misskey: use nebula to proxy

2026-01-12 04:39:23 +08:00 · 2023-09-03 16:53:56 +08:00
parent 203fc9cffd
commit 267279bc81
6 changed files with 47 additions and 51 deletions
--- a/flake.nix
+++ b/flake.nix
@@ -208,7 +208,8 @@
                nix-serve = { enable = true; hostname = "nix-store.chn.moe"; };
                smartd.enable = true;
                nginx = { enable = true; transparentProxy.enable = false; };
-                misskey = { enable = false; hostname = "xn--qbtm095lrg0bfka60z.chn.moe"; };
+                # misskey = { enable = true; hostname = "xn--qbtm095lrg0bfka60z.chn.moe"; };
+                # misskey-proxy."xn--qbtm095lrg0bfka60z.chn.moe" = {};
              };
              bugs =
              [
@@ -277,7 +278,11 @@
                    };
                  };
                };
-                misskey-proxy = { "xn--qbtm095lrg0bfka60z.chn.moe" = {}; "xn--s8w913fdga.chn.moe" = {}; };
+                misskey-proxy =
+                {
+                  "xn--qbtm095lrg0bfka60z.chn.moe".upstream.address = "internal.pc.chn.moe";
+                  "xn--s8w913fdga.chn.moe".upstream.address = "internal.vps7.chn.moe";
+                };
                coturn.enable = true;
                synapse-proxy."synapse.chn.moe".upstream.address = "internal.vps7.chn.moe";
              };
@@ -379,6 +384,7 @@
                nginx = { enable = true; transparentProxy.externalIp = "95.111.228.40"; };
                wallabag.enable = true;
                misskey = { enable = true; hostname = "xn--s8w913fdga.chn.moe"; };
+                misskey-proxy."xn--s8w913fdga.chn.moe" = {};
                synapse.enable = true;
                synapse-proxy."synapse.chn.moe" = {};
              };
--- a/modules/services/misskey.nix
+++ b/modules/services/misskey.nix
@@ -5,6 +5,7 @@ inputs:
    misskey =
    {
      enable = mkOption { type = types.bool; default = false; };
+      autoStart = mkOption { type = types.bool; default = true; };
      port = mkOption { type = types.ints.unsigned; default = 9726; };
      hostname = mkOption { type = types.str; default = "misskey.chn.moe"; };
    };
@@ -12,7 +13,16 @@ inputs:
    {
      type = types.attrsOf (types.submodule (submoduleInputs: { options =
      {
-        hostname = mkOption { type = types.str; default = submoduleInputs.config._module.args.name; };
+        hostname = mkOption { type = types.nonEmptyStr; default = submoduleInputs.config._module.args.name; };
+        upstream = mkOption
+        {
+          type = types.oneOf [ types.nonEmptyStr (types.submodule { options =
+          {
+            address = mkOption { type = types.nonEmptyStr; default = "127.0.0.1"; };
+            port = mkOption { type = types.ints.unsigned; default = 9726; };
+          };})];
+          default = "127.0.0.1:9726";
+        };
      };}));
      default = {};
    };
@@ -113,26 +123,6 @@ inputs:
        nixos.services =
        {
          redis.instances.misskey.port = 3545;
-          nginx =
-          {
-            enable = true;
-            httpProxy =
-            {
-              "${misskey.hostname}" =
-              {
-                upstream = "http://127.0.0.1:${toString misskey.port}";
-                websocket = true;
-                setHeaders.Host = misskey.hostname;
-              };
-              "direct.${misskey.hostname}" =
-              {
-                upstream = "http://127.0.0.1:${toString misskey.port}";
-                websocket = true;
-                setHeaders.Host = misskey.hostname;
-                detectAuth = true;
-              };
-            };
-          };
          postgresql = { enable = true; instances.misskey = {}; };
          meilisearch.instances.misskey = { user = inputs.config.users.users.misskey.name; port = 7700; };
        };
@@ -143,15 +133,15 @@ inputs:
        {
          enable = true;
          httpProxy = listToAttrs (map
-            (proxy:
+            (proxy: with proxy.value;
            {
-              name = proxy.value.hostname;
+              name = hostname;
              value =
              {
-                upstream = "https://direct.${proxy.value.hostname}";
+                upstream = if builtins.typeOf upstream == "string" then "http://${upstream}"
+                  else "http://${upstream.address}:${toString upstream.port}";
                websocket = true;
-                setHeaders.Host = "direct.${proxy.value.hostname}";
-                addAuth = true;
+                setHeaders.Host = hostname;
              };
            })
            (attrsToList misskey-proxy));
--- a/modules/services/synapse.nix
+++ b/modules/services/synapse.nix
@@ -128,15 +128,15 @@ inputs:
        {
          enable = true;
          httpProxy = listToAttrs (map
-            (proxy:
+            (proxy: with proxy.value;
            {
-              name = proxy.value.hostname;
+              name = hostname;
              value =
              {
-                upstream = if builtins.typeOf proxy.value.upstream == "string" then "http://${proxy.value.upstream}"
-                  else "http://${proxy.value.upstream.address}:${toString proxy.value.upstream.port}";
+                upstream = if builtins.typeOf upstream == "string" then "http://${upstream}"
+                  else "http://${upstream.address}:${toString upstream.port}";
                websocket = true;
-                setHeaders.Host = "${proxy.value.hostname}";
+                setHeaders.Host = hostname;
              };
            })
            (attrsToList synapse-proxy));
--- a/secrets/pc.yaml
+++ b/secrets/pc.yaml
@@ -7,8 +7,8 @@ frp:
 store:
    signingKey: ENC[AES256_GCM,data:TsB1nA0Rf2AsYyH59WpUK53pTCX2JdrGQjkJ9A9BfWLLmw3EMnPoaLHG12rv1R2/xRU7rP+iVhXb77g60I/Kn4ehun3ogMmK1oEAKyQcxudBUJFk+SeijaQLr2A=,iv:e2rdGBVOPS1nyC3pXhs5r0WyEkqxcpCnX3eAcBCj93M=,tag:HwccjH2Wms5/TevU2IuzNw==,type:str]
 nginx:
-    detectAuth:
-        direct.xn--qbtm095lrg0bfka60z.chn.moe: ENC[AES256_GCM,data:QbUQ9tK9sBpdNKRqCVlr2X38gOM0GCgXwpoYQcaRtb03o7gPNyPiOn/1w408,iv:uhetRhYDL01mbm/LUwUpQlQTm2cObSTvILv+kihLFZY=,tag:oz2Ns0YzQXjzcJMjOy7wog==,type:str]
+    #ENC[AES256_GCM,data:sHSfWhEO9PHWTY0r,iv:XSyOSkzEVOjMF/9vjEVpcuKH6B2mdE5D7l9VKrSILO0=,tag:2YkAoPW5GqOjFpPF5IvApg==,type:comment]
+    #ENC[AES256_GCM,data:Oaxg1nXYHLNOAF2V8lNF+4OtJz5bXOdEleXi89AW+dQvDgj0HMAAlxLiixlfhFW48Clcu+C+4opFZUk+4Q3GBePTQWeabgEFAZi+MgnVoiXzfizQpmve,iv:/NyV6W0vaXvS5qFKPw+7Iqe9po1VKQDLbHaC9Fa8Mto=,tag:JiCKJxhpAI9k11N9WxfZew==,type:comment]
    maxmind-license: ENC[AES256_GCM,data:PVV4VAvB22KoA8EM8Honb+KWYhydXdmTAVlDw/XnTcbaIY+5Km2gGA==,iv:7PfytRbpW4G2iDNqysvZnB0YsQFVUL5Kr1DNsBzuhCA=,tag:z2J14fdD7AUNabN+6kUojA==,type:str]
 postgresql:
    misskey: ENC[AES256_GCM,data:KiJ2smpRwJ1pzauCgVsmFH4aCiw4sEkCQ9JSTao5NdI=,iv:jIc0a797dokfByN2vJcYcAFfPC8MP7wCV5qsxoCDxcE=,tag:L5n1/xszwB0lhqYcbLqp2Q==,type:str]
@@ -42,8 +42,8 @@ sops:
            OUlxNjdQaXdXMkZ6bnV1ek4yZ2dpbkEKpKGOAxo5Eef2jtGrg4iSzmGCeg+vTgvu
            +K8b+O19MIkGMDBm6UbYUPtc/7eqoEZRiTUzNMTmfkLVS4ul5zou9A==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-08-31T09:25:34Z"
-    mac: ENC[AES256_GCM,data:mRs5TzJar9SOYP6L1RSWsK9XvtDvRSksGll8aqmsv8h2k+u3/D7hVOPw3/eCP8gdsPzczWc+9zpy3OHAXHDNujrJsKVw2urjBAwKsAllBggakENhrFhxKW3NKkHplqQFs3w52XUozqEucsRA8+k2/RLZE+RjHBFLlNyDXYaBzGc=,iv:h9aTsCfwKc7wj1Sk2o7n+I4KN9B40gZ3aJ2t53e/TtE=,tag:h6kC3IoRgENJXPnUh0064g==,type:str]
+    lastmodified: "2023-09-03T08:51:32Z"
+    mac: ENC[AES256_GCM,data:PlBRhBHJ067MzX77ZaG7XzQviTixWWEZboFM8h1ezmei+Pf2PY4oDxRfmEgAodXD2EpM0x4cao3NPzMeAYtJK0YUViZRzdSbya/60W6Xzv0nrbJHh3xvvJmLVsMXyD3KKMcafTOrBsxnCg0gRro778Z63XkN/S9tA2tZfdZLLcY=,iv:9N223T+lBjYt0WLvvERbAFE1Z30ejWwZNDjByFjlW98=,tag:iTD7+P5uFlwe/xEX80QgMg==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.7.3
--- a/secrets/vps6.yaml
+++ b/secrets/vps6.yaml
@@ -48,13 +48,13 @@ xray-server:
        chat: ENC[AES256_GCM,data:X1JxFQw0bPCu,iv:hf+TOSH2p9RdnXDFKxTpSRzxDLdJyzNHVV8MfOQuGWY=,tag:iiWw9IFiBGOOyOSl9Jj2wQ==,type:str]
    private-key: ENC[AES256_GCM,data:ts/LRGFAsYqvGvkvlxUI42IW1a8cGsSkpZhMDd3QVceRKvhPb1SRDaXoSw==,iv:6xX9xFIFUNlLBZ6CPBOz9JbHpvC4+QG9ZaCZcWdl12c=,tag:DYIa+QTV8vyl1l7OKKykTw==,type:str]
 nginx:
-    addAuth:
-        #ENC[AES256_GCM,data:0f7P/+sx7C8AQUK+q7TucsEhiYQpGG6axuSTYx+c/BtSbZvrC6UKHa4=,iv:lv9PsQLziNmK1y9pw8TDxNdmq0rARxGomBb7sRgH0cA=,tag:Vk004NA74XjT7pqIWD34jw==,type:comment]
-        xn--qbtm095lrg0bfka60z.chn.moe: ENC[AES256_GCM,data:6alYFNVOAk0Yp0l4K6G4t6iIptkpsqDxWLRjfSo9UsewNFrbsMqw8JWNAYIqEhitcCb0cMZIBgI=,iv:xZzGMCOJU9Ja9XhDE/4gjsLb7FEjzhfCUtiS7ORvnp4=,tag:pfJr5+GstP9BoKa/bI+t2g==,type:str]
-        #ENC[AES256_GCM,data:4DZF7+ES+DloksRjIlE5GUP3D1V7B7RGrkCVR8r3jqVr8jQubGpDPFE=,iv:4ZWoAEEBjqQDLNAOcgbgFV9btx5v8t3s+D/0uuGynX4=,tag:p5NrYdcX/jdA2atnFMJ6sA==,type:comment]
-        xn--s8w913fdga.chn.moe: ENC[AES256_GCM,data:66JQ6jYy/Md0fWB/yUI00zK3mrUlm+LuO2kS6UmGTIgQ9REDKhq4anVV1l72tK+Ogxfk+wEG7Rc=,iv:hYAsdPAgN2Dmqgtn7rChrqF4cwYmMPXjG82CrPXlnC0=,tag:XUh6M3g0miDC92oWyMyIWA==,type:str]
-        #ENC[AES256_GCM,data:+vQv0OiAnoVvRsgJa/suMdrQ6tTszhLdKqF58Ysbi4ESMy3bWdkH0hQ=,iv:z6jQRLRRnSph6+6yidhRvU4LOLUdpnPg//0J0jDnBCk=,tag:3yUMZcuBGcOgEYuuxD5ZuQ==,type:comment]
-        synapse.chn.moe: ENC[AES256_GCM,data:Thnj1uOAhzUHDpX7MXo6hRCP7xWlq9N5v9C0TzcpDWSeis0wpb8BKeJzp+olIWk4iehENgQc1ws=,iv:Hf9PYYUkubXJ3qggXzHIY69s8ruEscfIEHI+SvMO9l4=,tag:n8R5mS7KUY2CPrYPRctPGw==,type:str]
+    #ENC[AES256_GCM,data:85LrqdTMIhSa,iv:mIQPYz8VPd5AxeMCQEdTGMD0Iqa5QEAa5+8JVFaj3JM=,tag:TcZd7S3WRPpEV9lHI1fzbw==,type:comment]
+    #ENC[AES256_GCM,data:rVTLpe3uIQ5LArPnEY8N8kjtHq8kZddbqR+nyUaia72Y7PWEfHzy6wgx3Q==,iv:AZEufH3zfVL0XbUh3CQZGYcx6zIMFV4tF+jHf73IplU=,tag:B/UbtQh5dGrctNih2uoO8w==,type:comment]
+    #ENC[AES256_GCM,data:InzwjKl3R4SJSXTz5u1Pt0kf2HYEtKfSkJO0cbPhhXADNp2/Tn0nwQJFy9EzpMvK9mw8+l5LadbY0tIwmTVvV5yxUQo78HcgXWInfp/zJ+GG1L/RQOHck74lEA==,iv:UBMRYPd0loOQBs3mNyndiKPu72aRA8HbOKWDfUWPQg8=,tag:t/ONqdwpWcbo/2vy5TOjlA==,type:comment]
+    #ENC[AES256_GCM,data:HTinhnsAbVujUOuLIVT/CkvdtTN9Nk7wZKZ5SyrPC+vZ/cB9E10FffMYLQ==,iv:Clby9A7MIUSknNFkzKuWEDL0yUW/ctd6KShCIEYrDZA=,tag:CJKORoXrspDjRmaSHUnlqw==,type:comment]
+    #ENC[AES256_GCM,data:cwAb68VgebTwCCeAFUbOG0CUAuggfRnLNv9NWldJN+E9NY4WKxs12Nz7yX/vtelcqqJ2TOUL78uAR88Nzavv7VtCTZRivWjRG6GvAUyRdv8lAZo=,iv:PScTSTCuVnsoZlvyTVL+ZgqqEm4m2/fUqWzPwE+PvuY=,tag:1jeRsHqgMheXbcnhRicsnw==,type:comment]
+    #ENC[AES256_GCM,data:V5XRrTvyeezkcJqw1/BhhZz5K/egpl+PtNwjAGELjWRp7IqDfRsInxBKEg==,iv:LdOTkL22HvaNbiUi6hG8o0ownfZ22OKFGxCuGPqG8xU=,tag:/06I/mLzBlgS489iuwFTuw==,type:comment]
+    #ENC[AES256_GCM,data:i9PXzaO1od7HimP/6vxYfh30SxFbdXRDcnXujH3VrvngFcWaVcXgigncp3cboi6RoERSZ6yakxviVyEBIS4v0qRfombj2UtJg8N3Kg==,iv:aohIMhAYfZhlGDrcEvi+Qc16nF8ZgrPUGhWj/7nl8Fs=,tag:o70qsk/2cAbZgbVBwfl3Ew==,type:comment]
    maxmind-license: ENC[AES256_GCM,data:sESU6uK9EYLido9/0sXO2Zw1SjuKmxPh4r3giJcaG7068gn1kByjsA==,iv:htnFgnLrH35zSvmlRAdoRDLFIpKroKO5dW9TNK9soUc=,tag:6pJuc54SrKP5n0kJJ7fGyA==,type:str]
 send:
    redis-password: ENC[AES256_GCM,data:6zVKw9AmKwSWvHUZhzy0F2KcJW96uFoZY/N1Zq8ilUJOLZeX,iv:viwLIgJz9v8oadr8784OgETbEsxzGsJvVoxmOwWEFxo=,tag:XEYFnoCGwlnrkqaUbgeH+Q==,type:str]
@@ -86,8 +86,8 @@ sops:
            ZXFTU3ZCaW1pTVh0RUJzdDdGdHlPYTgK2mlgcX2kEc8+2UDdBnhUm6IIuh8V6agW
            ooxH9OEPXUVI/4JcDo4v8ZUhAyU1ehLH0Ef7PJCChOZe2KZmWSNbhA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-08-31T09:19:50Z"
-    mac: ENC[AES256_GCM,data:oXNW63+apUuSgla4kycVWrFpNFpaZstsdaNPym2qYJoi/kJblnA94T61ad/WxdLXFYK0eiVRvD5geNjQ62wQ4OGhHw8rAvBEynK6ayF8CFgDXmJCRjGPXIx8dN6gl/voxLf6kVkL/PtC7LH1j8jnEYMadWwG+5ohSw1jB/y60Bs=,iv:YsCd5Ib/9FzQF0sMv8WQMJ4vNkMGRMetFRH+zN4/gzY=,tag:lQ4/AotElVBWcT2BJuY0Bw==,type:str]
+    lastmodified: "2023-09-03T08:50:37Z"
+    mac: ENC[AES256_GCM,data:+w04X4hdgiBO3VpCI5tM2h+X13m3QOQeMdcmKGavqBoC9S+jx9dOoy2H9FdhjyYN/dkhglFqG5LMnHqEsdLGSwSxUsJDmHMm3MvFLJYIybvanNB+Gxb9+ooBNpC/e+d1iLg85mAUTXhLlezw5gaRHtwiQ4llOXZesE+c+Wnbbws=,iv:mM5lw8pFJoqYvz8uIi+oTqJFyIHq6HjspYTaEJp2xzY=,tag:9AqRnzwUxIV/ClJATxz95g==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.7.3
--- a/secrets/vps7.yaml
+++ b/secrets/vps7.yaml
@@ -1,9 +1,9 @@
 acme:
    cloudflare.ini: ENC[AES256_GCM,data:PJ3JhdSPCyxzdcRI4UFdESWgyAjIYGyuVaU9l0R3s8mJidtgavvSSMy0hC0G/2fauLB/Eqc3L3NppXFjlKVywVE=,iv:lZVlOf7P/Vs/+u/5YPKFXmdeYV9NP9kcVWd00w1OjB4=,tag:LfWZTvPQH4QPrNrYfZ/Z6Q==,type:str]
 nginx:
-    detectAuth:
-        direct.xn--s8w913fdga.chn.moe: ENC[AES256_GCM,data:6002XL/N+U9+1MVvWZLio0nC0laqf1K3Gh6kkzgGjqT3DHnMiycfsbO1vj6c,iv:o08K08/ZPPugjeA3eKPoiVe/ltEZv1OVuiZa/VyPv/A=,tag:CXu4i4upNdyNwJTXxhwc3w==,type:str]
-        direct.synapse.chn.moe: ENC[AES256_GCM,data:tvmm5xhZtuwa48tBrKHdYs4lKdEsBpCb0w00fpN0f8W57X+ijLTZCxu5AVN+,iv:5SoEvoIUfgGNsdPBLiY+2xsYfgqR9vDOGT6g3hlzgSY=,tag:nhWpGA3xSQ+X94ezauEeTg==,type:str]
+    #ENC[AES256_GCM,data:BwkND2sU5FkdN72C,iv:DNIdyY35BfBYtlJijfI17s7aP8zj5Y/kUAieAYSTr3w=,tag:016xmeOvZC3Grc8JLGcVaQ==,type:comment]
+    #ENC[AES256_GCM,data:NX8myRAMhMS7qx0T+471E9Wz//AKXt7FoY7P8cUOvJ/Xz+AKkB2VfP45gyPvds6zwwKuYtRLqvPD84afjE/mf2wAij3VEkprJKd5VMl+RQ==,iv:LYdigyW2VUlqo/3IvC7CRaiFsnxMyQIryHf2yFMJ+Yw=,tag:ttNAzJRCz/owZSe/V3eOPw==,type:comment]
+    #ENC[AES256_GCM,data:Ss47U7TQO6OS21/eLVnLGO/Gpz7V7I1mlQS2SC/6DQk3bySZK0Omyd3Nyctz7FX+ix1RbeRd7//JKNc8Dtj19jpicBFQpZMV,iv:j9QD7TmRvfzFLkLLlRcwrAHcklfGJ0R6Z3cpbli97vk=,tag:lhEkAmm/AV0gTLItdVcZ4A==,type:comment]
    maxmind-license: ENC[AES256_GCM,data:9aW4QR3K6S+eTqzIjVlNEwkG0wZ4u5jgRfe7CMwRlJlK4AmcS6c45Q==,iv:cPTN1K4Aag5sohGbCQUZHYTvcwAL7AhF+rrY3OvXGPs=,tag:d9GGUMHnfzRz9Cf2U+dBfw==,type:str]
 redis:
    rsshub: ENC[AES256_GCM,data:uPnZIjbnRRoWIHlWkZNZkMpIb3Ujnnpb+AisVSVGFv4sfDAuDlAjt39pRdnWkCXJPqtXjJzQ+FeT34cqxTf8Bg==,iv:/jcyAHkxByFnbkmCAYQwda2QRmhW7L/ICoLuCgsVLCI=,tag:M5Q+dh/Bn7FiNpqQGYus4Q==,type:str]
@@ -56,8 +56,8 @@ sops:
            SnFHS1Z0SXUzTFdEd29KTy9DU3Y3R0UKfhh+rUmWDrf+UGjclP57dHipPLFoXSqy
            HdelmfV6q4/c7ppx2E+oZw3VNgoZCsrxxzYZfwxHJiZb+5vkE0D8iA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2023-09-03T06:37:14Z"
-    mac: ENC[AES256_GCM,data:O22B3FRhxTxsIw3KQz0Qr/jNdv/HCr9OY1eCg+z6CF1uCB7SBEcJCaSK9UD57z5SLfGwKqnTlQUy/NsPyDye5+sSXQJy+58tNKw0pabTyyZ2EVNp2WRWEZ4LY2jxT+CmAslqB1Aq7bfahwGqyaRv1fAIkGQwCEmMIv1tzloDhj8=,iv:qYIWc7Yv1YQ8ySxfzcZ2ONtcBRC1825s53D6FjDSZNE=,tag:Ez3EPM6gwT84mVPEXAEZvg==,type:str]
+    lastmodified: "2023-09-03T08:51:12Z"
+    mac: ENC[AES256_GCM,data:PKxrr1uONIi4ljjS6FFLApcvjVEda4lnsh005Ukmi4NF4fj5/Tyg/4+j85S3UGjgKlHUJsda9qit/23sZjb1IMGgQyL3HakOhEGc1JgbvlibcGm8ZE5LCznu9sp7BQ6hDnYmV1rAyWBDmO6zjNwdjT6NikZUY5o+KiXptLWaUYo=,iv:Gw07qLy4QijtdJa3e15YsbP9UhCS+hpJuApvkvIDc7c=,tag:zit2ySLqpJ7si+YrGINFmg==,type:str]
    pgp: []
    unencrypted_suffix: _unencrypted
    version: 3.7.3