blob: f136ba021d81d59077c9521dc193669a88dcdec4 (
plain) (
blame)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
|
{
pkgs,
lib,
...
}:
let
httpHost = "10.100.0.60";
mkWebfinger = config: file: pkgs.writeTextDir file (lib.generators.toJSON { } config);
mkWebfingers =
{ subject, ... }@config:
map (mkWebfinger config) [
subject
(lib.escapeURL subject)
];
webfingerRoot = pkgs.symlinkJoin {
name = "felschr.com-webfinger";
paths = lib.flatten (
builtins.map mkWebfingers [
{
subject = "acct:franck@fcuny.net";
links = [
{
rel = "http://openid.net/specs/connect/1.0/issuer";
href = "https://auth.fcuny.net";
}
];
}
]
);
};
in
{
networking.firewall.allowedTCPPorts = [
80
443
];
services.nginx = {
enable = true;
recommendedProxySettings = true;
recommendedGzipSettings = true;
recommendedOptimisation = true;
recommendedTlsSettings = true;
commonHttpConfig = ''
# limit clients doing too many requests
# can be tested with ab -n 20 -c 10 <host>
limit_req_zone $binary_remote_addr zone=req_limit_per_ip:10m rate=10r/s;
# limit clients opening too many connections
limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
'';
virtualHosts = {
"code.fcuny.net" = {
enableACME = true;
acmeRoot = null;
forceSSL = true;
locations."/".proxyPass = "http://${httpHost}";
};
"auth.fcuny.net" = {
enableACME = true;
acmeRoot = null;
forceSSL = true;
locations."/".proxyPass = "http://${httpHost}:9092";
};
"reader.fcuny.net" = {
enableACME = true;
acmeRoot = null;
forceSSL = true;
locations."/".proxyPass = "http://${httpHost}:8002";
};
"fcuny.net" = {
enableACME = true;
acmeRoot = null;
forceSSL = true;
locations."/".proxyPass = "http://${httpHost}:8070";
locations."/.well-known/webfinger" = {
root = webfingerRoot;
extraConfig = ''
add_header Access-Control-Allow-Origin "*";
default_type "application/jrd+json";
types { application/jrd+json json; }
if ($arg_resource) {
rewrite ^(.*)$ /$arg_resource break;
}
'';
};
};
};
};
}
|
