palo/nixos-config
palo/nixos-config
1
0
Fork 0
Code Issues Pull requests Actions Projects Releases Wiki Activity

experiment with cache.nixos.org proxy

Browse source
This commit is contained in:
Ingolf Wagner 2023-10-10 14:58:23 +02:00
parent 67d463ad69
commit c1bcacb7c0
Signed by: palo
GPG key ID: 76BF5F1928B9618B
3 changed files with 82 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
nixos/machines/cream/configuration.nix
View file

@ -24,6 +24,9 @@
./trilium.nix
./test.nix
#./proxy.nix
];

16
nixos/machines/cream/packages.nix
View file

@ -100,14 +100,14 @@ in
#)
tor-browser-bundle-bin
(tor-browser-bundle-bin.overrideAttrs (old: rec {
version = "11.0.1";
name = "tor-browser-bundle-${version}";
src = pkgs.fetchurl {
url = "https://dist.torproject.org/torbrowser/11.0.1/tor-browser-linux64-11.0.1_en-US.tar.xz";
sha256 = "1ah69jmfgik063f9gkvyv9d4k706pqihmzc4k7cc95zyd17v8wrs";
};
}))
#(tor-browser-bundle-bin.overrideAttrs (old: rec {
# version = "11.0.1";
# name = "tor-browser-bundle-${version}";
# src = pkgs.fetchurl {
# url = "https://dist.torproject.org/torbrowser/11.0.1/tor-browser-linux64-11.0.1_en-US.tar.xz";
# sha256 = "1ah69jmfgik063f9gkvyv9d4k706pqihmzc4k7cc95zyd17v8wrs";
# };
#}))
sops

71
nixos/machines/cream/proxy.nix Normal file
View file

@ -0,0 +1,71 @@
{ config, lib, ... }:
let
domain = "awesome.cache";
in
{
networking.extraHosts = ''
127.0.0.1 ${domain}
'';
services.nginx = {
enable = true;
proxyCachePath.nixos = {
enable = true;
inactive = "365d";
keysZoneSize = "100m";
keysZoneName = "nixos";
};
virtualHosts = {
${domain} = {
extraConfig = ''
proxy_cache nixos;
proxy_ignore_headers "Set-Cookie";
proxy_hide_header "Set-Cookie";
proxy_buffering on;
'';
locations."/" = {
recommendedProxySettings = false;
proxyPass = "https://cache.nixos.org";
extraConfig = ''
proxy_set_header Host "cache.nixos.org";
'';
};
};
};
};
# most likely not needed
systemd.services.nginx.serviceConfig = {
RestrictNamespaces = lib.mkForce false;
ProtectSystem = lib.mkForce false;
ProtectControlGroups = lib.mkForce false;
ProtectHome = lib.mkForce false;
ProtectHostname = lib.mkForce false;
ProtectKernelLogs = lib.mkForce false;
ProtectKernelModules = lib.mkForce false;
ProtectKernelTunables = lib.mkForce false;
PrivateDevices = lib.mkForce false;
PrivateMounts = lib.mkForce false;
PrivateTmp = lib.mkForce false;
MemoryDenyWriteExecute = lib.mkForce false;
NoNewPrivileges = lib.mkForce false;
ProtectProc = lib.mkForce "default";
RestrictRealtime = lib.mkForce false;
RestrictSUIDSGID = lib.mkForce false;
};
#services.permown."/data" = {
# owner = "nginx";
#};
#systemd.services."permown./data" = {
# bindsTo = [ "nginx.service" ];
# after = [ "nginx.service" ];
#};
}