sokai/mynixos-config
1
1
Fork 0
forked from mirrors_public/oddlama_nix-config
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: move wireguard module to nixos-extra-modules

Browse source
This commit is contained in:
oddlama 2024-03-14 20:55:08 +01:00
parent 621d725af3
commit a4844807e6
No known key found for this signature in database
GPG key ID: 14EFE510775FE39A
27 changed files with 73 additions and 783 deletions
Download patch file Download diff file Expand all files Collapse all files

11
hosts/sire/guests/paperless.nix
View file

@ -17,7 +17,7 @@ in {
services.nginx = {
upstreams.paperless = {
servers."${config.meta.wireguard.proxy-sentinel.ipv4}:${toString config.services.paperless.port}" = {};
servers."${config.wireguard.proxy-sentinel.ipv4}:${toString config.services.paperless.port}" = {};
extraConfig = ''
zone paperless 64k;
keepalive 2;
@ -38,9 +38,10 @@ in {
};
};
meta.wireguard-proxy.sentinel.allowedTCPPorts = [
config.services.paperless.port
];
wireguard.proxy-sentinel = {
client.via = "sentinel";
firewallRuleForNode.sentinel.allowedTCPPorts = [config.services.paperless.port];
};
age.secrets.paperless-admin-password = {
generator.script = "alnum";
@ -74,7 +75,7 @@ in {
PAPERLESS_URL = "https://${paperlessDomain}";
PAPERLESS_ALLOWED_HOSTS = paperlessDomain;
PAPERLESS_CORS_ALLOWED_HOSTS = "https://${paperlessDomain}";
PAPERLESS_TRUSTED_PROXIES = sentinelCfg.meta.wireguard.proxy-sentinel.ipv4;
PAPERLESS_TRUSTED_PROXIES = sentinelCfg.wireguard.proxy-sentinel.ipv4;
# Authentication via kanidm
PAPERLESS_APPS = "allauth.socialaccount.providers.openid_connect";