From 2e0b6e2cfbf4863efe11dcd580f77d7a3748e02f Mon Sep 17 00:00:00 2001 From: Anirudh Oppiliappan Date: Mon, 27 Jul 2026 12:37:33 +0300 Subject: [PATCH] appview: deny blocked IPs at the ssh stream proxy HTTP block_scraper does not apply to stream traffic, so filter the ssh proxy separately via a dedicated sshBlocklist -> deny rules. Co-Authored-By: Claude Opus 4.8 (1M context) --- hosts/appview/services/nginx.nix | 18 ++++++++++++++---- 1 file changed, 14 insertions(+), 4 deletions(-) diff --git a/hosts/appview/services/nginx.nix b/hosts/appview/services/nginx.nix index 44e499f..0e33c01 100644 --- a/hosts/appview/services/nginx.nix +++ b/hosts/appview/services/nginx.nix @@ -1,8 +1,16 @@ { config, pkgs, + lib, ... -}: { +}: let + # Denied from the ssh stream proxy; HTTP block_scraper does not apply here. + sshBlocklist = [ + "13.220.42.207" + "98.82.21.79" + ]; + sshDenyRules = lib.concatMapStringsSep "\n " (cidr: "deny ${cidr};") sshBlocklist; +in { services.nginx = { enable = true; eventsConfig = '' @@ -67,9 +75,7 @@ ''; streamConfig = '' - # Log source IPs hitting the git-over-ssh proxy. SSH is an encrypted - # tunnel, so we can only see connection metadata here (source IP, - # bytes, duration) -- not the git paths/commands inside the session. + # ssh is an encrypted tunnel; only connection metadata is visible here. log_format ssh_proxy '$remote_addr [$time_local] ' 'proto=$protocol status=$status ' 'sent=$bytes_sent recv=$bytes_received ' @@ -82,6 +88,10 @@ server { listen 22; listen [::]:22; + + ${sshDenyRules} + allow all; + proxy_pass knot-sailor; access_log /var/log/nginx/ssh-proxy.log ssh_proxy; } -- 2.51.2