This repository has no description
5.8 kB
196 lines
1{
2 config,
3 lib,
4 pkgs,
5 self,
6 ...
7}:
8
9let
10 uploadPage = pkgs.writeText "paste-upload.html" ''
11 <!doctype html>
12 <title>p.krebsco.de</title>
13 <form action="/form" method="post" enctype="multipart/form-data">
14 <input type="file" name="file" required>
15 <button>upload</button>
16 </form>
17 <p>or with curl:</p>
18 <pre>
19 curl --data-binary @file https://p.krebsco.de
20 some-command | curl --data-binary @- https://p.krebsco.de
21 </pre>
22 '';
23in
24{
25
26 services.nginx.virtualHosts.cyberlocker = {
27 enableACME = true;
28 addSSL = true;
29 serverAliases = [ "c.r" ];
30 locations."/".extraConfig = ''
31 client_max_body_size 4G;
32 proxy_set_header Host $host;
33 proxy_pass http://127.0.0.1:${toString config.krebs.htgen.cyberlocker.port};
34 '';
35 extraConfig = ''
36 add_header Access-Control-Allow-Origin * always;
37 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
38 '';
39 };
40 services.nginx.virtualHosts.paste = {
41 enableACME = true;
42 addSSL = true;
43 serverAliases = [ "p.r" ];
44 locations."/".extraConfig = ''
45 client_max_body_size 4G;
46 proxy_set_header Host $host;
47 proxy_pass http://127.0.0.1:${toString config.krebs.htgen.paste.port};
48 '';
49 locations."/image".extraConfig = # nginx
50 ''
51 client_max_body_size 40M;
52
53 proxy_set_header Host $host;
54 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
55 proxy_set_header X-Forwarded-Proto $scheme;
56
57 proxy_pass http://127.0.0.1:${toString config.krebs.htgen.imgur.port};
58 proxy_pass_header Server;
59 '';
60 extraConfig = ''
61 add_header 'Access-Control-Allow-Origin' '*';
62 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
63 '';
64 };
65 services.nginx.virtualHosts."c.krebsco.de" = {
66 enableACME = true;
67 addSSL = true;
68 serverAliases = [ "c.krebsco.de" ];
69 locations."/".extraConfig = ''
70 if ($request_method != GET) {
71 return 403;
72 }
73 proxy_set_header Host $host;
74 proxy_pass http://127.0.0.1:${toString config.krebs.htgen.cyberlocker.port};
75 '';
76 extraConfig = ''
77 add_header Access-Control-Allow-Origin * always;
78 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
79 '';
80 };
81 services.nginx.virtualHosts."p.krebsco.de" = {
82 enableACME = true;
83 addSSL = true;
84 serverAliases = [ "p.krebsco.de" ];
85 locations."/".extraConfig = ''
86 if ($request_method = 'OPTIONS') {
87 return 204;
88 }
89 if ($request_method ~ ^(GET|HEAD)$) {
90 rewrite ^/$ /_upload last;
91 }
92 client_max_body_size 4G;
93 proxy_set_header Host $host;
94 proxy_set_header X-Forwarded-Proto $scheme;
95 proxy_pass http://127.0.0.1:${toString config.krebs.htgen.paste.port};
96 '';
97 locations."= /_upload".extraConfig = ''
98 internal;
99 default_type text/html;
100 alias ${uploadPage};
101 '';
102 locations."/form".extraConfig = ''
103 client_max_body_size 4G;
104 proxy_set_header Host $host;
105 proxy_pass http://127.0.0.1:${toString config.krebs.htgen.paste-form.port};
106 '';
107 locations."/image".extraConfig = ''
108 proxy_set_header Host $host;
109 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
110 proxy_set_header X-Forwarded-Proto $scheme;
111
112 proxy_pass http://127.0.0.1:${toString config.krebs.htgen.imgur.port};
113 proxy_pass_header Server;
114 '';
115 extraConfig = ''
116 add_header Access-Control-Allow-Headers Authorization always;
117 add_header Access-Control-Allow-Origin * always;
118 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
119 '';
120 };
121
122 krebs.htgen.paste = {
123 port = 9081;
124 script = # sh
125 ''
126 (. ${pkgs.htgen-paste}/bin/htgen-paste)
127 '';
128 };
129
130 systemd.services.paste-gc = {
131 startAt = "daily";
132 serviceConfig = {
133 ExecStart = ''
134 ${pkgs.findutils}/bin/find /var/lib/htgen-paste/items -type f -mtime '+30' -exec rm {} \;
135 '';
136 User = "htgen-paste";
137 };
138 };
139
140 krebs.htgen.paste-form = {
141 port = 7770;
142 script = # sh
143 ''
144 export PATH=${
145 lib.makeBinPath [
146 pkgs.curl
147 pkgs.gnused
148 ]
149 }:$PATH
150 (. ${pkgs.writeScript "paste-form" ''
151 case "$Method" in
152 'POST')
153 # multipart body: part headers up to the first empty line, then the
154 # file, then "\r\n--$boundary--\r\n" (length of boundary + 8 bytes)
155 boundary=''${req_content_type-}
156 boundary=''${boundary#*boundary=}
157 boundary=''${boundary%%;*}
158 boundary=''${boundary#\"}
159 boundary=''${boundary%\"}
160 ref=$(head -c $req_content_length | sed '0,/^\r$/d' | head -c -$(expr ''${#boundary} + 8) | curl -fSs --data-binary @- https://p.krebsco.de | sed '1d;s/^http:/https:/')
161
162 printf 'HTTP/1.1 200 OK\r\n'
163 printf 'Content-Type: text/plain; charset=UTF-8\r\n'
164 printf 'Server: %s\r\n' "$Server"
165 printf 'Connection: close\r\n'
166 printf 'Content-Length: %d\r\n' $(expr ''${#ref} + 1)
167 printf '\r\n'
168 printf '%s\n' "$ref"
169
170 exit
171 ;;
172 esac
173 ''})
174 '';
175 };
176 krebs.htgen.imgur = {
177 port = 7771;
178 script = # sh
179 ''
180 (. ${pkgs.htgen-imgur}/bin/htgen-imgur)
181 '';
182 };
183 krebs.htgen.cyberlocker = {
184 port = 7772;
185 script = # sh
186 ''
187 (. ${pkgs.htgen-cyberlocker}/bin/htgen-cyberlocker)
188 '';
189 };
190 krebs.iptables.tables.filter.INPUT.rules = [
191 {
192 predicate = "-i retiolum -p tcp --dport 80";
193 target = "ACCEPT";
194 }
195 ];
196}