Remove obsolete configuration

config/hosts/forgejo/nginx.nix

@@ -29,7 +29,8 @@
       };
 
       extraConfig = ''
-        set_real_ip_from 10.202.41.100;
+        set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
+        set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
         real_ip_header proxy_protocol;
       '';
     };

config/hosts/hydra/nginx.nix

@@ -16,7 +16,8 @@
         extraConfig = ''
           listen 0.0.0.0:8443 http2 ssl proxy_protocol;
 
-          set_real_ip_from 10.202.41.100;
+          set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
+          set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
           real_ip_header proxy_protocol;
         '';
       };
@@ -33,7 +34,8 @@
         extraConfig = ''
           listen 0.0.0.0:8443 http2 ssl proxy_protocol;
 
-          set_real_ip_from 10.202.41.100;
+          set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
+          set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
           real_ip_header proxy_protocol;
         '';
       };

config/hosts/ikiwiki/nginx.nix

@@ -39,7 +39,8 @@ in
         };
       };
       extraConfig = ''
-        set_real_ip_from 10.202.41.100;
+        set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
+        set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
         real_ip_header proxy_protocol;
       '';
     };

config/hosts/keycloak/nginx.nix

@@ -27,7 +27,8 @@
         extraConfig = ''
           listen 0.0.0.0:8443 http2 ssl proxy_protocol;
 
-          set_real_ip_from 10.202.41.100;
+          set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
+          set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
           real_ip_header proxy_protocol;
 
           add_header Strict-Transport-Security "max-age=63072000" always;

config/hosts/mastodon/nginx.nix

@@ -57,7 +57,8 @@
       };
 
       extraConfig = ''
-        set_real_ip_from 10.202.41.100;
+        set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
+        set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
         real_ip_header proxy_protocol;
       '';
     };

config/hosts/matrix/nginx.nix

@@ -51,7 +51,8 @@
         extraConfig = ''
           listen 0.0.0.0:8443 http2 ssl proxy_protocol;
 
-          set_real_ip_from 10.202.41.100;
+          set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
+          set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
           real_ip_header proxy_protocol;
         '';
       };
@@ -80,7 +81,8 @@
         extraConfig = ''
           listen 0.0.0.0:8443 http2 ssl proxy_protocol;
 
-          set_real_ip_from 10.202.41.100;
+          set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
+          set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
           real_ip_header proxy_protocol;
         '';
       };
@@ -103,7 +105,8 @@
         extraConfig = ''
           listen 0.0.0.0:8443 http2 ssl proxy_protocol;
 
-          set_real_ip_from 10.202.41.100;
+          set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
+          set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
           real_ip_header proxy_protocol;
         '';
       };

config/hosts/metrics-nekomesh/nginx.nix

@@ -23,7 +23,8 @@
           proxyWebsockets = true;
         };
         extraConfig = ''
-          set_real_ip_from 10.202.41.100;
+          set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
+          set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
           real_ip_header proxy_protocol;
         '';
       };

config/hosts/navidrome/configuration.nix

@@ -1,33 +0,0 @@
-{ ... }:
-{
-  boot.loader.grub = {
-    enable = true;
-    device = "/dev/vda";
-  };
-
-  networking = {
-    hostName = "navidrome";
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [ 80 443 ];
-    };
-  };
-
-  fileSystems = {
-    "/mnt/music" = {
-      device = "//10.202.40.5/music-ro";
-      fsType = "cifs";
-      options = [ 
-        "username=navidrome" 
-        "credentials=/secrets/navidrome-samba-credentials.secret"
-        "iocharset=utf8"
-        "vers=3.1.1"
-        "uid=navidrome"
-        "gid=navidrome"
-        "_netdev"
-      ];
-    };
-  };
-
-  system.stateVersion = "23.05";
-}

config/hosts/navidrome/default.nix

@@ -1,7 +0,0 @@
-{ ... }: {
-  imports = [
-    ./configuration.nix
-    ./navidrome.nix
-    ./nginx.nix
-  ];
-}

config/hosts/navidrome/navidrome.nix

@@ -1,9 +0,0 @@
-{ ... }: {
-  services.navidrome = {
-    enable = true;
-    settings = {
-      Address = "unix:/run/navidrome/navidrome.socket";
-      MusicFolder = "/mnt/music";
-    };
-  };
-}

config/hosts/navidrome/nginx.nix

@@ -1,24 +0,0 @@
-{ ... }: {
-  services.nginx = {
-    enable = true;
-    user = "navidrome";
-    virtualHosts."navidrome.grzb.de" = {
-      forceSSL = true;
-      enableACME = true;
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 80;
-        }
-        {
-          addr = "0.0.0.0";
-          port = 443;
-          ssl = true;
-        }
-      ];
-      locations."/" = {
-        proxyPass = "http://unix:/run/navidrome/navidrome.socket";
-      };
-    };
-  };
-}

config/hosts/navidrome/secrets.nix

@@ -1,13 +0,0 @@
-{ keyCommandEnv, ... }:
-{
-  deployment.keys = {
-    "navidrome-samba-credentials.secret" = {
-      keyCommand = keyCommandEnv ++ [ "pass" "navidrome/samba-credentials" ];
-      destDir = "/secrets";
-      user = "root";
-      group = "root";
-      permissions = "0640";
-      uploadAt = "pre-activation";
-    };
-  };
-}

config/hosts/netbox/configuration.nix

@@ -1,17 +0,0 @@
-{ ... }:
-{
-  boot.loader.grub = {
-    enable = true;
-    device = "/dev/vda";
-  };
-
-  networking = {
-    hostName = "netbox";
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [ 80 443 ];
-    };
-  };
-
-  system.stateVersion = "23.05";
-}

config/hosts/netbox/default.nix

@@ -1,8 +0,0 @@
-{ ... }:
-{
-  imports = [
-    ./configuration.nix
-    ./netbox.nix
-    ./nginx.nix
-  ];
-}

config/hosts/netbox/netbox.nix

@@ -1,8 +0,0 @@
-{ pkgs, ... }:
-{
-  services.netbox = {
-    enable = true;
-    package = pkgs.netbox;
-    secretKeyFile = "/secrets/netbox-secret-key.secret";
-  };
-}

config/hosts/netbox/nginx.nix

@@ -1,29 +0,0 @@
-{ config, ... }:
-{
-  services.nginx = {
-    enable = true;
-    clientMaxBodySize = "25m";
-    user = "netbox";
-    virtualHosts."netbox.grzb.de" = {
-      forceSSL = true;
-      enableACME = true;
-      listen = [
-        {
-          addr = "0.0.0.0";
-          port = 80;
-        }
-        {
-          addr = "0.0.0.0";
-          port = 443;
-          ssl = true;
-        }
-      ];
-      locations."/static/" = {
-        alias = "${config.services.netbox.dataDir}/static/";
-      };
-      locations."/" = {
-        proxyPass = "http://${config.services.netbox.listenAddress}:${builtins.toString config.services.netbox.port}";
-      };
-    };
-  };
-}

config/hosts/netbox/secrets.nix

@@ -1,11 +0,0 @@
-{ keyCommandEnv, ... }:
-{
-  deployment.keys."netbox-secret-key.secret" = {
-    keyCommand = keyCommandEnv ++ [ "pass" "netbox/secret-key" ];
-    destDir = "/secrets";
-    user = "netbox";
-    group = "netbox";
-    permissions = "0640";
-    uploadAt = "pre-activation";
-  };
-}

config/hosts/nextcloud/nextcloud.nix

@@ -44,7 +44,8 @@
       extraConfig = ''
         listen 0.0.0.0:8443 http2 ssl proxy_protocol;
 
-        set_real_ip_from 10.202.41.100;
+        set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
+        set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
         real_ip_header proxy_protocol;
       '';
     };

config/hosts/nitter/configuration.nix

@@ -1,17 +0,0 @@
-{ ... }:
-{
-  boot.loader.grub = {
-    enable = true;
-    device = "/dev/vda";
-  };
-
-  networking = {
-    hostName = "nitter";
-    firewall = {
-      enable = true;
-      allowedTCPPorts = [ 8443 ];
-    };
-  };
-
-  system.stateVersion = "23.05";
-}

config/hosts/nitter/default.nix

@@ -1,8 +0,0 @@
-{ ... }:
-{
-  imports = [
-    ./configuration.nix
-    ./nginx.nix
-    ./nitter.nix
-  ];
-}