sin0: add ip-checker
This commit is contained in:
parent
73ad793310
commit
60d435c2af
3 changed files with 55 additions and 0 deletions
|
@ -5,6 +5,7 @@
|
|||
./ports.nix
|
||||
|
||||
./services/telegram-bot/danbooru_img_bot.nix
|
||||
./services/ip-checker.nix
|
||||
./services/redlib.nix
|
||||
|
||||
../../../nixos/profiles/sing-box-server
|
||||
|
|
|
@ -1,5 +1,6 @@
|
|||
{
|
||||
lib.ports = {
|
||||
redlib = 8010;
|
||||
ip-checker = 8020;
|
||||
};
|
||||
}
|
||||
|
|
53
hosts/vultr/sin0/services/ip-checker.nix
Normal file
53
hosts/vultr/sin0/services/ip-checker.nix
Normal file
|
@ -0,0 +1,53 @@
|
|||
{
|
||||
lib,
|
||||
pkgs,
|
||||
inputs,
|
||||
config,
|
||||
...
|
||||
}:
|
||||
let
|
||||
port = config.lib.ports.ip-checker;
|
||||
in
|
||||
{
|
||||
systemd.services."ip-checker" = {
|
||||
wantedBy = [ "multi-user.target" ];
|
||||
environment.IP_CHECKER_LISTEN = "127.0.0.1:${toString port}";
|
||||
serviceConfig = {
|
||||
ExecStart = lib.getExe inputs.ip-checker.packages.${pkgs.stdenv.hostPlatform.system}.default;
|
||||
WorkingDirectory = inputs.ip-checker;
|
||||
|
||||
CapabilityBoundingSet = "";
|
||||
DynamicUser = true;
|
||||
LockPersonality = true;
|
||||
MemoryDenyWriteExecute = true;
|
||||
NoNewPrivileges = true;
|
||||
PrivateDevices = true;
|
||||
PrivateUsers = true;
|
||||
ProcSubset = "pid";
|
||||
ProtectClock = true;
|
||||
ProtectControlGroups = true;
|
||||
ProtectHome = true;
|
||||
ProtectHostname = true;
|
||||
ProtectKernelLogs = true;
|
||||
ProtectKernelModules = true;
|
||||
ProtectKernelTunables = true;
|
||||
ProtectProc = "invisible";
|
||||
ProtectSystem = "strict";
|
||||
RestrictNamespaces = true;
|
||||
RestrictRealtime = true;
|
||||
RestrictSUIDSGID = true;
|
||||
SystemCallArchitectures = "native";
|
||||
SystemCallErrorNumber = "EPERM";
|
||||
SystemCallFilter = "@system-service";
|
||||
UMask = "0077";
|
||||
};
|
||||
};
|
||||
|
||||
services.caddy.settings.apps.http.servers.srv0.routes = lib.singleton {
|
||||
match = lib.singleton { host = [ "ip.ny4.dev" ]; };
|
||||
handle = lib.singleton {
|
||||
handler = "reverse_proxy";
|
||||
upstreams = lib.singleton { dial = "127.0.0.1:${toString port}"; };
|
||||
};
|
||||
};
|
||||
}
|
Loading…
Reference in a new issue