nix-system-configs/modules/system/traefik.nix

@@ -58,12 +58,12 @@ in {
             TARGET = " ";
 
             # Configure redirect domains - ALL domains that should be able to redirect back after challenge
-            REDIRECT_DOMAINS = "prg-radio.org,anubis.prg-radio.org,git.prg-radio.org,lgbtq.prg-radio.org,wavelog.prg-radio.org,partdb.prg-radio.org";
+            REDIRECT_DOMAINS = "prg-radio.org,git.prg-radio.org,wavelog.prg-radio.org,partdb.prg-radio.org,anubis.prg-radio.org";
 
             # Public URL for Anubis
             PUBLIC_URL = "https://anubis.prg-radio.org";
 
-            # Cookie domain for proper scoping
+            # Cookie domain for proper scoping (leading dot for all subdomains)
             COOKIE_DOMAIN = ".prg-radio.org";
 
             # Difficulty level
@@ -76,21 +76,57 @@ in {
             # Optional: webmaster email for error pages
             WEBMASTER_EMAIL = "dtu.prg@gmail.com";
 
-            # Prevents infinite loop of doom:
-            # See: https://github.com/TecharoHQ/anubis/issues/970
-            JWT_RESTRICTION_HEADER="CF-Connecting-IP";
-
             # Metrics on separate port
             METRICS_BIND_NETWORK = "tcp";
             METRICS_BIND = "127.0.0.1:8091";
-
-            SLOG_LEVEL = "DEBUG";
-
-            COOKIE_SECURE = true;
-            COOKIE_SAME_SITE = "None"; # Only if Secure=true and you need cross-site
           };
         };
 
+        # Per-service Anubis instances (reverse-proxy mode) ---------------------------
+        forgejo = {
+          enable = true;
+          settings = {
+            BIND_NETWORK = "tcp";
+            BIND = "127.0.0.1:8092";
+            TARGET = "http://10.1.1.4:3000"; # Forgejo backend
+            DIFFICULTY = 20;
+            SERVE_ROBOTS_TXT = true;
+            WEBMASTER_EMAIL = "dtu.prg@gmail.com";
+            METRICS_BIND_NETWORK = "tcp";
+            METRICS_BIND = "127.0.0.1:8095";
+          };
+        };
+
+        /*
+        wavelog = {
+          enable = true;
+          settings = {
+            BIND_NETWORK = "tcp";
+            BIND = "127.0.0.1:8093";
+            TARGET = "http://10.1.1.249:8086"; # Wavelog backend
+            DIFFICULTY = 20;
+            SERVE_ROBOTS_TXT = true;
+            WEBMASTER_EMAIL = "dtu.prg@gmail.com";
+            METRICS_BIND_NETWORK = "tcp";
+            METRICS_BIND = "127.0.0.1:8096";
+          };
+        };
+        */
+
+        # This part needs investigating
+        partdb = {
+          enable = true;
+          settings = {
+            BIND_NETWORK = "tcp";
+            BIND = "127.0.0.1:8094";
+            TARGET = "http://10.1.1.249:8087"; # PartDB backend
+            DIFFICULTY = 20;
+            SERVE_ROBOTS_TXT = true;
+            WEBMASTER_EMAIL = "dtu.prg@gmail.com";
+            METRICS_BIND_NETWORK = "tcp";
+            METRICS_BIND = "127.0.0.1:8097";
+          };
+        };
       };
     };
 
@@ -154,46 +190,36 @@ in {
           }
         ];
 
-        # Traefik middlewares: Anubis forwardAuth
-        http.middlewares = {
-          anubisForwardAuth = {
-            forwardAuth = {
-              # point at the Anubis check endpoint (the subrequest/UI instance)
-              address = "http://127.0.0.1:8090/.within.website/x/cmd/anubis/api/check";
-            };
-          };
-          redirect-to-https = {
-            redirectScheme = {
-              scheme = "https";
-            };
-          };
-        };
-
         http.routers = {
+          #anubis-api = {
+          #  rule = "Host(`anubis.prg-radio.org`) && PathPrefix(`/.within.website/x/cmd/anubis/api`)";
+          #  service = "anubis";
+          #   entryPoints = ["websecure"];
+          #  priority = 200;
+          #   tls = {};
+          # };
+
           # Anubis router (for challenge page)
           anubis = {
             rule = "Host(`anubis.prg-radio.org`)";
             service = "anubis";
-            entryPoints = [ "websecure" ];
+            entryPoints = ["websecure"];
-            tls = {
+            tls = {};
-                certresolver = "acme";
-            };
           };
 
-          # Protected service example: Forgejo (attach Anubis forwardAuth middleware)
+          # Protected service example: Forgejo
           forgejo = {
             rule = "Host(`git.prg-radio.org`)";
             service = "forgejo";
-            entryPoints = [ "websecure" ];
+            entryPoints = ["websecure"];
             tls = {};
-            middlewares = [ "anubisForwardAuth" ];
           };
 
           # Matrix HTTP router for client requests (Element etc.)
           matrix = {
             rule = "Host(`lgbtq.prg-radio.org`)";
             service = "matrix";
-            entryPoints = [ "websecure" ];
+            entryPoints = ["websecure"];
             tls = {};
           };
 
@@ -201,7 +227,7 @@ in {
           wavelog = {
             rule = "Host(`wavelog.prg-radio.org`)";
             service = "wavelog";
-            entryPoints = [ "websecure" ];
+            entryPoints = ["websecure"];
             tls = {};
           };
 
@@ -209,9 +235,8 @@ in {
           partdb = {
             rule = "Host(`partdb.prg-radio.org`)";
             service = "partdb";
-            entryPoints = [ "websecure" ];
+            entryPoints = ["websecure"];
             tls = {};
-            middlewares = [ "anubisForwardAuth" ];
           };
         };
 
@@ -221,11 +246,12 @@ in {
             servers = [
               {url = "http://127.0.0.1:8090";}
             ];
+            #passHostHeader = true;
           };
 
           forgejo.loadBalancer = {
             servers = [
-              {url = "http://10.1.1.4:3000";}
+              {url = "http://127.0.0.1:8092";}
             ];
           };
           matrix.loadBalancer = {
@@ -241,7 +267,7 @@ in {
 
           partdb.loadBalancer = {
             servers = [
-              {url = "http://10.1.1.249:8087";}
+              {url = "http://127.0.0.1:8094";}
             ];
           };
         };
@@ -344,4 +370,4 @@ in {
 
     system.stateVersion = "25.11";
   };
-}
+}