feat: prepare local mirror web-proxy to speed up internal service access

hosts/kroma/default.nix

@@ -82,14 +82,20 @@
     port = 51820;
     name = "netbird-home";
     interface = "wt-home";
+    autoStart = false;
     openFirewall = true;
     config.ServerSSHAllowed = false;
     environment = rec {
       NB_MANAGEMENT_URL = "https://${nodes.sentinel.config.networking.providedDomains.netbird}";
       NB_ADMIN_URL = NB_MANAGEMENT_URL;
-      NB_HOSTNAME = "home-gateway";
     };
   };
+  environment.persistence."/persist".directories = [
+    {
+      directory = "/var/lib/netbird-home";
+      mode = "0700";
+    }
+  ];
 
   topology.self.icon = "devices.desktop";
 }

hosts/sentinel/default.nix

@@ -19,9 +19,9 @@
 
   boot.mode = "bios";
 
-  users.groups.acme.members = ["nginx"];
   wireguard.proxy-sentinel.firewallRuleForAll.allowedTCPPorts = [80 443];
 
+  users.groups.acme.members = ["nginx"];
   services.nginx.enable = true;
   services.nginx.recommendedSetup = true;
 

hosts/sire/guests/grafana.nix

@@ -9,6 +9,7 @@ in {
   wireguard.proxy-sentinel = {
     client.via = "sentinel";
     firewallRuleForNode.sentinel.allowedTCPPorts = [config.services.grafana.settings.server.http_port];
+    firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [config.services.grafana.settings.server.http_port];
   };
 
   age.secrets.grafana-secret-key = {
@@ -78,6 +79,30 @@ in {
     };
   };
 
+  nodes.ward-web-proxy = {
+    services.nginx = {
+      upstreams.grafana = {
+        servers."${config.wireguard.proxy-sentinel.ipv4}:${toString config.services.grafana.settings.server.http_port}" = {};
+        extraConfig = ''
+          zone grafana 64k;
+          keepalive 2;
+        '';
+      };
+      virtualHosts.${grafanaDomain} = {
+        forceSSL = true;
+        useACMEWildcardHost = true;
+        locations."/" = {
+          proxyPass = "http://grafana";
+          proxyWebsockets = true;
+        };
+        extraConfig = ''
+          allow 192.168.1.0/24;
+          deny all;
+        '';
+      };
+    };
+  };
+
   environment.persistence."/persist".directories = [
     {
       directory = config.services.grafana.dataDir;

hosts/ward/default.nix

@@ -111,5 +111,6 @@
       // mkMicrovm "netbird"
       // mkMicrovm "radicale"
       // mkMicrovm "vaultwarden"
+      // mkMicrovm "web-proxy"
     );
 }

hosts/ward/guests/netbird.nix

@@ -47,8 +47,9 @@ in {
       dashboard.settings.AUTH_AUTHORITY = "https://${sentinelCfg.networking.providedDomains.kanidm}/oauth2/openid/netbird";
 
       management = {
+        singleAccountModeDomain = "internal.${config.repo.secrets.global.domains.me}";
         dnsDomain = "internal.${config.repo.secrets.global.domains.me}";
-        singleAccountModeDomain = "home.lan";
+        disableAnonymousMetrics = true;
         oidcConfigEndpoint = "https://${sentinelCfg.networking.providedDomains.kanidm}/oauth2/openid/netbird/.well-known/openid-configuration";
         turnDomain = sentinelCfg.networking.providedDomains.coturn;
         turnPort = sentinelCfg.services.coturn.tls-listening-port;

hosts/ward/guests/web-proxy.nix

@@ -0,0 +1,37 @@
+{config, ...}: let
+  inherit (config.repo.secrets.local) acme;
+in {
+  age.secrets.acme-cloudflare-dns-token = {
+    rekeyFile = config.node.secretsDir + "/acme-cloudflare-dns-token.age";
+    mode = "440";
+    group = "acme";
+  };
+
+  age.secrets.acme-cloudflare-zone-token = {
+    rekeyFile = config.node.secretsDir + "/acme-cloudflare-zone-token.age";
+    mode = "440";
+    group = "acme";
+  };
+
+  security.acme = {
+    acceptTerms = true;
+    defaults = {
+      credentialFiles = {
+        CF_DNS_API_TOKEN_FILE = config.age.secrets.acme-cloudflare-dns-token.path;
+        CF_ZONE_API_TOKEN_FILE = config.age.secrets.acme-cloudflare-zone-token.path;
+      };
+      dnsProvider = "cloudflare";
+      dnsPropagationCheck = true;
+      reloadServices = ["nginx"];
+    };
+    inherit (acme) certs wildcardDomains;
+  };
+
+  #nodes.sentinel = {
+  #  # port forward 80,443 (ward) to 80,443 (web-proxy)
+  #};
+
+  users.groups.acme.members = ["nginx"];
+  services.nginx.enable = true;
+  services.nginx.recommendedSetup = true;
+}

hosts/ward/secrets/web-proxy/acme-cloudflare-dns-token.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> X25519 GLh/xkRHD1zOOGYiWxlORV+qzYaTNvnXZoGe9qdxXUI
+2TMHIo8emk76HOEgOpSOR3t1ib87kAGcH9FmZSLyhlU
+-> piv-p256 xqSe8Q A6KvjXG2UNrpvNfY924v9/DVz7Ooncem24keDbtWXp7i
+fNiibPhEaeRaXV8AxKFL2T7Er8byHmGCGT8ciwye1Kw
+-> l1G-grease w;*@H4
+r4rvf0/eUQYWuhKWMIR94Uww+bgbr2GBP4oEWM8TftQFcioNNEK1Zm8bwocMvhM9
+i/KA6H6qw5yR68gKU3CPDzlMaIM99Oit3p7+3NdM2QPFKqvdYr9MdBcI
+--- RGaCUY59RAiy0MUYasVeUf2cCfJqil3YTJmL0cXrmjA
+M~¦�õÜB{`\’½BÞvWñÏžŠ4™ã’b`aRîÜ^›l8ËK¹Ö;†ðû
Zþ5ß\ùW·¿.[ÎP,~éAqÕ

hosts/ward/secrets/web-proxy/acme-cloudflare-zone-token.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> X25519 Y7J0KmGssDwytzJSMTKnb2qVfCBEl4nMiKeg4PDhbhM
+R+FV22jr0XcybGJk8Z2o40O5ptRK3NPgQOxJ7HlORho
+-> piv-p256 xqSe8Q AyC1XlhbGhbfUBn4gV56t48AazKi5Lt9H5BCOZqbTtOp
+s3mrvVrMZ/kTdUSjKyBWa5hUFL2fwL2xRo7UFF0AwP0
+-> Ao-grease vp@ m_b
+oV7D7L5dZtF75bJ6Ms0yZr92rENJmE4xKpdlBp4h40onYWv1Z17R2/bmygv5MD9+
+S7J25g3rxfk00fUOK8cwDcWyRtp4jQqcooJyrQ
+--- J/aXuudcbUAfU06R065fsvPTX2qZr0w0eZ9gI6I+McY
+vÂâ-##·¬=|Ú•˝-IÝR†·żÝn<§z´fÄ.\śő‘cU/OÓ	6÷¶ëĽ±�Üož’Ţ$ő¶8\Ň6E•ËeËí†n

hosts/ward/secrets/web-proxy/host.pub

@@ -0,0 +1 @@
+ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHAuNTD4wF9XIR/m2TlLoHK/jSNus3gBCUKKsF4unKSm

hosts/ward/secrets/web-proxy/local.nix.age

@@ -0,0 +1,11 @@
+age-encryption.org/v1
+-> X25519 NIQfcq9fdcwAm3/7bqVw9XKuHxH6r2r7Lbqjjr/u+2w
+Cfz/aTYCh4gNWo+dOzDKXNBaAlt0W/aqTb30ho/i5nM
+-> piv-p256 xqSe8Q Al+FYiIKhA9B31HjuxCNE65MfYWKIxO+ZefbPsDWljxu
++K47WX1YQpRkvIzR4ALVucSj21YIv9WUluEQ62ccEWk
+-> a"CCg7E9-grease ~ &+9|O
+fuXdG2v+8S2Bti9ifpvRPfRZfh9ioXzOuYXcPkyPynbQPy2isAksKx83FgQeRoID
+VHH/CKTjy/qFCDec9MXX2i9GCWWrva1n2tfOXl9kh2IZ1Zl2te2rsA
+--- Tg/N4zk19YF7LCLd9wb95nyQJs0B59SHO4nh76xif0c
+ÄíNÑõ9Þ�}òõ¸–wÁÿ2Û
Q/çzbC—AuŸÇ{O
&âÎiR­ïž,E 1šúë9=Ñ”�íÏÓ‡òM
C¨ñìÞñÉæî±pæF:9�=È"‡¼[Èß–6»ò­ŸÁ§‚&}ú3E&%º²ýYŽA´í))¸Ä´Í‡mïË
+_³o¯V@U*½Q1ÄȈ_L²

secrets/generated/ward-web-proxy/promtail-loki-basic-auth-password.age

@@ -0,0 +1,10 @@
+age-encryption.org/v1
+-> X25519 L5QeScr47cZuTXA2+suY1Z859dDPG7NAiiYUgIA/6Bs
++9/qfyYCn3E4Pt3AiIe1y0ikuCDKn2TxPr2n8P9pbRI
+-> piv-p256 xqSe8Q AgqCoxqf5/kIfGz/w1ISInjhla9GM2/E7vbQ4xM2m6BI
+wqJBvegatDBotrMVu4Mtu/Ti+ZxmnqM+9S79WrnwGwY
+-> cJ+g)As-grease 17 halok $29WPO mJYp
+BhQNUu5asGzmfKDEQ9uJc5EBKzR5h62BAXMlE2hRs2YdyTDHGYnPt8W3fqPthnw2
+zujauJioA5apYZqEXT6rji9D9LY12tO3Kg
+--- dmVnPmT3cgoN8+PLw6VOeN34MCwv9xiq8Dz/moyR3aw
+˜3—ÎFevÐÜ«€¥w8¾ÐϯJE¯ã¤ò0â„ÁYÏ¿kÞ–)€®!ç#6ãæ¯"Ðë#•ƒVÉq€iÍIè  mb.Jý{~¤

secrets/generated/ward-web-proxy/telegraf-influxdb-token.age

@@ -0,0 +1,9 @@
+age-encryption.org/v1
+-> X25519 mDqiVQOWk7oHh8Fe+XfsJuBVYQKX64OBbJJHAlp9+go
+Y//Pun+q8oxIoygP4KNdqPQuF4ofsAsrcKBkJAxP+Q4
+-> piv-p256 xqSe8Q AlfJ9Pf9lseof2TLRM13YZn73LypMipUKDWjI9tWe/PS
+FwEwUcxtggjuZDQmAHagbBh6PsqnCR2qrAbhei3KYEI
+-> k-grease ^kKsR3EO g< S3? +W[LIq2,
+5HUcLZxeuBAD+LNu60mipaKZxS1iC50/pM1j5s8SULOjaYsHGkhgcgsuRK/R
+--- KzXceMOxfzRsGRXP99cvYn1Al3OHcebz80sGPWF2rww
+áÂûó WGÀVó¬T¼Ë"ö}È&m«¬Ž:ü+²‰3…–R¦9D¶øµ³®õ!0ËÐ"ê�'ó™Ûr%?Õã8Ò_lYn‰n®uaH”L×…v

secrets/rekeyed/sire-influxdb/77e41d6d4f1ee94ad7d26e00c3363352-telegraf-influxdb-token-ward-web-proxy.age

@@ -0,0 +1,8 @@
+age-encryption.org/v1
+-> ssh-ed25519 1tdZKQ UFx8Re0mcIt2HcL5x/GaXoi2CezPo6K7dKFD+nzfURg
+sPM57TihJrVuRIhAUHVfehcGOhw4w3DRHTwW12cmEoU
+-> }0-grease C\z~D+j
+wMZmyvzkl/4iDjjH2kq0bbiPImhlesbTgLTV09l4tiep7EEzeKm2BoG+gmTVDQ
+--- PzpDgRPy2dE/rvmZoKmJUDdY6yDaP3FCgL9t63YVWUM
+¤ÞE ñ0€RËÔKI=sTF…Ö$¼wëpIdEŒžWìP[^ÇÇÒþ°žü'w,9Ý„ù„A£˜M”–xÐ
¿0«øÛƒäÕË÷Ú
+S]OöCë

secrets/rekeyed/ward-web-proxy/fe0973a0966ad375770995305acd07c7-acme-cloudflare-dns-token.age

@@ -0,0 +1,7 @@
+age-encryption.org/v1
+-> ssh-ed25519 NwOpTA phHAnMhRnbsn7xSs7aWA65U/ZQusblSQ5dx0W7BgUmQ
+uYeX2njTvlGDpI7UQ3SwQJru0rc7SVcvVqy1UB9i+i4
+-> 3a@Ad*-grease 2$Q$, ghooe0R
+BrufnH/DkowTfeg/KW4a3ka10mONjewEiV70ag
+--- 0yFOek1QRJRzSuGzx91aB31S4jA5ieoqFw+jAFLL/Rs
+ёο�ux�
6ªc»l‡•ÜXºÄÙó0°��ªvª”}9Ãyªuœ¹QÁUÊ"¿ˆ’\ÀY?ÁÏ””ZõÆHPlßzÂ