grace/dots

dotfiles/nix configs

git clone https://git.gae.moe/grace/dots

Grace Yoderhamano againfdde154

vulcan
branchesidkmainvulcanwafrn-testingall refs →
5.9 KiB219 linesraw
1{ config, ... }:
2
3let
4  tailnet = import ../tailnet.nix;
5in
6{
7  networking.firewall.allowedTCPPorts = [
8    22
9    25565
10    80
11    443
12  ];
13
14  # TCP forwarding lives here alongside Caddy's HTTP/HTTPS reverse proxies.
15  systemd.sockets.git-ssh-proxy = {
16    wantedBy = [ "sockets.target" ];
17    listenStreams = [ "0.0.0.0:22" ];
18  };
19
20  systemd.services.git-ssh-proxy = {
21    description = "TCP proxy for Git SSH";
22    requires = [ "git-ssh-proxy.socket" ];
23    serviceConfig = {
24      ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd ${tailnet.dijkstra-git}:22";
25      DynamicUser = true;
26    };
27  };
28
29  systemd.sockets.minecraft-proxy = {
30    wantedBy = [ "sockets.target" ];
31    listenStreams = [ "0.0.0.0:25565" ];
32  };
33
34  systemd.services.minecraft-proxy = {
35    description = "TCP proxy for Minecraft";
36    requires = [ "minecraft-proxy.socket" ];
37    serviceConfig = {
38      ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd ${tailnet.dijkstra}:25565";
39      DynamicUser = true;
40    };
41  };
42
43  services.caddy = {
44    enable = true;
45
46    extraConfig = ''
47      # TODO: make it nice
48      (offline_page) {
49        handle_errors {
50          @offline expression {err.status_code} in [502, 503, 504]
51
52          handle @offline {
53            header Content-Type "text/html; charset=utf-8"
54            header Cache-Control "no-store"
55            respond <<HTML
56              <!doctype html>
57              <html lang="en">
58                <head>
59                  <title>Service temporarily offline</title>
60                </head>
61                <body>
62                  <main>
63                    <h1>Page Down</h1>
64                    <p>If you are seeing this, the backend server is offline. It should be back up soon so check again later.</p>
65                    <p class="status">Error {err.status_code}</p>
66                  </main>
67                </body>
68              </html>
69              HTML {err.status_code}
70          }
71
72          handle {
73            respond "{err.status_code} — {err.status_text}" {err.status_code}
74          }
75        }
76      }
77    '';
78
79    virtualHosts =
80      builtins.mapAttrs
81        (
82          _: virtualHost:
83          virtualHost
84          // {
85            extraConfig = ''
86              import offline_page
87              ${virtualHost.extraConfig}
88            '';
89          }
90        )
91        {
92          "map.mc.gae.moe".extraConfig = ''
93            reverse_proxy ${tailnet.dijkstra}:8101
94          '';
95
96          "fin.gae.moe".extraConfig = ''
97            request_body {
98              max_size 10GB
99            }
100
101            reverse_proxy ${tailnet.dijkstra}:8096 {
102              transport http {
103                read_buffer 16KiB
104                write_buffer 16KiB
105                dial_timeout 10s
106                response_header_timeout 300s
107                keepalive 60s
108              }
109            }
110          '';
111
112          "files.gae.moe".extraConfig = ''
113            request_body {
114              max_size 10GB
115            }
116
117            reverse_proxy ${tailnet.dijkstra}:8080 {
118              transport http {
119                read_buffer 16KiB
120                write_buffer 16KiB
121                dial_timeout 10s
122                response_header_timeout 300s
123                keepalive 60s
124              }
125            }
126          '';
127
128          "img.gae.moe".extraConfig = ''
129            reverse_proxy ${tailnet.dijkstra}:2283
130          '';
131
132          "git.gae.moe, git.tools.grace.pink".extraConfig = ''
133            request_body {
134              max_size 10GB
135            }
136
137            reverse_proxy http://${tailnet.dijkstra-git}:3000 {
138              flush_interval -1
139
140              header_up X-Real-IP {remote_host}
141              header_up X-Forwarded-For {remote_host}
142              header_up X-Forwarded-Proto {scheme}
143
144              transport http {
145                read_buffer 16KiB
146                write_buffer 16KiB
147                dial_timeout 10s
148                response_header_timeout 300s
149                keepalive 60s
150              }
151            }
152          '';
153
154          "ci.gae.moe".extraConfig = ''
155            reverse_proxy ${tailnet.dijkstra-git}:8000
156          '';
157
158          "knot.gae.moe".extraConfig = ''
159            reverse_proxy ${tailnet.dijkstra-git}:5555
160          '';
161
162          "books.gae.moe".extraConfig = ''
163            reverse_proxy localhost:6822
164          '';
165
166          "term.gae.moe".extraConfig = ''
167            reverse_proxy ${tailnet.dijkstra}:8082 {
168              transport http {
169                tls_insecure_skip_verify
170              }
171            }
172          '';
173
174          "pds.gae.moe, grace.pds.gae.moe, art.pds.gae.moe".extraConfig = ''
175            encode gzip
176
177            request_body {
178              max_size 10GB
179            }
180
181            handle /xrpc/* {
182              reverse_proxy http://${tailnet.lee}:8642 {
183                header_up Host {host}
184                header_up X-Real-IP {remote_host}
185                header_up X-Forwarded-For {remote_host}
186                header_up X-Forwarded-Proto {scheme}
187                header_up Upgrade {http.request.header.Upgrade}
188                header_up Connection "Upgrade"
189                flush_interval -1
190
191                transport http {
192                  response_header_timeout 86400s
193                  keepalive 32s
194                  keepalive_idle_conns 32
195                }
196              }
197            }
198
199            handle /oauth/* {
200              reverse_proxy http://${tailnet.lee}:8642 {
201                header_up Host {host}
202                header_up X-Real-IP {remote_host}
203                header_up X-Forwarded-For {remote_host}
204                header_up X-Forwarded-Proto {scheme}
205              }
206            }
207
208            handle /.well-known/webfinger {
209              rewrite * /helpers/webfinger
210              reverse_proxy https://atlogin.net
211            }
212
213            handle {
214              reverse_proxy http://${tailnet.lee}:8642
215            }
216          '';
217        };
218  };
219}