hosting/selfhostblocks
1
0
Fork 0
Code Issues Activity

restrict ldap UI to local network only

Browse source
This commit is contained in:
ibizaman 2023-07-30 17:44:50 -07:00
parent f22e06e132
commit ae8c959bd0
2 changed files with 9 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
README.md
View file

@ -10,6 +10,7 @@ services. Also, the design will be extendable to allow users to add services not
- [ ] SSO with Authelia. - [ ] SSO with Authelia.
- [X] LDAP server through lldap, it provides a nice Web UI. - [X] LDAP server through lldap, it provides a nice Web UI.
- [X] Administrative UI only accessible from local network.
- [X] Backup with Restic or BorgBackup - [X] Backup with Restic or BorgBackup
- [X] Monitoring through Prometheus and Grafana. - [X] Monitoring through Prometheus and Grafana.
- [X] Export systemd services status. - [X] Export systemd services status.

8
modules/ldap.nix
View file

@ -32,6 +32,12 @@ in
description = "Sops file location"; description = "Sops file location";
example = "secrets/ldap.yaml"; example = "secrets/ldap.yaml";
}; };
localNetworkIPRange = lib.mkOption {
type = lib.types.str;
description = "Local network range, to restrict access to the UI to only those IPs.";
example = "192.168.1.1/24";
};
}; };
@ -61,6 +67,8 @@ in
locations."/" = { locations."/" = {
extraConfig = '' extraConfig = ''
proxy_set_header Host $host; proxy_set_header Host $host;
allow ${cfg.localNetworkIPRange};
deny all;
''; '';
proxyPass = "http://${toString config.services.lldap.settings.http_host}:${toString config.services.lldap.settings.http_port}/"; proxyPass = "http://${toString config.services.lldap.settings.http_host}:${toString config.services.lldap.settings.http_port}/";
}; };