diff options
Diffstat (limited to 'modules')
| -rw-r--r-- | modules/foundation/www/default.nix | 13 | ||||
| -rw-r--r-- | modules/tunnel/egress.nix | 3 |
2 files changed, 15 insertions, 1 deletions
diff --git a/modules/foundation/www/default.nix b/modules/foundation/www/default.nix index c41c2f6..7bd1a13 100644 --- a/modules/foundation/www/default.nix +++ b/modules/foundation/www/default.nix @@ -18,7 +18,9 @@ let concatMapStrings concatLines splitString + optional ; + inherit (config.age) secrets; cfg = config.foundation.www; @@ -75,6 +77,15 @@ in type = lib.types.package; default = default-page; }; + + behindCloudflare = mkOption { + type = lib.types.bool; + description = '' + Whether to add real_ip directives to unwrap + Cloudflare IP addresses. + ''; + default = true; + }; }; config = mkIf cfg.enable { @@ -147,7 +158,7 @@ in real_ip_header CF-Connecting-IP; ''; in - concatLines [ logs cloudflare ]; + concatLines ([ logs ] ++ (optional cfg.behindCloudflare cloudflare)); virtualHosts = { base = mkIf cfg.public (defaultHost rnrdUrl "rnrd.eu" cfg.defaultPage "base"); diff --git a/modules/tunnel/egress.nix b/modules/tunnel/egress.nix index 55946ce..228a06a 100644 --- a/modules/tunnel/egress.nix +++ b/modules/tunnel/egress.nix @@ -136,6 +136,9 @@ in settingsFile = "/run/xray-configuration/xray.json"; }; + # don't unwrap cloudflare addresses + foundation.www.behindCloudflare = false; + services.nginx = { defaultListen = [ { addr = "127.0.0.1"; port = nginxPort; ssl = true; proxyProtocol = true; } |