From 7b8600e5ecdc993dffc2819641870d35c2a21c6b Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 14 Feb 2026 00:26:41 +0100 Subject: [PATCH 1/8] Try to investigate excessive soul weighing. --- nix-system-configs/modules/system/traefik.nix | 41 ++++++++++++++++++- 1 file changed, 40 insertions(+), 1 deletion(-) diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix index d66236b..a53ea75 100644 --- a/nix-system-configs/modules/system/traefik.nix +++ b/nix-system-configs/modules/system/traefik.nix @@ -212,6 +212,8 @@ in { rule = "Host(`git.prg-radio.org`)"; service = "forgejo"; entryPoints = ["websecure"]; + # Ensure upstream receives standard proxy headers + middlewares = ["anubis-proxy-headers-forgejo"]; tls = {}; }; @@ -236,23 +238,59 @@ in { rule = "Host(`partdb.prg-radio.org`)"; service = "partdb"; entryPoints = ["websecure"]; + # Ensure upstream receives standard proxy headers + middlewares = ["anubis-proxy-headers-partdb"]; tls = {}; }; }; + # Middlewares that inject proxy-style headers (per service) + http.middlewares = { + anubis-proxy-headers-forgejo = { + headers = { + customRequestHeaders = { + # Indicate original scheme; the TLS termination at Traefik is HTTPS + "X-Forwarded-Proto" = "https"; + # Tell the backend which host the client used + "X-Forwarded-Host" = "git.prg-radio.org"; + # Original destination port + "X-Forwarded-Port" = "443"; + # Common nginx-style proxy headers for parity testing + "Host" = "git.prg-radio.org"; + "X-Real-IP" = "${X-Forwarded-For}"; # placeholder - will be literal if not supported + "X-Http-Version" = "HTTP/2"; + }; + }; + }; + + anubis-proxy-headers-partdb = { + headers = { + customRequestHeaders = { + "X-Forwarded-Proto" = "https"; + "X-Forwarded-Host" = "partdb.prg-radio.org"; + "X-Forwarded-Port" = "443"; + "Host" = "partdb.prg-radio.org"; + "X-Real-IP" = "${X-Forwarded-For}"; # placeholder - will be literal if not supported + "X-Http-Version" = "HTTP/2"; + }; + }; + }; + }; + http.services = { # Anubis service (challenge UI / redirect endpoint) anubis.loadBalancer = { servers = [ {url = "http://127.0.0.1:8090";} ]; - #passHostHeader = true; + passHostHeader = true; }; forgejo.loadBalancer = { servers = [ {url = "http://127.0.0.1:8092";} ]; + passHostHeader = true; }; matrix.loadBalancer = { servers = [ @@ -269,6 +307,7 @@ in { servers = [ {url = "http://127.0.0.1:8094";} ]; + passHostHeader = true; }; }; From 40f02be01c052b05711d3e50c1edfa7b85752489 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 14 Feb 2026 00:28:11 +0100 Subject: [PATCH 2/8] Revert it. --- nix-system-configs/modules/system/traefik.nix | 41 +------------------ 1 file changed, 1 insertion(+), 40 deletions(-) diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix index a53ea75..d66236b 100644 --- a/nix-system-configs/modules/system/traefik.nix +++ b/nix-system-configs/modules/system/traefik.nix @@ -212,8 +212,6 @@ in { rule = "Host(`git.prg-radio.org`)"; service = "forgejo"; entryPoints = ["websecure"]; - # Ensure upstream receives standard proxy headers - middlewares = ["anubis-proxy-headers-forgejo"]; tls = {}; }; @@ -238,59 +236,23 @@ in { rule = "Host(`partdb.prg-radio.org`)"; service = "partdb"; entryPoints = ["websecure"]; - # Ensure upstream receives standard proxy headers - middlewares = ["anubis-proxy-headers-partdb"]; tls = {}; }; }; - # Middlewares that inject proxy-style headers (per service) - http.middlewares = { - anubis-proxy-headers-forgejo = { - headers = { - customRequestHeaders = { - # Indicate original scheme; the TLS termination at Traefik is HTTPS - "X-Forwarded-Proto" = "https"; - # Tell the backend which host the client used - "X-Forwarded-Host" = "git.prg-radio.org"; - # Original destination port - "X-Forwarded-Port" = "443"; - # Common nginx-style proxy headers for parity testing - "Host" = "git.prg-radio.org"; - "X-Real-IP" = "${X-Forwarded-For}"; # placeholder - will be literal if not supported - "X-Http-Version" = "HTTP/2"; - }; - }; - }; - - anubis-proxy-headers-partdb = { - headers = { - customRequestHeaders = { - "X-Forwarded-Proto" = "https"; - "X-Forwarded-Host" = "partdb.prg-radio.org"; - "X-Forwarded-Port" = "443"; - "Host" = "partdb.prg-radio.org"; - "X-Real-IP" = "${X-Forwarded-For}"; # placeholder - will be literal if not supported - "X-Http-Version" = "HTTP/2"; - }; - }; - }; - }; - http.services = { # Anubis service (challenge UI / redirect endpoint) anubis.loadBalancer = { servers = [ {url = "http://127.0.0.1:8090";} ]; - passHostHeader = true; + #passHostHeader = true; }; forgejo.loadBalancer = { servers = [ {url = "http://127.0.0.1:8092";} ]; - passHostHeader = true; }; matrix.loadBalancer = { servers = [ @@ -307,7 +269,6 @@ in { servers = [ {url = "http://127.0.0.1:8094";} ]; - passHostHeader = true; }; }; From 4d65b091ac5f1bae1b7ab86a108ba694c78e0cbc Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 14 Feb 2026 00:37:51 +0100 Subject: [PATCH 3/8] Try middle ware again --- nix-system-configs/modules/system/traefik.nix | 79 ++++++------------- 1 file changed, 26 insertions(+), 53 deletions(-) diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix index d66236b..3fd1070 100644 --- a/nix-system-configs/modules/system/traefik.nix +++ b/nix-system-configs/modules/system/traefik.nix @@ -46,25 +46,26 @@ in { # Configure Anubis service services.anubis = { + # Use a single shared Anubis instance (redirect mode) so cookie + challenge + # state is consistent across all protected services. instances = { - "" = { + shared = { enable = true; settings = { - # Bind to TCP instead of Unix socket for Docker-style integration BIND_NETWORK = "tcp"; BIND = "127.0.0.1:8090"; - # Empty TARGET for redirect mode + # Redirect mode (Anubis will issue challenges & redirects) TARGET = " "; - # Configure redirect domains - ALL domains that should be able to redirect back after challenge + # Which domains are allowed to be redirected back to REDIRECT_DOMAINS = "prg-radio.org,git.prg-radio.org,wavelog.prg-radio.org,partdb.prg-radio.org,anubis.prg-radio.org"; - # Public URL for Anubis + # Public URL for this Anubis instance PUBLIC_URL = "https://anubis.prg-radio.org"; - # Cookie domain for proper scoping (leading dot for all subdomains) - COOKIE_DOMAIN = ".prg-radio.org"; + # Use bare domain for cookie scoping (modern browsers prefer no leading dot) + COOKIE_DOMAIN = "prg-radio.org"; # Difficulty level DIFFICULTY = 7; @@ -81,52 +82,6 @@ in { METRICS_BIND = "127.0.0.1:8091"; }; }; - - # Per-service Anubis instances (reverse-proxy mode) --------------------------- - forgejo = { - enable = true; - settings = { - BIND_NETWORK = "tcp"; - BIND = "127.0.0.1:8092"; - TARGET = "http://10.1.1.4:3000"; # Forgejo backend - DIFFICULTY = 20; - SERVE_ROBOTS_TXT = true; - WEBMASTER_EMAIL = "dtu.prg@gmail.com"; - METRICS_BIND_NETWORK = "tcp"; - METRICS_BIND = "127.0.0.1:8095"; - }; - }; - - /* - wavelog = { - enable = true; - settings = { - BIND_NETWORK = "tcp"; - BIND = "127.0.0.1:8093"; - TARGET = "http://10.1.1.249:8086"; # Wavelog backend - DIFFICULTY = 20; - SERVE_ROBOTS_TXT = true; - WEBMASTER_EMAIL = "dtu.prg@gmail.com"; - METRICS_BIND_NETWORK = "tcp"; - METRICS_BIND = "127.0.0.1:8096"; - }; - }; - */ - - # This part needs investigating - partdb = { - enable = true; - settings = { - BIND_NETWORK = "tcp"; - BIND = "127.0.0.1:8094"; - TARGET = "http://10.1.1.249:8087"; # PartDB backend - DIFFICULTY = 20; - SERVE_ROBOTS_TXT = true; - WEBMASTER_EMAIL = "dtu.prg@gmail.com"; - METRICS_BIND_NETWORK = "tcp"; - METRICS_BIND = "127.0.0.1:8097"; - }; - }; }; }; @@ -190,6 +145,20 @@ in { } ]; + # ForwardAuth middleware so a single Anubis instance can protect many services + http.middlewares = lib.mkForce (lib.mkMerge [ (lib.optionalAttrs true { + anubis = { + forwardAuth = { + address = "http://127.0.0.1:8090/.within.website/x/cmd/anubis/api/check"; + trustForwardHeader = true; + # Ensure Traefik forwards Set-Cookie from Anubis back to the client + authResponseHeaders = [ "Set-Cookie" ]; + # Forward original host and proto so Anubis computes redirects correctly + authRequestHeaders = [ "X-Forwarded-Host" "X-Forwarded-Proto" ]; + }; + }; + }) ]); + http.routers = { #anubis-api = { # rule = "Host(`anubis.prg-radio.org`) && PathPrefix(`/.within.website/x/cmd/anubis/api`)"; @@ -212,6 +181,8 @@ in { rule = "Host(`git.prg-radio.org`)"; service = "forgejo"; entryPoints = ["websecure"]; + # Protect via shared Anubis using forwardAuth + middlewares = ["anubis"]; tls = {}; }; @@ -236,6 +207,8 @@ in { rule = "Host(`partdb.prg-radio.org`)"; service = "partdb"; entryPoints = ["websecure"]; + # Protect via shared Anubis using forwardAuth + middlewares = ["anubis"]; tls = {}; }; }; From e3bf73e96e1d24547f45c7c09e917c173cba8614 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 14 Feb 2026 00:40:14 +0100 Subject: [PATCH 4/8] Bring back the current solution again. --- nix-system-configs/modules/system/traefik.nix | 79 +++++++++++++------ 1 file changed, 53 insertions(+), 26 deletions(-) diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix index 3fd1070..d66236b 100644 --- a/nix-system-configs/modules/system/traefik.nix +++ b/nix-system-configs/modules/system/traefik.nix @@ -46,26 +46,25 @@ in { # Configure Anubis service services.anubis = { - # Use a single shared Anubis instance (redirect mode) so cookie + challenge - # state is consistent across all protected services. instances = { - shared = { + "" = { enable = true; settings = { + # Bind to TCP instead of Unix socket for Docker-style integration BIND_NETWORK = "tcp"; BIND = "127.0.0.1:8090"; - # Redirect mode (Anubis will issue challenges & redirects) + # Empty TARGET for redirect mode TARGET = " "; - # Which domains are allowed to be redirected back to + # Configure redirect domains - ALL domains that should be able to redirect back after challenge REDIRECT_DOMAINS = "prg-radio.org,git.prg-radio.org,wavelog.prg-radio.org,partdb.prg-radio.org,anubis.prg-radio.org"; - # Public URL for this Anubis instance + # Public URL for Anubis PUBLIC_URL = "https://anubis.prg-radio.org"; - # Use bare domain for cookie scoping (modern browsers prefer no leading dot) - COOKIE_DOMAIN = "prg-radio.org"; + # Cookie domain for proper scoping (leading dot for all subdomains) + COOKIE_DOMAIN = ".prg-radio.org"; # Difficulty level DIFFICULTY = 7; @@ -82,6 +81,52 @@ in { METRICS_BIND = "127.0.0.1:8091"; }; }; + + # Per-service Anubis instances (reverse-proxy mode) --------------------------- + forgejo = { + enable = true; + settings = { + BIND_NETWORK = "tcp"; + BIND = "127.0.0.1:8092"; + TARGET = "http://10.1.1.4:3000"; # Forgejo backend + DIFFICULTY = 20; + SERVE_ROBOTS_TXT = true; + WEBMASTER_EMAIL = "dtu.prg@gmail.com"; + METRICS_BIND_NETWORK = "tcp"; + METRICS_BIND = "127.0.0.1:8095"; + }; + }; + + /* + wavelog = { + enable = true; + settings = { + BIND_NETWORK = "tcp"; + BIND = "127.0.0.1:8093"; + TARGET = "http://10.1.1.249:8086"; # Wavelog backend + DIFFICULTY = 20; + SERVE_ROBOTS_TXT = true; + WEBMASTER_EMAIL = "dtu.prg@gmail.com"; + METRICS_BIND_NETWORK = "tcp"; + METRICS_BIND = "127.0.0.1:8096"; + }; + }; + */ + + # This part needs investigating + partdb = { + enable = true; + settings = { + BIND_NETWORK = "tcp"; + BIND = "127.0.0.1:8094"; + TARGET = "http://10.1.1.249:8087"; # PartDB backend + DIFFICULTY = 20; + SERVE_ROBOTS_TXT = true; + WEBMASTER_EMAIL = "dtu.prg@gmail.com"; + METRICS_BIND_NETWORK = "tcp"; + METRICS_BIND = "127.0.0.1:8097"; + }; + }; }; }; @@ -145,20 +190,6 @@ in { } ]; - # ForwardAuth middleware so a single Anubis instance can protect many services - http.middlewares = lib.mkForce (lib.mkMerge [ (lib.optionalAttrs true { - anubis = { - forwardAuth = { - address = "http://127.0.0.1:8090/.within.website/x/cmd/anubis/api/check"; - trustForwardHeader = true; - # Ensure Traefik forwards Set-Cookie from Anubis back to the client - authResponseHeaders = [ "Set-Cookie" ]; - # Forward original host and proto so Anubis computes redirects correctly - authRequestHeaders = [ "X-Forwarded-Host" "X-Forwarded-Proto" ]; - }; - }; - }) ]); - http.routers = { #anubis-api = { # rule = "Host(`anubis.prg-radio.org`) && PathPrefix(`/.within.website/x/cmd/anubis/api`)"; @@ -181,8 +212,6 @@ in { rule = "Host(`git.prg-radio.org`)"; service = "forgejo"; entryPoints = ["websecure"]; - # Protect via shared Anubis using forwardAuth - middlewares = ["anubis"]; tls = {}; }; @@ -207,8 +236,6 @@ in { rule = "Host(`partdb.prg-radio.org`)"; service = "partdb"; entryPoints = ["websecure"]; - # Protect via shared Anubis using forwardAuth - middlewares = ["anubis"]; tls = {}; }; }; From 8bf3695bf48d48348aa3337e4ca807da3629e3df Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 14 Feb 2026 00:48:58 +0100 Subject: [PATCH 5/8] Try to hopefully excessive soul weighting. --- nix-system-configs/modules/system/traefik.nix | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix index d66236b..091ebdd 100644 --- a/nix-system-configs/modules/system/traefik.nix +++ b/nix-system-configs/modules/system/traefik.nix @@ -64,7 +64,7 @@ in { PUBLIC_URL = "https://anubis.prg-radio.org"; # Cookie domain for proper scoping (leading dot for all subdomains) - COOKIE_DOMAIN = ".prg-radio.org"; + COOKIE_DOMAIN = "prg-radio.org"; # Difficulty level DIFFICULTY = 7; @@ -91,9 +91,11 @@ in { TARGET = "http://10.1.1.4:3000"; # Forgejo backend DIFFICULTY = 20; SERVE_ROBOTS_TXT = true; + COOKIE_DOMAIN = "prg-radio.org"; WEBMASTER_EMAIL = "dtu.prg@gmail.com"; METRICS_BIND_NETWORK = "tcp"; METRICS_BIND = "127.0.0.1:8095"; + ED25519_PRIVATE_KEY_HEX_FILE = "/home/traefikprg/sign-key.hex"; }; }; @@ -125,6 +127,8 @@ in { WEBMASTER_EMAIL = "dtu.prg@gmail.com"; METRICS_BIND_NETWORK = "tcp"; METRICS_BIND = "127.0.0.1:8097"; + COOKIE_DOMAIN = "prg-radio.org"; + ED25519_PRIVATE_KEY_HEX_FILE = "/home/traefikprg/sign-key.hex"; }; }; }; From b359b09cb56f78c3d28a9688b60914d6e7fddd3f Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 14 Feb 2026 00:54:57 +0100 Subject: [PATCH 6/8] Fix the keys. --- nix-system-configs/modules/system/traefik.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix index 091ebdd..cf8d713 100644 --- a/nix-system-configs/modules/system/traefik.nix +++ b/nix-system-configs/modules/system/traefik.nix @@ -95,7 +95,7 @@ in { WEBMASTER_EMAIL = "dtu.prg@gmail.com"; METRICS_BIND_NETWORK = "tcp"; METRICS_BIND = "127.0.0.1:8095"; - ED25519_PRIVATE_KEY_HEX_FILE = "/home/traefikprg/sign-key.hex"; + ED25519_PRIVATE_KEY_HEX_FILE = "/etc/anubis/sign-key.hex"; }; }; @@ -128,7 +128,7 @@ in { METRICS_BIND_NETWORK = "tcp"; METRICS_BIND = "127.0.0.1:8097"; COOKIE_DOMAIN = "prg-radio.org"; - ED25519_PRIVATE_KEY_HEX_FILE = "/home/traefikprg/sign-key.hex"; + ED25519_PRIVATE_KEY_HEX_FILE = "/etc/anubis/sign-key.hex"; }; }; }; From b7264e0524a6ab112f476568587b87d0a812d0b3 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 14 Feb 2026 01:00:21 +0100 Subject: [PATCH 7/8] More fix cookie --- nix-system-configs/modules/system/traefik.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix index cf8d713..428c217 100644 --- a/nix-system-configs/modules/system/traefik.nix +++ b/nix-system-configs/modules/system/traefik.nix @@ -91,7 +91,7 @@ in { TARGET = "http://10.1.1.4:3000"; # Forgejo backend DIFFICULTY = 20; SERVE_ROBOTS_TXT = true; - COOKIE_DOMAIN = "prg-radio.org"; + COOKIE_DOMAIN = "git.prg-radio.org"; WEBMASTER_EMAIL = "dtu.prg@gmail.com"; METRICS_BIND_NETWORK = "tcp"; METRICS_BIND = "127.0.0.1:8095"; @@ -127,7 +127,7 @@ in { WEBMASTER_EMAIL = "dtu.prg@gmail.com"; METRICS_BIND_NETWORK = "tcp"; METRICS_BIND = "127.0.0.1:8097"; - COOKIE_DOMAIN = "prg-radio.org"; + COOKIE_DOMAIN = "partdb.prg-radio.org"; ED25519_PRIVATE_KEY_HEX_FILE = "/etc/anubis/sign-key.hex"; }; }; From 0ebf6007b7b015976713067f03663fcc3e38fbe0 Mon Sep 17 00:00:00 2001 From: Christine Elisabeth Koppel Date: Sat, 14 Feb 2026 01:04:26 +0100 Subject: [PATCH 8/8] Revert changes. --- nix-system-configs/modules/system/traefik.nix | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix index 428c217..d66236b 100644 --- a/nix-system-configs/modules/system/traefik.nix +++ b/nix-system-configs/modules/system/traefik.nix @@ -64,7 +64,7 @@ in { PUBLIC_URL = "https://anubis.prg-radio.org"; # Cookie domain for proper scoping (leading dot for all subdomains) - COOKIE_DOMAIN = "prg-radio.org"; + COOKIE_DOMAIN = ".prg-radio.org"; # Difficulty level DIFFICULTY = 7; @@ -91,11 +91,9 @@ in { TARGET = "http://10.1.1.4:3000"; # Forgejo backend DIFFICULTY = 20; SERVE_ROBOTS_TXT = true; - COOKIE_DOMAIN = "git.prg-radio.org"; WEBMASTER_EMAIL = "dtu.prg@gmail.com"; METRICS_BIND_NETWORK = "tcp"; METRICS_BIND = "127.0.0.1:8095"; - ED25519_PRIVATE_KEY_HEX_FILE = "/etc/anubis/sign-key.hex"; }; }; @@ -127,8 +125,6 @@ in { WEBMASTER_EMAIL = "dtu.prg@gmail.com"; METRICS_BIND_NETWORK = "tcp"; METRICS_BIND = "127.0.0.1:8097"; - COOKIE_DOMAIN = "partdb.prg-radio.org"; - ED25519_PRIVATE_KEY_HEX_FILE = "/etc/anubis/sign-key.hex"; }; }; };