mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-10 23:00:39 +02:00
Code Activity

feat: allow services from home net

Browse source
This commit is contained in:
oddlama 2025-01-20 15:36:51 +01:00
parent 37bf3d0db7
commit 23e21f4145
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
7 changed files with 29 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hosts/ward/guests/web-proxy.nix
View file

@ -70,8 +70,8 @@ in
# is over TLS.
extraConfig = ''
proxy_ssl_verify off;
allow ${globals.net.home-lan.vlans.services.cidrv4};
allow ${globals.net.home-lan.vlans.services.cidrv6};
allow ${globals.net.home-lan.vlans.home.cidrv4};
allow ${globals.net.home-lan.vlans.home.cidrv6};
deny all;
'';
};

16
hosts/ward/net.nix
View file

@ -214,13 +214,27 @@
verdict = "accept";
};
# Allow devices in the home VLAN to talk to any of the services or home devices.
access-services = {
from = [
"vlan-home"
];
to = [
"vlan-services"
"vlan-devices"
];
late = true;
verdict = "accept";
};
# Allow the services VLAN to talk to our wireguard server
services-to-local = {
from = [ "vlan-services" ];
to = [ "local" ];
allowedUDPPorts = [ config.wireguard.proxy-home.server.port ];
};
# Forward traffic between participants
# Forward traffic between wireguard participants
forward-proxy-home-vpn-traffic = {
from = [ "proxy-home" ];
to = [ "proxy-home" ];