fruchti/hosts
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Compare commits

base: fruchti:6e3f037e1a6bb348f4c2da49450449ac1c8df090
Branches Tags
fruchti:prod
fruchti:jupyter_disable
...
compare: fruchti:e04e623deab13e1f738f933a722e6f32658da84d
Branches Tags
fruchti:prod
fruchti:jupyter_disable

5 commits
6e3f037e1a ... e04e623dea

Author SHA1 Message Date
fruchti
e04e623dea Emitter: Make Rupert TLS upstream IPv6-only 2025-12-23 17:46:35 +01:00
fruchti
8685c9ddc9 Emitter: Keep logs for 14 days 2025-12-23 17:38:05 +01:00
fruchti
3171db8a74 Emitter: Enable goatcounter 2025-12-23 17:37:48 +01:00
fruchti
ec4edd6ed3 Emitter: Add real-IP log formats for nginx 2025-12-23 17:37:26 +01:00
fruchti
7c5ca1188c Forgejo: Remove headers nginx complains about 2025-12-23 17:36:27 +01:00
3 changed files with 25 additions and 16 deletions
Download patch file Download diff file Expand all files Collapse all files

16
hosts/Emitter.nix
View file

@ -149,10 +149,24 @@
'';
};
services.goatcounter = {
enable = true;
proxy = true;
};
services.nginx = {
commonHttpConfig = ''
log_format combined_realip '$proxy_protocol_addr - $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
log_format combined_vhost escape=none '$host: $remote_addr $remote_user [$time_local] "$request" $status $body_bytes_sent "$http_referer" "$http_user_agent"';
access_log /var/log/nginx/access.log combined_vhost;
'';
};
services.logrotate = {
enable = true;
settings.nginx = {
rotate = 2;
frequency = "daily";
rotate = 14;
};
};

2
hosts/forgejo.nix
View file

@ -130,8 +130,6 @@ in
set_real_ip_from 127.0.0.1;
set_real_ip_from ::1;
real_ip_header proxy_protocol;
proxy_set_header X-Real-IP $proxy_protocol_addr;
proxy_set_header X-Fowarded-For $proxy_protocol_addr;
access_log /var/log/nginx/access.${domain}.log combined_realip;
'';

23
hosts/tls_sni.nix
View file

@ -3,31 +3,28 @@
services.nginx = {
streamConfig = ''
map $ssl_preread_server_name $target_backend {
md.gvfr.de rupert;
rupert.gvfr.de rupert;
default localserv;
default rupert;
md.gvfr.de rupert;
rupert.gvfr.de rupert;
git.25120.org localserv;
}
upstream rupert {
server rupert.gvfr.de:4431;
zone upstream_rupert 64k;
server rupert.gvfr.de:4431 resolve;
resolver 9.9.9.9 ipv4=off ipv6=on;
}
upstream localserv {
server localhost:4431;
server 127.0.0.1:4431;
}
server {
listen 443;
ssl_preread on;
# proxy_connect_timeout 1s;
# proxy_timeout 3s;
# resolver 1.1.1.1;
proxy_pass $target_backend;
proxy_next_upstream off;
proxy_protocol on;
proxy_pass $target_backend;
}
'';