From dfa32223172e6d5324c3d186d4720461e684cd7f Mon Sep 17 00:00:00 2001
From: lassulus <lass@lassul.us>
Date: Tue, 31 Jan 2017 17:14:30 +0100
Subject: [PATCH] l 1 prism: protect bepasty from external ip

---
 lass/1systems/prism.nix | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/lass/1systems/prism.nix b/lass/1systems/prism.nix
index b92c8d900..5fa86da4d 100644
--- a/lass/1systems/prism.nix
+++ b/lass/1systems/prism.nix
@@ -44,7 +44,16 @@ in {
     ../2configs/hfos.nix
     ../2configs/makefu-sip.nix
     ../2configs/monitoring/server.nix
-    ../2configs/bepasty.nix
+    {
+      imports = [
+        ../2configs/bepasty.nix
+      ];
+      krebs.bepasty.servers."paste.r".nginx.extraConfig = ''
+        if ( $server_addr = "${config.krebs.build.host.nets.internet.ip4.addr}" ) {
+          return 403;
+        }
+      '';
+    }
     {
       users.extraGroups = {
         # ● systemd-tmpfiles-setup.service - Create Volatile Files and Directories