forked from the-distro/infra
57 lines
1.3 KiB
Nix
57 lines
1.3 KiB
Nix
# This enables an IPv6-only server which is proxied by kurisu.lahfa.xyz to have proper IPv4 logs via PROXY protocol.
|
|
{ config, lib, ... }:
|
|
let
|
|
inherit (lib) mkEnableOption mkIf;
|
|
cfg = config.bagel.raito.v6-proxy-awareness;
|
|
allowedUpstream = "2001:bc8:38ee:99::1/128";
|
|
in
|
|
{
|
|
options.bagel.raito.v6-proxy-awareness.enable = mkEnableOption "the kurisu.lahfa.xyz's sniproxy awareness for NGINX";
|
|
config = mkIf cfg.enable {
|
|
services.nginx = {
|
|
# IPv6-only server
|
|
defaultListen = [
|
|
{
|
|
addr = "[::0]";
|
|
proxyProtocol = true;
|
|
port = 444;
|
|
ssl = true;
|
|
}
|
|
{
|
|
addr = "[::0]";
|
|
port = 443;
|
|
ssl = true;
|
|
}
|
|
{
|
|
addr = "[::0]";
|
|
port = 80;
|
|
ssl = false;
|
|
}
|
|
# Private networking
|
|
{
|
|
addr = "127.0.0.1";
|
|
port = 80;
|
|
ssl = false;
|
|
}
|
|
{
|
|
addr = "[::1]";
|
|
port = 80;
|
|
ssl = false;
|
|
}
|
|
];
|
|
|
|
appendHttpConfig = ''
|
|
# Kurisu node
|
|
set_real_ip_from ${allowedUpstream};
|
|
real_ip_header proxy_protocol;
|
|
'';
|
|
};
|
|
|
|
# Move to nftables if firewall is enabled.
|
|
networking.nftables.enable = true;
|
|
networking.firewall.extraInputRules = ''
|
|
ip6 saddr ${allowedUpstream} tcp dport 444 accept
|
|
'';
|
|
};
|
|
}
|