mirrors_public/oddlama_nix-config
1
1
Fork 1
mirror of https://github.com/oddlama/nix-config.git synced 2025-10-10 23:00:39 +02:00
Code Activity

feat: finish migration to new globals system for wireguard

Browse source
This commit is contained in:
oddlama 2025-09-13 23:23:28 +02:00
parent b885d1062b
commit a1623fb97c
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
29 changed files with 204 additions and 214 deletions
Download patch file Download diff file Expand all files Collapse all files

16
hosts/ward/guests/adguardhome.nix
View file

@ -8,16 +8,16 @@ let
adguardhomeDomain = "adguardhome.${globals.domains.me}";
in
{
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [ config.services.adguardhome.port ];
};
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[
config.services.adguardhome.port
];
# Allow home-assistant to access it directly
wireguard.proxy-home = {
client.via = "ward";
firewallRuleForNode.sausebiene.allowedTCPPorts = [ config.services.adguardhome.port ];
};
globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.sausebiene.allowedTCPPorts =
[
config.services.adguardhome.port
];
globals.services.adguardhome.domain = adguardhomeDomain;
globals.monitoring.dns.adguardhome = {

6
hosts/ward/guests/forgejo.nix
View file

@ -10,12 +10,10 @@ let
forgejoDomain = "git.${globals.domains.me}";
in
{
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[
config.services.forgejo.settings.server.HTTP_PORT
];
};
age.secrets.forgejo-mailer-password.rekeyFile =
config.node.secretsDir + "/forgejo-mailer-password.age";

6
hosts/ward/guests/kanidm.nix
View file

@ -15,10 +15,8 @@ let
};
in
{
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [ kanidmPort ];
};
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[ kanidmPort ];
age.secrets."kanidm-self-signed.crt" = {
rekeyFile = config.node.secretsDir + "/kanidm-self-signed.crt.age";

8
hosts/ward/guests/mealie.nix
View file

@ -8,10 +8,10 @@ let
mealieDomain = "mealie.${globals.domains.me}";
in
{
wireguard.proxy-home = {
client.via = "ward";
firewallRuleForNode.ward-web-proxy.allowedTCPPorts = [ config.services.mealie.port ];
};
globals.wireguard.proxy-home.hosts.${config.node.name}.firewallRuleForNode.ward-web-proxy.allowedTCPPorts =
[
config.services.mealie.port
];
# Mirror the original oauth2 secret, but prepend OIDC_CLIENT_SECRET=
# so it can be used as an EnvironmentFile

6
hosts/ward/guests/radicale.nix
View file

@ -7,10 +7,8 @@ let
radicaleDomain = "radicale.${globals.domains.personal}";
in
{
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [ 8000 ];
};
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[ 8000 ];
globals.services.radicale.domain = radicaleDomain;
globals.monitoring.http.radicale = {

8
hosts/ward/guests/vaultwarden.nix
View file

@ -8,10 +8,10 @@ let
vaultwardenDomain = "pw.${globals.domains.personal}";
in
{
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [ config.services.vaultwarden.config.rocketPort ];
};
globals.wireguard.proxy-sentinel.hosts.${config.node.name}.firewallRuleForNode.sentinel.allowedTCPPorts =
[
config.services.vaultwarden.config.rocketPort
];
age.secrets.vaultwarden-env = {
rekeyFile = config.node.secretsDir + "/vaultwarden-env.age";

3
hosts/ward/guests/web-proxy.nix
View file

@ -10,8 +10,7 @@ in
{
microvm.mem = 1024 * 4; # Need more /tmp space so nginx can store intermediary files
wireguard.proxy-home = {
client.via = "ward";
globals.wireguard.proxy-home.hosts.${config.node.name} = {
firewallRuleForAll.allowedTCPPorts = [
80
443