Configure Public-Reverse-Proxy

This commit is contained in:
June 2023-09-14 22:12:38 +02:00
parent 30b4139d23
commit cd13c189b1
4 changed files with 95 additions and 0 deletions

View file

@ -0,0 +1,7 @@
{ config, pkgs, ... }:
{
networking.hostName = "public-reverse-proxy";
system.stateVersion = "23.05";
}

View file

@ -0,0 +1,8 @@
{ config, pkgs, ... }:
{
imports = [
./configuration.nix
./nginx.nix
];
}

View file

@ -0,0 +1,66 @@
# Sources for this configuration:
# - https://nixos.wiki/wiki/Nginx
# - https://nixos.org/manual/nixos/stable/#sec-firewall
# - https://git.grzb.de/yuri/nix-infra/-/tree/3896d34f4f7f3b5dd5cbd270a14b56b102ef3a2a/hosts/web-public-2
{ config, pkgs, ... }:
{
services.nginx.streamConfig = ''
map $ssl_preread_server_name $address {
status.ccchh.net 10.31.206.15:8443;
}
# Listen on port 443 as a reverse proxy and use PROXY Protocol for the
# upstreams.
server {
listen 0.0.0.0:443;
proxy_pass $address;
ssl_preread on;
proxy_protocol on;
}
'';
services.nginx.appendHttpConfig = ''
map $host $upstream_acme_challenge_host {
club-assistant.ccchh.net 10.31.208.10;
netbox.ccchh.net 10.31.208.29;
light.ccchh.net 10.31.208.23;
thinkcccore0.ccchh.net 10.31.242.3;
thinkcccore1.ccchh.net 10.31.242.4;
thinkcccore2.ccchh.net 10.31.242.5;
thinkcccore3.ccchh.net 10.31.242.6;
zigbee2mqtt.ccchh.net 10.31.208.25:31820;
esphome.ccchh.net 10.31.208.24:31820;
proxmox-backup-server.ccchh.net 10.31.208.28;
status.ccchh.net 10.31.206.15:31820;
default "";
}
'';
services.nginx = {
enable = true;
virtualHosts."well-known_acme-challenge" = {
default = true;
listen = [{
addr = "0.0.0.0";
port = 80;
}];
locations."/.well-known/acme-challenge/" = {
proxyPass = "http://$upstream_acme_challenge_host";
};
# Better safe than sorry.
# Don't do a permanent redirect to avoid acme challenge pain.
locations."/" = {
return = "307 https://$host$request_uri";
};
};
};
networking.firewall.allowedTCPPorts = [ 80 443 ];
networking.firewall.allowedUDPPorts = [ 443 ];
}

View file

@ -48,6 +48,20 @@
./config/hosts/audio ./config/hosts/audio
]; ];
}; };
public-reverse-proxy = {
deployment = {
targetHost = "public-reverse-proxy.z9.ccchh.net";
targetPort = 22;
targetUser = "colmena-deploy";
tags = [ "thinkcccluster" ];
};
imports = [
./config/common
./config/proxmox-vm
./config/hosts/public-reverse-proxy
];
};
}; };
packages.x86_64-linux = { packages.x86_64-linux = {