pastila: weechat-relay

common/configuration.nix

@@ -10,7 +10,13 @@
   services.openssh.enable = true;
   services.openssh.settings.PermitRootLogin = lib.mkDefault "no";
 
-  services.fail2ban.enable = true;
+  services.fail2ban = {
+    enable = true;
+    maxretry = 5;
+    ignoreIP = [
+      "neptune.site.deuxfleurs.fr"
+    ];
+  };
 
   # Activate nix flakes.
   nix.settings.experimental-features = [ "nix-command" "flakes" ];

pastila/configuration.nix

@@ -13,6 +13,7 @@ in
       ./gitolite.nix
       ./letsencrypt.nix
       ./srv.nix
+      ./weechat-relay.nix
     ];
 
   # Use the GRUB 2 boot loader.

pastila/srv.nix

@@ -1,5 +1,8 @@
 { config, lib, pkgs, ... }:
 
+let
+  up_dir = /srv/up;
+in
 {
   services.nginx.enable = true;
 
@@ -7,25 +10,29 @@
   # in /home. So we need to use a different location.
   users.users."up" = {
     isNormalUser = true;
-    home = /srv/up;
-    group = config.services.nginx.group;
-    createHome = true;
-    homeMode = "750";
+    home = up_dir;
+    # group = config.services.nginx.group;
+    group = "nginx";
+    # Unsure why this is broken, but couldn't make things work without
+    # creating the directory by hand.
+    # createHome = true;
+    # homeMode = "750";
   };
 
   services.nginx.virtualHosts."srv.isomorphis.me" = {
     forceSSL = true;
     enableACME = true;
-    root = config.users.users."up".home;
-    locations."/" = {
-      extraConfig = ''
-        autoindex on;
-      '';
-    };
-    locations."/i/" = {
-      extraConfig = ''
-        autoindex off;
-      '';
+    root = up_dir;
+    locations ={
+      "/" = {
+        extraConfig = "autoindex on;";
+      };
+      "/.ssh" = {
+        return = "403";
+      };
+      "/i/" = {
+        extraConfig = "autoindex off;";
+      };
     };
   };
 }

pastila/weechat-relay.nix

@@ -0,0 +1,20 @@
+{ config, lib, pkgs, ... }:
+
+let
+  mkProxy = port: {
+    forceSSL = true;
+    enableACME = true;
+    locations."/" = {
+      proxyPass = "http://localhost:" + builtins.toString port + "/weechat";
+      proxyWebsockets = true;
+      extraConfig = ''
+        proxy_read_timeout 604800;                # Prevent idle disconnects
+        proxy_set_header X-Real-IP $remote_addr;  # Let WeeChat see the client's IP
+      '';
+    };
+  };
+in
+{
+  services.nginx.enable = true;
+  services.nginx.virtualHosts."relayjq.isomorphis.me" = mkProxy 9001;
+}