add staging hydra-proxy
Jörg Thalheim committed
Feb 15, 2025 at 17:16 UTC
8be3347435cc54b25e45e01884f0346bd695224d
2 files changed
+98
non-critical-infra/hosts/staging-hydra/default.nix
+1
@@ -5,6 +5,7 @@
5
inputs.srvos.nixosModules.server
6
inputs.srvos.nixosModules.hardware-hetzner-cloud-arm
7
../../modules/common.nix
8
+ ./hydra-proxy.nix
9
./hydra.nix
10
inputs.hydra.nixosModules.hydra
11
];
non-critical-infra/hosts/staging-hydra/hydra-proxy.nix
new
+97
@@ -0,0 +1,97 @@
1
+{
2
+ config,
3
+ lib,
4
+ pkgs,
5
+ ...
6
+}:
7
+
8
+let
9
+ bannedUserAgentPatterns = [
10
+ "Trident/"
11
+ "Android\\s[123456789]\\."
12
+ "iPod"
13
+ "iPad\\sOS\\s"
14
+ "iPhone\\sOS\\s[23456789]"
15
+ "Opera/[89]"
16
+ "(Chrome|CriOS)/(\\d\\d?\\.|1[01]|12[4])"
17
+ "(Firefox|FxiOS)/(\\d\\d?\\.|1[01]|12[012345679]\\.)"
18
+ "PPC\\sMac\\sOS"
19
+ "Windows\\sCE"
20
+ "Windows\\s95"
21
+ "Windows\\s98"
22
+ "Windows\\sNT\\s[12345]\\."
23
+ ];
24
+in
25
+{
26
+ networking.firewall.allowedTCPPorts = [
27
+ 80
28
+ 443
29
+ ];
30
+
31
+ services.nginx = {
32
+ enable = true;
33
+ enableReload = true;
34
+
35
+ recommendedBrotliSettings = true;
36
+ recommendedGzipSettings = true;
37
+ recommendedOptimisation = true;
38
+ recommendedProxySettings = true;
39
+ recommendedTlsSettings = true;
40
+ recommendedZstdSettings = true;
41
+
42
+ proxyTimeout = "900s";
43
+
44
+ appendConfig = ''
45
+ worker_processes auto;
46
+ '';
47
+
48
+ eventsConfig = ''
49
+ worker_connections 1024;
50
+ '';
51
+
52
+ appendHttpConfig = ''
53
+ map $http_user_agent $badagent {
54
+ default 0;
55
+ ${lib.concatMapStringsSep "\n" (pattern: ''
56
+ ~${pattern} 1;
57
+ '') bannedUserAgentPatterns}
58
+ }
59
+ '';
60
+
61
+ virtualHosts."staging-hydra.nixos.org" = {
62
+ forceSSL = true;
63
+ enableACME = true;
64
+
65
+ extraConfig = ''
66
+ error_page 502 /502.html;
67
+ error_page 503 /503.html;
68
+ location ~ /(502|503).html {
69
+ root ${../../../build/nginx-error-pages};
70
+ internal;
71
+ }
72
+ '';
73
+
74
+ # Ask robots not to scrape hydra, it has various expensive endpoints
75
+ locations."=/robots.txt".alias = pkgs.writeText "hydra.nixos.org-robots.txt" ''
76
+ User-agent: *
77
+ Disallow: /
78
+ Allow: /$
79
+ '';
80
+
81
+ locations."/" = {
82
+ proxyPass = "http://127.0.0.1:3000";
83
+ extraConfig = ''
84
+ if ($badagent) {
85
+ access_log /var/log/nginx/abuse.log;
86
+ return 403;
87
+ }
88
+ '';
89
+ };
90
+
91
+ locations."/static/" = {
92
+ alias = "${config.services.hydra-dev.package}/libexec/hydra/root/static/";
93
+ };
94
+ };
95
+ };
96
+
97
+}