imxyy1soope1/nixos-dotfiles
1
0
Fork 0
Code Issues Pull Requests Actions Activity

server: centralize frp web proxies and enable proxy protocol

Browse Source
This commit is contained in:
imxyy1soope1
2026-07-24 14:03:08 +08:00
parent 5e6a75fcc1
commit 2e5f40c70d
15 changed files with 99 additions and 318 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/imxyy-nix-server/caddy.nix
+12
View File
@@ -2,6 +2,18 @@
services.caddy = {
enable = true;
email = "acme@imxyy.top";
globalConfig = ''
servers {
listener_wrappers {
proxy_protocol {
timeout 5s
allow 127.0.0.1/32
}
tls
}
trusted_proxies static 127.0.0.1
}
'';
};
security.acme = {
acceptTerms = true;
hosts/imxyy-nix-server/code.nix
+2 -3
View File
@@ -7,9 +7,8 @@
users.users.coder.extraGroups = [ "podman" ];
services.caddy.virtualHosts."coder.imxyy.top" = {
extraConfig = ''
reverse_proxy :8086 {
header_up X-Real-IP {remote_host}
}
reverse_proxy :8086
'';
};
my.services.frp.webServers = [ "coder.imxyy.top" ];
}
hosts/imxyy-nix-server/efl.nix
+6 -6
View File
@@ -34,16 +34,16 @@
};
services.caddy.virtualHosts."mtx.eflx.top" = {
extraConfig = ''
reverse_proxy :6167 {
header_up X-Real-IP {remote_host}
}
reverse_proxy :6167
'';
};
services.caddy.virtualHosts."send.eflx.top" = {
extraConfig = ''
reverse_proxy :12345 {
header_up X-Real-IP {remote_host}
}
reverse_proxy :12345
'';
};
my.services.frp.webServers = [
"mtx.eflx.top"
"send.eflx.top"
];
}
hosts/imxyy-nix-server/frp.nix
+33
View File
@@ -0,0 +1,33 @@
{ config, lib, ... }:
let
cfg = config.my.services.frp;
mkServer = domain: [
{
name = "${domain}-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ domain ];
}
{
name = "${domain}-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ domain ];
transport.proxyProtocolVersion = "v2";
}
];
in
{
options = {
my.services.frp.webServers = lib.mkOption {
type = with lib.types; listOf str;
default = [ ];
};
};
config = {
services.frp.instances."".settings.proxies = builtins.concatLists (map mkServer cfg.webServers);
};
}
hosts/imxyy-nix-server/gitea.nix
+14 -3
View File
@@ -1,11 +1,19 @@
{
services.caddy.virtualHosts."git.imxyy.top" = {
extraConfig = ''
reverse_proxy :8082 {
header_up X-Real-IP {remote_host}
}
reverse_proxy :8082
'';
};
my.services.frp.webServers = [ "git.imxyy.top" ];
services.frp.instances."".settings.proxies = [
{
name = "gitea-ssh";
type = "tcp";
localIP = "127.0.0.1";
localPort = 2222;
remotePort = 2222;
}
];
services.gitea = {
enable = true;
appName = "imxyy_soope_'s Gitea";
@@ -27,6 +35,9 @@
service = {
REGISTER_MANUAL_CONFIRM = true;
};
security = {
REVERSE_PROXY_TRUSTED_PROXIES = "127.0.0.0/8,::1/128";
};
};
};
services.openssh.ports = [
hosts/imxyy-nix-server/homepage.nix
+1
View File
@@ -11,4 +11,5 @@
reverse_proxy :8085
'';
};
my.services.frp.webServers = [ "home.imxyy.top" ];
}
hosts/imxyy-nix-server/immich.nix
+2 -3
View File
@@ -13,9 +13,8 @@
};
services.caddy.virtualHosts."immich.imxyy.top" = {
extraConfig = ''
reverse_proxy :8096 {
header_up X-Real-IP {remote_host}
}
reverse_proxy :8096
'';
};
my.services.frp.webServers = [ "immich.imxyy.top" ];
}
hosts/imxyy-nix-server/mail.nix
+2 -3
View File
@@ -46,9 +46,8 @@
};
services.caddy.virtualHosts."mail.imxyy.top" = {
extraConfig = ''
reverse_proxy :8087 {
header_up X-Real-IP {remote_host}
}
reverse_proxy :8087
'';
};
my.services.frp.webServers = [ "mail.imxyy.top" ];
}
hosts/imxyy-nix-server/matrix.nix
+4
View File
@@ -75,6 +75,10 @@
reverse_proxy :8094
'';
};
my.services.frp.webServers = [
"imxyy.top"
"matrix.imxyy.top"
];
sops.secrets.mautrix-telegram = {
sopsFile = secrets.mautrix-telegram;
hosts/imxyy-nix-server/net.nix
+17 -253
View File
@@ -177,222 +177,6 @@
serverAddr = "{{ .Envs.FRP_SERVER_ADDR }}";
serverPort = 7000;
auth.token = "{{ .Envs.FRP_AUTH_TOKEN }}";
proxies = [
{
name = "nextcloud-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "nextcloud.imxyy.top" ];
}
{
name = "nextcloud-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "nextcloud.imxyy.top" ];
}
{
name = "oidc-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "oidc.imxyy.top" ];
}
{
name = "oidc-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "oidc.imxyy.top" ];
}
{
name = "mail-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "mail.imxyy.top" ];
}
{
name = "mail-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "mail.imxyy.top" ];
}
{
name = "gitea-ssh";
type = "tcp";
localIP = "127.0.0.1";
localPort = 2222;
remotePort = 2222;
}
{
name = "gitea-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "git.imxyy.top" ];
}
{
name = "gitea-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "git.imxyy.top" ];
}
{
name = "vault-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "vault.imxyy.top" ];
}
{
name = "vault-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "vault.imxyy.top" ];
}
{
name = "home-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "home.imxyy.top" ];
}
{
name = "home-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "home.imxyy.top" ];
}
{
name = "coder-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "coder.imxyy.top" ];
}
{
name = "coder-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "coder.imxyy.top" ];
}
{
name = "siyuan-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "sy.imxyy.top" ];
}
{
name = "siyuan-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "sy.imxyy.top" ];
}
{
name = "matrix-root-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "imxyy.top" ];
}
{
name = "matrix-root-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "imxyy.top" ];
}
{
name = "matrix-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "matrix.imxyy.top" ];
}
{
name = "matrix-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "matrix.imxyy.top" ];
}
{
name = "immich-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "immich.imxyy.top" ];
}
{
name = "immich-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "immich.imxyy.top" ];
}
{
name = "memo-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "memo.imxyy.top" ];
}
{
name = "memo-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "memo.imxyy.top" ];
}
{
name = "efl-matrix-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "mtx.eflx.top" ];
}
{
name = "efl-matrix-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "mtx.eflx.top" ];
}
{
name = "efl-send-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "send.eflx.top" ];
}
{
name = "efl-send-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "send.eflx.top" ];
}
];
};
};
};
@@ -438,11 +222,10 @@
};
services.caddy.virtualHosts."oidc.imxyy.top" = {
extraConfig = ''
reverse_proxy :8081 {
header_up X-Real-IP {remote_host}
}
reverse_proxy :8081
'';
};
my.services.frp.webServers = [ "oidc.imxyy.top" ];
systemd.services.ddns-go =
let
@@ -475,39 +258,20 @@
];
};
services.dnsmasq =
let
subDomains = [
"home"
"nextcloud"
"mail"
"git"
"vault"
"coder"
"matrix"
"note"
"oidc"
"mc"
"music"
"sy"
"immich"
];
in
{
enable = true;
resolveLocalQueries = false;
settings = {
no-resolv = true;
server = [ "192.168.3.1" ];
address = map (sub: "/${sub}.imxyy.top/192.168.3.2") subDomains ++ [
"/imxyy-nix-server/192.168.3.2"
"/mtx.eflx.top/192.168.3.2"
"/send.eflx.top/192.168.3.2"
"/imxyy-cloudwin/192.168.3.4"
"/printer.home/192.168.3.53"
];
cache-size = 0;
log-queries = "extra";
};
services.dnsmasq = {
enable = true;
resolveLocalQueries = false;
settings = {
no-resolv = true;
server = [ "192.168.3.1" ];
address = [
"/imxyy-nix-server/192.168.3.2"
"/imxyy-cloudwin/192.168.3.4"
"/printer.home/192.168.3.53"
]
++ (map (domain: "/${domain}/192.168.3.2") config.my.services.frp.webServers);
cache-size = 0;
log-queries = "extra";
};
};
}
hosts/imxyy-nix-server/nextcloud.nix
+1
View File
@@ -113,6 +113,7 @@ in
redir /.well-known/caldav /remote.php/dav/ 301
'';
};
my.services.frp.webServers = [ "nextcloud.imxyy.top" ];
/*
systemd.timers."kopia" = {
hosts/imxyy-nix-server/note.nix
+1 -12
View File
@@ -28,13 +28,6 @@
];
ports = [ "8095:6806" ];
};
memos = {
image = "neosmemo/memos:stable";
volumes = [
"/mnt/nas/memos:/var/opt/memos"
];
ports = [ "8097:5230" ];
};
};
services.caddy.virtualHosts = {
"sy.imxyy.top" = {
@@ -42,10 +35,6 @@
reverse_proxy :8095
'';
};
"memo.imxyy.top" = {
extraConfig = ''
reverse_proxy :8097
'';
};
};
my.services.frp.webServers = [ "sy.imxyy.top" ];
}
hosts/imxyy-nix-server/rss.nix
+1 -16
View File
@@ -36,20 +36,5 @@ in
reverse_proxy :8100
'';
};
services.frp.instances."".settings.proxies = [
{
name = "rsshub-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "rss.imxyy.top" ];
}
{
name = "rsshub-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "rss.imxyy.top" ];
}
];
my.services.frp.webServers = [ "rss.imxyy.top" ];
}
hosts/imxyy-nix-server/sshwifty.nix
+1 -16
View File
@@ -30,20 +30,5 @@
reverse_proxy :8101
'';
};
services.frp.instances."".settings.proxies = [
{
name = "sshwifty-http";
type = "http";
localIP = "127.0.0.1";
localPort = 80;
customDomains = [ "ssh.imxyy.top" ];
}
{
name = "sshwifty-https";
type = "https";
localIP = "127.0.0.1";
localPort = 443;
customDomains = [ "ssh.imxyy.top" ];
}
];
my.services.frp.webServers = [ "ssh.imxyy.top" ];
}
hosts/imxyy-nix-server/vault.nix
+2 -3
View File
@@ -24,9 +24,8 @@
};
services.caddy.virtualHosts."vault.imxyy.top" = {
extraConfig = ''
reverse_proxy :8083 {
header_up X-Real-IP {remote_host}
}
reverse_proxy :8083
'';
};
my.services.frp.webServers = [ "vault.imxyy.top" ];
}