This repository has no description
5.9 kB
202 lines
1{
2 config,
3 lib,
4 pkgs,
5 self,
6 ...
7}:
8
9let
10 uploadPage = pkgs.writeText "paste-upload.html" ''
11 <!doctype html>
12 <title>p.krebsco.de</title>
13 <form action="/form" method="post" enctype="multipart/form-data">
14 <input type="file" name="file" required>
15 <button>upload</button>
16 </form>
17 <p>or with curl:</p>
18 <pre>
19 curl --data-binary @file https://p.krebsco.de
20 some-command | curl --data-binary @- https://p.krebsco.de
21 </pre>
22 '';
23in
24{
25 imports = [
26 {
27 key = "stockholm-htgen";
28 imports = [ self.inputs.stockholm.nixosModules.htgen ];
29 }
30 ];
31
32 services.nginx.virtualHosts.cyberlocker = {
33 enableACME = true;
34 addSSL = true;
35 serverAliases = [ "c.r" ];
36 locations."/".extraConfig = ''
37 client_max_body_size 4G;
38 proxy_set_header Host $host;
39 proxy_pass http://127.0.0.1:${toString config.krebs.htgen.cyberlocker.port};
40 '';
41 extraConfig = ''
42 add_header Access-Control-Allow-Origin * always;
43 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS';
44 '';
45 };
46 services.nginx.virtualHosts.paste = {
47 enableACME = true;
48 addSSL = true;
49 serverAliases = [ "p.r" ];
50 locations."/".extraConfig = ''
51 client_max_body_size 4G;
52 proxy_set_header Host $host;
53 proxy_pass http://127.0.0.1:${toString config.krebs.htgen.paste.port};
54 '';
55 locations."/image".extraConfig = # nginx
56 ''
57 client_max_body_size 40M;
58
59 proxy_set_header Host $host;
60 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
61 proxy_set_header X-Forwarded-Proto $scheme;
62
63 proxy_pass http://127.0.0.1:${toString config.krebs.htgen.imgur.port};
64 proxy_pass_header Server;
65 '';
66 extraConfig = ''
67 add_header 'Access-Control-Allow-Origin' '*';
68 add_header 'Access-Control-Allow-Methods' 'GET, POST, OPTIONS';
69 '';
70 };
71 services.nginx.virtualHosts."c.krebsco.de" = {
72 enableACME = true;
73 addSSL = true;
74 serverAliases = [ "c.krebsco.de" ];
75 locations."/".extraConfig = ''
76 if ($request_method != GET) {
77 return 403;
78 }
79 proxy_set_header Host $host;
80 proxy_pass http://127.0.0.1:${toString config.krebs.htgen.cyberlocker.port};
81 '';
82 extraConfig = ''
83 add_header Access-Control-Allow-Origin * always;
84 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
85 '';
86 };
87 services.nginx.virtualHosts."p.krebsco.de" = {
88 enableACME = true;
89 addSSL = true;
90 serverAliases = [ "p.krebsco.de" ];
91 locations."/".extraConfig = ''
92 if ($request_method = 'OPTIONS') {
93 return 204;
94 }
95 if ($request_method ~ ^(GET|HEAD)$) {
96 rewrite ^/$ /_upload last;
97 }
98 client_max_body_size 4G;
99 proxy_set_header Host $host;
100 proxy_set_header X-Forwarded-Proto $scheme;
101 proxy_pass http://127.0.0.1:${toString config.krebs.htgen.paste.port};
102 '';
103 locations."= /_upload".extraConfig = ''
104 internal;
105 default_type text/html;
106 alias ${uploadPage};
107 '';
108 locations."/form".extraConfig = ''
109 client_max_body_size 4G;
110 proxy_set_header Host $host;
111 proxy_pass http://127.0.0.1:${toString config.krebs.htgen.paste-form.port};
112 '';
113 locations."/image".extraConfig = ''
114 proxy_set_header Host $host;
115 proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
116 proxy_set_header X-Forwarded-Proto $scheme;
117
118 proxy_pass http://127.0.0.1:${toString config.krebs.htgen.imgur.port};
119 proxy_pass_header Server;
120 '';
121 extraConfig = ''
122 add_header Access-Control-Allow-Headers Authorization always;
123 add_header Access-Control-Allow-Origin * always;
124 add_header Access-Control-Allow-Methods 'GET, POST, OPTIONS' always;
125 '';
126 };
127
128 krebs.htgen.paste = {
129 port = 9081;
130 script = # sh
131 ''
132 (. ${pkgs.htgen-paste}/bin/htgen-paste)
133 '';
134 };
135
136 systemd.services.paste-gc = {
137 startAt = "daily";
138 serviceConfig = {
139 ExecStart = ''
140 ${pkgs.findutils}/bin/find /var/lib/htgen-paste/items -type f -mtime '+30' -exec rm {} \;
141 '';
142 User = "htgen-paste";
143 };
144 };
145
146 krebs.htgen.paste-form = {
147 port = 7770;
148 script = # sh
149 ''
150 export PATH=${
151 lib.makeBinPath [
152 pkgs.curl
153 pkgs.gnused
154 ]
155 }:$PATH
156 (. ${pkgs.writeScript "paste-form" ''
157 case "$Method" in
158 'POST')
159 # multipart body: part headers up to the first empty line, then the
160 # file, then "\r\n--$boundary--\r\n" (length of boundary + 8 bytes)
161 boundary=''${req_content_type-}
162 boundary=''${boundary#*boundary=}
163 boundary=''${boundary%%;*}
164 boundary=''${boundary#\"}
165 boundary=''${boundary%\"}
166 ref=$(head -c $req_content_length | sed '0,/^\r$/d' | head -c -$(expr ''${#boundary} + 8) | curl -fSs --data-binary @- https://p.krebsco.de | sed '1d;s/^http:/https:/')
167
168 printf 'HTTP/1.1 200 OK\r\n'
169 printf 'Content-Type: text/plain; charset=UTF-8\r\n'
170 printf 'Server: %s\r\n' "$Server"
171 printf 'Connection: close\r\n'
172 printf 'Content-Length: %d\r\n' $(expr ''${#ref} + 1)
173 printf '\r\n'
174 printf '%s\n' "$ref"
175
176 exit
177 ;;
178 esac
179 ''})
180 '';
181 };
182 krebs.htgen.imgur = {
183 port = 7771;
184 script = # sh
185 ''
186 (. ${pkgs.htgen-imgur}/bin/htgen-imgur)
187 '';
188 };
189 krebs.htgen.cyberlocker = {
190 port = 7772;
191 script = # sh
192 ''
193 (. ${pkgs.htgen-cyberlocker}/bin/htgen-cyberlocker)
194 '';
195 };
196 krebs.iptables.tables.filter.INPUT.rules = [
197 {
198 predicate = "-i retiolum -p tcp --dport 80";
199 target = "ACCEPT";
200 }
201 ];
202}