From c254af632c1e45b561971870821ac24fd67868e0 Mon Sep 17 00:00:00 2001 From: MDLeom <2809763-curben@users.noreply.gitlab.com> Date: Sun, 8 Mar 2020 10:44:03 +0000 Subject: [PATCH] post(caddy-nixos-1): add diagram and links to related posts --- source/_posts/caddy-nixos-part-1.md | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/source/_posts/caddy-nixos-part-1.md b/source/_posts/caddy-nixos-part-1.md index 9c9983b..e7dafc0 100644 --- a/source/_posts/caddy-nixos-part-1.md +++ b/source/_posts/caddy-nixos-part-1.md @@ -7,6 +7,13 @@ tags: - linux --- +This post is Part 1 of a series of articles that show you how I set up Caddy and Tor hidden service on NixOS: + +- Part 1: Install NixOS +- {% post_link caddy-nixos-part-2 'Part 2: Configure NixOS' %} +- {% post_link caddy-nixos-part-3 'Part 3: Configure Caddy' %} +- Part 4: Configure Tor (coming soon) + ## Background > Skip to [Installation](#Installation) part. @@ -30,6 +37,12 @@ Right off the bat I can already see the need of setting up a private server due As for web server, I went with Caddy, which has the most secured defaults. It is installed in NixOS, which is attractive for its centralised configuration. I initially planned to use Ubuntu, and then I noticed [NixOS](https://nixos.org/); unlike most other Linux servers which has configs scattered around, NixOS is configured through a single "configuration.nix" file. It is [declarative](https://en.wikipedia.org/wiki/Declarative_programming), meaning you simply supply the desired configuration and NixOS would figure how to achieve that. For example, to open port 80, you just need `networking.firewall.allowedTCPPorts = [ 80 ]`, instead of mucking around with iptables. This significantly helps reproducibility, making server migration much easier; simply supply the "configuration.nix" used in the previous server and the new server would have the same state. Having Caddy in the repo is the tipping point that finally made me dive into NixOS. +![Architecture behind mdleom.com](20200223/caddy-nixos.png) + +Above diagram shows the architecture behind this website (mdleom.com). When a visitor browse mdleom.com, it will first go through Cloudflare CDN, the CDN then pass the request to my virtual private server (VPS). Before it reaches my VPS, there is a cloud firewall provided by the VPS host which I configure to allow inbound port 443. Once my VPS receive the request, the iptables port forward from 443 to 4430. The web server (Caddy) binds to (or listens on) port 4430 and it acts as a reverse proxy to the actual backend, curben.netlify.com. + +The flow is slightly different when browsing via [.onion](http://xw226dvxac7jzcpsf4xb64r4epr6o5hgn46dxlqk7gnjptakik6xnzqd.onion). Tor hidden service is able to NAT-punching, only rely on outbound connection, so it can work behind a firewall that block inbound ports. The Tor daemon acts as a reverse proxy and forward the request to Caddy, which in turn is also a reverse proxy which finally forward the request to curben.netlify.com. + ## Installation NixOS has a detailed installation [guide](https://nixos.org/nixos/manual/index.html#sec-installation), anyhow this is how I installed it. @@ -46,7 +59,7 @@ sudo -s # Most KVM-powered VPS use "/dev/vda" naming scheme (instead of "/dev/sda") # Check the output of `ls /dev/` to make sure parted /dev/vda -- mklabel msdos - + # Create a new partition that fill the disk but # leaves 1 GB space for the swap parted /dev/vda -- mkpart primary 1MiB -1GiB @@ -265,7 +278,7 @@ Following is my "configuration.nix". I'll show you how to secure NixOS using has toPort = "8080"; }]; }]; - extraConfig = + extraConfig = '' ClientUseIPv4 0 ClientUseIPv6 1