Merge branch 'main' of ssh://git.berlin.ccc.de/xengi/infra

README.md

@@ -26,17 +26,8 @@ nix run .#remote-apply-git
 
 ### Special things
 
-Production:
-
 - [Synapse (matrix.berlin.ccc.de)](./README.matrix.md)
 - [Postgres (sql.berlin.ccc.de)](./README.postgres.md)
-- [NGINX (www.berlin.ccc.de)](./README.www.md)
-
-Testing:
-
-- [Hedgedoc (md.berlin.ccc.de)](./README.hedgedoc.md)
-- [Grafana (monitoring.berlin.ccc.de)](./README.grafana.md)
-- [Prometheus (monitoring.berlin.ccc.de)](./README.prometheus.md)
 
 ## Always looking for co-maintainers
 

flake.lock

@@ -40,11 +40,11 @@
     },
     "nixpkgs": {
       "locked": {
-        "lastModified": 1793104058,
+        "lastModified": 1793571983,
-        "narHash": "sha256-VXw3hCnL2UxbnHDuyh+/Rw13lEenbRxzm3E+luxeTgY=",
+        "narHash": "sha256-hwLE3wUw9gnplbv1I4EaB92BecfYK4P0sl84SmB5SPs=",
         "owner": "NixOS",
         "repo": "nixpkgs",
-        "rev": "3f30131f1f44be1235b47d04cb74dab94f16788e",
+        "rev": "64aec40e18595d342f25f120069f2cb63c3947b4",
         "type": "github"
       },
       "original": {

hosts/dav/baikal.nix

@@ -1,5 +1,8 @@
 { config, ... }:
 
+let
+  fqdn = "dav.${config.networking.domain}";
+in
 {
   imports = [
     ../../services/nginx.nix
@@ -9,15 +12,20 @@
   services = {
     baikal = {
       enable = true;
-      virtualHost = "dav.${config.networking.domain}";
+      virtualHost = fqdn;
     };
 
-    nginx.virtualHosts."dav.${config.networking.domain}" = {
+    nginx.virtualHosts.${fqdn} = {
       default = true;
       quic = true;
       kTLS = true;
       forceSSL = true;
       enableACME = true;
+      extraConfig = ''
+        proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
+        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] fqdn} warn;
+        access_log syslog:server=unix:/dev/log vhost_combined;
+      '';
     };
   };
 }

hosts/git/forgejo.nix

@@ -46,6 +46,7 @@ in
           ALLOW_ONLY_EXTERNAL_REGISTRATION = true;
           AUTO_WATCH_NEW_REPOS = false;
         };
+        repository.DISABLE_DOWNLOAD_SOURCE_ARCHIVES = true;
         mailer = {
           ENABLED = true;
           FROM = "admin@berlin.ccc.de";
@@ -85,6 +86,9 @@ in
         enableACME = true;
         extraConfig = ''
           merge_slashes off; # Required to handle URL-encoded slashes
+          proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
+          error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] fqdn} warn;
+          access_log syslog:server=unix:/dev/log vhost_combined;
         '';
         locations = {
           "/" = {
@@ -93,7 +97,6 @@ in
             proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}";
             extraConfig = ''
               client_max_body_size 512M;
-              proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
             '';
           };
           "/metrics" = {
@@ -109,7 +112,6 @@ in
             recommendedProxySettings = true;
             proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}";
             extraConfig = ''
-              proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
               limit_req zone=forgejo_archive burst=10 nodelay;
               limit_conn forgejo_archive_conn 2;
               limit_req_status 429;

hosts/matrix/synapse.nix

@@ -1,5 +1,8 @@
 { config, ... }:
 
+let
+  fqdn = "matrix.${config.networking.domain}";
+in
 {
   imports = [
     ../../services/nginx.nix
@@ -11,7 +14,7 @@
       enable = true;
       settings = {
         server_name = config.networking.domain;
-        public_baseurl = "https://matrix.${config.networking.domain}:443/";
+        public_baseurl = "https://${fqdn}:443/";
         # "/var/lib/matrix-synapse/homeserver.signing.key"
         signing_key_path = config.age.secrets.matrix_signing_key.path;
         registration_shared_secret_path = config.age.secrets.matrix_registration_shared_secret.path;
@@ -67,12 +70,17 @@
       enableRegistrationScript = true;
     };
 
-    nginx.virtualHosts."matrix.${config.networking.domain}" = {
+    nginx.virtualHosts.${fqdn} = {
       default = true;
       quic = true;
       kTLS = true;
       forceSSL = true;
       enableACME = true;
+      extraConfig = ''
+        proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
+        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] fqdn} warn;
+        access_log syslog:server=unix:/dev/log vhost_combined;
+      '';
       locations = {
         "/".return = "418 \"🫖\"";
         "~ ^(/_matrix|/_synapse/client)" = {
@@ -82,7 +90,6 @@
             client_max_body_size 64M;
             proxy_set_header X-Request-ID $request_id;
             proxy_http_version 1.1;
-            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
           '';
         };
         "/_synapse/metrics" = {

hosts/md/hedgedoc.nix

@@ -2,6 +2,7 @@
 
 let
   cfg = config.services.hedgedoc.settings;
+  fqdn = "md.${config.networking.domain}";
 in
 {
   imports = [
@@ -14,7 +15,7 @@ in
       enable = true;
       environmentFile = config.age.secrets.hedgedoc_db_password.path;
       settings = {
-        domain = "md.${config.networking.domain}";
+        domain = fqdn;
         dbURL = "postgres://hedgedoc:\${DB_PASSWORD}@sql.berlin.ccc.de:5432/hedgedoc";
         db.dialect = "postgresql";
         protocolUseSSL = true;
@@ -24,28 +25,29 @@ in
       };
     };
 
-    nginx.virtualHosts."md.${config.networking.domain}" = {
+    nginx.virtualHosts.${fqdn} = {
       default = true;
       quic = true;
       kTLS = true;
       forceSSL = true;
       enableACME = true;
+      extraConfig = ''
+        proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
+        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] fqdn} warn;
+        access_log syslog:server=unix:/dev/log vhost_combined;
+      '';
       locations = {
         "/" = {
           proxyPass = "http://${cfg.host}:${toString cfg.port}";
           recommendedProxySettings = true;
           extraConfig = ''
             add_header Content-Security-Policy "frame-src 'self'; default-src 'self'; script-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; form-action 'self'; upgrade-insecure-requests;" always;
-            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
           '';
         };
         "/socket.io/" = {
           proxyPass = "http://${cfg.host}:${toString cfg.port}";
           proxyWebsockets = true;
           recommendedProxySettings = true;
-          extraConfig = ''
-            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
-          '';
         };
         "/metrics" = {
           proxyPass = "http://${cfg.host}:${toString cfg.port}";

hosts/monitoring/grafana.nix

@@ -66,34 +66,27 @@ in
       };
     };
 
-    nginx.virtualHosts."monitoring.${config.networking.domain}" = {
+    nginx.virtualHosts.${fqdn} = {
       default = true;
       quic = true;
       kTLS = true;
       forceSSL = true;
       enableACME = true;
-      #extraConfig = ''
+      extraConfig = ''
-      #  map $http_upgrade $connection_upgrade {
+        proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
-      #    default upgrade;
+        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] fqdn} warn;
-      #    \'\' close;
+        access_log syslog:server=unix:/dev/log vhost_combined;
-      #  }
+      '';
-      #'';
       locations = {
         "/" = {
           basicAuthFile = config.age.secrets.grafana_basic_auth.path;
           proxyPass = "http://unix:/run/grafana/grafana.sock";
           recommendedProxySettings = true;
-          extraConfig = ''
-            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
-          '';
         };
         "/api/live/" = {
           proxyPass = "http://unix:/run/grafana/grafana.sock";
           recommendedProxySettings = true;
           proxyWebsockets = true;
-          extraConfig = ''
-            proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
-          '';
         };
       };
     };

hosts/www/nginx.nix

@@ -23,6 +23,8 @@ in
       enableACME = true;
       extraConfig = ''
         add_header Strict-Transport-Security max-age=15768000;
+        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] "mta-sts.${config.networking.domain}"} warn;
+        access_log syslog:server=unix:/dev/log vhost_combined;
       '';
       locations."= /.well-known/mta-sts.txt" = {
         alias = "/srv/http/mta-sts.txt";
@@ -41,6 +43,8 @@ in
       extraConfig = ''
         # HSTS (ngx_http_headers_module is required) (15768000 seconds = 6 months)
         add_header Strict-Transport-Security max-age=15768000;
+        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] "www.${config.networking.domain}"} warn;
+        access_log syslog:server=unix:/dev/log vhost_combined;
       '';
       locations = {
         "/" = {
@@ -104,6 +108,10 @@ in
       kTLS = true;
       forceSSL = true;
       enableACME = true;
+      extraConfig = ''
+        error_log syslog:server=unix:/dev/log,tag=${builtins.replaceStrings [ "." ] [ "_" ] "staging.${config.networking.domain}"} warn;
+        access_log syslog:server=unix:/dev/log vhost_combined;
+      '';
       locations = {
         "/" = {
           basicAuthFile = config.age.secrets.www-staging-htpasswd.path;

services/nginx.nix

@@ -18,9 +18,13 @@
     recommendedGzipSettings = true;
     recommendedBrotliSettings = true;
     commonHttpConfig = ''
+      log_format vhost_combined '$host:$server_port $remote_addr - $remote_user [$time_local] '
+        '"$request" $status $body_bytes_sent '
+        '"$http_referer" "$http_user_agent"';
+
       map $remote_addr $proxy_forwarded_for_element {
         # IPv4 addresses can be sent as-is
-        ~^[0-9.]+$          "for=$remote_addr:$remote_port";
+        ~^[0-9.]+$          "for=\"$remote_addr:$remote_port\"";
 
         # IPv6 addresses need to be bracketed and quoted
         ~^[0-9A-Fa-f:.]+$   "for=\"[$remote_addr]:$remote_port\"";
@@ -30,7 +34,7 @@
 
       map $server_addr $proxy_forwarded_by_element {
         # IPv4 addresses can be sent as-is
-        ~^[0-9.]+$        "by=$server_addr:$server_port";
+        ~^[0-9.]+$        "by=\"$server_addr:$server_port\"";
 
         # IPv6 addresses need to be bracketed and quoted
         ~^[0-9A-Fa-f:.]+$ "by=\"[$server_addr]:$server_port\"";