Erich Blume
80c33ccaf1
nginx configuration: - forge.eblu.me server block with WebSocket support, 512m body limit - Rate limit login/signup/forgot-password at 3r/s per real client IP (keyed on Fly-Client-IP header, not Fly's internal remote_addr) - Static asset caching (7d), no blanket caching for dynamic content - Security headers (HSTS, X-Frame-Options, X-Content-Type-Options) - Block /swagger (API docs only available via tailnet) - X-Real-IP set to real client IP for Forgejo audit logs - geo-based deny list for fail2ban integration fail2ban configuration: - Custom filter matching 401/403 on login paths in nginx JSON log - Ban after 5 failures in 10 minutes, ban duration 1 hour - Custom nginx-deny action: writes IPs to deny file and reloads nginx (iptables won't work in Fly.io — remote_addr is Fly's proxy IP) - Ban lists ephemeral across deploys (nginx rate limiting is persistent) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
34 lines
1.1 KiB
Bash
34 lines
1.1 KiB
Bash
#!/bin/sh
|
|
set -e
|
|
|
|
# Connect to tailnet first — nginx needs MagicDNS for upstream resolution.
|
|
# With bluegreen deploys, the old machine serves traffic until this one is
|
|
# fully ready. Fly.io runs Firecracker microVMs that support TUN devices
|
|
# natively — no need for --tun=userspace-networking.
|
|
tailscaled --statedir=/var/lib/tailscale &
|
|
sleep 2
|
|
|
|
tailscale up --authkey="${TS_AUTHKEY}" --hostname=flyio-proxy
|
|
until tailscale status > /dev/null 2>&1; do sleep 1; done
|
|
echo "Tailscale connected"
|
|
|
|
# Ensure fail2ban deny file exists before nginx starts
|
|
touch /etc/nginx/forge-deny.conf
|
|
|
|
# Start nginx — MagicDNS is available, health check passes immediately.
|
|
nginx -g "daemon off;" &
|
|
NGINX_PID=$!
|
|
echo "Nginx started"
|
|
|
|
# Start fail2ban for login brute-force protection
|
|
fail2ban-server -b
|
|
echo "fail2ban started"
|
|
|
|
# Start Alloy for observability (logs → Loki, metrics → Prometheus)
|
|
alloy run /etc/alloy/config.alloy \
|
|
--server.http.listen-addr=127.0.0.1:12345 \
|
|
--storage.path=/tmp/alloy-data &
|
|
echo "Alloy started"
|
|
|
|
# Block on nginx — container exits if nginx stops
|
|
wait $NGINX_PID
|