Merge branch 'reverseproxy' into 'main'

Fix rules anubis

See merge request nounous/nixos!27

hosts/vm/reverseproxy/reverseproxy.nix

@@ -1,141 +1,149 @@
 { pkgs, ... }:
 
 let
-  anubisBotsMirror = pkgs.writeText "anubis_bots_mirror.yaml"
+  formatJSON = pkgs.formats.json { };
-    ''
+  formatYAML = pkgs.formats.yaml { };
-      - name: whitelist-crans
-        action: ALLOW
-        remote_addresses:
-          - 185.230.79.0/22
-          - 2a0c:700::/32
-          - 46.105.102.188/32
-          - 2001:41d0:2:d5bc::/128
 
-      - name: no-user-agent-string
+  anubisBotsMirror = formatYAML.generate "anubis_bots_mirror.yaml" [
-        action: DENY
-        expression: userAgent == ""
-
-      - name: ban-gpt
-        user_agent_regex: ".*gpt.*"
-        action: DENY
-
-      - name: ban-bot
-        user_agent_regex: ".*(b|B)ot.*"
-        action: DENY
-
-      - name: ban-WebKit
-        action: DENY
-        expression:
-          all:
-            - userAgent.startsWith("Mozilla")
-            - userAgent.matches("AppleWebKit")
-            - userAgent.matches("Safari")
-            - userAgent.matches("Chrome")
-
-      - name: ban-Barkrowler
-        user_agent_regex: ".*Barkrowler.*"
-        action: DENY
-    '';
-  anubisMirror = pkgs.writeText "anubis_mirror.json"
-    ''
     {
-        "bots": [
+      name = "whitelist-crans";
-          {
+      action = "ALLOW";
-            "import": "${anubisBotsMirror}"
+      remote_addresses = [
-          },
+        "185.230.79.0/22"
-          {
+        "2a0c:700::/32"
-            "name": "allow-repo",
+        "46.105.102.188/32"
-            "path_regex": "^...*",
+        "2001:41d0:2:d5bc::/128"
-            "action": "ALLOW"
+      ];
-          },
-          {
-            "name": "deny-other",
-            "path_regex": ".*",
-            "action": "ALLOW"
     }
-        ]
+    {
+      name = "no-user-agent";
+      action = "DENY";
+      expression = "userAgent == \"\"";
     }
-    '';
-  antibot = pkgs.writeText "antibot.yaml"
-    ''
-      - name: whitelist-crans
-        action: ALLOW
-        remote_addresses:
-          - 185.230.79.0/22
-          - 2a0c:700::/32
-          - 46.105.102.188/32
-          - 2001:41d0:2:d5bc::/128
-
-      - name: no-user-agent-string
-        action: DENY
-        expression: userAgent == ""
-
-      - name: ban-gpt
-        user_agent_regex: ".*gpt.*"
-        action: DENY
-
-      - name: ban-bot
-        user_agent_regex: ".*(b|B)ot.*"
-        action: DENY
-
-      - name: ban-WebKit
-        action: CHALLENGE
-        expression:
-          all:
-            - userAgent.startsWith("Mozilla")
-            - userAgent.matches("AppleWebKit")
-            - userAgent.matches("Safari")
-            - userAgent.matches("Chrome")
-
-      - name: ban-Barkrowler
-        user_agent_regex: ".*Barkrowler.*"
-        action: DENY
-    '';
-  anubisChallenge = pkgs.writeText "anubis_challenge.json"
-    ''
     {
-        "bots": [
+      name = "ban-gpt";
-          {
+      action = "DENY";
-            "import": "${antibot}"
+      user_agent_regex = ".*gpt.*";
-          },
-          {
-            "name": "challenge-other",
-            "path_regex": "^*",
-            "action": "CHALLENGE"
     }
-        ]
+    {
+      name = "ban-bot";
+      action = "DENY";
+      user_agent_regex = ".*(b|B)ot.*";
     }
-    '';
-  anubisMirrors = pkgs.writeText "anubis_mirrors.json"
-    ''
     {
-        "bots": [
+      name = "ban-WebKit";
-          {
+      action = "DENY";
-            "import": "${antibot}"
+      expression = {
-          },
+        all = [
-          {
+          "userAgent.startsWith(\"Mozilla\")"
-            "name": "deny-other",
+          "userAgent.startsWith(\"AppleWebKit\")"
-            "path_regex": ".*cdimage-.*",
+          "userAgent.startsWith(\"Safari\")"
-            "action": "ALLOW"
+          "userAgent.startsWith(\"Chrome\")"
-          },
+        ];
-          {
+      };
-            "name": "allow-repo",
-            "path_regex": "^...*",
-            "action": "ALLOW"
-          },
-          {
-            "name": "deny-other",
-            "path_regex": ".*",
-            "action": "CHALLENGE"
     }
-        ]
+    {
+      name = "ban-Barkrowler";
+      action = "DENY";
+      user_agent_regex = ".*Barkrowler.*";
     }
-    '';
+  ];
-in {
+
+  anubisMirror = formatJSON.generate "anubis_mirror.json" {
+    bots = [
+      {
+        import = "${anubisBotsMirror}";
+      }
+      {
+        name = "allow-repo";
+        action = "ALLOW";
+        path_regex = "^...*";
+      }
+      {
+        name = "deny-other";
+        path_regex = ".*";
+        action = "ALLOW";
+      }
+    ];
+  };
+
+  antiBot = formatYAML.generate "antibot.yaml" [
+    {
+      import = "${anubisBotsMirror}";
+    }
+    {
+      # On refuse les bots qui font souvent de la merde.
+      # https://github.com/TecharoHQ/anubis/blob/main/data/bots/deny-pathological.yaml
+      import = "(data)/bots/_deny-pathological.yaml";
+    }
+    {
+      # On autorise les indexers des moteurs de recherche.
+      # https://github.com/TecharoHQ/anubis/blob/main/data/crawlers/_allow-good.yaml
+      import = "(data)/crawlers/_allow-good.yaml";
+    }
+    {
+      # On autorise l'accès à favicon, robots.txt, well-known, ...
+      # https://github.com/TecharoHQ/anubis/blob/main/data/common/keep-internet-working.yaml
+      import = "(data)/common/keep-internet-working.yaml";
+    }
+    {
+      # On refuse si userAgent = ""
+      # https://github.com/TecharoHQ/anubis/blob/main/data/common/keep-internet-working.yaml
+      import = "(data)/common/rfc-violations.yaml";
+    }
+    {
+      # On bloque les AI aggressivement (bots/agent, training et user search par IA)
+      # https://github.com/TecharoHQ/anubis/blob/main/data/meta/ai-block-aggressive.yaml
+      import = "(data)/meta/ai-block-aggressive.yaml";
+    }
+  ];
+
+  anubisChallenge = formatJSON.generate "anubis_challenge.json" {
+    "bots" = [
+      {
+        import = "${antiBot}";
+      }
+      {
+        name = "challenge-other";
+        path_regex = "^*";
+        action = "CHALLENGE";
+      }
+    ];
+  };
+
+  anubisMirrors = formatJSON.generate "anubis_mirrors.json" {
+    "bots" = [
+      {
+        import = "${antiBot}";
+      }
+      {
+        name = "deny-other";
+        path_regex = ".*cdimage-.*";
+        action = "ALLOW";
+      }
+      {
+        name = "allow-repo";
+        path_regex = "^...*";
+        action = "ALLOW";
+      }
+      {
+        name = "deny-other";
+        path_regex = ".*";
+        action = "CHALLENGE";
+      }
+    ];
+  };
+
+in
+{
   crans = {
     reverseProxy = {
       enable = true;
       virtualHosts = {
+        "collabora" = {
+          target = "172.16.10.149";
+          proxyWebsockets = true;
+        };
         "eclat" = {
           anubisConfig = "${anubisMirror}";
           httpOnly = true;

modules/services/reverseproxy.nix

@@ -1,30 +1,36 @@
-{ pkgs, lib, config, ... }:
+{
+  pkgs,
+  lib,
+  config,
+  ...
+}:
 
 let
   cfg = config.crans.reverseProxy;
 
-  allowAll = pkgs.writeText "allow_all.json"
+  formatJSON = pkgs.formats.json { };
-    ''
+
+  allowAll = formatJSON.generate "allow_all.json" {
+    bots = [
       {
-        "bots": [
+        name = "allow_all";
-          {
+        path_regex = ".*";
-            "name": "allow_all",
+        action = "ALLOW";
-            "path_regex": ".*",
-            "action": "ALLOW"
       }
-        ]
+    ];
-      }
+  };
-    '';
+
+  mainTld = "org";
+  otherTld = [
+    "fr"
+    "eu"
+  ];
+
   inherit (lib)
-    cartesianProduct
     literalExpression
-    mapAttrs
-    mapAttrs'
     mkEnableOption
     mkIf
     mkOption
-    nameValuePair
-    substring
     types
     ;
 in
@@ -75,10 +81,21 @@ in
               '';
               example = "true";
             };
+
+            proxyWebsockets = mkOption {
+              type = types.bool;
+              default = false;
+              description = ''
+                Activer les websockets
+              '';
+              example = "true";
+            };
           };
         }
       );
-      default = {};
+
+      default = { };
+
       example = literalExpression ''
         {
           "framadate" = {
@@ -95,17 +112,14 @@ in
   };
 
   config = {
-    systemd.services = mapAttrs (
+    systemd.services = lib.mapAttrs (vhostName: vhostConfig: {
-      vhostName: vhostConfig: {
       wantedBy = [ "multi-user.target" ];
-      }
+    }) cfg.virtualHosts;
-    ) cfg.virtualHosts;
 
     services = mkIf cfg.enable {
       anubis = {
         defaultOptions.group = "nginx";
-        instances = mapAttrs (
+        instances = lib.mapAttrs (vhostName: vhostConfig: {
-          vhostName: vhostConfig: {
           enable = true;
           settings = {
             BIND = "/run/anubis/anubis-${vhostName}.sock";
@@ -114,63 +128,65 @@ in
             COOKIE_DOMAIN = "crans.org";
             REDIRECT_DOMAINS = "${vhostName}.crans.org";
             SOCKET_MODE = "0660";
-              POLICY_FNAME =
+            POLICY_FNAME = if (vhostConfig.anubisConfig == "") then "${allowAll}" else vhostConfig.anubisConfig;
-                if (vhostConfig.anubisConfig == "")
-                then allowAll
-                else vhostConfig.anubisConfig;
           };
-          }
+        }) cfg.virtualHosts;
-        ) cfg.virtualHosts;
       };
 
       nginx =
         let
-          domaines = [
+          # Configuration du serveur principal.
-            "crans.org"
+          mainConfig = lib.mapAttrs' (
-            "crans.fr"
+            vhostName: vhostConfig:
-            "crans.eu"
+            lib.nameValuePair (vhostName + "-anubis") {
-          ];
+              enableACME = !vhostConfig.httpOnly;
-          redirectConfig = mapAttrs (
+              forceSSL = !vhostConfig.httpOnly;
-            vhostName: vhostConfig: {
+              rejectSSL = vhostConfig.httpOnly;
-              locations = mkIf ((substring 0 1 vhostConfig.target) != "/") {
+              locations."/" = {
-                "/favicon.ico".root = "/var/www/logo/";
+                proxyPass = "http://unix:/run/anubis/anubis-${vhostName}.sock";
-                "/".proxyPass = "http://${vhostConfig.target}";
+                proxyWebsockets = vhostConfig.proxyWebsockets;
               };
-              root = mkIf ((substring 0 1 vhostConfig.target) == "/") vhostConfig.target;
+              serverName = "${vhostName}.crans.${mainTld}";
+            }
+          ) cfg.virtualHosts;
+
+          # Redirections
+          redirectConfig = lib.mapAttrs (vhostName: vhostConfig: {
+            # Redirection vers d'autres machines
+            locations = mkIf (!lib.strings.hasPrefix "/" vhostConfig.target) {
+              "/favicon.ico".root = "/var/www/logo/";
+              "/" = {
+                proxyPass = "http://${vhostConfig.target}";
+                proxyWebsockets = vhostConfig.proxyWebsockets;
+              };
+            };
+            # Redirection vers des fichiers locaux
+            root = mkIf (lib.strings.hasPrefix "/" vhostConfig.target) vhostConfig.target;
             listen = [
               { addr = "unix:/run/nginx/nginx-${vhostName}.sock"; }
             ];
-            }
+          }) cfg.virtualHosts;
-          ) cfg.virtualHosts;
+
-          aliasConfig =  mapAttrs' (
+          # Configuration des alias .fr et .eu
-            vhostName: vhostConfig: nameValuePair (vhostName + "-alias") {
+          aliasConfig = lib.fold (
-              enableACME = !vhostConfig.httpOnly;
+            tld: acc:
-              forceSSL = !vhostConfig.httpOnly;
+            acc
+            // lib.mapAttrs' (
+              vhostName: vhostConfig:
+              lib.nameValuePair "${vhostName}-alias-${tld}" rec {
                 rejectSSL = vhostConfig.httpOnly;
-              serverName = "${vhostName}.crans.fr";
+                forceSSL = !rejectSSL;
-              serverAliases = let
+                enableACME = !rejectSSL;
-                aliases = cartesianProduct {
+                serverName = "${vhostName}.crans.${tld}";
-                  name = vhostConfig.serverAliases;
+                serverAliases = map (name: "${name}.crans.${tld}") vhostConfig.serverAliases;
-                  domaine = domaines;
+                globalRedirect = "${vhostName}.crans.${mainTld}";
-                };
-              in [
-                "${vhostName}.crans.eu"
-              ] ++ map (value: value.name + "." + value.domaine) aliases;
-              globalRedirect = "${vhostName}.crans.org";
               }
-          ) cfg.virtualHosts;
+            ) cfg.virtualHosts
-          anubisConfig = mapAttrs' (
+          ) { } otherTld;
-            vhostName: vhostConfig: nameValuePair (vhostName + "-anubis") {
+        in
-              enableACME = !vhostConfig.httpOnly;
+        {
-              forceSSL = !vhostConfig.httpOnly;
-              rejectSSL = vhostConfig.httpOnly;
-              locations."/".proxyPass = "http://unix:/run/anubis/anubis-${vhostName}.sock";
-              serverName = "${vhostName}.crans.org";
-            }
-          ) cfg.virtualHosts;
-        in {
           enable = true;
-          virtualHosts = redirectConfig // aliasConfig // anubisConfig;
+          virtualHosts = redirectConfig // aliasConfig // mainConfig;
         };
     };
   };