mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-10 23:00:39 +02:00
Code Activity

feat: allow services from home net

Browse source
This commit is contained in:
oddlama 2025-01-20 15:36:51 +01:00
parent 37bf3d0db7
commit 23e21f4145
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
7 changed files with 29 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

4
hosts/sire/guests/grafana.nix
View file

@ -146,8 +146,8 @@ in
proxyWebsockets = true; proxyWebsockets = true;
}; };
extraConfig = '' extraConfig = ''
allow ${globals.net.home-lan.vlans.services.cidrv4}; allow ${globals.net.home-lan.vlans.home.cidrv4};
allow ${globals.net.home-lan.vlans.services.cidrv6}; allow ${globals.net.home-lan.vlans.home.cidrv6};
deny all; deny all;
''; '';
}; };

4
hosts/sire/guests/immich.nix
View file

@ -249,8 +249,8 @@ in
proxy_read_timeout 600s; proxy_read_timeout 600s;
proxy_send_timeout 600s; proxy_send_timeout 600s;
send_timeout 600s; send_timeout 600s;
allow ${globals.net.home-lan.vlans.services.cidrv4}; allow ${globals.net.home-lan.vlans.home.cidrv4};
allow ${globals.net.home-lan.vlans.services.cidrv6}; allow ${globals.net.home-lan.vlans.home.cidrv6};
deny all; deny all;
''; '';
}; };

4
hosts/sire/guests/paperless.nix
View file

@ -79,8 +79,8 @@ in
useACMEWildcardHost = true; useACMEWildcardHost = true;
extraConfig = '' extraConfig = ''
client_max_body_size 512M; client_max_body_size 512M;
allow ${globals.net.home-lan.vlans.services.cidrv4}; allow ${globals.net.home-lan.vlans.home.cidrv4};
allow ${globals.net.home-lan.vlans.services.cidrv6}; allow ${globals.net.home-lan.vlans.home.cidrv6};
deny all; deny all;
''; '';
locations."/" = { locations."/" = {

6
hosts/sire/guests/samba.nix
View file

@ -179,8 +179,10 @@ in
# Deny access to all hosts by default. # Deny access to all hosts by default.
"hosts deny" = "0.0.0.0/0"; "hosts deny" = "0.0.0.0/0";
# Allow access to local network and TODO: wireguard # Allow access to local network and TODO: wireguard
"hosts allow" = "hosts allow" = lib.concatStringsSep " " [
"${globals.net.home-lan.vlans.services.cidrv4} ${globals.net.home-lan.vlans.services.cidrv6}"; globals.net.home-lan.vlans.home.cidrv4
globals.net.home-lan.vlans.home.cidrv6
];
# Don't advertise inaccessible shares to users # Don't advertise inaccessible shares to users
"access based share enum" = "yes"; "access based share enum" = "yes";

4
hosts/ward/guests/web-proxy.nix
View file

@ -70,8 +70,8 @@ in
# is over TLS. # is over TLS.
extraConfig = '' extraConfig = ''
proxy_ssl_verify off; proxy_ssl_verify off;
allow ${globals.net.home-lan.vlans.services.cidrv4}; allow ${globals.net.home-lan.vlans.home.cidrv4};
allow ${globals.net.home-lan.vlans.services.cidrv6}; allow ${globals.net.home-lan.vlans.home.cidrv6};
deny all; deny all;
''; '';
}; };

16
hosts/ward/net.nix
View file

@ -214,13 +214,27 @@
verdict = "accept"; verdict = "accept";
}; };
# Allow devices in the home VLAN to talk to any of the services or home devices.
access-services = {
from = [
"vlan-home"
];
to = [
"vlan-services"
"vlan-devices"
];
late = true;
verdict = "accept";
};
# Allow the services VLAN to talk to our wireguard server
services-to-local = { services-to-local = {
from = [ "vlan-services" ]; from = [ "vlan-services" ];
to = [ "local" ]; to = [ "local" ];
allowedUDPPorts = [ config.wireguard.proxy-home.server.port ]; allowedUDPPorts = [ config.wireguard.proxy-home.server.port ];
}; };
# Forward traffic between participants # Forward traffic between wireguard participants
forward-proxy-home-vpn-traffic = { forward-proxy-home-vpn-traffic = {
from = [ "proxy-home" ]; from = [ "proxy-home" ];
to = [ "proxy-home" ]; to = [ "proxy-home" ];

4
hosts/zackbiene/home-assistant.nix
View file

@ -176,8 +176,8 @@ in
proxyWebsockets = true; proxyWebsockets = true;
}; };
extraConfig = '' extraConfig = ''
allow ${globals.net.home-lan.vlans.services.cidrv4}; allow ${globals.net.home-lan.vlans.home.cidrv4};
allow ${globals.net.home-lan.vlans.services.cidrv6}; allow ${globals.net.home-lan.vlans.home.cidrv6};
deny all; deny all;
''; '';
}; };