From 93b9b3c17629f84ad956f6cbd10875ca9ef4cf04 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Sun, 5 Jul 2026 14:07:34 +0200 Subject: [PATCH 1/6] reverseproxy: add alias snl et nekorale --- hosts/vm/reverseproxy/reverseproxy.nix | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix index 3401084..25c1437 100644 --- a/hosts/vm/reverseproxy/reverseproxy.nix +++ b/hosts/vm/reverseproxy/reverseproxy.nix @@ -176,6 +176,10 @@ in httpOnly = true; target = "172.16.10.104"; }; + "nekorale" = { + anubisConfig = "${anubisAllowOther}"; + target = "172.16.10.31/club-nekorale/"; + }; "perso" = { anubisConfig = "${anubisPerso}"; target = "172.16.10.31"; @@ -183,6 +187,10 @@ in "clubs" ]; }; + "snl" = { + anubisConfig = "${anubisAllowOther}"; + target = "172.16.10.31/sonetlumens/"; + }; "wiki" = { anubisConfig = "${anubisChallenge}"; target = "172.16.10.161"; From c93e770f940f7fac9dd95627d8308d4615afb02e Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Sun, 5 Jul 2026 14:15:29 +0200 Subject: [PATCH 2/6] reverseproxy: nix trailing / --- hosts/vm/reverseproxy/reverseproxy.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix index 25c1437..7d82111 100644 --- a/hosts/vm/reverseproxy/reverseproxy.nix +++ b/hosts/vm/reverseproxy/reverseproxy.nix @@ -178,7 +178,7 @@ in }; "nekorale" = { anubisConfig = "${anubisAllowOther}"; - target = "172.16.10.31/club-nekorale/"; + target = "172.16.10.31/club-nekorale"; }; "perso" = { anubisConfig = "${anubisPerso}"; @@ -189,7 +189,7 @@ in }; "snl" = { anubisConfig = "${anubisAllowOther}"; - target = "172.16.10.31/sonetlumens/"; + target = "172.16.10.31/sonetlumens"; }; "wiki" = { anubisConfig = "${anubisChallenge}"; From 4e83b11d229cbc48690f6e6b3526b4cdaa53a193 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Sun, 5 Jul 2026 22:51:26 +0200 Subject: [PATCH 3/6] Refactor reverseproxy --- hosts/vm/reverseproxy/reverseproxy.nix | 24 +-- modules/services/reverseproxy.nix | 215 ++++++++++++++----------- 2 files changed, 135 insertions(+), 104 deletions(-) diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix index 7d82111..e154c2c 100644 --- a/hosts/vm/reverseproxy/reverseproxy.nix +++ b/hosts/vm/reverseproxy/reverseproxy.nix @@ -135,21 +135,21 @@ in enable = true; virtualHosts = { "collabora" = { - target = "172.16.10.149"; + proxyPass = "172.16.10.149"; proxyWebsockets = true; }; "eclat" = { anubisConfig = "${anubisMirrors}"; httpOnly = true; - target = "172.16.10.104"; + proxyPass = "172.16.10.104"; }; "eclats" = { anubisConfig = "${anubisMirrors}"; - target = "172.16.10.104"; + proxyPass = "172.16.10.104"; }; "install-party" = { anubisConfig = "${anubisChallenge}"; - target = "/var/www/install-party.crans.org"; + serveLocalFiles = "/var/www/install-party.crans.org"; serverAliases = [ "i-p" "adopteunmanchot" @@ -158,42 +158,42 @@ in }; "lists" = { anubisConfig = "${anubisChallenge}"; - target = "172.16.10.110"; + proxyPass = "172.16.10.110"; }; "mediawiki" = { anubisConfig = "${anubisChallenge}"; - target = "172.16.10.144"; + proxyPass = "172.16.10.144"; serverAliases = [ "mediakiwi" ]; }; "mirrors" = { anubisConfig = "${anubisMirrors}"; - target = "172.16.10.104"; + proxyPass = "172.16.10.104"; }; "mirror" = { anubisConfig = "${anubisMirrors}"; httpOnly = true; - target = "172.16.10.104"; + proxyPass = "172.16.10.104"; }; "nekorale" = { anubisConfig = "${anubisAllowOther}"; - target = "172.16.10.31/club-nekorale"; + globalRedirect = "172.16.10.31/club-nekorale"; }; "perso" = { anubisConfig = "${anubisPerso}"; - target = "172.16.10.31"; + proxyPass = "172.16.10.31"; serverAliases = [ "clubs" ]; }; "snl" = { anubisConfig = "${anubisAllowOther}"; - target = "172.16.10.31/sonetlumens"; + globalRedirect = "172.16.10.31/sonetlumens"; }; "wiki" = { anubisConfig = "${anubisChallenge}"; - target = "172.16.10.161"; + proxyPass = "172.16.10.161"; serverAliases = [ "wikipedia" ]; diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix index 5098771..ed386a7 100644 --- a/modules/services/reverseproxy.nix +++ b/modules/services/reverseproxy.nix @@ -65,18 +65,36 @@ in ''; }; - target = mkOption { + proxyPass = mkOption { type = types.str; default = ""; description = '' - Indique la destination. Il peut s'agir du chemin vers des fichiers statiques. + Indique la destination à proxy. ''; example = "172.16.10.128:8000"; }; + serveLocalFiles = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Chemin vers un dossier à exposer statiquement. + ''; + example = "/var/local/adopter-un-manchot"; + }; + + globalRedirect = mkOption { + type = types.nullOr types.str; + default = null; + description = '' + Si définie, toutes les requêtes sont redirigées (via 301) sur cet hôte. + ''; + example = "perso.crans.org/club"; + }; + anubisConfig = mkOption { - type = types.str; - default = ""; + type = types.nullOr types.str; + default = null; description = '' Chemin du fichier de configuration ''; @@ -95,7 +113,7 @@ in type = types.bool; default = false; description = '' - Interdit les connexions en ssh + Interdit les connexions en https ''; example = "true"; }; @@ -137,104 +155,117 @@ in services = mkIf cfg.enable { anubis = { defaultOptions.group = "nginx"; - instances = lib.mapAttrs (vhostName: vhostConfig: { - enable = true; - settings = { - BIND = "/run/anubis/anubis-${vhostName}/socket.sock"; - BIND_NETWORK = "unix"; - METRICS_BIND = "/run/anubis/anubis-${vhostName}/anubis-${vhostName}-metrics.sock"; - TARGET = "unix:///run/nginx/nginx-${vhostName}.sock"; - COOKIE_DOMAIN = "crans.org"; - REDIRECT_DOMAINS = "${vhostName}.crans.org"; - SOCKET_MODE = "0660"; - # OpenGraph config - OG_PASSTHROUGH = vhostConfig.anubisOpenGraph; - OG_EXPIRY_TIME = "24h"; - OG_CACHE_CONSIDER_HOST = true; - # Policy config - POLICY_FNAME = if (vhostConfig.anubisConfig == "") then "${allowAll}" else vhostConfig.anubisConfig; - }; - }) cfg.virtualHosts; + instances = lib.mapAttrs ( + vhostName: vhostConfig: + mkIf (vhostConfig.anubisConfig != null) { + enable = true; + settings = { + BIND = "/run/anubis/anubis-${vhostName}/socket.sock"; + BIND_NETWORK = "unix"; + METRICS_BIND = "/run/anubis/anubis-${vhostName}/anubis-${vhostName}-metrics.sock"; + TARGET = "unix:///run/nginx/nginx-${vhostName}.sock"; + COOKIE_DOMAIN = "crans.org"; + REDIRECT_DOMAINS = "${vhostName}.crans.org"; + SOCKET_MODE = "0660"; + # OpenGraph config + OG_PASSTHROUGH = vhostConfig.anubisOpenGraph; + OG_EXPIRY_TIME = "24h"; + OG_CACHE_CONSIDER_HOST = true; + # Policy config + POLICY_FNAME = vhostConfig.anubisConfig; + }; + } + ) cfg.virtualHosts; }; nginx = let - # Configuration du serveur principal. - mainConfig = lib.mapAttrs' ( + configVhost = vhostName: vhostConfig: - lib.nameValuePair (vhostName + "-anubis") { - enableACME = !vhostConfig.httpOnly; - forceSSL = !vhostConfig.httpOnly; - rejectSSL = vhostConfig.httpOnly; - locations."/" = { - proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock"; - proxyWebsockets = vhostConfig.proxyWebsockets; + let + sslConf = { + enableACME = !vhostConfig.httpOnly; + forceSSL = !vhostConfig.httpOnly; + rejectSSL = vhostConfig.httpOnly; }; - serverName = "${vhostName}.crans.${mainTld}"; - extraConfig = " - set_real_ip_from 172.16.0.0/16; - set_real_ip_from fd00::/56; - real_ip_header X-Real-Ip; - "; - } - ) cfg.virtualHosts; - # Redirections - redirectConfig = lib.mapAttrs (vhostName: vhostConfig: { - # Redirection vers d'autres machines - locations = mkIf (!lib.strings.hasPrefix "/" vhostConfig.target) { - "/favicon.ico".root = "/var/www/logo/"; - "/" = { - proxyPass = "http://${vhostConfig.target}"; - proxyWebsockets = vhostConfig.proxyWebsockets; - }; - }; - # Redirection vers des fichiers locaux - root = mkIf (lib.strings.hasPrefix "/" vhostConfig.target) vhostConfig.target; - listen = [ - { addr = "unix:/run/nginx/nginx-${vhostName}.sock"; } - ]; - serverName = "${vhostName}.crans.${mainTld}"; - extraConfig = " - set_real_ip_from unix:; - real_ip_header X-Real-IP; - "; - }) cfg.virtualHosts; - - # Génération des alias - getAliases = name: config: lib.foldr ( - tld: acc: - acc - ++ - (lib.foldr (alias: acc: acc ++ ["${alias}.crans.${tld}"]) ["${name}.crans.${tld}"] config.serverAliases) - ) - (lib.foldr (alias: acc: acc ++ ["${alias}.crans.${mainTld}"]) [] config.serverAliases) - otherTld; - - # Configuration des alias - aliasConfig = lib.foldr ( - vhost: acc: - acc - // - lib.foldr ( - alias: acc: - acc - // - { - "${vhost.name}-alias-${alias}" = rec { - rejectSSL = vhost.value.httpOnly; - forceSSL = !rejectSSL; - enableACME = !rejectSSL; - serverName = alias; - globalRedirect = "${vhost.name}.crans.${mainTld}"; - }; + # Conf pour l’host en entrès + entryExtraConf = { + extraConfig = '' + set_real_ip_from 172.16.0.0/16; + set_real_ip_from fd00::/56; + real_ip_header X-Real-Ip; + ''; } - ) { } (getAliases vhost.name vhost.value) - ) { } (lib.attrsToList cfg.virtualHosts); + // sslConf; + # Conf supplémentaire pour le proxy principal + vhostExtraConf = + if vhostConfig.anubisConfig != null then + # Il reçoit les requêtes d’Anubis + { + listen = [ + { addr = "unix:/run/nginx/nginx-${vhostName}.sock"; } + ]; + extraConfig = '' + set_real_ip_from unix:; + real_ip_header X-Real-IP; + ''; + } + else + # Il est en entrée + entryExtraConf; + + # Les alias : vhostName × otherTld U serverAliases × allTld + aliases = + lib.foldr + ( + tld: acc: + acc + ++ (lib.foldr (alias: acc: acc ++ [ "${alias}.crans.${tld}" ]) [ + "${vhostName}.crans.${tld}" + ] vhostConfig.serverAliases) + ) + (lib.foldr (alias: acc: acc ++ [ "${alias}.crans.${mainTld}" ]) [ ] vhostConfig.serverAliases) + otherTld; + in + { + # Configuration du service à proxy. + "${vhostName}" = vhostExtraConf // { + serverName = "${vhostName}.crans.${mainTld}"; + locations."/" = mkIf (vhostConfig.proxyPass != "") { + proxyPass = "http://${vhostConfig.proxyPass}"; + proxyWebsockets = vhostConfig.proxyWebsockets; + }; + root = vhostConfig.serveLocalFiles; + globalRedirect = vhostConfig.globalRedirect; + }; + + # Entrée d’Anubis + "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) entryExtraConf // { + locations."/" = { + proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock"; + proxyWebsockets = vhostConfig.proxyWebsockets; + extraConfig = entryExtraConf.extraConfig + '' + access_log /var/log/nginx/anubis.access.log; + error_log /var/log/nginx/anubis.error.log; + ''; + }; + serverName = "${vhostName}.crans.${mainTld}"; + }; + } + # Les alias + // lib.mergeAttrsList ( + lib.map (alias: { + "${vhostName}-alias-${alias}" = sslConf // { + serverName = alias; + globalRedirect = vhostConfig.globalRedirect or "${vhostName}.crans.${mainTld}"; + }; + }) aliases + ); in { enable = true; - virtualHosts = redirectConfig // aliasConfig // mainConfig; + virtualHosts = lib.concatMapAttrs configVhost cfg.virtualHosts; }; }; }; From 0af3d1071c5289b7cee2c49bf34717d707884c70 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Mon, 6 Jul 2026 11:52:33 +0200 Subject: [PATCH 4/6] Small reverseproxy fixes --- hosts/vm/reverseproxy/reverseproxy.nix | 10 ++-------- modules/services/reverseproxy.nix | 18 +++++++++--------- 2 files changed, 11 insertions(+), 17 deletions(-) diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix index e154c2c..5c09e66 100644 --- a/hosts/vm/reverseproxy/reverseproxy.nix +++ b/hosts/vm/reverseproxy/reverseproxy.nix @@ -176,10 +176,7 @@ in httpOnly = true; proxyPass = "172.16.10.104"; }; - "nekorale" = { - anubisConfig = "${anubisAllowOther}"; - globalRedirect = "172.16.10.31/club-nekorale"; - }; + "nekorale".globalRedirect = "172.16.10.31/club-nekorale"; "perso" = { anubisConfig = "${anubisPerso}"; proxyPass = "172.16.10.31"; @@ -187,10 +184,7 @@ in "clubs" ]; }; - "snl" = { - anubisConfig = "${anubisAllowOther}"; - globalRedirect = "172.16.10.31/sonetlumens"; - }; + "snl".globalRedirect = "172.16.10.31/sonetlumens"; "wiki" = { anubisConfig = "${anubisChallenge}"; proxyPass = "172.16.10.161"; diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix index ed386a7..57c9486 100644 --- a/modules/services/reverseproxy.nix +++ b/modules/services/reverseproxy.nix @@ -66,8 +66,8 @@ in }; proxyPass = mkOption { - type = types.str; - default = ""; + type = types.nullOr types.str; + default = null; description = '' Indique la destination à proxy. ''; @@ -75,7 +75,7 @@ in }; serveLocalFiles = mkOption { - type = types.nullOr types.str; + type = types.nullOr types.path; default = null; description = '' Chemin vers un dossier à exposer statiquement. @@ -232,7 +232,7 @@ in # Configuration du service à proxy. "${vhostName}" = vhostExtraConf // { serverName = "${vhostName}.crans.${mainTld}"; - locations."/" = mkIf (vhostConfig.proxyPass != "") { + locations."/" = mkIf (vhostConfig.proxyPass != null) { proxyPass = "http://${vhostConfig.proxyPass}"; proxyWebsockets = vhostConfig.proxyWebsockets; }; @@ -242,15 +242,15 @@ in # Entrée d’Anubis "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) entryExtraConf // { + serverName = "${vhostName}.crans.${mainTld}"; locations."/" = { proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock"; proxyWebsockets = vhostConfig.proxyWebsockets; - extraConfig = entryExtraConf.extraConfig + '' - access_log /var/log/nginx/anubis.access.log; - error_log /var/log/nginx/anubis.error.log; - ''; }; - serverName = "${vhostName}.crans.${mainTld}"; + extraConfig = entryExtraConf.extraConfig + '' + access_log /var/log/nginx/anubis.access.log; + error_log /var/log/nginx/anubis.error.log; + ''; }; } # Les alias From 721133147d0f3f791f6a1b95d6a57dcc0d0aa310 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Mon, 6 Jul 2026 12:09:04 +0200 Subject: [PATCH 5/6] Fix missing parenthesis --- modules/services/reverseproxy.nix | 25 ++++++++++++++----------- 1 file changed, 14 insertions(+), 11 deletions(-) diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix index 57c9486..ec1c1eb 100644 --- a/modules/services/reverseproxy.nix +++ b/modules/services/reverseproxy.nix @@ -241,17 +241,20 @@ in }; # Entrée d’Anubis - "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) entryExtraConf // { - serverName = "${vhostName}.crans.${mainTld}"; - locations."/" = { - proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock"; - proxyWebsockets = vhostConfig.proxyWebsockets; - }; - extraConfig = entryExtraConf.extraConfig + '' - access_log /var/log/nginx/anubis.access.log; - error_log /var/log/nginx/anubis.error.log; - ''; - }; + "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) ( + entryExtraConf + // { + serverName = "${vhostName}.crans.${mainTld}"; + locations."/" = { + proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock"; + proxyWebsockets = vhostConfig.proxyWebsockets; + }; + extraConfig = entryExtraConf.extraConfig + '' + access_log /var/log/nginx/anubis.access.log; + error_log /var/log/nginx/anubis.error.log; + ''; + } + ); } # Les alias // lib.mergeAttrsList ( From 24a71dd509f48ca9bf2671eeb421f03b07dcd0f2 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Mon, 6 Jul 2026 12:17:44 +0200 Subject: [PATCH 6/6] fix perso.crans.org redirection --- hosts/vm/reverseproxy/reverseproxy.nix | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix index 5c09e66..ef36132 100644 --- a/hosts/vm/reverseproxy/reverseproxy.nix +++ b/hosts/vm/reverseproxy/reverseproxy.nix @@ -176,7 +176,7 @@ in httpOnly = true; proxyPass = "172.16.10.104"; }; - "nekorale".globalRedirect = "172.16.10.31/club-nekorale"; + "nekorale".globalRedirect = "perso.crans.org/club-nekorale"; "perso" = { anubisConfig = "${anubisPerso}"; proxyPass = "172.16.10.31"; @@ -184,7 +184,7 @@ in "clubs" ]; }; - "snl".globalRedirect = "172.16.10.31/sonetlumens"; + "snl".globalRedirect = "perso.crans.org/sonetlumens"; "wiki" = { anubisConfig = "${anubisChallenge}"; proxyPass = "172.16.10.161";