diff options
| author | Arun Isaac | 2026-07-03 05:18:59 +0100 |
|---|---|---|
| committer | Arun Isaac | 2026-07-03 05:20:39 +0100 |
| commit | 37471bfbf36f355a522c86e929a02c01d9b8410c (patch) | |
| tree | cfc156948289b3175e88fb6f290d3f33f02fd24e | |
| parent | ff33a2731e421f0719ca8e2eb8134c5f549606b6 (diff) | |
| download | guix-forge-37471bfbf36f355a522c86e929a02c01d9b8410c.tar.gz guix-forge-37471bfbf36f355a522c86e929a02c01d9b8410c.tar.lz guix-forge-37471bfbf36f355a522c86e929a02c01d9b8410c.zip | |
nginx: Support PROXY protocol.
| -rw-r--r-- | doc/forge.skb | 6 | ||||
| -rw-r--r-- | guix/forge/nginx.scm | 13 |
2 files changed, 15 insertions, 4 deletions
diff --git a/doc/forge.skb b/doc/forge.skb index 3ea04d3..1fd6750 100644 --- a/doc/forge.skb +++ b/doc/forge.skb @@ -1,5 +1,5 @@ ;;; guix-forge --- Guix software forge meta-service -;;; Copyright © 2022–2025 Arun Isaac <arunisaac@systemreboot.net> +;;; Copyright © 2022–2026 Arun Isaac <arunisaac@systemreboot.net> ;;; Copyright © 2024 Frederick M. Muriithi <fredmanglis@protonmail.com> ;;; ;;; This file is part of guix-forge. @@ -378,6 +378,10 @@ with the following in the ,(code [sudoers-file]) field of your ,(code [Socket to listen on for HTTPS requests. Socket may be a ,(record-ref "<forge-host-socket>"), ,(record-ref "<forge-ip-socket>"), or ,(record-ref "<forge-unix-socket>") object.]) + (record-field "proxy-protocol-listen" + [Optional socket to listen on for PROXY protocol requests. Socket may +be a ,(record-ref "<forge-host-socket>"), ,(record-ref "<forge-ip-socket>"), or +,(record-ref "<forge-unix-socket>") object. Disable if ,(code "#f").]) (record-field "acme-state-directory" [State directory of the ,(ref :ident "section-acme-service" :text "ACME service")]) diff --git a/guix/forge/nginx.scm b/guix/forge/nginx.scm index 2e22bd8..3baa156 100644 --- a/guix/forge/nginx.scm +++ b/guix/forge/nginx.scm @@ -32,6 +32,7 @@ forge-nginx-configuration? forge-nginx-configuration-http-listen forge-nginx-configuration-https-listen + forge-nginx-configuration-proxy-protocol-listen forge-nginx-configuration-acme-state-directory forge-nginx-configuration-acme-challenge-directory forge-nginx-configuration-server-blocks @@ -50,6 +51,8 @@ (default (forge-ip-socket (ip "0.0.0.0") (port 443)))) + (proxy-protocol-listen forge-nginx-configuration-proxy-protocol-listen + (default #f)) (acme-state-directory forge-nginx-configuration-acme-state-directory (default "/var/lib/acme")) (acme-challenge-directory forge-nginx-configuration-acme-challenge-directory @@ -93,7 +96,7 @@ directive." "Return list of nginx server blocks to provision for forge-web service specified by @var{config}." (match-record config <forge-nginx-configuration> - (http-listen https-listen acme-state-directory acme-challenge-directory server-blocks) + (http-listen https-listen proxy-protocol-listen acme-state-directory acme-challenge-directory server-blocks) (cons (nginx-server-configuration (listen (list (nginx-socket->string http-listen))) (locations @@ -120,8 +123,12 @@ specified by @var{config}." ((name _ ...) (nginx-server-configuration (inherit server) - (listen (list (string-append (nginx-socket->string https-listen) - " ssl"))) + (listen (cons (string-append (nginx-socket->string https-listen) + " ssl") + (if proxy-protocol-listen + (list (string-append (nginx-socket->string proxy-protocol-listen) + " ssl proxy_protocol")) + (list)))) (ssl-certificate (string-append acme-state-directory "/" name "/cert.pem")) (ssl-certificate-key (string-append acme-state-directory |