forked from CCCHH/nix-infra
Migrate NetBox to Chaosknoten and hamburg.ccc.de domain
This commit is contained in:
parent
2e3e8c7031
commit
01a6d189f2
|
@ -4,6 +4,7 @@
|
|||
imports = [
|
||||
./configuration.nix
|
||||
./netbox.nix
|
||||
./networking.nix
|
||||
./nginx.nix
|
||||
];
|
||||
}
|
||||
|
|
|
@ -11,7 +11,7 @@
|
|||
enable = true;
|
||||
secretKeyFile = "/secrets/netbox-secret-key.secret";
|
||||
settings = {
|
||||
ALLOWED_HOSTS = [ "netbox.ccchh.net" "10.31.208.29" ];
|
||||
ALLOWED_HOSTS = [ "netbox.hamburg.ccc.de" ];
|
||||
SESSION_COOKIE_SECURE = true;
|
||||
};
|
||||
};
|
||||
|
|
26
config/hosts/netbox/networking.nix
Normal file
26
config/hosts/netbox/networking.nix
Normal file
|
@ -0,0 +1,26 @@
|
|||
# Networking configuration for the host.
|
||||
# Sources for this configuration:
|
||||
# - https://nixos.org/manual/nixos/stable/#sec-networking
|
||||
# - https://nixos.wiki/wiki/Systemd-networkd
|
||||
# - https://wiki.archlinux.org/title/Systemd-networkd
|
||||
|
||||
{ config, pkgs, ... }:
|
||||
|
||||
{
|
||||
networking.interfaces.net0 = {
|
||||
ipv4.addresses = [
|
||||
{
|
||||
address = "172.31.17.149";
|
||||
prefixLength = 25;
|
||||
}
|
||||
];
|
||||
};
|
||||
networking.defaultGateway = "172.31.17.129";
|
||||
networking.nameservers = [ "212.12.50.158" "192.76.134.90" ];
|
||||
networking.search = [ "hamburg.ccc.de" ];
|
||||
|
||||
systemd.network.links."10-net0" = {
|
||||
matchConfig.MACAddress = "62:ED:44:20:7C:C1";
|
||||
linkConfig.Name = "net0";
|
||||
};
|
||||
}
|
|
@ -12,10 +12,10 @@
|
|||
# So nginx can access the Netbox static files.
|
||||
user = "netbox";
|
||||
|
||||
virtualHosts."acme-netbox.ccchh.net" = {
|
||||
virtualHosts."acme-netbox.hamburg.ccc.de" = {
|
||||
default = true;
|
||||
enableACME = true;
|
||||
serverName = "netbox.ccchh.net";
|
||||
serverName = "netbox.hamburg.ccc.de";
|
||||
|
||||
listen = [
|
||||
{
|
||||
|
@ -25,20 +25,17 @@
|
|||
];
|
||||
};
|
||||
|
||||
virtualHosts."netbox.ccchh.net" = {
|
||||
virtualHosts."netbox.hamburg.ccc.de" = {
|
||||
default = true;
|
||||
forceSSL = true;
|
||||
useACMEHost = "netbox.ccchh.net";
|
||||
useACMEHost = "netbox.hamburg.ccc.de";
|
||||
|
||||
listen = [
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 80;
|
||||
}
|
||||
{
|
||||
addr = "0.0.0.0";
|
||||
port = 443;
|
||||
port = 8443;
|
||||
ssl = true;
|
||||
extraParameters = [ "proxy_protocol" ];
|
||||
}
|
||||
];
|
||||
|
||||
|
@ -51,11 +48,20 @@
|
|||
};
|
||||
|
||||
extraConfig = ''
|
||||
# Make use of the ngx_http_realip_module to set the $remote_addr and
|
||||
# $remote_port to the client address and client port, when using proxy
|
||||
# protocol.
|
||||
# First set our proxy protocol proxy as trusted.
|
||||
set_real_ip_from 172.31.17.140;
|
||||
# Then tell the realip_module to get the addreses from the proxy protocol
|
||||
# header.
|
||||
real_ip_header proxy_protocol;
|
||||
|
||||
client_max_body_size 25m;
|
||||
'';
|
||||
};
|
||||
};
|
||||
|
||||
networking.firewall.allowedTCPPorts = [ 80 443 31820 ];
|
||||
networking.firewall.allowedUDPPorts = [ 443 ];
|
||||
networking.firewall.allowedTCPPorts = [ 8443 31820 ];
|
||||
networking.firewall.allowedUDPPorts = [ 8443 ];
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue