this repo has no description
feat: add anubis to protect forgejo
+8
-1
+8
-1
hosts/wolumonde/modules/forgejo.nix
+8
-1
hosts/wolumonde/modules/forgejo.nix
···
13
13
service = {
14
14
DISABLE_REGISTRATION = true;
15
15
};
16
+
security.REVERSE_PROXY_TRUSTED_PROXIES = "127.0.0.0/8,::1/128";
16
17
session.COOKIE_SECURE = true;
17
18
attachment = {
18
19
MAX_SIZE = 50;
···
33
34
extraConfig = ''
34
35
client_max_body_size 50m;
35
36
'';
36
-
proxyPass = "http://localhost:${toString config.services.forgejo.settings.server.HTTP_PORT}";
37
+
proxyPass = "http://localhost${config.services.anubis.instances."forgejo".settings.BIND}";
37
38
};
39
+
};
40
+
41
+
services.anubis.instances."forgejo" = {
42
+
settings.BIND = ":6293";
43
+
settings.BIND_NETWORK = "tcp";
44
+
settings.TARGET = "http://localhost:${toString config.services.forgejo.settings.server.HTTP_PORT}";
38
45
};
39
46
}