root/the_prg_server_configuration
1
0
Fork 0
mirror of https://codeberg.org/polyteknisk-radiogruppe/the_prg_server_configuration.git synced 2026-10-21 03:15:46 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

Compare commits

base: root:0ebf6007b7b015976713067f03663fcc3e38fbe0
Branches Tags
root:main
...
compare: root:11a870a60fb983f9cddd0a18e337d84a191ddb7b
Branches Tags
root:main

3 commits
0ebf6007b7 ... 11a870a60f

Author SHA1 Message Date
Christine Elisabeth Koppel
11a870a60f
Config works, now Anubis is properly added. 2026-02-14 12:49:34 +01:00
Christine Elisabeth Koppel
c5bf309d5b
Nope, nope wrong config. 2026-02-14 12:17:49 +01:00
Christine Elisabeth Koppel
9b7d1ca52d
Anubis middleware added and working this time. 2026-02-14 12:12:50 +01:00
1 changed files with 40 additions and 66 deletions
Download patch file Download diff file Expand all files Collapse all files

106
nix-system-configs/modules/system/traefik.nix
View file

@ -58,12 +58,12 @@ in {
TARGET = " ";
# Configure redirect domains - ALL domains that should be able to redirect back after challenge
REDIRECT_DOMAINS = "prg-radio.org,git.prg-radio.org,wavelog.prg-radio.org,partdb.prg-radio.org,anubis.prg-radio.org";
REDIRECT_DOMAINS = "prg-radio.org,anubis.prg-radio.org,git.prg-radio.org,lgbtq.prg-radio.org,wavelog.prg-radio.org,partdb.prg-radio.org";
# Public URL for Anubis
PUBLIC_URL = "https://anubis.prg-radio.org";
# Cookie domain for proper scoping (leading dot for all subdomains)
# Cookie domain for proper scoping
COOKIE_DOMAIN = ".prg-radio.org";
# Difficulty level
@ -76,57 +76,21 @@ in {
# Optional: webmaster email for error pages
WEBMASTER_EMAIL = "dtu.prg@gmail.com";
# Prevents infinite loop of doom:
# See: https://github.com/TecharoHQ/anubis/issues/970
JWT_RESTRICTION_HEADER="CF-Connecting-IP";
# Metrics on separate port
METRICS_BIND_NETWORK = "tcp";
METRICS_BIND = "127.0.0.1:8091";
SLOG_LEVEL = "DEBUG";
COOKIE_SECURE = true;
COOKIE_SAME_SITE = "None"; # Only if Secure=true and you need cross-site
};
};
# Per-service Anubis instances (reverse-proxy mode) ---------------------------
forgejo = {
enable = true;
settings = {
BIND_NETWORK = "tcp";
BIND = "127.0.0.1:8092";
TARGET = "http://10.1.1.4:3000"; # Forgejo backend
DIFFICULTY = 20;
SERVE_ROBOTS_TXT = true;
WEBMASTER_EMAIL = "dtu.prg@gmail.com";
METRICS_BIND_NETWORK = "tcp";
METRICS_BIND = "127.0.0.1:8095";
};
};
/*
wavelog = {
enable = true;
settings = {
BIND_NETWORK = "tcp";
BIND = "127.0.0.1:8093";
TARGET = "http://10.1.1.249:8086"; # Wavelog backend
DIFFICULTY = 20;
SERVE_ROBOTS_TXT = true;
WEBMASTER_EMAIL = "dtu.prg@gmail.com";
METRICS_BIND_NETWORK = "tcp";
METRICS_BIND = "127.0.0.1:8096";
};
};
*/
# This part needs investigating
partdb = {
enable = true;
settings = {
BIND_NETWORK = "tcp";
BIND = "127.0.0.1:8094";
TARGET = "http://10.1.1.249:8087"; # PartDB backend
DIFFICULTY = 20;
SERVE_ROBOTS_TXT = true;
WEBMASTER_EMAIL = "dtu.prg@gmail.com";
METRICS_BIND_NETWORK = "tcp";
METRICS_BIND = "127.0.0.1:8097";
};
};
};
};
@ -190,36 +154,46 @@ in {
}
];
http.routers = {
#anubis-api = {
# rule = "Host(`anubis.prg-radio.org`) && PathPrefix(`/.within.website/x/cmd/anubis/api`)";
# service = "anubis";
# entryPoints = ["websecure"];
# priority = 200;
# tls = {};
# };
# Traefik middlewares: Anubis forwardAuth
http.middlewares = {
anubisForwardAuth = {
forwardAuth = {
# point at the Anubis check endpoint (the subrequest/UI instance)
address = "http://127.0.0.1:8090/.within.website/x/cmd/anubis/api/check";
};
};
redirect-to-https = {
redirectScheme = {
scheme = "https";
};
};
};
http.routers = {
# Anubis router (for challenge page)
anubis = {
rule = "Host(`anubis.prg-radio.org`)";
service = "anubis";
entryPoints = ["websecure"];
tls = {};
entryPoints = [ "websecure" ];
tls = {
certresolver = "acme";
};
};
# Protected service example: Forgejo
# Protected service example: Forgejo (attach Anubis forwardAuth middleware)
forgejo = {
rule = "Host(`git.prg-radio.org`)";
service = "forgejo";
entryPoints = ["websecure"];
entryPoints = [ "websecure" ];
tls = {};
middlewares = [ "anubisForwardAuth" ];
};
# Matrix HTTP router for client requests (Element etc.)
matrix = {
rule = "Host(`lgbtq.prg-radio.org`)";
service = "matrix";
entryPoints = ["websecure"];
entryPoints = [ "websecure" ];
tls = {};
};
@ -227,7 +201,7 @@ in {
wavelog = {
rule = "Host(`wavelog.prg-radio.org`)";
service = "wavelog";
entryPoints = ["websecure"];
entryPoints = [ "websecure" ];
tls = {};
};
@ -235,8 +209,9 @@ in {
partdb = {
rule = "Host(`partdb.prg-radio.org`)";
service = "partdb";
entryPoints = ["websecure"];
entryPoints = [ "websecure" ];
tls = {};
middlewares = [ "anubisForwardAuth" ];
};
};
@ -246,12 +221,11 @@ in {
servers = [
{url = "http://127.0.0.1:8090";}
];
#passHostHeader = true;
};
forgejo.loadBalancer = {
servers = [
{url = "http://127.0.0.1:8092";}
{url = "http://10.1.1.4:3000";}
];
};
matrix.loadBalancer = {
@ -267,7 +241,7 @@ in {
partdb.loadBalancer = {
servers = [
{url = "http://127.0.0.1:8094";}
{url = "http://10.1.1.249:8087";}
];
};
};
@ -370,4 +344,4 @@ in {
system.stateVersion = "25.11";
};
}
}