From 41d030658d12e6153810bb0bea23db824bbb4254 Mon Sep 17 00:00:00 2001 From: arcnmx Date: Thu, 21 Mar 2024 15:02:41 -0700 Subject: [PATCH] refactor(nginx): yt updates --- modules/nixos/nginx/ssl.nix | 2 +- nixos/access/invidious.nix | 118 ++++++++++++++++++++++-------------- nixos/access/proxmox.nix | 2 +- nixos/access/unifi.nix | 2 +- systems/hakurei/nixos.nix | 22 +++---- 5 files changed, 84 insertions(+), 62 deletions(-) diff --git a/modules/nixos/nginx/ssl.nix b/modules/nixos/nginx/ssl.nix index aa068f15..bc39158f 100644 --- a/modules/nixos/nginx/ssl.nix +++ b/modules/nixos/nginx/ssl.nix @@ -10,7 +10,7 @@ mkAlmostOptionDefault = mkOverride 1250; forceRedirectConfig = virtualHost: '' if ($x_scheme = http) { - return ${toString virtualHost.redirectCode} https://$host$request_uri; + return ${toString virtualHost.redirectCode} https://$x_forwarded_host$request_uri; } ''; locationModule = { config, virtualHost, ... }: let diff --git a/nixos/access/invidious.nix b/nixos/access/invidious.nix index 11915b13..00bf8676 100644 --- a/nixos/access/invidious.nix +++ b/nixos/access/invidious.nix @@ -3,83 +3,109 @@ lib, ... }: let - inherit (lib.options) mkOption; - inherit (lib.modules) mkIf mkMerge mkDefault mkOptionDefault; - inherit (lib.lists) optional; - inherit (lib.strings) replaceStrings concatStringsSep; + inherit (lib.modules) mkIf mkMerge mkBefore mkDefault; + inherit (lib.strings) replaceStrings concatStringsSep concatMapStringsSep escapeRegex; inherit (config.services.nginx) virtualHosts; - inherit (config.services) tailscale; cfg = config.services.invidious; - access = config.services.nginx.access.invidious; in { - options.services.nginx.access.invidious = with lib.types; { - url = mkOption { - type = str; - }; - domain = mkOption { - type = str; - default = "yt.${config.networking.domain}"; - }; - localDomain = mkOption { - type = str; - default = "yt.local.${config.networking.domain}"; - }; - tailDomain = mkOption { - type = str; - default = "yt.tail.${config.networking.domain}"; - }; - }; config.services.nginx = { - access.invidious = mkIf cfg.enable { - url = mkOptionDefault "http://localhost:${toString cfg.port}"; - }; virtualHosts = let invidiousDomains = - [ - access.domain - access.localDomain - ] - ++ optional tailscale.enable access.tailDomain; + virtualHosts.invidious.allServerNames + ++ virtualHosts.invidious'local.allServerNames; contentSecurityPolicy' = "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self'; manifest-src 'self'; media-src 'self' blob: https://*.googlevideo.com:443 https://*.youtube.com:443; child-src 'self' blob:; frame-src 'self'; frame-ancestors 'none'"; contentSecurityPolicy = replaceStrings ["'self'"] ["'self' ${concatStringsSep " " invidiousDomains}"] contentSecurityPolicy'; - extraConfig = '' + extraConfig = mkBefore '' # Some players don't reopen a socket and playback stops totally instead of resuming after an extended pause send_timeout 100m; # Buffering off send to the client as soon as the data is received from invidious. proxy_redirect off; proxy_buffering off; + set $x_proxy_host $x_forwarded_host; ''; location = { proxy.websocket.enable = true; - proxyPass = access.url; + proxy.headers.enableRecommended = true; extraConfig = '' proxy_hide_header content-security-policy; add_header content-security-policy "${contentSecurityPolicy}"; + proxy_cookie_domain ${virtualHosts.invidious.serverName} $x_forwarded_host; ''; }; + name.shortServer = mkDefault "yt"; + kTLS = mkDefault true; + localDomains = virtualHosts.invidious'local.allServerNames; in { - ${access.domain} = {config, ...}: { - vouch.enable = true; - locations."/" = location; - kTLS = mkDefault true; + invidious = { + # lua can't handle HTTP 2.0 requests, so layer it behind another proxy... + inherit name extraConfig kTLS; + locations."/" = { + proxyPass = "http://localhost:${toString config.services.nginx.defaultHTTPListenPort}"; + proxy.headers.enableRecommended = true; + extraConfig = '' + proxy_http_version 1.1; + set $x_proxy_host ${virtualHosts.invidious'int.serverName}; + set $invidious_req_check $x_scheme:$request_uri; + if ($invidious_req_check = "http:/") { + return ${toString virtualHosts.invidious.redirectCode} https://$x_forwarded_host$request_uri; + } + ''; + }; + }; + invidious'int = { config, ... }: { + serverName = "invidious_internal"; + proxied.enable = true; + local.denyGlobal = true; + # TODO: consider disabling registration then redirecting to login if `SID` cookie is unset instead of using vouch + vouch = { + enable = true; + requireAuth = false; + auth.lua = { + enable = true; + accessRequest = '' + local invidious_auth = ngx.var["http_authentication"] + local invidious_agent = ngx.var["http_user_agent"] + local invidious_app_auth = invidious_auth ~= nil and ngx.re.match(invidious_auth, [[":]]) + local invidious_app = invidious_agent ~= nil and ngx.re.match(invidious_agent, [[Dart/\d\.\d \(dart:io\)]]) + local invidious_api_request = ngx.re.match(ngx.var.request_uri, [[^/(api/v\d|vi/)]]) + local is_local_request = ngx.re.match(ngx.var["http_referer"], [[^https?://(${concatMapStringsSep "|" escapeRegex localDomains})/]]) + if invidious_app_auth or (invidious_app and invidious_api_request) or is_local_request then + -- bypass vouch if the app is using token auth... + ngx.ctx.auth_res = { + status = ngx.HTTP_OK, + header = { }, + } + else + ngx.ctx.auth_res = ngx.location.capture("${config.vouch.auth.requestLocation}") + end + ''; + }; + }; + locations = { + "/" = mkMerge [ + location + { + vouch.requireAuth = true; + proxyPass = mkIf cfg.enable ( + mkDefault "http://localhost:${toString cfg.port}" + ); + } + ]; + }; inherit extraConfig; }; - ${access.localDomain} = {config, ...}: { - serverAliases = mkIf tailscale.enable [access.tailDomain]; + invidious'local = { local.enable = true; + ssl.cert.copyFromVhost = "invidious"; locations."/" = mkMerge [ location { - extraConfig = '' - proxy_cookie_domain ${access.domain} $host; - ''; + proxyPass = mkDefault virtualHosts.invidious'int.locations."/".proxyPass; } ]; - useACMEHost = mkDefault virtualHosts.${access.domain}.useACMEHost; - addSSL = mkIf (config.useACMEHost != null) (mkDefault true); - kTLS = mkDefault true; - inherit extraConfig; + inherit name extraConfig kTLS; }; }; + lua.http.enable = true; }; } diff --git a/nixos/access/proxmox.nix b/nixos/access/proxmox.nix index 67556717..3d5c62c3 100644 --- a/nixos/access/proxmox.nix +++ b/nixos/access/proxmox.nix @@ -55,7 +55,7 @@ in { extraConfig = '' client_max_body_size 16384M; ''; - name.shortServer = "prox"; + name.shortServer = mkDefault "prox"; in { prox = { inherit name locations extraConfig; diff --git a/nixos/access/unifi.nix b/nixos/access/unifi.nix index 339822db..3fe48b13 100644 --- a/nixos/access/unifi.nix +++ b/nixos/access/unifi.nix @@ -36,7 +36,7 @@ in { locations."/" = { proxyPass = mkDefault access.url; }; - name.shortServer = "unifi"; + name.shortServer = mkDefault "unifi"; kTLS = mkDefault true; in { unifi'management = mkIf access.global.management { diff --git a/systems/hakurei/nixos.nix b/systems/hakurei/nixos.nix index e7f3ee16..77c6406c 100644 --- a/systems/hakurei/nixos.nix +++ b/systems/hakurei/nixos.nix @@ -170,15 +170,12 @@ in { virtualHosts.kitchencam'local.allServerNames ]; }; - ${access.invidious.domain} = { + yt = { inherit (nginx) group; + domain = virtualHosts.invidious.serverName; extraDomainNames = mkMerge [ - [ - access.invidious.localDomain - ] - (mkIf tailscale.enable [ - access.invidious.tailDomain - ]) + virtualHosts.invidious.serverAliases + virtualHosts.invidious'local.allServerNames ]; }; }; @@ -207,9 +204,6 @@ in { access.kitchencam = { streamPort = 41081; }; - access.invidious = { - url = "http://${mediabox.lib.access.hostnameForNetwork.local}:${toString mediabox.services.invidious.port}"; - }; virtualHosts = { gensokyoZone.proxied.enable = "cloudflared"; keycloak = { @@ -250,9 +244,11 @@ in { }; plex.ssl.cert.enable = true; kitchencam.ssl.cert.enable = true; - ${access.invidious.domain} = { - useACMEHost = access.invidious.domain; - forceSSL = true; + invidious = { + ssl.cert.enable = true; + }; + invidious'int = { + locations."/".proxyPass = "http://${mediabox.lib.access.hostnameForNetwork.local}:${toString mediabox.services.invidious.port}"; }; }; };