Revert "hydra-proxy: replace abuse handling with anubis"
Roll back until we have a resolution for https://github.com/NixOS/nix/pull/13099#discussion_r2063377495.
Martin Weinelt committed
Apr 29, 2025 at 00:25 UTC
4900942f742a09974f94670e82c55e1307bfd8c8
3 files changed
+36
-30
build/hydra-proxy.nix
+35
-12
@@ -1,26 +1,33 @@
1
{
2
config,
3
+ lib,
4
pkgs,
5
...
6
}:
7
8
+let
9
+ bannedUserAgentPatterns = [
10
+ "Trident/"
11
+ "Android\\s[123456789]\\."
12
+ "iPod"
13
+ "iPad\\sOS\\s"
14
+ "iPhone\\sOS\\s[23456789]"
15
+ "Opera/[89]"
16
+ "(Chrome|CriOS)/(\\d\\d?\\.|1[01]|12[4])"
17
+ "(Firefox|FxiOS)/(\\d\\d?\\.|1[01]|12[012345679]\\.)"
18
+ "PPC\\sMac\\sOS"
19
+ "Windows\\sCE"
20
+ "Windows\\s95"
21
+ "Windows\\s98"
22
+ "Windows\\sNT\\s[12345]\\."
23
+ ];
24
+in
25
{
26
networking.firewall.allowedTCPPorts = [
27
80
28
443
11
- 9001
29
];
30
14
- services.anubis.instances."hydra-server" = {
15
- settings = {
16
- TARGET = "http://127.0.0.1:3000";
17
- BIND = ":3001";
18
- BIND_NETWORK = "tcp";
19
- METRICS_BIND = ":9001";
20
- METRICS_BIND_NETWORK = "tcp";
21
- };
22
- };
23
-
31
services.nginx = {
32
enable = true;
33
enableReload = true;
@@ -42,6 +49,15 @@
49
worker_connections 1024;
50
'';
51
52
+ appendHttpConfig = ''
53
+ map $http_user_agent $badagent {
54
+ default 0;
55
+ ${lib.concatMapStringsSep "\n" (pattern: ''
56
+ ~${pattern} 1;
57
+ '') bannedUserAgentPatterns}
58
+ }
59
+ '';
60
+
61
virtualHosts."hydra.nixos.org" = {
62
forceSSL = true;
63
enableACME = true;
@@ -63,7 +79,13 @@
79
'';
80
81
locations."/" = {
66
- proxyPass = "http://127.0.0.1:3001";
82
+ proxyPass = "http://127.0.0.1:3000";
83
+ extraConfig = ''
84
+ if ($badagent) {
85
+ access_log /var/log/nginx/abuse.log;
86
+ return 403;
87
+ }
88
+ '';
89
};
90
91
locations."/static/" = {
@@ -71,4 +93,5 @@
93
};
94
};
95
};
96
+
97
}
build/pluto/prometheus/default.nix
+1
-2
@@ -3,7 +3,7 @@
3
{
4
imports = [
5
./alertmanager.nix
6
- ./exporters/anubis.nix
6
+ ./exporters/up.nix
7
./exporters/blackbox.nix
8
./exporters/channel.nix
9
./exporters/domain.nix
@@ -17,7 +17,6 @@
17
./exporters/owncast.nix
18
./exporters/postgresql.nix
19
./exporters/rasdaemon.nix
20
- ./exporters/up.nix
20
./exporters/zfs.nix
21
];
22
build/pluto/prometheus/exporters/anubis.nix
deleted
-16
@@ -1,16 +0,0 @@
1
-{
2
- services.prometheus = {
3
- scrapeConfigs = [
4
- {
5
- job_name = "anubis";
6
- static_configs = [
7
- {
8
- targets = [
9
- "hydra.nixos.org:9001"
10
- ];
11
- }
12
- ];
13
- }
14
- ];
15
- };
16
-}