hydra-proxy: replace abuse handling with anubis
Closes: #626
Martin Weinelt committed
Apr 25, 2025 at 00:38 UTC
e265c1e8ca315a5b3916ef075060d98374634896
1 file changed
+12
-35
build/hydra-proxy.nix
+12
-35
@@ -1,33 +1,26 @@
1
{
2
config,
3
- lib,
3
pkgs,
4
...
5
}:
6
8
-let
9
- bannedUserAgentPatterns = [
10
- "Trident/"
11
- "Android\\s[123456789]\\."
12
- "iPod"
13
- "iPad\\sOS\\s"
14
- "iPhone\\sOS\\s[23456789]"
15
- "Opera/[89]"
16
- "(Chrome|CriOS)/(\\d\\d?\\.|1[01]|12[4])"
17
- "(Firefox|FxiOS)/(\\d\\d?\\.|1[01]|12[012345679]\\.)"
18
- "PPC\\sMac\\sOS"
19
- "Windows\\sCE"
20
- "Windows\\s95"
21
- "Windows\\s98"
22
- "Windows\\sNT\\s[12345]\\."
23
- ];
24
-in
7
{
8
networking.firewall.allowedTCPPorts = [
9
80
10
443
11
+ 9001
12
];
13
14
+ services.anubis.instances."hydra-server" = {
15
+ settings = {
16
+ TARGET = "http://127.0.0.1:3000";
17
+ BIND = ":3001";
18
+ BIND_NETWORK = "tcp";
19
+ METRICS_BIND = ":9001";
20
+ METRICS_BIND_NETWORK = "tcp";
21
+ };
22
+ };
23
+
24
services.nginx = {
25
enable = true;
26
enableReload = true;
@@ -49,15 +42,6 @@ in
42
worker_connections 1024;
43
'';
44
52
- appendHttpConfig = ''
53
- map $http_user_agent $badagent {
54
- default 0;
55
- ${lib.concatMapStringsSep "\n" (pattern: ''
56
- ~${pattern} 1;
57
- '') bannedUserAgentPatterns}
58
- }
59
- '';
60
-
45
virtualHosts."hydra.nixos.org" = {
46
forceSSL = true;
47
enableACME = true;
@@ -79,13 +63,7 @@ in
63
'';
64
65
locations."/" = {
82
- proxyPass = "http://127.0.0.1:3000";
83
- extraConfig = ''
84
- if ($badagent) {
85
- access_log /var/log/nginx/abuse.log;
86
- return 403;
87
- }
88
- '';
66
+ proxyPass = "http://127.0.0.1:3001";
67
};
68
69
locations."/static/" = {
@@ -93,5 +71,4 @@ in
71
};
72
};
73
};
96
-
74
}