danlin/infra-nix
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add LAN-only music vhost and enable weekly autoUpgrade

Browse Source 
- gateway: replace konnektor/api/auth/mailpit vhosts with
  music.home.lindenfelser.de -> 10.202.82.195:80, LAN-only (403 otherwise)
- common: enable system.autoUpgrade, pulling config from Gitea main and
  overriding nixpkgs to the nixos-25.11 tip for weekly package refresh;
  reboot allowed in a 04:00-06:00 window

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Daniel Lindenfelser
2026-07-18 18:51:02 +02:00
parent a0658b3a97
commit ad1dd816f4
2 changed files with 23 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/gateway.nix
+5 -27
View File
@@ -42,38 +42,16 @@
reverse_proxy 10.202.82.6:3000
'';
};
# konnektor-web — Frontend
"konnektor.home.lindenfelser.de" = {
extraConfig = ''
reverse_proxy 10.202.82.49:8082
'';
};
# konnektor-api Frontend REST
"api.konnektor.home.lindenfelser.de" = {
extraConfig = ''
reverse_proxy 10.202.82.49:8080
'';
};
# Zitadel OIDC
# Wichtig: `header_up Host {host}` — Zitadel routet anhand des Host-
# Headers; ohne das sieht es den Upstream-Container-Hostname und failt.
"auth.konnektor.home.lindenfelser.de" = {
extraConfig = ''
reverse_proxy 10.202.82.49:8081 {
header_up Host {host}
}
'';
};
# Mailpit Web UI — NUR aus dem LAN 10.202.82.0/24 erreichbar.
# Alle anderen IPs bekommen 403, ohne dass Mailpit jemals angerufen wird.
"mailpit.konnektor.home.lindenfelser.de" = {
# Music-Server — NUR aus dem LAN 10.202.82.0/24 erreichbar.
# Alle anderen IPs bekommen 403, ohne dass der Upstream je angerufen wird.
"music.home.lindenfelser.de" = {
extraConfig = ''
@lan client_ip 10.202.82.0/24
handle @lan {
reverse_proxy 10.202.82.49:8025
reverse_proxy 10.202.82.195:80
}
handle {
respond "forbidden — mailpit ist nur aus dem LAN 10.202.82.0/24 erreichbar" 403
respond "forbidden — music ist nur aus dem LAN 10.202.82.0/24 erreichbar" 403
}
'';
};