xun/nixos-config
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

move some things out of the vpn namespace

Browse source
This commit is contained in:
xunuwu 2025-04-22 12:31:55 +02:00
parent 0f71ca1484
commit f3a04f8bd7
5 changed files with 9 additions and 18 deletions
Download patch file Download diff file Expand all files Collapse all files

11
sys/machines/hopper/lab/caddy.nix
View file

@ -5,6 +5,7 @@
}: let }: let
inherit (vars.common) domain; inherit (vars.common) domain;
caddyPort = 8336; caddyPort = 8336;
bridge = config.vpnNamespaces."wg".bridgeAddress;
in { in {
systemd.services.caddy.vpnConfinement = { systemd.services.caddy.vpnConfinement = {
enable = true; enable = true;
@ -26,7 +27,7 @@ in {
extraConfig = '' extraConfig = ''
reverse_proxy { reverse_proxy {
header_up X-Forwarded-For {http.request.header.CF-Connecting-IP} header_up X-Forwarded-For {http.request.header.CF-Connecting-IP}
to localhost:8096 to ${bridge}:8096
} }
''; '';
}; };
@ -46,13 +47,13 @@ in {
prometheus = { prometheus = {
hostName = "prometheus.hopper.xun.host:80"; hostName = "prometheus.hopper.xun.host:80";
extraConfig = '' extraConfig = ''
reverse_proxy ${config.vpnNamespaces."wg".bridgeAddress}:${toString config.services.prometheus.port} reverse_proxy ${bridge}:${toString config.services.prometheus.port}
''; '';
}; };
adguard = { adguard = {
hostName = "adguard.hopper.xun.host:80"; hostName = "adguard.hopper.xun.host:80";
extraConfig = '' extraConfig = ''
reverse_proxy ${config.vpnNamespaces."wg".bridgeAddress}:${toString config.services.adguardhome.port} reverse_proxy ${bridge}:${toString config.services.adguardhome.port}
''; '';
}; };
transmission = { transmission = {
@ -64,7 +65,7 @@ in {
dash = { dash = {
hostName = "dash.hopper.xun.host:80"; hostName = "dash.hopper.xun.host:80";
extraConfig = '' extraConfig = ''
reverse_proxy localhost:${toString config.services.homepage-dashboard.listenPort} reverse_proxy ${bridge}:${toString config.services.homepage-dashboard.listenPort}
''; '';
}; };
vw = { vw = {
@ -73,7 +74,7 @@ in {
extraConfig = '' extraConfig = ''
reverse_proxy { reverse_proxy {
header_up X-Real-Ip {http.request.header.CF-Connecting-IP} header_up X-Real-Ip {http.request.header.CF-Connecting-IP}
to localhost:${toString config.services.vaultwarden.config.ROCKET_PORT} to ${bridge}:${toString config.services.vaultwarden.config.ROCKET_PORT}
} }
''; '';
}; };

5
sys/machines/hopper/lab/homepage.nix
View file

@ -5,11 +5,6 @@
}: let }: let
inherit (vars.common) domain; inherit (vars.common) domain;
in { in {
systemd.services.homepage-dashboard.vpnConfinement = {
enable = true;
vpnNamespace = "wg";
};
systemd.services.homepage-dashboard.environment.HOMEPAGE_ALLOWED_HOSTS = "dash.hopper.xun.host"; systemd.services.homepage-dashboard.environment.HOMEPAGE_ALLOWED_HOSTS = "dash.hopper.xun.host";
services.homepage-dashboard = { services.homepage-dashboard = {

4
sys/machines/hopper/lab/jellyfin.nix
View file

@ -1,8 +1,4 @@
{ {
systemd.services.jellyfin.vpnConfinement = {
enable = true;
vpnNamespace = "wg";
};
services.jellyfin.enable = true; services.jellyfin.enable = true;
services.restic.backups.hopper.paths = [ services.restic.backups.hopper.paths = [

4
sys/machines/hopper/lab/vaultwarden.nix
View file

@ -1,10 +1,6 @@
{config, ...}: { {config, ...}: {
systemd.services.vaultwarden = { systemd.services.vaultwarden = {
serviceConfig.EnvironmentFile = config.sops.secrets.vaultwarden-env.path; serviceConfig.EnvironmentFile = config.sops.secrets.vaultwarden-env.path;
vpnConfinement = {
enable = true;
vpnNamespace = "wg";
};
}; };
# NOTE send doesnt work, probably due to my cloudflare port rewriting rules # NOTE send doesnt work, probably due to my cloudflare port rewriting rules
services.vaultwarden = { services.vaultwarden = {

3
sys/machines/hopper/lab/vpn-namespace.nix
View file

@ -7,6 +7,9 @@
allowTcpFromVPNToDefaultPorts = [ allowTcpFromVPNToDefaultPorts = [
config.services.prometheus.port config.services.prometheus.port
config.services.adguardhome.port config.services.adguardhome.port
config.services.vaultwarden.config.ROCKET_PORT
config.services.homepage-dashboard.listenPort
8096 # jellyfin port
]; ];
in { in {
extraCommands = builtins.concatStringsSep "\n" (map extraCommands = builtins.concatStringsSep "\n" (map