Reapply "hydra-proxy: replace abuse handling with anubis"
This reverts commit 4900942f742a09974f94670e82c55e1307bfd8c8.
Martin Weinelt committed
May 31, 2025 at 01:06 UTC
6cb0dc61a4eaed38ca1c8af2200d42854069cb47
3 files changed
+30
-38
build/hydra-proxy.nix
+12
-37
@@ -1,35 +1,26 @@
1
{
2
config,
3
- lib,
3
pkgs,
4
...
5
}:
6
8
-let
9
- bannedUserAgentPatterns = [
10
- "Trident/"
11
- "Android\\s[123456789]\\."
12
- "iPod"
13
- "iPad\\sOS\\s"
14
- "iPhone\\sOS\\s[23456789]"
15
- "Opera/[89]"
16
- # Chrome 134+
17
- "(Chrome|CriOS)/(\\d\\d?\\.|1[012]|13[0123])"
18
- # Firefox ESR 128 and Firefox 137+
19
- "(Firefox|FxiOS)/(\\d\\d?\\.|1[01]|12[012345679]|13[0123456])"
20
- "PPC\\sMac\\sOS"
21
- "Windows\\sCE"
22
- "Windows\\s95"
23
- "Windows\\s98"
24
- "Windows\\sNT\\s[12345]\\."
25
- ];
26
-in
7
{
8
networking.firewall.allowedTCPPorts = [
9
80
10
443
11
+ 9001
12
];
13
14
+ services.anubis.instances."hydra-server" = {
15
+ settings = {
16
+ TARGET = "http://127.0.0.1:3000";
17
+ BIND = ":3001";
18
+ BIND_NETWORK = "tcp";
19
+ METRICS_BIND = ":9001";
20
+ METRICS_BIND_NETWORK = "tcp";
21
+ };
22
+ };
23
+
24
services.nginx = {
25
enable = true;
26
enableReload = true;
@@ -51,15 +42,6 @@ in
42
worker_connections 1024;
43
'';
44
54
- appendHttpConfig = ''
55
- map $http_user_agent $badagent {
56
- default 0;
57
- ${lib.concatMapStringsSep "\n" (pattern: ''
58
- ~${pattern} 1;
59
- '') bannedUserAgentPatterns}
60
- }
61
- '';
62
-
45
virtualHosts."hydra.nixos.org" = {
46
forceSSL = true;
47
enableACME = true;
@@ -82,13 +64,7 @@ in
64
'';
65
66
locations."/" = {
85
- proxyPass = "http://127.0.0.1:3000";
86
- extraConfig = ''
87
- if ($badagent) {
88
- access_log /var/log/nginx/abuse.log;
89
- return 403;
90
- }
91
- '';
67
+ proxyPass = "http://127.0.0.1:3001";
68
};
69
70
locations."/static/" = {
@@ -96,5 +72,4 @@ in
72
};
73
};
74
};
99
-
75
}
build/pluto/prometheus/default.nix
+2
-1
@@ -3,7 +3,7 @@
3
{
4
imports = [
5
./alertmanager.nix
6
- ./exporters/up.nix
6
+ ./exporters/anubis.nix
7
./exporters/blackbox.nix
8
./exporters/channel.nix
9
./exporters/domain.nix
@@ -17,6 +17,7 @@
17
./exporters/owncast.nix
18
./exporters/postgresql.nix
19
./exporters/rasdaemon.nix
20
+ ./exporters/up.nix
21
./exporters/zfs.nix
22
];
23
build/pluto/prometheus/exporters/anubis.nix
new
+16
@@ -0,0 +1,16 @@
1
+{
2
+ services.prometheus = {
3
+ scrapeConfigs = [
4
+ {
5
+ job_name = "anubis";
6
+ static_configs = [
7
+ {
8
+ targets = [
9
+ "hydra.nixos.org:9001"
10
+ ];
11
+ }
12
+ ];
13
+ }
14
+ ];
15
+ };
16
+}