fix: put loki behind nginx proxy to hide debug/pprof endpoint and only allow push.

hosts/bekkalokk/configuration.nix

@@ -7,6 +7,7 @@
 
     ./services/alps.nix
     ./services/bluemap.nix
+    ./services/radicle.nix
     ./services/idp-simplesamlphp
     ./services/kerberos.nix
     ./services/mediawiki

hosts/bekkalokk/services/mediawiki/default.nix

@@ -107,7 +107,6 @@ in {
         CodeEditor
         CodeMirror
         DeleteBatch
-        MediawikiMatrixNotifs
         PdfHandler
         PluggableAuth
         Popups

hosts/bekkalokk/services/radicle.nix

@@ -0,0 +1,40 @@
+{ config, lib, ... }:
+let
+  domain = "dav.pvv.ntnu.no";
+  radicalePort = 5232;
+in {
+  services.radicale = {
+    enable = true;
+
+    settings = {
+      server = {
+        hosts = [ "127.0.0.1:${toString radicalePort}" ];
+      };
+
+      auth = {
+        type = "imap";
+        imap_host = "imap.pvv.ntnu.no";
+        imap_security = "tls";
+      };
+
+      storage = {
+        filesystem_folder = "/var/lib/radicale/collections";
+      };
+    };
+  };
+  services.nginx.virtualHosts."${domain}" = {
+    forceSSL = true;
+    enableACME = true;
+    kTLS = true;
+
+    extraConfig = ''
+      client_max_body_size 128M;
+    '';
+
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:${toString radicalePort}";
+      proxyWebsockets = true;
+    };
+  };
+  networking.firewall.allowedTCPPorts = [ radicalePort ];
+}

hosts/ildkule/services/monitoring/loki.nix

@@ -3,14 +3,15 @@
 let
   cfg = config.services.loki;
   stateDir = "/data/monitoring/loki";
+  internalPort = 83100;
 in {
   services.loki = {
     enable = true;
     configuration = {
       auth_enabled = false;
       server = {
-        http_listen_port = 3100;
+        http_listen_port = internalPort;
-        http_listen_address = "0.0.0.0";
+        http_listen_address = "127.0.0.1";
         grpc_listen_port = 9096;
       };
 
@@ -81,5 +82,21 @@ in {
     };
   };
 
-  networking.firewall.allowedTCPPorts = [ cfg.configuration.server.http_listen_port ];
+  services.nginx.virtualHosts."loki-internal" = {
+    listen = [{
+      addr = "0.0.0.0";
+      port = 3100;
+      ssl = false;
+    }];
+    locations = {
+      "/loki/api/v1/push" = {
+        proxyPass = "http://127.0.0.1:${toString internalPort}";
+      };
+      "/" = {
+        return = "403";
+      };
+    };
+  };
+
+  networking.firewall.allowedTCPPorts = [ 3100 ];
 }

packages/mediawiki-extensions/default.nix

@@ -15,13 +15,12 @@ let
   , tracking-branch ? "REL1_45"
   , kebab-name ? kebab-case-name name
   , fetchgit ? pkgs.fetchgit
-  , url ? "https://gerrit.wikimedia.org/r/mediawiki/extensions/${name}"
   }:
   {
     ${name} = (fetchgit {
       name = "mediawiki-${kebab-name}-source";
+      url = "https://gerrit.wikimedia.org/r/mediawiki/extensions/${name}";
       rev = commit;
-      inherit url;
       inherit hash;
     }).overrideAttrs (_: {
       passthru = { inherit name kebab-name tracking-branch; };
@@ -98,12 +97,4 @@ lib.mergeAttrsList [
     commit = "f53000f0499858fe74e4f5008b2f5e467d9d9382";
     hash = "sha256-+HTXZEVCwMD8z6c1kCZA3k686HzNd30pJljzRvf+gMg=";
   })
-
-  (mw-ext {
-    name = "MediawikiMatrixNotifs";
-    commit = "52d2a46c03f51af7c16ed4d7b3b07b0cbbffb4df";
-    hash = "sha256-AADWunm2Rn2cfxeu9xyYBw5txnaIbJNdR3jxLqgzAy8=";
-    url = "https://git.pvv.ntnu.no/oysteikt/mediawiki-matrix-notifs.git";
-    tracking-branch = "master";
-  })
 ]