| 1 | { |
| 2 | config, |
| 3 | lib, |
| 4 | pkgs, |
| 5 | inputs, |
| 6 | ... |
| 7 | }: |
| 8 | |
| 9 | let |
| 10 | genAgentRange = |
| 11 | agent: from: to: sep: trailer: |
| 12 | map (n: "${agent}${sep}${toString n}${trailer}") (lib.range from to); |
| 13 | in |
| 14 | |
| 15 | { |
| 16 | imports = [ |
| 17 | inputs.nixocaine.nixosModules.default |
| 18 | ]; |
| 19 | |
| 20 | networking.firewall.allowedTCPPorts = [ |
| 21 | 80 |
| 22 | 443 |
| 23 | ]; |
| 24 | |
| 25 | services.iocaine = { |
| 26 | enable = true; |
| 27 | config = { |
| 28 | handler.default.config = { |
| 29 | "ai-robots-txt-path" = inputs.ai-robots-txt; |
| 30 | sources = { |
| 31 | "training-corpus" = [ |
| 32 | (pkgs.fetchurl { |
| 33 | name = "1984_djvu.txt"; |
| 34 | url = "https://archive.org/download/GeorgeOrwells1984/1984_djvu.txt"; |
| 35 | hash = "sha256-9R1PTa8yDtkfH+4rU5BF62ee73irhd3VYX1QB5KU+ZU="; |
| 36 | }) |
| 37 | (pkgs.fetchurl { |
| 38 | name = "brave-new-world.txt"; |
| 39 | url = "https://archive.org/download/ost-english-brave_new_world_aldous_huxley/Brave_New_World_Aldous_Huxley_djvu.txt"; |
| 40 | hash = "sha256-6WkaO/3zQIezGzJDp4QjglikiTZTxgo0P4MEff2mdcY="; |
| 41 | }) |
| 42 | ]; |
| 43 | "wordlists" = [ |
| 44 | (pkgs.fetchurl { |
| 45 | name = "words.txt"; |
| 46 | url = "https://git.savannah.gnu.org/cgit/miscfiles.git/plain/web2"; |
| 47 | hash = "sha256-KSmJWrP+x4xpY+vly7NJP+T8nhHroJWlInh7ivxTqGM="; |
| 48 | }) |
| 49 | ]; |
| 50 | }; |
| 51 | unwanted-asns = { |
| 52 | db-path = inputs.geolite2-asn-mmdb; |
| 53 | list = map toString [ |
| 54 | 7552 # VIETEL-AS-AP |
| 55 | 37963 # ALIBABA-CN-NET |
| 56 | 45102 # ALIBABA-CN-NET |
| 57 | 45899 # VNPT-AS-VN |
| 58 | 51167 # CONTABO |
| 59 | 62610 # ZEN-DPS |
| 60 | 132203 # TENCENT-NET-AP-CN |
| 61 | ]; |
| 62 | }; |
| 63 | unwanted-visitors = |
| 64 | # broad version ranges |
| 65 | (genAgentRange "Android" 2 12 " " ".") |
| 66 | ++ (genAgentRange "Chrome" 1 148 "/" ".") |
| 67 | ++ (genAgentRange "CriOS" 1 142 "/" ".") |
| 68 | ++ (genAgentRange "Firefox" 1 139 "/" ".") |
| 69 | ++ (genAgentRange "Firefox" 141 150 "/" ".") |
| 70 | ++ (genAgentRange "FxiOS" 1 150 "/" ".") |
| 71 | ++ (genAgentRange "iPhone OS" 1 14 " " "_") |
| 72 | ++ (genAgentRange "Windows NT" 4 7 " " "") |
| 73 | ++ (genAgentRange "Mac OS X 10." 5 14 "" "") |
| 74 | ++ (genAgentRange "Mac OS X 10_" 5 14 "" "") |
| 75 | ++ (genAgentRange "Mac OS X" 11 14 " " "") |
| 76 | ++ [ |
| 77 | # manually crafted patterns |
| 78 | "iPod;" |
| 79 | "Presto/" |
| 80 | "Trident/" |
| 81 | "Windows CE" |
| 82 | # Missing contact information |
| 83 | "efx-scanner/3.0" |
| 84 | "Go-http-client/1.1" |
| 85 | ]; |
| 86 | }; |
| 87 | server.default = { |
| 88 | bind = "/run/iocaine/default.sock"; |
| 89 | unix-socket-access = "group"; |
| 90 | mode = "http"; |
| 91 | use = { |
| 92 | handler-from = "default"; |
| 93 | metrics = "metrics"; |
| 94 | }; |
| 95 | }; |
| 96 | server.metrics = { |
| 97 | bind = "[::]:42042"; |
| 98 | mode = "prometheus"; |
| 99 | }; |
| 100 | }; |
| 101 | }; |
| 102 | |
| 103 | networking.firewall.extraInputRules = '' |
| 104 | ip6 saddr $prometheus_inet6 tcp dport { 9001, 42042 } accept |
| 105 | ip saddr $prometheus_inet4 tcp dport { 9001, 42042 } accept |
| 106 | ''; |
| 107 | |
| 108 | # Kill the hard dependency on iocaine |
| 109 | systemd.services.nginx = { |
| 110 | requires = lib.mkForce [ ]; |
| 111 | after = lib.mkForce [ "network.target" ]; |
| 112 | }; |
| 113 | |
| 114 | services.nginx = { |
| 115 | enable = true; |
| 116 | enableReload = true; |
| 117 | |
| 118 | recommendedBrotliSettings = true; |
| 119 | recommendedGzipSettings = true; |
| 120 | recommendedOptimisation = true; |
| 121 | recommendedProxySettings = true; |
| 122 | recommendedTlsSettings = true; |
| 123 | |
| 124 | proxyTimeout = "900s"; |
| 125 | |
| 126 | appendConfig = '' |
| 127 | worker_processes auto; |
| 128 | ''; |
| 129 | |
| 130 | appendHttpConfig = '' |
| 131 | limit_req_zone $binary_remote_addr zone=hydra-server:8m rate=2r/s; |
| 132 | limit_req_status 429; |
| 133 | ''; |
| 134 | |
| 135 | eventsConfig = '' |
| 136 | worker_connections 1024; |
| 137 | ''; |
| 138 | |
| 139 | upstreams = { |
| 140 | iocaine.servers."unix:${config.services.iocaine.config.server.default.bind}" = { }; |
| 141 | hydra-server.servers."127.0.0.1:3000" = { }; |
| 142 | }; |
| 143 | |
| 144 | virtualHosts."mimas.nixos.org" = { |
| 145 | forceSSL = true; |
| 146 | enableACME = true; |
| 147 | default = true; |
| 148 | locations."/".return = "444"; |
| 149 | }; |
| 150 | |
| 151 | virtualHosts."hydra.nixos.org" = { |
| 152 | forceSSL = true; |
| 153 | enableACME = true; |
| 154 | |
| 155 | extraConfig = '' |
| 156 | error_page 403 /403.html; |
| 157 | error_page 502 /502.html; |
| 158 | error_page 503 /503.html; |
| 159 | location ~ /(403|502|503).html { |
| 160 | root ${./nginx-error-pages}; |
| 161 | internal; |
| 162 | } |
| 163 | ''; |
| 164 | |
| 165 | # Ask robots not to scrape hydra, it has various expensive endpoints |
| 166 | locations."=/robots.txt".alias = pkgs.writeText "hydra.nixos.org-robots.txt" '' |
| 167 | User-agent: * |
| 168 | Disallow: / |
| 169 | Allow: /$ |
| 170 | ''; |
| 171 | |
| 172 | locations."/" = { |
| 173 | proxyPass = "http://iocaine"; |
| 174 | extraConfig = '' |
| 175 | # allow nginx to intercept non-200 responses |
| 176 | proxy_intercept_errors on; |
| 177 | |
| 178 | # optionally retry upstream on certain failures |
| 179 | proxy_next_upstream error timeout; |
| 180 | |
| 181 | # treat 421 as a special fallback condition |
| 182 | # treat 502 when iocaine is down |
| 183 | error_page 421 502 = @hydra; |
| 184 | |
| 185 | # discard the noise |
| 186 | access_log off; |
| 187 | |
| 188 | # don't spend time compressing garbage |
| 189 | gzip off; |
| 190 | ''; |
| 191 | }; |
| 192 | |
| 193 | locations."~ ^/job/[^/]+/[^/]+/metrics/metric/" = { |
| 194 | proxyPass = "http://hydra-server"; |
| 195 | }; |
| 196 | |
| 197 | locations."@hydra" = { |
| 198 | proxyPass = "http://hydra-server"; |
| 199 | extraConfig = '' |
| 200 | limit_req zone=hydra-server burst=7; |
| 201 | ''; |
| 202 | }; |
| 203 | |
| 204 | locations."/static/" = { |
| 205 | alias = "${config.services.hydra-dev.package}/libexec/hydra/root/static/"; |
| 206 | }; |
| 207 | }; |
| 208 | }; |
| 209 | } |