fruchti/hosts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Compare commits

base: fruchti:11b3dd292731d09c0d1d8fb73baca6bf9000c2b0
Branches Tags
fruchti:prod
fruchti:jupyter_disable
..
compare: fruchti:038a0c8176b2979067709364298893ce136f89fd
Branches Tags
fruchti:prod
fruchti:jupyter_disable

No commits in common. "11b3dd292731d09c0d1d8fb73baca6bf9000c2b0" and "038a0c8176b2979067709364298893ce136f89fd" have entirely different histories.
11b3dd2927 ... 038a0c8176

3 changed files with 4 additions and 58 deletions
Download patch file Download diff file Expand all files Collapse all files

9
hosts/Emitter.nix
View file

@ -100,7 +100,7 @@
set -e set -e
echo "Ensuring rupert.gvfr.de is up." echo "Ensuring rupert.gvfr.de is up."
${pkgs.dig}/bin/nslookup rupert.gvfr.de ${pkgs.dig}/bin/nslookup rupert.gvfr.de
${pkgs.unixtools.ping}/bin/ping -c2 rupert.gvfr.de ${pkgs.unixtools.ping}/bin/ping -c1 rupert.gvfr.de >/dev/null
echo "Opening SSH tunnel." echo "Opening SSH tunnel."
${pkgs.openssh}/bin/ssh -6 -i /secrets/id_burp_remote -o IdentitiesOnly=yes -o ExitOnForwardFailure=yes -L 4971:localhost:4971 burp-remote@rupert.gvfr.de -f true ${pkgs.openssh}/bin/ssh -6 -i /secrets/id_burp_remote -o IdentitiesOnly=yes -o ExitOnForwardFailure=yes -L 4971:localhost:4971 burp-remote@rupert.gvfr.de -f true
echo "Beginning backup operation." echo "Beginning backup operation."
@ -144,13 +144,6 @@
services.postgresql.package = pkgs.postgresql_13; services.postgresql.package = pkgs.postgresql_13;
services.logrotate = {
enable = true;
settings.nginx = {
rotate = 2;
};
};
# This value determines the NixOS release from which the default # This value determines the NixOS release from which the default
# settings for stateful data, like file locations and database versions # settings for stateful data, like file locations and database versions
# on your system were taken. It’s perfectly fine and recommended to leave # on your system were taken. It’s perfectly fine and recommended to leave

21
hosts/forgejo.nix
View file

@ -126,28 +126,7 @@ in
extraConfig = '' extraConfig = ''
# Maximum upload file size for git-lfs # Maximum upload file size for git-lfs
client_max_body_size 100M; client_max_body_size 100M;
set_real_ip_from 127.0.0.1;
set_real_ip_from ::1;
real_ip_header proxy_protocol;
proxy_set_header X-Real-IP $proxy_protocol_addr;
proxy_set_header X-Fowarded-For $proxy_protocol_addr;
access_log /var/log/nginx/access.${domain}.log combined_realip;
''; '';
locations."/awstats/" = {
basicAuthFile = "/secrets/webstats_auth";
};
};
};
services.awstats = {
enable = true;
updateAt = "hourly";
configs."${domain}" = {
logFile = "/var/log/nginx/access.${domain}.log";
domain = domain;
webService.enable = true;
}; };
}; };

32
hosts/tls_sni.nix
View file

@ -9,7 +9,7 @@
} }
upstream rupert { upstream rupert {
server rupert.gvfr.de:4431; server rupert.gvfr.de:443;
} }
upstream localserv { upstream localserv {
@ -18,42 +18,16 @@
server { server {
listen 443; listen 443;
ssl_preread on;
# proxy_connect_timeout 1s; # proxy_connect_timeout 1s;
# proxy_timeout 3s; # proxy_timeout 3s;
# resolver 1.1.1.1; # resolver 1.1.1.1;
proxy_pass $target_backend; proxy_pass $target_backend;
proxy_next_upstream off; ssl_preread on;
proxy_protocol on;
} }
''; '';
defaultListen = [ defaultSSLListenPort = 4431;
{
addr = "0.0.0.0";
port = 80;
ssl = false;
}
{
addr = "[::0]";
port = 80;
ssl = false;
}
{
addr = "0.0.0.0";
port = 4431;
ssl = true;
proxyProtocol = true;
}
{
addr = "[::0]";
port = 4431;
ssl = true;
proxyProtocol = true;
}
];
}; };
} }