services/homelab
1
1
Fork 0
Code Issues 5 Pull Requests Actions Packages Projects Releases Wiki Activity

ipv6 migration

Browse Source
This commit is contained in:
Reese Wells
2024-06-21 15:04:58 -04:00
parent 1f4769fdbe
commit 45c58aeba7
25 changed files with 357 additions and 62 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
nginx/https.conf
View File

@@ -2,6 +2,12 @@ server {
access_log /var/log/nginx/nginx_https_access.log basic;
error_log /var/log/nginx/nginx_https_error.log warn;
{% if item.external.restricted %}
if ($external_addr) {
return 404;
}
{% endif %}
http2 on;
gzip on;
@@ -19,21 +25,13 @@ server {
}
set_real_ip_from unix:;
set_real_ip_from {{ internal_ipv4 }};
set_real_ip_from {{ internal_ipv6 }};
real_ip_header X-Real-IP;
real_ip_recursive on;
server_name {{ item.external.domain }}{{ expose_tld }};
location / {
{% if item.external.protect %}
auth_basic "Restricted";
auth_basic_user_file /etc/nginx/.htpasswd;
{% endif %}
proxy_pass {{ item.internal.protocol }}://{{ item.internal.ip }}:{{ item.internal.port }}$request_uri;
proxy_set_header X-Forwarded-Port $server_port;

30
nginx/nginx.conf
View File

@@ -27,10 +27,12 @@ events {
}
stream {
log_format basic '| Remote Addr: $remote_addr:$server_port | SSL Preread: $ssl_preread_server_name | Forward: $map_forward_ip$upstream_port | Upstream Addr: $upstream_addr | $time_local | $protocol | $status | $bytes_sent | $bytes_received | $session_time |';
log_format basic '| Remote Addr: $remote_addr:$server_port | SSL Preread: $ssl_preread_server_name | Forward: $map_forward$upstream_port | Upstream Addr: $upstream_addr | $time_local | $protocol | $status | $bytes_sent | $bytes_received | $session_time |';
include /etc/nginx/stream.d/*.conf;
# Map all SSL parsed server names to hosts
map $ssl_preread_server_name $map_forward_ip {
map $ssl_preread_server_name $map_forward {
# Empty ssl preread gets forwarded to internal http server
"" "unix:/var/lib/nginx/tmp/nginx_http.sock";
@@ -46,7 +48,7 @@ stream {
# Since traffic being forwarded to the unix socket doesn't need a port we'll create
# a map here to enforce that case.
map $map_forward_ip $upstream_port {
map $map_forward $upstream_port {
{{ defaults.forward_ip }} ":443";
"unix:/var/lib/nginx/tmp/nginx_http.sock" "";
@@ -73,18 +75,16 @@ stream {
listen [::]:{{ port }};
{% endfor %}
proxy_pass $map_forward_ip$upstream_port;
proxy_pass $map_forward$upstream_port;
ssl_preread on;
proxy_socket_keepalive on;
}
include /etc/nginx/stream.d/*.conf;
}
http {
log_format basic '| Proxy Proto Addr: $proxy_protocol_addr | Remote Addr: $remote_addr:$server_port | Host: $host | Forward: $map_forward_ip$server_port | Referer: $http_referer | $request | $time_local | $status |';
log_format basic '| Proxy Proto Addr: $proxy_protocol_addr | Internal: $external_addr | Remote Addr: $remote_addr:$server_port | Host: $host | Forward: $map_forward$server_port | Referer: $http_referer | $request | $time_local | $status |';
map $host $map_forward_ip {
map $host $map_forward {
"" "unix:/var/lib/nginx/tmp/nginx_http.sock";
# We don't want to forward traffic we're terminating
@@ -105,8 +105,8 @@ http {
location / {
# If we have an external forward IP, forward traffic
if ($map_forward_ip != "unix:/var/lib/nginx/tmp/nginx_http.sock") {
proxy_pass $map_forward_ip:80;
if ($map_forward != "unix:/var/lib/nginx/tmp/nginx_http.sock") {
proxy_pass $map_forward:80;
}
# Else redirect if the scheme is http
if ($scheme = "http") {
@@ -115,6 +115,16 @@ http {
}
}
map $proxy_protocol_addr $external_addr {
default 1;
{% for ip in internal_ipv4_regex %}
~{{ ip }} 0;
{% endfor %}
{% for ip in internal_ipv6_regex %}
~{{ ip }} 0;
{% endfor %}
}
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;

1
nginx/stream.d/gitea-ssh.conf
View File

@@ -3,5 +3,6 @@ server {
error_log /var/log/nginx/nginx_stream_error.log warn;
listen 2222;
listen [::]:2222;
proxy_pass 10.1.2.100:2222;
}

3
nginx/stream.d/iperf3.conf
View File

@@ -3,6 +3,9 @@ server {
error_log /var/log/nginx/nginx_stream_error.log warn;
listen 5201;
listen [::]:5201;
listen 5201 udp;
listen [::]:5201 udp;
proxy_pass 127.0.0.1:5202;
}

1
nginx/stream.d/kube.conf
View File

@@ -9,5 +9,6 @@ server {
error_log /var/log/nginx/nginx_stream_error.log warn;
listen 6443;
listen [::]:6443;
proxy_pass kube_backend;
}

2
nginx/stream.d/minecraft.conf
View File

@@ -3,5 +3,7 @@ server {
error_log /var/log/nginx/nginx_stream_error.log warn;
listen 25565-25575;
listen [::]:25565-25575;
proxy_pass 10.1.2.100:$server_port;
}

11
nginx/stream.d/nextcloud-talk.conf Normal file
View File

@@ -0,0 +1,11 @@
server {
access_log /var/log/nginx/nginx_stream_access.log basic;
error_log /var/log/nginx/nginx_stream_error.log warn;
listen 3478;
listen 3478 udp;
listen [::]:3478;
listen [::]:3478 udp;
proxy_pass 10.1.175.237:3478;
}

59
nginx/vars.yaml
View File

@@ -7,14 +7,17 @@ defaults:
http:
internal_http_port: 80
internal_https_port: 443
internal_ipv4: 10.1.0.0/16
internal_ipv6: 2600:1700:1e6c:a81f::/64
internal_ipv4_regex:
- "10.1.*"
- "10.10.*"
internal_ipv6_regex:
- "2600:1700:1e6c:a81f.*"
expose_tld: .reeseapps.com
http:
- external:
domain: homeassistant
protect: false
restricted: false
extra_http_ports: []
extra_https_ports: []
internal:
@@ -24,7 +27,7 @@ http:
- external:
domain: driveripper
protect: false
restricted: false
extra_http_ports: []
extra_https_ports: []
internal:
@@ -34,17 +37,17 @@ http:
- external:
domain: e3s1plus
protect: true
restricted: true
extra_http_ports: []
extra_https_ports: []
internal:
ip: "10.2.224.77"
ip: "10.1.224.78"
port: 80
protocol: http
- external:
domain: yellow
protect: false
restricted: true
extra_http_ports: []
extra_https_ports: []
internal:
@@ -54,7 +57,7 @@ http:
- external:
domain: orange
protect: false
restricted: true
extra_http_ports: []
extra_https_ports: []
internal:
@@ -64,7 +67,7 @@ http:
- external:
domain: node1
protect: false
restricted: true
extra_http_ports: []
extra_https_ports: []
internal:
@@ -74,7 +77,7 @@ http:
- external:
domain: node2
protect: false
restricted: true
extra_http_ports: []
extra_https_ports: []
internal:
@@ -84,7 +87,7 @@ http:
- external:
domain: node3
protect: false
restricted: true
extra_http_ports: []
extra_https_ports: []
internal:
@@ -92,10 +95,30 @@ http:
port: 9090
protocol: https
- external:
domain: unifi-external-cockpit
restricted: true
extra_http_ports: []
extra_https_ports: []
internal:
ip: "10.1.241.139"
port: 9090
protocol: https
- external:
domain: nextcloud-aio-cockpit
restricted: true
extra_http_ports: []
extra_https_ports: []
internal:
ip: "10.1.175.237"
port: 9090
protocol: https
# Printer
- external:
domain: cr10se
protect: true
restricted: true
extra_http_ports: []
extra_https_ports:
# websocket
@@ -103,13 +126,13 @@ http:
# camera
- 8080
internal:
ip: "10.3.165.70"
ip: "10.2.165.70"
port: 80
protocol: http
- external:
domain: pihole-yellow
protect: true
restricted: true
extra_http_ports: []
extra_https_ports: []
internal:
@@ -119,7 +142,7 @@ http:
- external:
domain: pihole-orange
protect: true
restricted: true
extra_http_ports: []
extra_https_ports: []
internal:
@@ -129,7 +152,7 @@ http:
- external:
domain: attmodem
protect: true
restricted: true
extra_http_ports: []
extra_https_ports: []
internal:
@@ -139,7 +162,7 @@ http:
- external:
domain: nextcloud-aio
protect: false
restricted: false
extra_http_ports: []
extra_https_ports: []
internal:
@@ -149,7 +172,7 @@ http:
- external:
domain: unifi-external
protect: false
restricted: false
extra_http_ports:
- 8080
extra_https_ports: []