lkjdsalkjdsalkjdsalkj

profiles/http/default.nix

@@ -17,6 +17,16 @@ in
       (lib.sort (x: y: x<y))
     ];
   };
+  options.pbsds.nginx.allowList.extraConfig = lib.mkOption {
+    visible = false; internal = true; readOnly = true;
+    default = ''
+     # home https://ipinfo.io/ips/193.71.0.0/16
+     allow 193.71.0.0/16;
+     # ntnu https://ipinfo.io/ips/129.241.0.0/16
+     allow 129.241.0.0/16;
+     deny all;
+    '';
+  };
 
 
   config = {

profiles/http/services/cryptpad.nix

@@ -12,7 +12,7 @@ in
   services.cryptpad = {
     #enable = true; # current node version used is marked insecure
     # reference: https://github.com/xwiki-labs/cryptpad/blob/main/config/config.example.js
-    configFile = toFile "cryptpad-config.js" ''
+    configFile = builtins.toFile "cryptpad-config.js" ''
       module.exports = {
         httpUnsafeOrigin: 'http://localhost:3457',
         httpSafeOrigin: 'https://${mkDomain "cryptpad"}',
@@ -32,7 +32,7 @@ in
 
         filePath: './datastore/',
         archivePath: './data/archive', // recovery in the event of accidental deletion
-        pinPath: './data/pins', // content stored indefinetly
+        pinPath: './data/pins', // content stored indefinitely
         taskPath: './data/tasks', // scheduled tasks
         blockPath: './block', // users' authenticated blocks
         blobPath: './blob', // uploaded encrypted blobs

profiles/http/services/invidious.nix

@@ -42,6 +42,7 @@ in
     locations."/" = {
       proxyPass = "http://127.0.0.1:${toString config.services.invidious.port}";
       proxyWebsockets = true;
+      inherit (config.pbsds.nginx.allowList) extraConfig;
     };
   };
 

profiles/http/services/plex.nix

@@ -48,6 +48,7 @@ lib.mkIf (!config.virtualisation.isVmVariant)
     locations."/" = {
       proxyPass = "http://127.0.0.1:32400"; # TODO: make configurable
       proxyWebsockets = true;
+      # TODO: inherit (config.pbsds.nginx.allowList) extraConfig;
     };
     # from https://wiki.nixos.org/wiki/Plex
     extraConfig = ''

profiles/http/services/redlib.nix

@@ -23,6 +23,7 @@ in
     locations."/" = {
       proxyPass = "http://127.0.0.1:${toString config.services.redlib.port}";
       proxyWebsockets = true;
+      inherit (config.pbsds.nginx.allowList) extraConfig;
     };
   };
   services.nginx.virtualHosts.${mkDomain "libreddit"} = lib.mkIf config.services.redlib.enable {

profiles/http/services/thelounge.nix

@@ -30,6 +30,7 @@ in
     locations."/" = {
       proxyPass = "http://127.0.0.1:${toString config.services.thelounge.port}";
       proxyWebsockets = true;
+      inherit (config.pbsds.nginx.allowList) extraConfig;
     };
   };
 }

profiles/http/services/webdav-zotero.nix

@@ -69,6 +69,8 @@ in
 
         proxy_request_buffering off;
         client_max_body_size 2G;
+
+        ${config.pbsds.nginx.allowList.extraConfig}
       '';
     };
   };