xengi/infra
Watch
0
1
Fork
You've already forked infra
 0
Code Pull requests Activity Actions 1

Merge branch 'main' of ssh://git.berlin.ccc.de/xengi/infra
Some checks are pending
Test Nix flake / Test nix flake (push) Waiting to run
Details

Browse source
This commit is contained in:
XenGi 2026-09-11 10:31:29 +02:00
commit cd48d3c530
Signed by: xengi
SSH key fingerprint: SHA256:jxWM2RTHvxxcncXycwwWkP7HCWb4VREN05UGJTbIPZg
5 changed files with 33 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

1
hosts/git/forgejo.nix
View file

@ -92,6 +92,7 @@ in
proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}"; proxyPass = "http://unix:${config.services.forgejo.settings.server.HTTP_ADDR}";
extraConfig = '' extraConfig = ''
client_max_body_size 512M; client_max_body_size 512M;
proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
''; '';
}; };
"/metrics" = { "/metrics" = {

1
hosts/matrix/synapse.nix
View file

@ -82,6 +82,7 @@
client_max_body_size 64M; client_max_body_size 64M;
proxy_set_header X-Request-ID $request_id; proxy_set_header X-Request-ID $request_id;
proxy_http_version 1.1; proxy_http_version 1.1;
proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
''; '';
}; };
"/_synapse/metrics" = { "/_synapse/metrics" = {

4
hosts/md/hedgedoc.nix
View file

@ -34,12 +34,16 @@ in
recommendedProxySettings = true; recommendedProxySettings = true;
extraConfig = '' extraConfig = ''
add_header Content-Security-Policy "frame-src 'self'; default-src 'self'; script-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; form-action 'self'; upgrade-insecure-requests;" always; add_header Content-Security-Policy "frame-src 'self'; default-src 'self'; script-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self'; form-action 'self'; upgrade-insecure-requests;" always;
proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
''; '';
}; };
"/socket.io/" = { "/socket.io/" = {
proxyPass = "http://${cfg.host}:${toString cfg.port}"; proxyPass = "http://${cfg.host}:${toString cfg.port}";
proxyWebsockets = true; proxyWebsockets = true;
recommendedProxySettings = true; recommendedProxySettings = true;
extraConfig = ''
proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
'';
}; };
"/metrics" = { "/metrics" = {
proxyPass = "http://${cfg.host}:${toString cfg.port}"; proxyPass = "http://${cfg.host}:${toString cfg.port}";

6
hosts/monitoring/grafana.nix
View file

@ -83,11 +83,17 @@ in
basicAuthFile = config.age.secrets.grafana_basic_auth.path; basicAuthFile = config.age.secrets.grafana_basic_auth.path;
proxyPass = "http://unix:/run/grafana/grafana.sock"; proxyPass = "http://unix:/run/grafana/grafana.sock";
recommendedProxySettings = true; recommendedProxySettings = true;
extraConfig = ''
proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
'';
}; };
"/api/live/" = { "/api/live/" = {
proxyPass = "http://unix:/run/grafana/grafana.sock"; proxyPass = "http://unix:/run/grafana/grafana.sock";
recommendedProxySettings = true; recommendedProxySettings = true;
proxyWebsockets = true; proxyWebsockets = true;
extraConfig = ''
proxy_set_header Forwarded "$proxy_forwarded_for_element;$proxy_forwarded_by_element;host=$host;proto=$scheme";
'';
}; };
}; };
}; };

21
services/nginx.nix
View file

@ -17,5 +17,26 @@
recommendedOptimisation = true; recommendedOptimisation = true;
recommendedGzipSettings = true; recommendedGzipSettings = true;
recommendedBrotliSettings = true; recommendedBrotliSettings = true;
commonHttpConfig = ''
map $remote_addr $proxy_forwarded_for_element {
# IPv4 addresses can be sent as-is
~^[0-9.]+$ "for=$remote_addr:$remote_port";
# IPv6 addresses need to be bracketed and quoted
~^[0-9A-Fa-f:.]+$ "for=\"[$remote_addr]:$remote_port\"";
default "for=unknown";
}
map $server_addr $proxy_forwarded_by_element {
# IPv4 addresses can be sent as-is
~^[0-9.]+$ "by=$server_addr:$server_port";
# IPv6 addresses need to be bracketed and quoted
~^[0-9A-Fa-f:.]+$ "by=\"[$server_addr]:$server_port\"";
default "by=unknown";
}
'';
}; };
} }