diff --git a/hosts/imxyy-nix-server/caddy.nix b/hosts/imxyy-nix-server/caddy.nix index c0e3f5f..e87c32c 100644 --- a/hosts/imxyy-nix-server/caddy.nix +++ b/hosts/imxyy-nix-server/caddy.nix @@ -2,6 +2,18 @@ services.caddy = { enable = true; email = "acme@imxyy.top"; + globalConfig = '' + servers { + listener_wrappers { + proxy_protocol { + timeout 5s + allow 127.0.0.1/32 + } + tls + } + trusted_proxies static 127.0.0.1 + } + ''; }; security.acme = { acceptTerms = true; diff --git a/hosts/imxyy-nix-server/code.nix b/hosts/imxyy-nix-server/code.nix index b7f29ef..afe9264 100644 --- a/hosts/imxyy-nix-server/code.nix +++ b/hosts/imxyy-nix-server/code.nix @@ -7,9 +7,8 @@ users.users.coder.extraGroups = [ "podman" ]; services.caddy.virtualHosts."coder.imxyy.top" = { extraConfig = '' - reverse_proxy :8086 { - header_up X-Real-IP {remote_host} - } + reverse_proxy :8086 ''; }; + my.services.frp.webServers = [ "coder.imxyy.top" ]; } diff --git a/hosts/imxyy-nix-server/efl.nix b/hosts/imxyy-nix-server/efl.nix index 6106dd8..e16484f 100644 --- a/hosts/imxyy-nix-server/efl.nix +++ b/hosts/imxyy-nix-server/efl.nix @@ -34,16 +34,16 @@ }; services.caddy.virtualHosts."mtx.eflx.top" = { extraConfig = '' - reverse_proxy :6167 { - header_up X-Real-IP {remote_host} - } + reverse_proxy :6167 ''; }; services.caddy.virtualHosts."send.eflx.top" = { extraConfig = '' - reverse_proxy :12345 { - header_up X-Real-IP {remote_host} - } + reverse_proxy :12345 ''; }; + my.services.frp.webServers = [ + "mtx.eflx.top" + "send.eflx.top" + ]; } diff --git a/hosts/imxyy-nix-server/frp.nix b/hosts/imxyy-nix-server/frp.nix new file mode 100644 index 0000000..c0a94d0 --- /dev/null +++ b/hosts/imxyy-nix-server/frp.nix @@ -0,0 +1,33 @@ +{ config, lib, ... }: +let + cfg = config.my.services.frp; + mkServer = domain: [ + { + name = "${domain}-http"; + type = "http"; + localIP = "127.0.0.1"; + localPort = 80; + customDomains = [ domain ]; + } + { + name = "${domain}-https"; + type = "https"; + localIP = "127.0.0.1"; + localPort = 443; + customDomains = [ domain ]; + transport.proxyProtocolVersion = "v2"; + } + ]; +in +{ + options = { + my.services.frp.webServers = lib.mkOption { + type = with lib.types; listOf str; + default = [ ]; + }; + }; + + config = { + services.frp.instances."".settings.proxies = builtins.concatLists (map mkServer cfg.webServers); + }; +} diff --git a/hosts/imxyy-nix-server/gitea.nix b/hosts/imxyy-nix-server/gitea.nix index 501a675..f8f433f 100644 --- a/hosts/imxyy-nix-server/gitea.nix +++ b/hosts/imxyy-nix-server/gitea.nix @@ -1,11 +1,19 @@ { services.caddy.virtualHosts."git.imxyy.top" = { extraConfig = '' - reverse_proxy :8082 { - header_up X-Real-IP {remote_host} - } + reverse_proxy :8082 ''; }; + my.services.frp.webServers = [ "git.imxyy.top" ]; + services.frp.instances."".settings.proxies = [ + { + name = "gitea-ssh"; + type = "tcp"; + localIP = "127.0.0.1"; + localPort = 2222; + remotePort = 2222; + } + ]; services.gitea = { enable = true; appName = "imxyy_soope_'s Gitea"; @@ -27,6 +35,9 @@ service = { REGISTER_MANUAL_CONFIRM = true; }; + security = { + REVERSE_PROXY_TRUSTED_PROXIES = "127.0.0.0/8,::1/128"; + }; }; }; services.openssh.ports = [ diff --git a/hosts/imxyy-nix-server/homepage.nix b/hosts/imxyy-nix-server/homepage.nix index 5c8cc64..d8531bf 100644 --- a/hosts/imxyy-nix-server/homepage.nix +++ b/hosts/imxyy-nix-server/homepage.nix @@ -11,4 +11,5 @@ reverse_proxy :8085 ''; }; + my.services.frp.webServers = [ "home.imxyy.top" ]; } diff --git a/hosts/imxyy-nix-server/immich.nix b/hosts/imxyy-nix-server/immich.nix index 4440587..390ad5a 100644 --- a/hosts/imxyy-nix-server/immich.nix +++ b/hosts/imxyy-nix-server/immich.nix @@ -13,9 +13,8 @@ }; services.caddy.virtualHosts."immich.imxyy.top" = { extraConfig = '' - reverse_proxy :8096 { - header_up X-Real-IP {remote_host} - } + reverse_proxy :8096 ''; }; + my.services.frp.webServers = [ "immich.imxyy.top" ]; } diff --git a/hosts/imxyy-nix-server/mail.nix b/hosts/imxyy-nix-server/mail.nix index 7c9e747..dd154ab 100644 --- a/hosts/imxyy-nix-server/mail.nix +++ b/hosts/imxyy-nix-server/mail.nix @@ -46,9 +46,8 @@ }; services.caddy.virtualHosts."mail.imxyy.top" = { extraConfig = '' - reverse_proxy :8087 { - header_up X-Real-IP {remote_host} - } + reverse_proxy :8087 ''; }; + my.services.frp.webServers = [ "mail.imxyy.top" ]; } diff --git a/hosts/imxyy-nix-server/matrix.nix b/hosts/imxyy-nix-server/matrix.nix index 9468398..59e91c6 100644 --- a/hosts/imxyy-nix-server/matrix.nix +++ b/hosts/imxyy-nix-server/matrix.nix @@ -75,6 +75,10 @@ reverse_proxy :8094 ''; }; + my.services.frp.webServers = [ + "imxyy.top" + "matrix.imxyy.top" + ]; sops.secrets.mautrix-telegram = { sopsFile = secrets.mautrix-telegram; diff --git a/hosts/imxyy-nix-server/net.nix b/hosts/imxyy-nix-server/net.nix index e8fecc3..29194e4 100644 --- a/hosts/imxyy-nix-server/net.nix +++ b/hosts/imxyy-nix-server/net.nix @@ -177,222 +177,6 @@ serverAddr = "{{ .Envs.FRP_SERVER_ADDR }}"; serverPort = 7000; auth.token = "{{ .Envs.FRP_AUTH_TOKEN }}"; - proxies = [ - { - name = "nextcloud-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "nextcloud.imxyy.top" ]; - } - { - name = "nextcloud-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "nextcloud.imxyy.top" ]; - } - - { - name = "oidc-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "oidc.imxyy.top" ]; - } - { - name = "oidc-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "oidc.imxyy.top" ]; - } - - { - name = "mail-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "mail.imxyy.top" ]; - } - { - name = "mail-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "mail.imxyy.top" ]; - } - - { - name = "gitea-ssh"; - type = "tcp"; - localIP = "127.0.0.1"; - localPort = 2222; - remotePort = 2222; - } - { - name = "gitea-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "git.imxyy.top" ]; - } - { - name = "gitea-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "git.imxyy.top" ]; - } - - { - name = "vault-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "vault.imxyy.top" ]; - } - { - name = "vault-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "vault.imxyy.top" ]; - } - - { - name = "home-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "home.imxyy.top" ]; - } - { - name = "home-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "home.imxyy.top" ]; - } - - { - name = "coder-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "coder.imxyy.top" ]; - } - { - name = "coder-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "coder.imxyy.top" ]; - } - - { - name = "siyuan-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "sy.imxyy.top" ]; - } - { - name = "siyuan-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "sy.imxyy.top" ]; - } - - { - name = "matrix-root-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "imxyy.top" ]; - } - { - name = "matrix-root-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "imxyy.top" ]; - } - { - name = "matrix-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "matrix.imxyy.top" ]; - } - { - name = "matrix-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "matrix.imxyy.top" ]; - } - - { - name = "immich-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "immich.imxyy.top" ]; - } - { - name = "immich-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "immich.imxyy.top" ]; - } - - { - name = "memo-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "memo.imxyy.top" ]; - } - { - name = "memo-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "memo.imxyy.top" ]; - } - - { - name = "efl-matrix-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "mtx.eflx.top" ]; - } - { - name = "efl-matrix-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "mtx.eflx.top" ]; - } - { - name = "efl-send-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "send.eflx.top" ]; - } - { - name = "efl-send-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "send.eflx.top" ]; - } - ]; }; }; }; @@ -438,11 +222,10 @@ }; services.caddy.virtualHosts."oidc.imxyy.top" = { extraConfig = '' - reverse_proxy :8081 { - header_up X-Real-IP {remote_host} - } + reverse_proxy :8081 ''; }; + my.services.frp.webServers = [ "oidc.imxyy.top" ]; systemd.services.ddns-go = let @@ -475,39 +258,20 @@ ]; }; - services.dnsmasq = - let - subDomains = [ - "home" - "nextcloud" - "mail" - "git" - "vault" - "coder" - "matrix" - "note" - "oidc" - "mc" - "music" - "sy" - "immich" - ]; - in - { - enable = true; - resolveLocalQueries = false; - settings = { - no-resolv = true; - server = [ "192.168.3.1" ]; - address = map (sub: "/${sub}.imxyy.top/192.168.3.2") subDomains ++ [ - "/imxyy-nix-server/192.168.3.2" - "/mtx.eflx.top/192.168.3.2" - "/send.eflx.top/192.168.3.2" - "/imxyy-cloudwin/192.168.3.4" - "/printer.home/192.168.3.53" - ]; - cache-size = 0; - log-queries = "extra"; - }; + services.dnsmasq = { + enable = true; + resolveLocalQueries = false; + settings = { + no-resolv = true; + server = [ "192.168.3.1" ]; + address = [ + "/imxyy-nix-server/192.168.3.2" + "/imxyy-cloudwin/192.168.3.4" + "/printer.home/192.168.3.53" + ] + ++ (map (domain: "/${domain}/192.168.3.2") config.my.services.frp.webServers); + cache-size = 0; + log-queries = "extra"; }; + }; } diff --git a/hosts/imxyy-nix-server/nextcloud.nix b/hosts/imxyy-nix-server/nextcloud.nix index dbeb335..4441c00 100644 --- a/hosts/imxyy-nix-server/nextcloud.nix +++ b/hosts/imxyy-nix-server/nextcloud.nix @@ -113,6 +113,7 @@ in redir /.well-known/caldav /remote.php/dav/ 301 ''; }; + my.services.frp.webServers = [ "nextcloud.imxyy.top" ]; /* systemd.timers."kopia" = { diff --git a/hosts/imxyy-nix-server/note.nix b/hosts/imxyy-nix-server/note.nix index 9ca3845..9b7d6c8 100644 --- a/hosts/imxyy-nix-server/note.nix +++ b/hosts/imxyy-nix-server/note.nix @@ -28,13 +28,6 @@ ]; ports = [ "8095:6806" ]; }; - memos = { - image = "neosmemo/memos:stable"; - volumes = [ - "/mnt/nas/memos:/var/opt/memos" - ]; - ports = [ "8097:5230" ]; - }; }; services.caddy.virtualHosts = { "sy.imxyy.top" = { @@ -42,10 +35,6 @@ reverse_proxy :8095 ''; }; - "memo.imxyy.top" = { - extraConfig = '' - reverse_proxy :8097 - ''; - }; }; + my.services.frp.webServers = [ "sy.imxyy.top" ]; } diff --git a/hosts/imxyy-nix-server/rss.nix b/hosts/imxyy-nix-server/rss.nix index a7a39b0..3d9b415 100644 --- a/hosts/imxyy-nix-server/rss.nix +++ b/hosts/imxyy-nix-server/rss.nix @@ -36,20 +36,5 @@ in reverse_proxy :8100 ''; }; - services.frp.instances."".settings.proxies = [ - { - name = "rsshub-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "rss.imxyy.top" ]; - } - { - name = "rsshub-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "rss.imxyy.top" ]; - } - ]; + my.services.frp.webServers = [ "rss.imxyy.top" ]; } diff --git a/hosts/imxyy-nix-server/sshwifty.nix b/hosts/imxyy-nix-server/sshwifty.nix index 8eef373..bb384a3 100644 --- a/hosts/imxyy-nix-server/sshwifty.nix +++ b/hosts/imxyy-nix-server/sshwifty.nix @@ -30,20 +30,5 @@ reverse_proxy :8101 ''; }; - services.frp.instances."".settings.proxies = [ - { - name = "sshwifty-http"; - type = "http"; - localIP = "127.0.0.1"; - localPort = 80; - customDomains = [ "ssh.imxyy.top" ]; - } - { - name = "sshwifty-https"; - type = "https"; - localIP = "127.0.0.1"; - localPort = 443; - customDomains = [ "ssh.imxyy.top" ]; - } - ]; + my.services.frp.webServers = [ "ssh.imxyy.top" ]; } diff --git a/hosts/imxyy-nix-server/vault.nix b/hosts/imxyy-nix-server/vault.nix index 5c5fb9b..8c0b58b 100644 --- a/hosts/imxyy-nix-server/vault.nix +++ b/hosts/imxyy-nix-server/vault.nix @@ -24,9 +24,8 @@ }; services.caddy.virtualHosts."vault.imxyy.top" = { extraConfig = '' - reverse_proxy :8083 { - header_up X-Real-IP {remote_host} - } + reverse_proxy :8083 ''; }; + my.services.frp.webServers = [ "vault.imxyy.top" ]; }