june/fi-nix-infra
1
0
Fork 0
forked from fi/nix-infra
Code Pull requests Activity

Put matrix federation behind reverse proxy

Browse source
This commit is contained in:
fi 2026-04-07 21:32:12 +02:00
commit fe86c128ed
Signed by: fi
SSH key fingerprint: SHA256:dgX1HRsK+8F1OzYvKfv1VLhMJac/Iv/rsjixuV94+dA
4 changed files with 30 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

25
config/hosts/matrix/nginx.nix
View file

@ -11,10 +11,17 @@
addr = "0.0.0.0"; addr = "0.0.0.0";
port = 80; port = 80;
} }
{
addr = "0.0.0.0";
port = 8443;
ssl = true;
proxyProtocol = true;
}
{ {
addr = "0.0.0.0"; addr = "0.0.0.0";
port = 8448; port = 8448;
ssl = true; ssl = true;
proxyProtocol = true;
} }
]; ];
locations = { locations = {
@ -49,8 +56,6 @@
}; };
}; };
extraConfig = '' extraConfig = ''
listen 0.0.0.0:8443 http2 ssl proxy_protocol;
set_real_ip_from 10.202.41.100; # IPv4 from web-public-2 set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
@ -64,6 +69,12 @@
addr = "0.0.0.0"; addr = "0.0.0.0";
port = 80; port = 80;
} }
{
addr = "0.0.0.0";
port = 8443;
ssl = true;
proxyProtocol = true;
}
]; ];
locations = { locations = {
"/" = { "/" = {
@ -79,8 +90,6 @@
}; };
}; };
extraConfig = '' extraConfig = ''
listen 0.0.0.0:8443 http2 ssl proxy_protocol;
set_real_ip_from 10.202.41.100; # IPv4 from web-public-2 set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;
@ -94,6 +103,12 @@
addr = "0.0.0.0"; addr = "0.0.0.0";
port = 80; port = 80;
} }
{
addr = "0.0.0.0";
port = 8443;
ssl = true;
proxyProtocol = true;
}
]; ];
locations."^~ /livekit/jwt/" = { locations."^~ /livekit/jwt/" = {
proxyPass = "http://localhost:8082/"; proxyPass = "http://localhost:8082/";
@ -103,8 +118,6 @@
proxyWebsockets = true; proxyWebsockets = true;
}; };
extraConfig = '' extraConfig = ''
listen 0.0.0.0:8443 http2 ssl proxy_protocol;
set_real_ip_from 10.202.41.100; # IPv4 from web-public-2 set_real_ip_from 10.202.41.100; # IPv4 from web-public-2
set_real_ip_from 10.203.10.3; # IPv6 from valkyrie set_real_ip_from 10.203.10.3; # IPv6 from valkyrie
real_ip_header proxy_protocol; real_ip_header proxy_protocol;

2
config/hosts/valkyrie/configuration.nix
View file

@ -7,7 +7,7 @@
nftables.enable = true; nftables.enable = true;
firewall = { firewall = {
enable = true; enable = true;
allowedTCPPorts = [ 80 443 ]; allowedTCPPorts = [ 80 443 8448 ];
allowedUDPPorts = [ 51820 51821 51822 51824 51827 51828 51829 51830 ]; allowedUDPPorts = [ 51820 51821 51822 51824 51827 51828 51829 51830 ];
}; };
wireguard = { wireguard = {

5
config/hosts/valkyrie/nginx.nix
View file

@ -58,6 +58,11 @@
ssl_preread on; ssl_preread on;
proxy_protocol on; proxy_protocol on;
} }
server {
listen [::]:8448;
proxy_pass 10.202.41.112:8448; # matrix federation port
proxy_protocol on;
}
''; '';
}; };
} }

5
config/hosts/web-public-2/nginx.nix
View file

@ -38,6 +38,11 @@
ssl_preread on; ssl_preread on;
proxy_protocol on; proxy_protocol on;
} }
server {
listen 0.0.0.0:8448;
proxy_pass 10.202.41.112:8448; # matrix federation port
proxy_protocol on;
}
} }
''; '';