grace/dots

dotfiles/nix configs

git clone https://git.gae.moe/grace/dots

Grace Yodermore stuff4db52e6

wafrn-testing
branchesidkmainvulcanwafrn-testingall refs →
5.8 KiB218 linesraw
1{ config, ... }:
2
3let
4  tailnet = import ../tailnet.nix;
5in
6{
7  networking.firewall.allowedTCPPorts = [
8    # 22
9    25565
10    80
11    443
12  ];
13
14  # systemd.sockets.git-ssh-proxy = {
15  #   wantedBy = [ "sockets.target" ];
16  #   listenStreams = [ "0.0.0.0:22" ];
17  # };
18
19  # systemd.services.git-ssh-proxy = {
20  #   description = "TCP proxy for Git SSH";
21  #   requires = [ "git-ssh-proxy.socket" ];
22  #   serviceConfig = {
23  #     ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd ${tailnet.dijkstra-git}:22";
24  #     DynamicUser = true;
25  #   };
26  # };
27
28  systemd.sockets.minecraft-proxy = {
29    wantedBy = [ "sockets.target" ];
30    listenStreams = [ "0.0.0.0:25565" ];
31  };
32
33  systemd.services.minecraft-proxy = {
34    description = "TCP proxy for Minecraft";
35    requires = [ "minecraft-proxy.socket" ];
36    serviceConfig = {
37      ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd ${tailnet.dijkstra}:25565";
38      DynamicUser = true;
39    };
40  };
41
42  services.caddy = {
43    enable = true;
44
45    extraConfig = ''
46      # TODO: make it nice
47      (offline_page) {
48        handle_errors {
49          @offline expression {err.status_code} in [502, 503, 504]
50
51          handle @offline {
52            header Content-Type "text/html; charset=utf-8"
53            header Cache-Control "no-store"
54            respond <<HTML
55              <!doctype html>
56              <html lang="en">
57                <head>
58                  <title>Service temporarily offline</title>
59                </head>
60                <body>
61                  <main>
62                    <h1>Page Down</h1>
63                    <p>If you are seeing this, the backend server is offline. It should be back up soon so check again later.</p>
64                    <p class="status">Error {err.status_code}</p>
65                  </main>
66                </body>
67              </html>
68              HTML {err.status_code}
69          }
70
71          handle {
72            respond "{err.status_code} — {err.status_text}" {err.status_code}
73          }
74        }
75      }
76    '';
77
78    virtualHosts =
79      builtins.mapAttrs
80        (
81          _: virtualHost:
82          virtualHost
83          // {
84            extraConfig = ''
85              import offline_page
86              ${virtualHost.extraConfig}
87            '';
88          }
89        )
90        {
91          "map.mc.gae.moe".extraConfig = ''
92            reverse_proxy ${tailnet.dijkstra}:8101
93          '';
94
95          "fin.gae.moe".extraConfig = ''
96            request_body {
97              max_size 10GB
98            }
99
100            reverse_proxy ${tailnet.dijkstra}:8096 {
101              transport http {
102                read_buffer 16KiB
103                write_buffer 16KiB
104                dial_timeout 10s
105                response_header_timeout 300s
106                keepalive 60s
107              }
108            }
109          '';
110
111          "files.gae.moe".extraConfig = ''
112            request_body {
113              max_size 10GB
114            }
115
116            reverse_proxy ${tailnet.dijkstra}:8080 {
117              transport http {
118                read_buffer 16KiB
119                write_buffer 16KiB
120                dial_timeout 10s
121                response_header_timeout 300s
122                keepalive 60s
123              }
124            }
125          '';
126
127          "img.gae.moe".extraConfig = ''
128            reverse_proxy ${tailnet.dijkstra}:2283
129          '';
130
131          "git.gae.moe, git.tools.grace.pink".extraConfig = ''
132            request_body {
133              max_size 10GB
134            }
135
136            reverse_proxy http://${tailnet.dijkstra-git}:3000 {
137              flush_interval -1
138
139              header_up X-Real-IP {remote_host}
140              header_up X-Forwarded-For {remote_host}
141              header_up X-Forwarded-Proto {scheme}
142
143              transport http {
144                read_buffer 16KiB
145                write_buffer 16KiB
146                dial_timeout 10s
147                response_header_timeout 300s
148                keepalive 60s
149              }
150            }
151          '';
152
153          "ci.gae.moe".extraConfig = ''
154            reverse_proxy ${tailnet.dijkstra-git}:8000
155          '';
156
157          "knot.gae.moe".extraConfig = ''
158            reverse_proxy ${tailnet.dijkstra-git}:5555
159          '';
160
161          "books.gae.moe".extraConfig = ''
162            reverse_proxy localhost:6822
163          '';
164
165          "term.gae.moe".extraConfig = ''
166            reverse_proxy ${tailnet.dijkstra}:8082 {
167              transport http {
168                tls_insecure_skip_verify
169              }
170            }
171          '';
172
173          "pds.gae.moe, grace.pds.gae.moe, art.pds.gae.moe".extraConfig = ''
174            encode gzip
175
176            request_body {
177              max_size 10GB
178            }
179
180            handle /xrpc/* {
181              reverse_proxy http://${tailnet.lee}:8642 {
182                header_up Host {host}
183                header_up X-Real-IP {remote_host}
184                header_up X-Forwarded-For {remote_host}
185                header_up X-Forwarded-Proto {scheme}
186                header_up Upgrade {http.request.header.Upgrade}
187                header_up Connection "Upgrade"
188                flush_interval -1
189
190                transport http {
191                  response_header_timeout 86400s
192                  keepalive 32s
193                  keepalive_idle_conns 32
194                }
195              }
196            }
197
198            handle /oauth/* {
199              reverse_proxy http://${tailnet.lee}:8642 {
200                header_up Host {host}
201                header_up X-Real-IP {remote_host}
202                header_up X-Forwarded-For {remote_host}
203                header_up X-Forwarded-Proto {scheme}
204              }
205            }
206
207            handle /.well-known/webfinger {
208              rewrite * /helpers/webfinger
209              reverse_proxy https://atlogin.net
210            }
211
212            handle {
213              reverse_proxy http://${tailnet.lee}:8642
214            }
215          '';
216        };
217  };
218}