics";
|
proxyPass = "http://127.0.0.1:${toString config.services.prometheus.exporters.node.port}/metrics";
|
||||||
# ip ranges duplicated with matemat
|
extraConfig = libC.hqNetworkOnly;
|
||||||
extraConfig = ''
|
|
||||||
satisfy any;
|
|
||||||
allow 2a00:8180:2c00:200::/56;
|
|
||||||
allow 2a0f:5382:acab:1400::/56;
|
|
||||||
allow fd23:42:c3d2:500::/56;
|
|
||||||
allow 30c:c3d2:b946:76d0::/64;
|
|
||||||
allow ::1/128;
|
|
||||||
allow 172.22.99.0/24;
|
|
||||||
allow 172.20.72.0/21;
|
|
||||||
allow 127.0.0.0/8;
|
|
||||||
deny all;
|
|
||||||
'';
|
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
};
|
};
|
||||||
|
|
Loading…
Reference in New Issue