v/infrastructure
1
0
Fork 0
Code Issues 13 Pull requests 1 Actions Packages Projects Releases Activity

added nginx autoproxy for exposes config, needs some refactoring
All checks were successful
ci/woodpecker/push/woodpecker Pipeline was successful
Details

Browse source
This commit is contained in:
Vivian 2023-05-04 16:19:01 +02:00
parent fa5bda60be
commit af893b9e43
3 changed files with 106 additions and 95 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
nixos/common/modules/meta.nix
View file

@ -20,15 +20,15 @@ let
}; };
}; };
in { in {
options = { options.meta = {
meta.exposes = mkOption { exposes = mkOption {
type = with types; attrsOf (submodule exposesOpts); type = with types; attrsOf (submodule exposesOpts);
description = '' description = ''
Exposed services Exposed services
''; '';
}; };
meta.ipv4 = mkOption { ipv4 = mkOption {
type = types.str; type = types.str;
description = '' description = ''
Own IPv4 Address Own IPv4 Address

2
nixos/common/modules/vault.nix
View file

@ -2,7 +2,7 @@
with lib; with lib;
let let
cfg = config.services.v.vault; cfg = config.services.v.vault;
hostIP = config.deployment.targetHost; hostIP = config.meta.ipv4;
# Find all vault hosts that do not have the same IP as the current host # Find all vault hosts that do not have the same IP as the current host
vault_hosts = vault_hosts =

193
nixos/hosts/olympus/nginx/configuration.nix
View file

@ -1,5 +1,7 @@
{ pkgs, hosts, ... }: { pkgs, config, hosts, lib, ... }:
let let
inherit (builtins) filter hasAttr attrValues concatMap;
proxy = url: { proxy = url: {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
@ -22,6 +24,16 @@ let
add_header Access-Control-Allow-Origin *; add_header Access-Control-Allow-Origin *;
return 200 '${builtins.toJSON data}'; return 200 '${builtins.toJSON data}';
''; '';
hostsWithExposes =
filter (hasAttr "exposes") (attrValues hosts.${config.networking.domain});
exposes = { ip, exposes, ... }:
map ({ domain, port }: { inherit ip domain port; }) (attrValues exposes);
mkVhost = { ip, domain, port }: {
"${domain}" = proxy "http://${ip}:${toString port}";
};
vhosts = lib.foldr (el: acc: acc // mkVhost el) { }
(concatMap exposes hostsWithExposes);
in { in {
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions # settings for stateful data, like file locations and database versions
@ -45,107 +57,106 @@ in {
package = pkgs.nginxMainline; package = pkgs.nginxMainline;
# Templated # Templated
virtualHosts.${hosts.olympus.hedgedoc.exposes.md.domain} = proxy "http://hedgedoc.olympus:${toString hosts.olympus.hedgedoc.exposes.md.port}/"; virtualHosts = vhosts // {
# 0x76.dev
# 0x76.dev "ha.0x76.dev" = proxy "http://home-assistant.olympus:8123/";
virtualHosts."ha.0x76.dev" = proxy "http://home-assistant.olympus:8123/"; "git.0x76.dev" = proxy "http://gitea.olympus:3000";
virtualHosts."git.0x76.dev" = proxy "http://gitea.olympus:3000"; "o.0x76.dev" = proxy "http://minio.olympus:9000";
virtualHosts."o.0x76.dev" = proxy "http://minio.olympus:9000"; "grafana.0x76.dev" = proxy "http://victoriametrics.olympus:2342";
virtualHosts."grafana.0x76.dev" = "outline.0x76.dev" = proxy "http://outline.olympus:3000";
proxy "http://victoriametrics.olympus:2342"; "ntfy.0x76.dev" = proxy "http://ntfy.olympus:80";
virtualHosts."outline.0x76.dev" = proxy "http://outline.olympus:3000"; "ci.0x76.dev" = proxy "http://woodpecker.olympus:8000";
virtualHosts."ntfy.0x76.dev" = proxy "http://ntfy.olympus:80"; "dex.0x76.dev" = proxy "http://dex.olympus:5556";
virtualHosts."ci.0x76.dev" = proxy "http://woodpecker.olympus:8000"; "pass.0x76.dev" = {
virtualHosts."dex.0x76.dev" = proxy "http://dex.olympus:5556"; enableACME = true;
virtualHosts."pass.0x76.dev" = { forceSSL = true;
enableACME = true; locations."/" = {
forceSSL = true; proxyPass = "http://vaultwarden.olympus:8222";
locations."/" = { proxyWebsockets = true;
proxyPass = "http://vaultwarden.olympus:8222"; };
proxyWebsockets = true; locations."/notifications/hub/negotiate" = {
proxyPass = "http://vaultwarden.olympus:8222";
proxyWebsockets = true;
};
locations."/notifications/hub" = {
proxyPass = "http://vaultwarden.olympus:3012";
proxyWebsockets = true;
};
}; };
locations."/notifications/hub/negotiate" = {
proxyPass = "http://vaultwarden.olympus:8222";
proxyWebsockets = true;
};
locations."/notifications/hub" = {
proxyPass = "http://vaultwarden.olympus:3012";
proxyWebsockets = true;
};
};
# Redshifts # Redshifts
virtualHosts."andreea.redshifts.xyz" = proxy "http://zmeura.olympus:8008"; "andreea.redshifts.xyz" = proxy "http://zmeura.olympus:8008";
# Meow # Meow
virtualHosts."meowy.tech" = { "meowy.tech" = {
enableACME = true; enableACME = true;
forceSSL = true; forceSSL = true;
locations."/".extraConfig = '' locations."/".extraConfig = ''
add_header Content-Type 'text/html; charset=UTF-8'; add_header Content-Type 'text/html; charset=UTF-8';
return 200 '<h1>meow</h1>'; return 200 '<h1>meow</h1>';
'';
locations."= /.well-known/matrix/client".extraConfig =
mkWellKnown clientConfig;
locations."= /.well-known/matrix/server".extraConfig =
mkWellKnown serverConfig;
};
virtualHosts."chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
locations."/".extraConfig = ''
return 307 https://element.chat.meowy.tech;
'';
locations."/_matrix".proxyPass = "http://synapse.olympus:8008";
locations."/_synapse/client".proxyPass = "http://synapse.olympus:8008";
locations."/_synapse/admin" = {
# Allow only local and my own IPs
extraConfig = ''
allow 127.0.0.1;
allow 10.42.42.0/23;
allow 192.168.0.0/23;
allow 80.60.83.220;
allow 195.85.167.32/29;
deny all;
''; '';
proxyPass = "http://synapse.olympus:8008"; locations."= /.well-known/matrix/client".extraConfig =
mkWellKnown clientConfig;
locations."= /.well-known/matrix/server".extraConfig =
mkWellKnown serverConfig;
}; };
}; "chat.meowy.tech" = {
virtualHosts."element.chat.meowy.tech" = { enableACME = true;
enableACME = true; forceSSL = true;
forceSSL = true; locations."/".extraConfig = ''
return 307 https://element.chat.meowy.tech;
root = pkgs.element-web.override { '';
conf = { locations."/_matrix".proxyPass = "http://synapse.olympus:8008";
default_server_config = clientConfig; locations."/_synapse/client".proxyPass = "http://synapse.olympus:8008";
show_labs_settings = true; locations."/_synapse/admin" = {
brand = "chat.meowy.tech"; # Allow only local and my own IPs
extraConfig = ''
allow 127.0.0.1;
allow 10.42.42.0/23;
allow 192.168.0.0/23;
allow 80.60.83.220;
allow 195.85.167.32/29;
deny all;
'';
proxyPass = "http://synapse.olympus:8008";
}; };
}; };
}; "element.chat.meowy.tech" = {
virtualHosts."cinny.chat.meowy.tech" = { enableACME = true;
enableACME = true; forceSSL = true;
forceSSL = true;
root = pkgs.cinny.override { root = pkgs.element-web.override {
conf = { conf = {
defaultHomeserver = 0; default_server_config = clientConfig;
allowCustomHomeservers = false; show_labs_settings = true;
homeserverList = [ "chat.meowy.tech" ]; brand = "chat.meowy.tech";
};
}; };
}; };
}; "cinny.chat.meowy.tech" = {
virtualHosts."admin.chat.meowy.tech" = { enableACME = true;
enableACME = true; forceSSL = true;
forceSSL = true;
root = pkgs.synapse-admin;
};
virtualHosts."books.meowy.tech" = proxy "http://bookwyrm.olympus:8001";
# Kubernetes endpoints root = pkgs.cinny.override {
virtualHosts."0x76.dev" = k8s_proxy; conf = {
virtualHosts."internal.xirion.net" = k8s_proxy; defaultHomeserver = 0;
virtualHosts."blog.xirion.net" = k8s_proxy; allowCustomHomeservers = false;
homeserverList = [ "chat.meowy.tech" ];
};
};
};
"admin.chat.meowy.tech" = {
enableACME = true;
forceSSL = true;
root = pkgs.synapse-admin;
};
"books.meowy.tech" = proxy "http://bookwyrm.olympus:8001";
# Kubernetes endpoints
"0x76.dev" = k8s_proxy;
"internal.xirion.net" = k8s_proxy;
"blog.xirion.net" = k8s_proxy;
};
}; };
security.acme.defaults.email = "victorheld12@gmail.com"; security.acme.defaults.email = "victorheld12@gmail.com";