From 452c275074f406e8ae6393c68cff4db80a1167c7 Mon Sep 17 00:00:00 2001 From: Pyjacpp Date: Sat, 29 Aug 2026 15:43:02 +0200 Subject: [PATCH] =?UTF-8?q?Anubis=E2=80=AF:=20ne=20pas=20refresh=20syst?= =?UTF-8?q?=C3=A9matiquement=20en=20changeant=20de=20site?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- hosts/vm/reverseproxy/reverseproxy.nix | 23 ++++++++++++------ modules/services/reverseproxy.nix | 28 +++++++++++++++++----- secrets/reverseproxy/anubis-secret.age | 33 ++++++++++++++++++++++++++ 3 files changed, 71 insertions(+), 13 deletions(-) create mode 100644 secrets/reverseproxy/anubis-secret.age diff --git a/hosts/vm/reverseproxy/reverseproxy.nix b/hosts/vm/reverseproxy/reverseproxy.nix index 0cb5191..c262998 100644 --- a/hosts/vm/reverseproxy/reverseproxy.nix +++ b/hosts/vm/reverseproxy/reverseproxy.nix @@ -194,8 +194,8 @@ let src = fetchFromCrans { repo = "homepage"; - rev = "51ae6b9f4d59815d14963209ff30988200eff944"; - hash = "sha256-un0LIIIFn56Zm1uF32+suc2/QrBDMRVTv/A0bOgbFJQ="; + rev = "a71446ad7c125241835190a4035159bc7be751bc"; + hash = "sha256-dAKJpBnGeDtv0UM8gXsdqUCzbliskRMYUEQ1KGCW1Cw="; }; nativeBuildInputs = with pkgs; [ @@ -293,8 +293,8 @@ in "re2o-dev".proxyPass = "172.16.10.166"; "services".serveLocalFiles = fetchFromCrans { repo = "services-page"; - rev = "ef5e998a09d298e75a94daae089f65407d40e331"; - hash = "sha256-GzFmU+U9OzZ0m40NKmrtDGKqfWdUO/fBsWBWKYFL8xs="; + rev = "e32ac21513d88e5123eb4138835453df64aa21d0"; + hash = "sha256-nc4IjA/wtj7WXnt0wZqGymGz/NR45STlMLbsTdnSzJ0="; }; "snl".globalRedirect = "perso.crans.org/sonetlumens"; "test-melon".proxyPass = "172.16.10.150:8080"; @@ -313,9 +313,9 @@ in proxyPass = "172.16.10.161"; serverAliases = [ "wikipedia" ]; }; - "www" = { + "_crans-org" = { serveLocalFiles = homepagePkg; - serverAliases = [ "." ]; + serverAliases = [ "www" ]; }; "zero".proxyPass = "172.16.10.130"; }; @@ -325,5 +325,14 @@ in acme.enable = true; }; }; - services.nginx.virtualHosts."www-alias-crans.org".default = true; + + # Règle particulières + services.nginx.virtualHosts = { + "www-alias-crans.org".default = true; + + "_crans-org".locations = { + "/_matrix/".proxyPass = "https://matrix.crans.org/_matrix/"; + "/_synapse/".proxyPass = "https://matrix.crans.org/_synapse/"; + }; + }; } diff --git a/modules/services/reverseproxy.nix b/modules/services/reverseproxy.nix index f66ce0f..23146c3 100644 --- a/modules/services/reverseproxy.nix +++ b/modules/services/reverseproxy.nix @@ -20,6 +20,8 @@ let mkOption types ; + + mkHostName = als: tld: if als == "_crans-org" then "crans.${tld}" else "${als}.crans.${tld}"; in { @@ -158,11 +160,19 @@ in }; }; + age.secrets.anubis-secret = { + file = ../../secrets/reverseproxy/anubis-secret.age; + owner = "anubis"; + }; + services = mkIf cfg.enable { anubis = { defaultOptions.group = "nginx"; instances = lib.mapAttrs ( vhostName: vhostConfig: + let + hostname = mkHostName vhostName mainTld; + in mkIf (vhostConfig.anubisConfig != null) { enable = true; settings = { @@ -170,9 +180,14 @@ in BIND_NETWORK = "unix"; METRICS_BIND = "/run/anubis/anubis-${vhostName}/anubis-${vhostName}-metrics.sock"; TARGET = "unix:///run/nginx/nginx-${vhostName}.sock"; - COOKIE_DOMAIN = "crans.${mainTld}"; - REDIRECT_DOMAINS = "${vhostName}.crans.${mainTld}"; + COOKIE_DOMAIN = hostname; + # TODO: db pour mettre en commun les token. + # Transitoirement on les sépare + COOKIE_PREFIX = "anubis-${vhostName}"; + REDIRECT_DOMAINS = hostname; SOCKET_MODE = "0660"; + # Secret partagé entre les instances + ED25519_PRIVATE_KEY_HEX_FILE = config.age.secrets.anubis-secret.path; # OpenGraph config OG_PASSTHROUGH = vhostConfig.anubisOpenGraph; OG_EXPIRY_TIME = "24h"; @@ -215,6 +230,8 @@ in configVhost = vhostName: vhostConfig: let + hostname = mkHostName vhostName mainTld; + sslConf = { forceSSL = !vhostConfig.httpOnly; rejectSSL = vhostConfig.httpOnly; @@ -254,7 +271,6 @@ in ''; # Les alias : vhostName × otherTld U serverAliases × allTld - mkHostName = als: tld: if als == "." then "crans.${tld}" else "${als}.crans.${tld}"; aliases = lib.foldr ( @@ -270,7 +286,7 @@ in { # Configuration du service à proxy. "${vhostName}" = vhostExtraConf // { - serverName = mkHostName vhostName mainTld; + serverName = hostname; locations."/" = mkIf (vhostConfig.proxyPass != null) { proxyPass = "http://${vhostConfig.proxyPass}"; proxyWebsockets = vhostConfig.proxyWebsockets; @@ -284,7 +300,7 @@ in "${vhostName}-anubis" = mkIf (vhostConfig.anubisConfig != null) ( entryExtraConf // rec { - serverName = mkHostName vhostName mainTld; + serverName = hostname; locations."/" = { proxyPass = "http://unix:/run/anubis/anubis-${vhostName}/socket.sock"; proxyWebsockets = vhostConfig.proxyWebsockets; @@ -306,7 +322,7 @@ in lib.map (alias: { "${vhostName}-alias-${alias}" = sslConf // { serverName = alias; - globalRedirect = lib.defaultTo "${vhostName}.crans.${mainTld}" vhostConfig.globalRedirect; + globalRedirect = lib.defaultTo hostname vhostConfig.globalRedirect; extraConfig = logHostConf; }; }) aliases diff --git a/secrets/reverseproxy/anubis-secret.age b/secrets/reverseproxy/anubis-secret.age new file mode 100644 index 0000000..578c302 --- /dev/null +++ b/secrets/reverseproxy/anubis-secret.age @@ -0,0 +1,33 @@ +age-encryption.org/v1 +-> ssh-ed25519 GCcVXA qD1f4YdP88JvuPLS6H416O0LF+rKN/gJ+gPf0lFWIRs +B0LuHjXX0UiHHTwY7v1HqP4VF5/5yn0d/gNW4zUOC5w +-> piv-p256 ewCc3w A8Wnjz7tLNpV/m5bUzuq/MBTHn+jQiaCSUb4vFvGDH7N +gNBEsgdHogaz3OSJBelB39bGrOBt8+hkNXpAYcFcy28 +-> piv-p256 6CL/Pw AoJBcpyhK+hpZOfHOBUHh0Kivvn6YJ4xepo7IWppbMuJ +f1fwsu8okH7F+6nSHowxHpTdtjU72lvd6FmwFIMmV8E +-> ssh-ed25519 eOAUSg 0bH2dDdNzKapr54HKndKJpKO5iTQtbhY957NIJQcvBo +LYVsTuKNsE4JlBxbf2e+Qo9ZjRxnz6saEHEjyfCcAjc +-> ssh-rsa REaZBA +Pho7O15lWd5/2Uy1OQmA/JzE0wmOji6IPKGj03nK9aYSQjsTTc30YhNCrkddglGX +MCClDyGDlQ0mCwHKVfpFeeSC9VQWQDDYk90dM4MF//6hHPqU/zn8dR25NyxDgyyi +DVrCFB+S09LsKI4isbDoCru6fWXfdN4Fj8I44c64dBpIVh4XhSzUtmlzmge//35C +y6EvAjVIhVTbbgnQ5CJFgnRlSPaN5BHDq76aJ3c+8Ajkjowa2YcYu7w8asi7PsIs +WH6J2qMIPvPdxOEKczGc401ysUfz9fNFKs0Xx4spduwv8I3Sv4ImURDkYmCl/k7J +rwRXbUGr8JzZu093cmkjVxDrSfb9VhqlZVJD7uc2VSTk8ntwStLWafSuE03bIN2L +on0t/4/wXtvFtwlGoDe9QGYAJpPYWM0ZUPMZfpddOz9vYvL1+6nUcDroLMvCIItI +blwJZ0970K/Je99SmI3+6mUEAw8nJ/pBFaF/LmTJecypLEalLNsu2IALyCMIdTa0 + +-> ssh-ed25519 J/iReg fpgi4t31rVl+KvOYd0Ph0Nd2gInJAZXNhQC5ekpv0kI +lznh3YwmqVr05vjWxf1HKRWAFZGXbypAYygjUe+ELlk +-> ssh-ed25519 GNhSGw 2cVptD/h5NWcYsjPPwQcP/b9tjJPDbhjDKh2hKhA5GM +JZvQvXkb1RRw+NHnJ+HMV5tlwiBnLf4+cwm6J2hZD9Y +-> ssh-ed25519 eXMAtA axP3hHgfgWJScGLIGpYgu0iYW1qZRQzMK9XjIeszrnc +rBzAqSVoRqj/drZSOlxSIZLgZZU/wqGML1gKCEHtcy4 +-> ssh-ed25519 5hXocQ b3kjoM+FfQ434V7X8FdpIHVFjTn4sc+psj+9jyRljxU +l5rna7ap0ydVXPCSr4qrPnu2MV2n7XwoSh/T87OkuMU +-> ssh-ed25519 bRHVVA 92Rj1gMmueSHWzxsKWVs+7nF4JzuekhfaB2u5AWnazk +yg4qa9lyHsGCOXWOTm7/XH9F8JzvRLjzsxyXe88oXnE +-> ssh-ed25519 HgW9eA mpIFRqMXj08JuyYLf6Hx4p9fOLbxXZquSMAjh0e/lSU +h1kvwnu+mLOeRfVFUXgE9IDo/MQ+4gtkYwrF3JWQfwY +--- MCDm2NH5NWgwnFYQ+zJ4obfdxWpiv3BGohnIJ1bRkco +_ֹ`FvF3[;197%490M[Ip:s|CR6,C;[;