From 14fe8e912e402d5504bfaf23749594d1db0eb3e3 Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Fri, 30 Oct 2026 12:29:36 +0100
Subject: [PATCH 1/9] update flake

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 8730164..4346d48 100644
--- a/flake.lock
+++ b/flake.lock
@@ -40,11 +40,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1793104058,
-        "narHash": "sha256-VXw3hCnL2UxbnHDuyh+/Rw13lEenbRxzm3E+luxeTgY=",
+        "lastModified": 1793312659,
+        "narHash": "sha256-MvAPnOIP6vKH5bhMB2EUt1SXePA91ywk2wJhDxSJgIQ=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3f30131f1f44be1235b47d04cb74dab94f16788e",
+        "rev": "4b914391e046f526b6690e8bb87003d3f603fd60",
         "type": "github"
       },
       "original": {

From 6022b14de8bcb03ba9fecfa1ad6a61b34f3b3b3f Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Fri, 30 Oct 2026 23:12:25 +0100
Subject: [PATCH 2/9] send nginx log to journal

---
 hosts/dav/baikal.nix         | 12 ++++++++++--
 hosts/git/forgejo.nix        |  5 +++--
 hosts/matrix/synapse.nix     |  6 +++++-
 hosts/md/hedgedoc.nix        | 14 ++++++++------
 hosts/monitoring/grafana.nix | 19 ++++++-------------
 hosts/www/nginx.nix          |  8 ++++++++
 services/nginx.nix           |  8 ++++++--
 7 files changed, 46 insertions(+), 26 deletions(-)

diff --git a/hosts/dav/baikal.nix b/hosts/dav/baikal.nix
index da53865..ddc4413 100644
--- a/hosts/dav/baikal.nix
+++ b/hosts/dav/baikal.nix
@@ -1,5 +1,8 @@
 { config, ... }:
 
+let
+  fqdn = "dav.${config.networking.domain}";
+in
 {
   imports = [
     ../../services/nginx.nix
@@ -9,15 +12,20 @@
   services = {
     baikal = {
       enable = true;
-      virtualHost = "dav.${config.networking.domain}";
+      virtualHost = fqdn;
     };
 
-    nginx.virtualHosts."dav.${config.networking.domain}" = {
+    nginx.virtualHosts.${fqdn} = {
       default = true;
       quic = true;
       kTLS = true;
       forceSSL = true;
       enableACME = true;
+      extraConfig = ''
+        proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
+        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] fqdn} warn;
+        access_log syslog:server=unix:/dev/log vhost_combined;
+      '';
     };
   };
 }
diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix
index b1ebeda..8cd28f8 100644
--- a/hosts/git/forgejo.nix
+++ b/hosts/git/forgejo.nix
@@ -85,6 +85,9 @@ in
         enableACME = true;
         extraConfig = ''
           merge_slashes off; # Required to handle URL-encoded slashes
+          proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
+          error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] fqdn} warn;
+          access_log syslog:server=unix:/dev/log vhost_combined;
         '';
         locations = {
           "/" = {
@@ -93,7 +96,6 @@ in
             proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}";
             extraConfig = ''
               client_max_body_size 512M;
-              proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
             '';
           };
           "/metrics" = {
@@ -109,7 +111,6 @@ in
             recommendedProxySettings = true;
             proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}";
             extraConfig = ''
-              proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
               limit_req zone=forgejo_archive burst=10 nodelay;
               limit_conn forgejo_archive_conn 2;
               limit_req_status 429;
diff --git a/hosts/matrix/synapse.nix b/hosts/matrix/synapse.nix
index 0d51d8e..7025c42 100644
--- a/hosts/matrix/synapse.nix
+++ b/hosts/matrix/synapse.nix
@@ -73,6 +73,11 @@
       kTLS = true;
       forceSSL = true;
       enableACME = true;
+      extraConfig = ''
+        proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
+        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] fqdn} warn;
+        access_log syslog:server=unix:/dev/log vhost_combined;
+      '';
       locations = {
         "/".return = "418 \"🫖\"";
         "~ ^(/_matrix|/_synapse/client)" = {
@@ -82,7 +87,6 @@
             client_max_body_size 64M;
             proxy_set_header X-Request-ID $request_id;
             proxy_http_version 1.1;
-            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
           '';
         };
         "/_synapse/metrics" = {
diff --git a/hosts/md/hedgedoc.nix b/hosts/md/hedgedoc.nix
index c97ed4d..aaa64b5 100644
--- a/hosts/md/hedgedoc.nix
+++ b/hosts/md/hedgedoc.nix
@@ -2,6 +2,7 @@
 
 let
   cfg = config.services.hedgedoc.settings;
+  fqdn = "md.${config.networking.domain}";
 in
 {
   imports = [
@@ -14,7 +15,7 @@ in
       enable = true;
       environmentFile = config.age.secrets.hedgedoc_db_password.path;
       settings = {
-        domain = "md.${config.networking.domain}";
+        domain = fqdn;
         dbURL = "postgres://hedgedoc:\${DB_PASSWORD}@sql.berlin.ccc.de:5432/hedgedoc";
         db.dialect = "postgresql";
         protocolUseSSL = true;
@@ -24,28 +25,29 @@ in
       };
     };
 
-    nginx.virtualHosts."md.${config.networking.domain}" = {
+    nginx.virtualHosts.${fqdn} = {
       default = true;
       quic = true;
       kTLS = true;
       forceSSL = true;
       enableACME = true;
+      extraConfig = ''
+        proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
+        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] fqdn} warn;
+        access_log syslog:server=unix:/dev/log vhost_combined;
+      '';
       locations = {
         "/" = {
           proxyPass = "http://${cfg.host}:${toString cfg.port}";
           recommendedProxySettings = true;
           extraConfig = ''
             add_header Content-Security-Policy "frame-src 'self'; default-src 'self'; script-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; form-action 'self'; upgrade-insecure-requests;" always;
-            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
           '';
         };
         "/socket.io/" = {
           proxyPass = "http://${cfg.host}:${toString cfg.port}";
           proxyWebsockets = true;
           recommendedProxySettings = true;
-          extraConfig = ''
-            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
-          '';
         };
         "/metrics" = {
           proxyPass = "http://${cfg.host}:${toString cfg.port}";
diff --git a/hosts/monitoring/grafana.nix b/hosts/monitoring/grafana.nix
index 8dc908c..deef92e 100644
--- a/hosts/monitoring/grafana.nix
+++ b/hosts/monitoring/grafana.nix
@@ -66,34 +66,27 @@ in
       };
     };
 
-    nginx.virtualHosts."monitoring.${config.networking.domain}" = {
+    nginx.virtualHosts.${fqdn} = {
       default = true;
       quic = true;
       kTLS = true;
       forceSSL = true;
       enableACME = true;
-      #extraConfig = ''
-      #  map $http_upgrade $connection_upgrade {
-      #    default upgrade;
-      #    \'\' close;
-      #  }
-      #'';
+      extraConfig = ''
+        proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
+        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] fqdn} warn;
+        access_log syslog:server=unix:/dev/log vhost_combined;
+      '';
       locations = {
         "/" = {
           basicAuthFile = config.age.secrets.grafana_basic_auth.path;
           proxyPass = "http://unix:/run/grafana/grafana.sock";
           recommendedProxySettings = true;
-          extraConfig = ''
-            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
-          '';
         };
         "/api/live/" = {
           proxyPass = "http://unix:/run/grafana/grafana.sock";
           recommendedProxySettings = true;
           proxyWebsockets = true;
-          extraConfig = ''
-            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
-          '';
         };
       };
     };
diff --git a/hosts/www/nginx.nix b/hosts/www/nginx.nix
index c5efd3e..835b946 100644
--- a/hosts/www/nginx.nix
+++ b/hosts/www/nginx.nix
@@ -23,6 +23,8 @@ in
       enableACME = true;
       extraConfig = ''
         add_header Strict-Transport-Security max-age=15768000;
+        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] "mta-sts.${config.networking.domain}"} warn;
+        access_log syslog:server=unix:/dev/log vhost_combined;
       '';
       locations."= /.well-known/mta-sts.txt" = {
         alias = "/srv/http/mta-sts.txt";
@@ -41,6 +43,8 @@ in
       extraConfig = ''
         # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
         add_header Strict-Transport-Security max-age=15768000;
+        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] "www.${config.networking.domain}"} warn;
+        access_log syslog:server=unix:/dev/log vhost_combined;
       '';
       locations = {
         "/" = {
@@ -104,6 +108,10 @@ in
       kTLS = true;
       forceSSL = true;
       enableACME = true;
+      extraConfig = ''
+        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] "staging.${config.networking.domain}"} warn;
+        access_log syslog:server=unix:/dev/log vhost_combined;
+      '';
       locations = {
         "/" = {
           basicAuthFile = config.age.secrets.www-staging-htpasswd.path;
diff --git a/services/nginx.nix b/services/nginx.nix
index 8574a0d..0aa75b3 100644
--- a/services/nginx.nix
+++ b/services/nginx.nix
@@ -18,9 +18,13 @@
     recommendedGzipSettings = true;
     recommendedBrotliSettings = true;
     commonHttpConfig = ''
+      log_format vhost_combined '$host:$server_port $remote_addr - $remote_user [$time_local] '
+        '"$request" $status $body_bytes_sent '
+        '"$http_referer" "$http_user_agent"';
+
       map $remote_addr $proxy_forwarded_for_element {
         # IPv4 addresses can be sent as-is
-        ~^[0-9.]+$          "for=$remote_addr:$remote_port";
+        ~^[0-9.]+$          "for=\"$remote_addr:$remote_port\"";
 
         # IPv6 addresses need to be bracketed and quoted
         ~^[0-9A-Fa-f:.]+$   "for=\"[$remote_addr]:$remote_port\"";
@@ -30,7 +34,7 @@
 
       map $server_addr $proxy_forwarded_by_element {
         # IPv4 addresses can be sent as-is
-        ~^[0-9.]+$        "by=$server_addr:$server_port";
+        ~^[0-9.]+$        "by=\"$server_addr:$server_port\"";
 
         # IPv6 addresses need to be bracketed and quoted
         ~^[0-9A-Fa-f:.]+$ "by=\"[$server_addr]:$server_port\"";

From c155c42c814cfa08af537cb3664893ed963c0db4 Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Fri, 30 Oct 2026 23:12:58 +0100
Subject: [PATCH 3/9] update flake

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4346d48..4e1115e 100644
--- a/flake.lock
+++ b/flake.lock
@@ -40,11 +40,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1793312659,
-        "narHash": "sha256-MvAPnOIP6vKH5bhMB2EUt1SXePA91ywk2wJhDxSJgIQ=",
+        "lastModified": 1793373903,
+        "narHash": "sha256-9Hu9ogFl8ak5yo/l3xfmbLyz4z/j5zwKZGaArpf5RKE=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "4b914391e046f526b6690e8bb87003d3f603fd60",
+        "rev": "2f3e25034e0500fa0c56ab4d665677de0277586b",
         "type": "github"
       },
       "original": {

From 5af37f9f000bc4b249550dd2cff51ebf43ffc2ce Mon Sep 17 00:00:00 2001
From: xengi <cccb-git@xengi.de>
Date: Sat, 31 Oct 2026 00:30:13 +0100
Subject: [PATCH 4/9] Update README.md

Signed-off-by: xengi <cccb-git@xengi.de>
---
 README.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/README.md b/README.md
index 28e4b42..4410872 100644
--- a/README.md
+++ b/README.md
@@ -30,7 +30,6 @@ Production:
 
 - [Synapse (matrix.berlin.ccc.de)](./README.matrix.md)
 - [Postgres (sql.berlin.ccc.de)](./README.postgres.md)
-- [NGINX (www.berlin.ccc.de)](./README.www.md)
 
 Testing:
 

From ac95b8e7d76877cd6d4fb6e12a19fa849dcd65cb Mon Sep 17 00:00:00 2001
From: xengi <cccb-git@xengi.de>
Date: Sat, 31 Oct 2026 00:30:56 +0100
Subject: [PATCH 5/9] Update README.md

---
 README.md | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/README.md b/README.md
index 4410872..91061bd 100644
--- a/README.md
+++ b/README.md
@@ -26,17 +26,9 @@ nix run .#remote-apply-git
 
 ### Special things
 
-Production:
-
 - [Synapse (matrix.berlin.ccc.de)](./README.matrix.md)
 - [Postgres (sql.berlin.ccc.de)](./README.postgres.md)
 
-Testing:
-
-- [Hedgedoc (md.berlin.ccc.de)](./README.hedgedoc.md)
-- [Grafana (monitoring.berlin.ccc.de)](./README.grafana.md)
-- [Prometheus (monitoring.berlin.ccc.de)](./README.prometheus.md)
-
 ## Always looking for co-maintainers
 
 Wanna join the Admin team? Contact us!

From e77b9438f540291e432e5bdbbe594ae4769109ed Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Sun, 1 Nov 2026 13:05:33 +0100
Subject: [PATCH 6/9] disable archive download

---
 hosts/git/forgejo.nix | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hosts/git/forgejo.nix b/hosts/git/forgejo.nix
index 8cd28f8..84516aa 100644
--- a/hosts/git/forgejo.nix
+++ b/hosts/git/forgejo.nix
@@ -46,6 +46,7 @@ in
           ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
           AUTO_WATCH_NEW_REPOS = false;
         };
+        repository.DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
         mailer = {
           ENABLED = true;
           FROM = "admin@berlin.ccc.de";

From f32293b05498b62ce5e0f99376e4110b1ae70e59 Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Sun, 1 Nov 2026 13:06:00 +0100
Subject: [PATCH 7/9] update flake

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index 4e1115e..a439ec9 100644
--- a/flake.lock
+++ b/flake.lock
@@ -40,11 +40,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1793373903,
-        "narHash": "sha256-9Hu9ogFl8ak5yo/l3xfmbLyz4z/j5zwKZGaArpf5RKE=",
+        "lastModified": 1793493379,
+        "narHash": "sha256-sXMzgHQx2o1lsEVNOXj7sOSPGUwPPR4JMkBneso5pd4=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "2f3e25034e0500fa0c56ab4d665677de0277586b",
+        "rev": "39d1a6c4566dfdb75a27ae40a2ae3aad4df77408",
         "type": "github"
       },
       "original": {

From 242ab154e9dd0e9152521a45995f561a4a5a8765 Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Mon, 2 Nov 2026 19:21:43 +0100
Subject: [PATCH 8/9] update flake

---
 flake.lock | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/flake.lock b/flake.lock
index a439ec9..9dcde7c 100644
--- a/flake.lock
+++ b/flake.lock
@@ -40,11 +40,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1793493379,
-        "narHash": "sha256-sXMzgHQx2o1lsEVNOXj7sOSPGUwPPR4JMkBneso5pd4=",
+        "lastModified": 1793571983,
+        "narHash": "sha256-hwLE3wUw9gnplbv1I4EaB92BecfYK4P0sl84SmB5SPs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "39d1a6c4566dfdb75a27ae40a2ae3aad4df77408",
+        "rev": "64aec40e18595d342f25f120069f2cb63c3947b4",
         "type": "github"
       },
       "original": {

From 08f89180857c837415e883d0f4ed10e186ac78ca Mon Sep 17 00:00:00 2001
From: "Ricardo (XenGi) Band" <email@ricardo.band>
Date: Mon, 2 Nov 2026 19:23:45 +0100
Subject: [PATCH 9/9] set fqdn

---
 hosts/matrix/synapse.nix | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/hosts/matrix/synapse.nix b/hosts/matrix/synapse.nix
index 7025c42..4ebe8cd 100644
--- a/hosts/matrix/synapse.nix
+++ b/hosts/matrix/synapse.nix
@@ -1,5 +1,8 @@
 { config, ... }:
 
+let
+  fqdn = "matrix.${config.networking.domain}";
+in
 {
   imports = [
     ../../services/nginx.nix
@@ -11,7 +14,7 @@
       enable = true;
       settings = {
         server_name = config.networking.domain;
-        public_baseurl = "https://matrix.${config.networking.domain}:443/";
+        public_baseurl = "https://${fqdn}:443/";
         # "/var/lib/matrix-synapse/homeserver.signing.key"
         signing_key_path = config.age.secrets.matrix_signing_key.path;
         registration_shared_secret_path = config.age.secrets.matrix_registration_shared_secret.path;
@@ -67,7 +70,7 @@
       enableRegistrationScript = true;
     };
 
-    nginx.virtualHosts."matrix.${config.networking.domain}" = {
+    nginx.virtualHosts.${fqdn} = {
       default = true;
       quic = true;
       kTLS = true;