noah/dotfiles
1
0
Fork 0
mirror of https://github.com/nmasur/dotfiles synced 2024-11-26 11:55:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: caddy denylist and jellyfin prometheus

Browse Source
This commit is contained in:
Noah Masur 2023-07-16 21:04:07 +00:00
parent 6ea99eca5d
commit d85e4b1593
2 changed files with 24 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
modules/nixos/services/cloudflare.nix
View File

@ -41,11 +41,11 @@ in {
config = lib.mkIf config.cloudflare.enable { config = lib.mkIf config.cloudflare.enable {
# Forces Caddy to error if coming from a non-Cloudflare IP # Forces Caddy to error if coming from a non-Cloudflare IP
caddy.blocks = [{ caddy.routes = [{
match = [{ not = [{ remote_ip.ranges = cloudflareIpRanges; }]; }]; match = [{ not = [{ remote_ip.ranges = cloudflareIpRanges; }]; }];
handle = [{ handle = [{
handler = "static_response"; handler = "static_response";
abort = true; status_code = "403";
}]; }];
}]; }];

29
modules/nixos/services/jellyfin.nix
View File

@ -5,13 +5,25 @@
services.jellyfin.group = "media"; services.jellyfin.group = "media";
users.users.jellyfin = { isSystemUser = true; }; users.users.jellyfin = { isSystemUser = true; };
caddy.routes = [{ caddy.routes = [
match = [{ host = [ config.hostnames.stream ]; }]; {
handle = [{ match = [{
handler = "reverse_proxy"; host = [ config.hostnames.stream ];
upstreams = [{ dial = "localhost:8096"; }]; path = [ "/metrics*" ];
}]; }];
}]; handle = [{
handler = "static_response";
status_code = "403";
}];
}
{
match = [{ host = [ config.hostnames.stream ]; }];
handle = [{
handler = "reverse_proxy";
upstreams = [{ dial = "localhost:8096"; }];
}];
}
];
# Create videos directory, allow anyone in Jellyfin group to manage it # Create videos directory, allow anyone in Jellyfin group to manage it
systemd.tmpfiles.rules = [ systemd.tmpfiles.rules = [
@ -35,6 +47,9 @@
users.users.jellyfin.extraGroups = users.users.jellyfin.extraGroups =
[ "render" "video" ]; # Access to /dev/dri [ "render" "video" ]; # Access to /dev/dri
# Requires MetricsEnable is true in /var/lib/jellyfin/config/system.xml
prometheus.scrapeTargets = [ "127.0.0.1:8096" ];
}; };
} }