James/eve-psr-nix0
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Lock down services to LAN

Browse Source
This commit is contained in:
James Eversole 2025-04-22 13:40:41 -05:00
parent 2034274ee0
commit b27d748e30
3 changed files with 22 additions and 24 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
nix/application/containers.nix
View File

@ -1,13 +1,5 @@
{ config, lib, pkgs, ... }: { config, lib, pkgs, ... }:
{ {
environment.etc."containers/containers.conf".text = lib.mkForce ''
[engine]
init_path = "${pkgs.catatonit}/bin/catatonit"
[network]
network_backend = "cni"
cni_plugin_dirs = ["${pkgs.cni-plugins}/bin"]
'';
virtualisation.oci-containers = { virtualisation.oci-containers = {
containers = { containers = {

10
nix/application/headscale.nix
View File

@ -4,7 +4,10 @@
address = "0.0.0.0"; address = "0.0.0.0";
port = 35893; port = 35893;
settings = { settings = {
dns.base_domain = "vpn.matri.cx"; dns = {
base_domain = "vpn.matri.cx";
nameservers.global = ["192.168.0.130" "1.1.1.1"];
};
logtail.enabled = false; logtail.enabled = false;
noise.private_key_path = "/var/lib/headscale/noise_private.key"; noise.private_key_path = "/var/lib/headscale/noise_private.key";
server_url = "https://vpn.matri.cx:443"; server_url = "https://vpn.matri.cx:443";
@ -12,11 +15,8 @@
}; };
services.tailscale = { services.tailscale = {
enable = true; enable = true;
extraSetFlags = [
"--advertise-exit-node"
];
extraUpFlags = [ extraUpFlags = [
"--advertise-tags=tag:home-server" "--accept-routes" "--advertise-exit-node" "--advertise-routes=192.168.0.0/24" "--login-server=https://vpn.matri.cx"
]; ];
useRoutingFeatures = "both"; useRoutingFeatures = "both";
}; };

28
nix/application/nginx.nix
View File

@ -33,20 +33,23 @@
}; };
}; };
proxiedLAN = { target }: base { proxiedLAN = { target, extra ? ""}: base {
"/" = { "/" = {
proxyPass = target; proxyPass = target;
extraConfig = '' extraConfig = allowedLANAddrs + extra;
allow 192.168.0.0/24;
deny all;
'';
}; };
}; };
allowedLANAddrs = ''
allow 127.0.0.1;
allow 192.168.0.0/24;
allow 100.64.0.0/24;
deny all;
'';
in in
{ {
"default.host" = { default = true; root = "/var/www/default";}; "default.host" = { default = true; root = "/var/www/default";};
"atuin.matri.cx" = proxied { target = "http://127.0.0.1:8888"; }; "atuin.matri.cx" = proxied { target = "http://127.0.0.1:8888"; };
"brohan.lol" = static { dir = "/var/www/brohan.lol"; };
"cache.matri.cx" = proxiedLAN { "cache.matri.cx" = proxiedLAN {
target = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}"; target = "http://${config.services.nix-serve.bindAddress}:${toString config.services.nix-serve.port}";
}; };
@ -59,10 +62,13 @@
''; '';
}; };
"eversole.co" = proxied { target = "http://127.0.0.1:5196"; }; "eversole.co" = proxied { target = "http://127.0.0.1:5196"; };
"flux.matri.cx" = proxied { target = "http://127.0.0.1:26343"; }; "flux.matri.cx" = proxiedLAN { target = "http://127.0.0.1:26343"; };
"git.eversole.co" = proxied { target = "http://127.0.0.1:8027"; }; "git.eversole.co" = proxied { target = "http://127.0.0.1:8027"; };
"graf.matri.cx" = { root = "/var/www/graf.matri.cx"; }; # refer to /monitoring/nginx.nix "graf.matri.cx" = { # refer to /monitoring/nginx.nix
"hydra.matri.cx" = proxied { root = "/var/www/graf.matri.cx";
extraConfig = allowedLANAddrs;
};
"hydra.matri.cx" = proxiedLAN {
target = "http://127.0.0.1:3034"; target = "http://127.0.0.1:3034";
extra = '' extra = ''
proxy_set_header X-Request-Base "https://hydra.matri.cx"; proxy_set_header X-Request-Base "https://hydra.matri.cx";
@ -70,9 +76,9 @@
}; };
"jame.su" = static { dir = "/var/www/jame.su"; }; "jame.su" = static { dir = "/var/www/jame.su"; };
"matri.cx" = static { dir = "/var/www/matri.cx"; }; "matri.cx" = static { dir = "/var/www/matri.cx"; };
"media.matri.cx" = proxied { target = "http://127.0.0.1:8096"; }; "media.matri.cx" = proxiedLAN { target = "http://127.0.0.1:8096"; };
"purr.eversole.co" = proxied { target = "http://127.0.0.1:5195"; }; "purr.eversole.co" = proxied { target = "http://127.0.0.1:5195"; };
"pw.eversole.co" = proxied { target = "http://127.0.0.1:40080"; }; "pw.eversole.co" = proxiedLAN { target = "http://127.0.0.1:40080"; };
"sezycei.com" = static { dir = "/var/www/sezycei.com"; }; "sezycei.com" = static { dir = "/var/www/sezycei.com"; };
"snakebelmont.com" = static { dir = "/var/www/snakebelmont.com"; }; "snakebelmont.com" = static { dir = "/var/www/snakebelmont.com"; };
"transmission.matri.cx" = proxiedLAN { target = "http://127.0.0.1:9091"; }; "transmission.matri.cx" = proxiedLAN { target = "http://127.0.0.1:9091"; };