Use bunny.net for certificates and edge address unwrapping

Signed-off-by: Mel <mel@rnrd.eu>

2 files changed, 54 insertions, 25 deletions

diff --git a/modules/foundation/www/default.nix b/modules/foundation/www/default.nix
index 7bd1a13..c84e7b4 100644
--- a/modules/foundation/www/default.nix
+++ b/modules/foundation/www/default.nix
@@ -4,8 +4,6 @@
   pkgs,
   lib,
   util,
-  cloudflare-ips-v4,
-  cloudflare-ips-v6,
   ...
 }:
 
@@ -15,9 +13,7 @@ let
     mkIf
     mkEnableOption
     mkOption
-    concatMapStrings
     concatLines
-    splitString
     optional
     ;
 
@@ -41,18 +37,36 @@ let
     "favicon.png" = ../../../assets/favicon.png;
   };
 
-  certificate = domain: {
+  certificate = domain: dnsProvider: credentialFiles: {
     ${domain} = {
       domain = "*.${domain}";
       extraDomainNames = [ domain ];
 
-      dnsProvider = "cloudflare";
-      credentialFiles = {
-        CLOUDFLARE_DNS_API_TOKEN_FILE = secrets.cloudflare-dns.path;
-      };
+      inherit dnsProvider credentialFiles;
     };
   };
 
+  # edge addresses of the cdn providers we use, to allow extraction
+  # of the real addresses connecting to us.
+  edgeAddresses = let
+    fetch = url: hash: pkgs.fetchurl { inherit url hash; };
+  in {
+    cloudflare = pkgs.runCommand "cloudflare-edge-servers.conf" {
+      v4 = fetch "https://www.cloudflare.com/ips-v4" "sha256-8Cxtg7wBqwroV3Fg4DbXAMdFU1m84FTfiE5dfZ5Onns=";
+      v6 = fetch "https://www.cloudflare.com/ips-v6" "sha256-np054+g7rQDE3sr9U8Y/piAp89ldto3pN9K+KCNMoKk=";
+    } ''
+      awk 'NF { print "set_real_ip_from " $0 ";" }' $v4 $v6 > $out
+    '';
+
+    bunny = pkgs.runCommand "bunny-edge-servers.conf" {
+      nativeBuildInputs = [ pkgs.jq ];
+      v4 = fetch "https://bunnycdn.com/api/system/edgeserverlist" "sha256-a27vEUILkiSN8ieWYcHnquuqUsS4i2xv5Lv9AA9iJxU=";
+      v6 = fetch "https://bunnycdn.com/api/system/edgeserverlist/IPv6" "sha256-3qwGHkAnnrbeDvvv1wUnMU3Hi1vNog4alu5y0nOA6Do=";
+    } ''
+      jq -r '.[] | "set_real_ip_from \(.);"' $v4 $v6 > $out
+    '';
+  };
+
   defaultHost = domain: certificate: base: log: {
     default = true;
     serverName = domain;
@@ -82,14 +96,24 @@ in
       type = lib.types.bool;
       description = ''
         Whether to add real_ip directives to unwrap
-        Cloudflare IP addresses.
+        Cloudflare CDN edge addresses.
       '';
       default = true;
     };
+
+    behindBunny = mkOption {
+      type = lib.types.bool;
+      description = ''
+        Whether to add real_ip directives to unwrap
+        bunny.net CDN edge addresses.
+      '';
+      default = false;
+    };
   };
 
   config = mkIf cfg.enable {
     age.secrets = {
+      bunny-dns.file = ../../../secrets/bunny-dns.age;
       cloudflare-dns.file = ../../../secrets/cloudflare-dns.age;
     };
 
@@ -106,8 +130,12 @@ in
       # used by every machine, but as long as it doesn't cause
       # any problems... :)
       certs = mergeAttrsList [
-        (certificate "rnrd.eu")
-        (certificate "rnrd.fyi")
+        (certificate "rnrd.eu" "bunny" {
+          BUNNY_API_KEY_FILE = secrets.bunny-dns.path;
+        })
+        (certificate "rnrd.fyi" "cloudflare" {
+          CLOUDFLARE_DNS_API_TOKEN_FILE = secrets.cloudflare-dns.path;
+        })
       ];
     };
 
@@ -143,22 +171,21 @@ in
             error_log /var/log/nginx/error.log warn;
           '';
 
-          cloudflareAddresses = builtins.filter (ip: ip != "") (
-            splitString "\n" ''
-              ${builtins.readFile cloudflare-ips-v4}
-              ${builtins.readFile cloudflare-ips-v6}
-            ''
-          );
-
-          realIpLine = ip: "set_real_ip_from ${ip};\n";
-
           cloudflare = ''
-            ${concatMapStrings realIpLine cloudflareAddresses}
-
+            include ${edgeAddresses.cloudflare};
             real_ip_header CF-Connecting-IP;
           '';
+
+          bunny = ''
+            include ${edgeAddresses.bunny};
+            real_ip_header X-Real-IP;
+          '';
         in
-        concatLines ([ logs ] ++ (optional cfg.behindCloudflare cloudflare));
+        concatLines (
+          [ logs ]
+          ++ (optional cfg.behindCloudflare cloudflare)
+          ++ (optional cfg.behindBunny bunny)
+        );
 
       virtualHosts = {
         base = mkIf cfg.public (defaultHost rnrdUrl "rnrd.eu" cfg.defaultPage "base");
diff --git a/modules/foundation/www/tailnet.nix b/modules/foundation/www/tailnet.nix
index e7ec0e8..01fa156 100644
--- a/modules/foundation/www/tailnet.nix
+++ b/modules/foundation/www/tailnet.nix
@@ -24,7 +24,9 @@ let
       pem=$1
       ${pkgs.openssl}/bin/openssl x509 \
     -checkend ${toString oneWeekInSeconds} \
-    -noout <$pem
+    -noout <$pem &&
+      [ "$(${pkgs.openssl}/bin/openssl x509 -pubkey -noout <$pem)" \
+    = "$(${pkgs.openssl}/bin/openssl pkey -pubout <out/key.pem)" ]
     }
 
     try_renew() {