fi/nix-infra
1
2
Fork 1
Code Issues Pull requests Projects Releases Packages Wiki Activity

Route IPv6 traffic via valkyrie

Browse source
This commit is contained in:
fi 2026-04-05 18:31:16 +02:00
commit 654a8459eb
Signed by: fi
SSH key fingerprint: SHA256:dgX1HRsK+8F1OzYvKfv1VLhMJac/Iv/rsjixuV94+dA
14 changed files with 58 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

3
config/hosts/forgejo/nginx.nix
View file

@ -29,7 +29,8 @@
}; };
extraConfig = '' extraConfig = ''
set_real_ip_from 10.202.41.100; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
''; '';
}; };

6
config/hosts/hydra/nginx.nix
View file

@ -16,7 +16,8 @@
extraConfig = '' extraConfig = ''
listen 0.0.0.0:8443 http2 ssl proxy_protocol; listen 0.0.0.0:8443 http2 ssl proxy_protocol;
set_real_ip_from 10.202.41.100; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
''; '';
}; };
@ -33,7 +34,8 @@
extraConfig = '' extraConfig = ''
listen 0.0.0.0:8443 http2 ssl proxy_protocol; listen 0.0.0.0:8443 http2 ssl proxy_protocol;
set_real_ip_from 10.202.41.100; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
''; '';
}; };

3
config/hosts/ikiwiki/nginx.nix
View file

@ -39,7 +39,8 @@ in
}; };
}; };
extraConfig = '' extraConfig = ''
set_real_ip_from 10.202.41.100; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
''; '';
}; };

3
config/hosts/keycloak/nginx.nix
View file

@ -27,7 +27,8 @@
extraConfig = '' extraConfig = ''
listen 0.0.0.0:8443 http2 ssl proxy_protocol; listen 0.0.0.0:8443 http2 ssl proxy_protocol;
set_real_ip_from 10.202.41.100; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
add_header Strict-Transport-Security "max-age=63072000" always; add_header Strict-Transport-Security "max-age=63072000" always;

3
config/hosts/mastodon/nginx.nix
View file

@ -57,7 +57,8 @@
}; };
extraConfig = '' extraConfig = ''
set_real_ip_from 10.202.41.100; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
''; '';
}; };

9
config/hosts/matrix/nginx.nix
View file

@ -51,7 +51,8 @@
extraConfig = '' extraConfig = ''
listen 0.0.0.0:8443 http2 ssl proxy_protocol; listen 0.0.0.0:8443 http2 ssl proxy_protocol;
set_real_ip_from 10.202.41.100; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
''; '';
}; };
@ -80,7 +81,8 @@
extraConfig = '' extraConfig = ''
listen 0.0.0.0:8443 http2 ssl proxy_protocol; listen 0.0.0.0:8443 http2 ssl proxy_protocol;
set_real_ip_from 10.202.41.100; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
''; '';
}; };
@ -103,7 +105,8 @@
extraConfig = '' extraConfig = ''
listen 0.0.0.0:8443 http2 ssl proxy_protocol; listen 0.0.0.0:8443 http2 ssl proxy_protocol;
set_real_ip_from 10.202.41.100; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
''; '';
}; };

3
config/hosts/metrics-nekomesh/nginx.nix
View file

@ -23,7 +23,8 @@
proxyWebsockets = true; proxyWebsockets = true;
}; };
extraConfig = '' extraConfig = ''
set_real_ip_from 10.202.41.100; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
''; '';
}; };

3
config/hosts/nextcloud/nextcloud.nix
View file

@ -44,7 +44,8 @@
extraConfig = '' extraConfig = ''
listen 0.0.0.0:8443 http2 ssl proxy_protocol; listen 0.0.0.0:8443 http2 ssl proxy_protocol;
set_real_ip_from 10.202.41.100; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
''; '';
}; };

3
config/hosts/searx/nginx.nix
View file

@ -21,7 +21,8 @@
proxyPass = "http://${config.services.searx.settings.server.bind_address}:${builtins.toString config.services.searx.settings.server.port}"; proxyPass = "http://${config.services.searx.settings.server.bind_address}:${builtins.toString config.services.searx.settings.server.port}";
}; };
extraConfig = '' extraConfig = ''
set_real_ip_from 10.202.41.100; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
''; '';
}; };

26
config/hosts/valkyrie/nginx.nix
View file

@ -33,5 +33,31 @@
}; };
}; };
}; };
streamConfig = ''
map $ssl_preread_server_name $address {
cloud.nekover.se 10.202.41.122:8443;
element.nekover.se 10.202.41.100:8443;
element-admin.nekover.se 10.202.41.100:8443;
fi.nekover.se 10.202.41.125:8443;
git.nekover.se 10.202.41.106:8443;
hydra.nekover.se 10.202.41.121:8443;
id.nekover.se 10.202.41.124:8443;
mas.nekover.se 10.202.41.112:8443;
matrix.nekover.se 10.202.41.112:8443;
matrix-rtc.nekover.se 10.202.41.112:8443;
mesh.nekover.se 10.202.41.126:8443;
nekover.se 10.202.41.100:8443;
nix-cache.nekover.se 10.202.41.121:8443;
searx.nekover.se 10.202.41.105:8443;
social.nekover.se 10.202.41.104:8443;
}
server {
listen [::]:443;
proxy_pass $address;
ssl_preread on;
proxy_protocol on;
}
'';
}; };
} }

1
config/hosts/web-public-2/nginx.nix
View file

@ -38,7 +38,6 @@
} }
server { server {
listen 0.0.0.0:443; listen 0.0.0.0:443;
listen [::]:443;
proxy_pass $address; proxy_pass $address;
ssl_preread on; ssl_preread on;
proxy_protocol on; proxy_protocol on;

5
config/hosts/web-public-2/virtualHosts/element-admin.nekover.se.nix
View file

@ -37,7 +37,7 @@ in
enableACME = true; enableACME = true;
listen = [{ listen = [{
addr = "localhost"; addr = "0.0.0.0";
port = 8443; port = 8443;
ssl = true; ssl = true;
extraParameters = ["proxy_protocol"]; extraParameters = ["proxy_protocol"];
@ -86,7 +86,8 @@ in
# $remote_port to the client address and client port, when using proxy # $remote_port to the client address and client port, when using proxy
# protocol. # protocol.
# First set our proxy protocol proxy as trusted. # First set our proxy protocol proxy as trusted.
set_real_ip_from 127.0.0.1; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
# Then tell the realip_module to get the addreses from the proxy protocol # Then tell the realip_module to get the addreses from the proxy protocol
# header. # header.
real_ip_header proxy_protocol; real_ip_header proxy_protocol;

5
config/hosts/web-public-2/virtualHosts/element.nekover.se.nix
View file

@ -28,7 +28,7 @@ in
]; ];
}; };
listen = [{ listen = [{
addr = "localhost"; addr = "0.0.0.0";
port = 8443; port = 8443;
ssl = true; ssl = true;
extraParameters = ["proxy_protocol"]; extraParameters = ["proxy_protocol"];
@ -60,7 +60,8 @@ in
# redirect server error pages to the static page /50x.html # redirect server error pages to the static page /50x.html
error_page 500 502 503 504 /50x.html; error_page 500 502 503 504 /50x.html;
set_real_ip_from 127.0.0.1; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
''; '';
}; };

3
config/hosts/web-public-2/virtualHosts/nekover.se.nix
View file

@ -23,7 +23,8 @@
''; '';
}; };
extraConfig = '' extraConfig = ''
set_real_ip_from 127.0.0.1; set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
''; '';
}; };