infrastructure/ansible/roles/headscale/files/nginx.conf
Jake Howard 0c6528f9ca
All checks were successful
/ terraform (push) Successful in 29s
/ ansible (push) Successful in 1m33s
Restrict access to headscale OIDC and API
2024-01-31 21:40:43 +00:00

32 lines
874 B
Nginx Configuration File

# {{ ansible_managed }}
limit_req_zone $binary_remote_addr zone=headscale:10m rate=1r/m;
server {
listen 8888 ssl proxy_protocol;
http2 on;
server_name headscale.jakehoward.tech;
ssl_certificate /etc/letsencrypt/live/headscale.jakehoward.tech/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/headscale.jakehoward.tech/privkey.pem;
ssl_trusted_certificate /etc/letsencrypt/live/headscale.jakehoward.tech/chain.pem;
include includes/ssl.conf;
location / {
proxy_pass http://localhost:8416;
}
location /oidc {
# 3 should be enough for the redirect, callback plus 1 error
limit_req zone=headscale burst=3 nodelay;
limit_req_status 429;
proxy_pass http://localhost:8416;
}
# Block access to the API entirely - I'm not using it
location /api {
return 403;
}
}