diff options
| author |  Joe Banks <[email protected]> | 2024-06-02 14:56:16 +0100 |
|---|---|---|
| committer | Joe Banks <[email protected]> | 2024-06-02 14:56:16 +0100 |
| commit | 92b88c0e22e783140949b8cf12ba4930b58a6da6 (patch) | |
| tree | 01f5ac8ba9a332302a1143ff7ee1c547b6055625 | |
| parent | Allow node_exporter scraping in nftables (diff) | |
Filter CNs of client certificates for Prometheus
| -rw-r--r-- | ansible/host_vars/lovelace/nginx.yml | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/ansible/host_vars/lovelace/nginx.yml b/ansible/host_vars/lovelace/nginx.yml index be10ebc..2179c2c 100644 --- a/ansible/host_vars/lovelace/nginx.yml +++ b/ansible/host_vars/lovelace/nginx.yml @@ -13,6 +13,14 @@ nginx_configs: ssl_verify_client on; location / { + if ($reject) { return 403; } + proxy_pass http://localhost:9090; } } + + map $ssl_client_s_dn $reject { + default 1; + CN=sudo.access.tls.pydis.wtf 0; + CN=prometheus.access.tls.pydis.wtf 0; + } |