diff options
| -rw-r--r-- | flake.lock | 26 | ||||
| -rw-r--r-- | flake.nix | 9 | ||||
| -rw-r--r-- | modules/foundation/www/default.nix | 75 | ||||
| -rw-r--r-- | modules/foundation/www/tailnet.nix | 4 | ||||
| -rw-r--r-- | secrets/bunny-dns.age | bin | 0 -> 1935 bytes |
5 files changed, 54 insertions, 60 deletions
@@ -25,30 +25,6 @@ "type": "github" } }, - "cloudflare-ips-v4": { - "flake": false, - "locked": { - "narHash": "sha256-V4dThTb8iw02hjngubVtSJbEeWgOS1e/ODt1fLjLZvk=", - "type": "file", - "url": "https://www.cloudflare.com/ips-v4" - }, - "original": { - "type": "file", - "url": "https://www.cloudflare.com/ips-v4" - } - }, - "cloudflare-ips-v6": { - "flake": false, - "locked": { - "narHash": "sha256-BgpkXCAh/MmK3GTAElKiGJctCYUN+/UgvpuawqGmitE=", - "type": "file", - "url": "https://www.cloudflare.com/ips-v6" - }, - "original": { - "type": "file", - "url": "https://www.cloudflare.com/ips-v6" - } - }, "darwin": { "inputs": { "nixpkgs": [ @@ -384,8 +360,6 @@ "root": { "inputs": { "agenix": "agenix", - "cloudflare-ips-v4": "cloudflare-ips-v4", - "cloudflare-ips-v6": "cloudflare-ips-v6", "ddnnss": "ddnnss", "flake-compat": "flake-compat", "hermes-agent": "hermes-agent", @@ -26,15 +26,6 @@ flake = false; }; - cloudflare-ips-v4 = { - url = "https://www.cloudflare.com/ips-v4"; - flake = false; - }; - cloudflare-ips-v6 = { - url = "https://www.cloudflare.com/ips-v6"; - flake = false; - }; - hermes-agent = { url = "github:NousResearch/hermes-agent"; inputs.nixpkgs.follows = "nixpkgs-unstable"; diff --git a/modules/foundation/www/default.nix b/modules/foundation/www/default.nix index 7bd1a13..c84e7b4 100644 --- a/modules/foundation/www/default.nix +++ b/modules/foundation/www/default.nix @@ -4,8 +4,6 @@ pkgs, lib, util, - cloudflare-ips-v4, - cloudflare-ips-v6, ... }: @@ -15,9 +13,7 @@ let mkIf mkEnableOption mkOption - concatMapStrings concatLines - splitString optional ; @@ -41,18 +37,36 @@ let "favicon.png" = ../../../assets/favicon.png; }; - certificate = domain: { + certificate = domain: dnsProvider: credentialFiles: { ${domain} = { domain = "*.${domain}"; extraDomainNames = [ domain ]; - dnsProvider = "cloudflare"; - credentialFiles = { - CLOUDFLARE_DNS_API_TOKEN_FILE = secrets.cloudflare-dns.path; - }; + inherit dnsProvider credentialFiles; }; }; + # edge addresses of the cdn providers we use, to allow extraction + # of the real addresses connecting to us. + edgeAddresses = let + fetch = url: hash: pkgs.fetchurl { inherit url hash; }; + in { + cloudflare = pkgs.runCommand "cloudflare-edge-servers.conf" { + v4 = fetch "https://www.cloudflare.com/ips-v4" "sha256-8Cxtg7wBqwroV3Fg4DbXAMdFU1m84FTfiE5dfZ5Onns="; + v6 = fetch "https://www.cloudflare.com/ips-v6" "sha256-np054+g7rQDE3sr9U8Y/piAp89ldto3pN9K+KCNMoKk="; + } '' + awk 'NF { print "set_real_ip_from " $0 ";" }' $v4 $v6 > $out + ''; + + bunny = pkgs.runCommand "bunny-edge-servers.conf" { + nativeBuildInputs = [ pkgs.jq ]; + v4 = fetch "https://bunnycdn.com/api/system/edgeserverlist" "sha256-a27vEUILkiSN8ieWYcHnquuqUsS4i2xv5Lv9AA9iJxU="; + v6 = fetch "https://bunnycdn.com/api/system/edgeserverlist/IPv6" "sha256-3qwGHkAnnrbeDvvv1wUnMU3Hi1vNog4alu5y0nOA6Do="; + } '' + jq -r '.[] | "set_real_ip_from \(.);"' $v4 $v6 > $out + ''; + }; + defaultHost = domain: certificate: base: log: { default = true; serverName = domain; @@ -82,14 +96,24 @@ in type = lib.types.bool; description = '' Whether to add real_ip directives to unwrap - Cloudflare IP addresses. + Cloudflare CDN edge addresses. ''; default = true; }; + + behindBunny = mkOption { + type = lib.types.bool; + description = '' + Whether to add real_ip directives to unwrap + bunny.net CDN edge addresses. + ''; + default = false; + }; }; config = mkIf cfg.enable { age.secrets = { + bunny-dns.file = ../../../secrets/bunny-dns.age; cloudflare-dns.file = ../../../secrets/cloudflare-dns.age; }; @@ -106,8 +130,12 @@ in # used by every machine, but as long as it doesn't cause # any problems... :) certs = mergeAttrsList [ - (certificate "rnrd.eu") - (certificate "rnrd.fyi") + (certificate "rnrd.eu" "bunny" { + BUNNY_API_KEY_FILE = secrets.bunny-dns.path; + }) + (certificate "rnrd.fyi" "cloudflare" { + CLOUDFLARE_DNS_API_TOKEN_FILE = secrets.cloudflare-dns.path; + }) ]; }; @@ -143,22 +171,21 @@ in error_log /var/log/nginx/error.log warn; ''; - cloudflareAddresses = builtins.filter (ip: ip != "") ( - splitString "\n" '' - ${builtins.readFile cloudflare-ips-v4} - ${builtins.readFile cloudflare-ips-v6} - '' - ); - - realIpLine = ip: "set_real_ip_from ${ip};\n"; - cloudflare = '' - ${concatMapStrings realIpLine cloudflareAddresses} - + include ${edgeAddresses.cloudflare}; real_ip_header CF-Connecting-IP; ''; + + bunny = '' + include ${edgeAddresses.bunny}; + real_ip_header X-Real-IP; + ''; in - concatLines ([ logs ] ++ (optional cfg.behindCloudflare cloudflare)); + concatLines ( + [ logs ] + ++ (optional cfg.behindCloudflare cloudflare) + ++ (optional cfg.behindBunny bunny) + ); virtualHosts = { base = mkIf cfg.public (defaultHost rnrdUrl "rnrd.eu" cfg.defaultPage "base"); diff --git a/modules/foundation/www/tailnet.nix b/modules/foundation/www/tailnet.nix index e7ec0e8..01fa156 100644 --- a/modules/foundation/www/tailnet.nix +++ b/modules/foundation/www/tailnet.nix @@ -24,7 +24,9 @@ let pem=$1 ${pkgs.openssl}/bin/openssl x509 \ -checkend ${toString oneWeekInSeconds} \ - -noout <$pem + -noout <$pem && + [ "$(${pkgs.openssl}/bin/openssl x509 -pubkey -noout <$pem)" \ + = "$(${pkgs.openssl}/bin/openssl pkey -pubout <out/key.pem)" ] } try_renew() { diff --git a/secrets/bunny-dns.age b/secrets/bunny-dns.age Binary files differnew file mode 100644 index 0000000..a0a0b2a --- /dev/null +++ b/secrets/bunny-dns.age |