nerd: only allow export from services-net

2022-07-20 23:58:11 +02:00 · 2022-07-20 23:58:11 +02:00 · 9795ed55b8
commit 9795ed55b8
parent 138bddf30b
1 changed files with 8 additions and 0 deletions
--- a/hosts/nerd/nerd.nix
+++ b/hosts/nerd/nerd.nix
@ -79,8 +79,16 @@
    enable = true;
    virtualHosts."nerd.bula22.de" = {
      extraConfig = ''
+        @disallow_export {
+          not remote_ip 10.42.10.0/24 2a01:4f8:1c0c:8221::/64
+          path /export.json*
+        }
+
        route {
          file_server /static/*
+          respond @disallow_export 403 {
+            close
+          }
          reverse_proxy * http://127.0.0.1:10510
        }