Reapply "hydra-proxy: replace abuse handling with anubis"

This reverts commit 4900942.

Author: mweinelt

build/hydra-proxy.nix

@@ -1,35 +1,26 @@
 {
   config,
-  lib,
   pkgs,
   ...
 }:
 
-let
-  bannedUserAgentPatterns = [
-    "Trident/"
-    "Android\\s[123456789]\\."
-    "iPod"
-    "iPad\\sOS\\s"
-    "iPhone\\sOS\\s[23456789]"
-    "Opera/[89]"
-    # Chrome 134+
-    "(Chrome|CriOS)/(\\d\\d?\\.|1[012]|13[0123])"
-    # Firefox ESR 128 and Firefox 137+
-    "(Firefox|FxiOS)/(\\d\\d?\\.|1[01]|12[012345679]|13[0123456])"
-    "PPC\\sMac\\sOS"
-    "Windows\\sCE"
-    "Windows\\s95"
-    "Windows\\s98"
-    "Windows\\sNT\\s[12345]\\."
-  ];
-in
 {
   networking.firewall.allowedTCPPorts = [
     80
     443
+    9001
   ];
 
+  services.anubis.instances."hydra-server" = {
+    settings = {
+      TARGET = "http://127.0.0.1:3000";
+      BIND = ":3001";
+      BIND_NETWORK = "tcp";
+      METRICS_BIND = ":9001";
+      METRICS_BIND_NETWORK = "tcp";
+    };
+  };
+
   services.nginx = {
     enable = true;
     enableReload = true;
@@ -51,15 +42,6 @@ in
       worker_connections 1024;
     '';
 
-    appendHttpConfig = ''
-      map $http_user_agent $badagent {
-        default 0;
-        ${lib.concatMapStringsSep "\n" (pattern: ''
-          ~${pattern} 1;
-        '') bannedUserAgentPatterns}
-      }
-    '';
-
     virtualHosts."hydra.nixos.org" = {
       forceSSL = true;
       enableACME = true;
@@ -82,19 +64,12 @@ in
       '';
 
       locations."/" = {
-        proxyPass = "http://127.0.0.1:3000";
-        extraConfig = ''
-          if ($badagent) {
-            access_log /var/log/nginx/abuse.log;
-            return 403;
-          }
-        '';
+        proxyPass = "http://127.0.0.1:3001";
       };
 
       locations."/static/" = {
         alias = "${config.services.hydra-dev.package}/libexec/hydra/root/static/";
       };
     };
   };
-
 }

build/pluto/prometheus/default.nix

@@ -3,7 +3,7 @@
 {
   imports = [
     ./alertmanager.nix
-    ./exporters/up.nix
+    ./exporters/anubis.nix
     ./exporters/blackbox.nix
     ./exporters/channel.nix
     ./exporters/domain.nix
@@ -17,6 +17,7 @@
     ./exporters/owncast.nix
     ./exporters/postgresql.nix
     ./exporters/rasdaemon.nix
+    ./exporters/up.nix
     ./exporters/zfs.nix
   ];
 

build/pluto/prometheus/exporters/anubis.nix

@@ -0,0 +1,16 @@
+{
+  services.prometheus = {
+    scrapeConfigs = [
+      {
+        job_name = "anubis";
+        static_configs = [
+          {
+            targets = [
+              "hydra.nixos.org:9001"
+            ];
+          }
+        ];
+      }
+    ];
+  };
+}