From 46615cc36153e04de43274c474582868c91ae6b2 Mon Sep 17 00:00:00 2001 From: Leyla Becker Date: Fri, 7 Mar 2025 15:10:37 -0600 Subject: [PATCH 1/4] added task to tech debt --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index eab1983..448c91d 100644 --- a/README.md +++ b/README.md @@ -51,6 +51,7 @@ nix multi user, multi system, configuration with `sops` secret management, `home - syncthing folders should just be enabled per devices and then combined with "extraDevices" to give final folder configurations - syncthing folder passwords - move fail2ban configs out of fail2ban.nix and into configs for their respective services +- nginx config should be reworked to give a list of subdomains and then the config information to apply to each proxy ## New Features - offline access for nfs mounts (overlay with rsync might be a good option here? https://www.spinics.net/lists/linux-unionfs/msg07105.html note about nfs4 and overlay fs) - Flake templates - we need to add these to some kind of local registry??? `nix flake show templates` - https://nix.dev/manual/nix/2.18/command-ref/new-cli/nix3-flake-init From 62abf65e5af948a5fad393a19587a6d0ab6edd6b Mon Sep 17 00:00:00 2001 From: Leyla Becker Date: Fri, 7 Mar 2025 18:14:42 -0600 Subject: [PATCH 2/4] enabled ACME --- configurations/nixos/defiant/configuration.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configurations/nixos/defiant/configuration.nix b/configurations/nixos/defiant/configuration.nix index 3ea37e9..9d6a434 100644 --- a/configurations/nixos/defiant/configuration.nix +++ b/configurations/nixos/defiant/configuration.nix @@ -77,7 +77,7 @@ }; reverse_proxy = { enable = true; - enableACME = false; + enableACME = true; hostname = "jan-leila.com"; }; postgres = { From 8b39a8084950929f1c4c260f23bead1ccde6f9f7 Mon Sep 17 00:00:00 2001 From: Leyla Becker Date: Fri, 7 Mar 2025 18:18:37 -0600 Subject: [PATCH 3/4] added extra config to services --- .../nixos-modules/server/home-assistant.nix | 19 +++++++++++- modules/nixos-modules/server/jellyfin.nix | 30 +++++++++++++++++++ .../nixos-modules/server/reverse_proxy.nix | 8 +++++ 3 files changed, 56 insertions(+), 1 deletion(-) diff --git a/modules/nixos-modules/server/home-assistant.nix b/modules/nixos-modules/server/home-assistant.nix index ba6d81f..cadb607 100644 --- a/modules/nixos-modules/server/home-assistant.nix +++ b/modules/nixos-modules/server/home-assistant.nix @@ -18,10 +18,15 @@ in { { services.home-assistant = { enable = true; + extraComponents = [ + "esphome" + "met" + "radio_browser" + ]; config.http = { server_port = 8082; use_x_forwarded_for = true; - trusted_proxies = ["127.0.0.1"]; + trusted_proxies = ["127.0.0.1" "::1"]; ip_ban_enabled = true; login_attempts_threshold = 10; }; @@ -29,6 +34,18 @@ in { host = { reverse_proxy.subdomains.${config.host.home-assistant.subdomain} = { target = "http://localhost:${toString config.services.home-assistant.config.http.server_port}"; + websockets = true; + extraConfig = '' + add_header Upgrade $http_upgrade; + add_header Connection \"upgrade\"; + proxy_set_header Host $host; + proxy_set_header Upgrade $http_upgrade; + proxy_set_header Connection "upgrade"; + proxy_set_header X-Forwarded-Host $server_name; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_read_timeout 90; + ''; }; }; } diff --git a/modules/nixos-modules/server/jellyfin.nix b/modules/nixos-modules/server/jellyfin.nix index 78afbc7..4746ad3 100644 --- a/modules/nixos-modules/server/jellyfin.nix +++ b/modules/nixos-modules/server/jellyfin.nix @@ -31,12 +31,42 @@ in { { ${config.host.jellyfin.subdomain} = { target = "http://localhost:${toString jellyfinPort}"; + extraConfig = '' + client_max_body_size 20M; + add_header X-Content-Type-Options "nosniff"; + add_header Content-Security-Policy "default-src https: data: blob: ; img-src 'self' https://* ; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'; font-src 'self'"; + add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Protocol $scheme; + proxy_set_header X-Forwarded-Host $http_host; + + proxy_buffering off; + ''; }; } ] ++ (builtins.map (subdomain: { ${subdomain} = { target = "http://localhost:${toString jellyfinPort}"; + extraConfig = '' + client_max_body_size 20M; + add_header X-Content-Type-Options "nosniff"; + add_header Content-Security-Policy "default-src https: data: blob: ; img-src 'self' https://* ; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; frame-ancestors 'self'; font-src 'self'"; + add_header Permissions-Policy "accelerometer=(), ambient-light-sensor=(), battery=(), bluetooth=(), camera=(), clipboard-read=(), display-capture=(), document-domain=(), encrypted-media=(), gamepad=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), interest-cohort=(), keyboard-map=(), local-fonts=(), magnetometer=(), microphone=(), payment=(), publickey-credentials-get=(), serial=(), sync-xhr=(), usb=(), xr-spatial-tracking=()" always; + + proxy_set_header Host $host; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Forwarded-Proto $scheme; + proxy_set_header X-Forwarded-Protocol $scheme; + proxy_set_header X-Forwarded-Host $http_host; + + proxy_buffering off; + ''; }; }) config.host.jellyfin.extraSubdomains)); diff --git a/modules/nixos-modules/server/reverse_proxy.nix b/modules/nixos-modules/server/reverse_proxy.nix index a218b3f..a406b14 100644 --- a/modules/nixos-modules/server/reverse_proxy.nix +++ b/modules/nixos-modules/server/reverse_proxy.nix @@ -31,6 +31,13 @@ in { description = "where should this host point to"; }; websockets = lib.mkEnableOption "should websockets be proxied"; + extraConfig = lib.mkOption { + type = lib.types.lines; + default = ""; + description = '' + These lines go to the end of the upstream verbatim. + ''; + }; }; })); default = {}; @@ -53,6 +60,7 @@ in { locations."/" = { proxyPass = value.target; proxyWebsockets = value.websockets; + extraConfig = value.extraConfig; }; }) config.host.reverse_proxy.subdomains; From 86c585111cf58f3aae11697cdf524d5e591f8f0d Mon Sep 17 00:00:00 2001 From: Leyla Becker Date: Fri, 7 Mar 2025 18:35:41 -0600 Subject: [PATCH 4/4] added packages for home assistant --- modules/nixos-modules/server/home-assistant.nix | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/modules/nixos-modules/server/home-assistant.nix b/modules/nixos-modules/server/home-assistant.nix index cadb607..63f67d2 100644 --- a/modules/nixos-modules/server/home-assistant.nix +++ b/modules/nixos-modules/server/home-assistant.nix @@ -22,6 +22,7 @@ in { "esphome" "met" "radio_browser" + "isal" ]; config.http = { server_port = 8082; @@ -30,6 +31,11 @@ in { ip_ban_enabled = true; login_attempts_threshold = 10; }; + extraPackages = python3Packages: + with python3Packages; [ + numpy + gtts + ]; }; host = { reverse_proxy.subdomains.${config.host.home-assistant.subdomain} = {