diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix index a4cb3d0..e111592 100644 --- a/hosts/git/forgejo.nix +++ b/hosts/git/forgejo.nix @@ -78,38 +78,39 @@ in limit_req_zone $binary_remote_addr zone=forgejo_archive:10m rate=2r/s; ''; virtualHosts."${fqdn}" = { - quic = true; - kTLS = true; - forceSSL = true; - enableACME = true; - extraConfig = '' - merge_slashes off; # Required to handle URL-encoded slashes - ''; - locations = { - "/" = { - recommendedProxySettings = true; - proxyWebsockets = true; - proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}"; - extraConfig = '' - client_max_body_size 512M; + quic = true; + kTLS = true; + forceSSL = true; + enableACME = true; + extraConfig = '' + merge_slashes off; # Required to handle URL-encoded slashes + ''; + locations = { + "/" = { + recommendedProxySettings = true; + proxyWebsockets = true; + proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}"; + extraConfig = '' + client_max_body_size 512M; + ''; + }; + "/metrics" = { + recommendedProxySettings = true; + proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}"; + extraConfig = '' + allow 195.160.173.14; + allow 2001:678:760:cccb::14; + deny all; + ''; + }; + "~ ^/[^/]+/[^/]+/archive/".extraConfig = '' + limit_req zone=forgejo_archive burst=10 nodelay; + ''; + "= /robots.txt".extraConfig = '' + default_type text/plain; + return 200 "User-agent: *\nDisallow: /*/*/archive/\n"; ''; }; - "/metrics" = { - recommendedProxySettings = true; - proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}"; - extraConfig = '' - allow 195.160.173.14; - allow 2001:678:760:cccb::14; - deny all; - ''; - }; - "~ ^/[^/]+/[^/]+/archive/".extraConfig = '' - limit_req zone=forgejo_archive burst=10 nodelay; - ''; - "= /robots.txt".extraConfig = '' - default_type text/plain; - return 200 "User-agent: *\nDisallow: /*/*/archive/\n"; - ''; }; }; };