starred/Foundry
1
0
Fork 0
mirror of https://github.com/Misterio77/Foundry.git synced 2026-08-24 10:04:09 -05:00
Code Issues Packages Projects Releases Wiki Activity

fix(headscale): manage internal services DNS in headscale, deny only / location

Browse Source 
This is to fix ACME http challenges not working. I've also replaced the public DNS to point to public IP instead of TS IP.
This commit is contained in:
Gabriel Fontes
2026-06-02 09:30:27 -03:00
parent 0b18edd96b
commit 320090eda4
10 changed files with 113 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/alcyone/services/grafana/default.nix
+8 -6
View File
@@ -209,12 +209,14 @@
in {
forceSSL = true;
enableACME = true;
locations."/".proxyPass = "http://localhost:${toString port}";
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
locations."/" = {
proxyPass = "http://localhost:${toString port}";
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
};
};
};
hosts/alcyone/services/headscale.nix
+59
View File
@@ -15,6 +15,65 @@ in {
base_domain = "ts.m7.rs";
magic_dns = true;
nameservers.global = ["9.9.9.9"];
extra_records = let
# Would be nice to not have to hardcode these
alcyone = "100.77.0.6";
celaeno = "100.77.0.10";
merope = "100.77.0.5";
in [
{
type = "A";
name = "photos.m7.rs";
value = merope;
}
{
type = "A";
name = "deluge.m7.rs";
value = merope;
}
{
type = "A";
name = "bazarr.m7.rs";
value = merope;
}
{
type = "A";
name = "lidarr.m7.rs";
value = merope;
}
{
type = "A";
name = "radarr.m7.rs";
value = merope;
}
{
type = "A";
name = "prowlarr.m7.rs";
value = merope;
}
{
type = "A";
name = "sonarr.m7.rs";
value = merope;
}
{
type = "A";
name = "dash.m7.rs";
value = alcyone;
}
{
type = "A";
name = "metrics.m7.rs";
value = alcyone;
}
{
type = "A";
name = "hydra.m7.rs";
value = celaeno;
}
];
};
server_url = "https://tailscale.m7.rs";
metrics_listen_addr = "127.0.0.1:8095";
hosts/alcyone/services/prometheus.nix
+8 -6
View File
@@ -78,12 +78,14 @@ in {
"metrics.m7.rs" = {
forceSSL = true;
enableACME = true;
locations."/".proxyPass = "http://localhost:${toString config.services.prometheus.port}";
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
locations."/" = {
proxyPass = "http://localhost:${toString config.services.prometheus.port}";
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
};
};
};
hosts/celaeno/services/hydra/default.nix
+8 -6
View File
@@ -44,13 +44,15 @@ in {
enableACME = true;
locations = {
"~* ^/shield/([^\\s]*)".return = "302 https://img.shields.io/endpoint?url=https://hydra.m7.rs/$1/shield";
"/".proxyPass = "http://localhost:${toString config.services.hydra.port}";
"/" = {
proxyPass = "http://localhost:${toString config.services.hydra.port}";
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
};
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
};
};
hosts/merope/services/immich.nix
+5 -5
View File
@@ -14,12 +14,12 @@
locations."/" = {
proxyPass = "http://localhost:${toString config.services.immich.port}";
proxyWebsockets = true;
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
/*
hosts/merope/services/media/bazarr.nix
+5 -5
View File
@@ -10,12 +10,12 @@
locations."/" = {
proxyPass = "http://localhost:${toString config.services.bazarr.listenPort}";
proxyWebsockets = true;
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
# Add bazarr to sonarr and radarr groups
hosts/merope/services/media/lidarr.nix
+5 -5
View File
@@ -12,12 +12,12 @@
locations."/" = {
proxyPass = "http://localhost:${toString config.services.lidarr.settings.server.port}";
proxyWebsockets = true;
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
# Add lidarr to deluge's and nzbget's groups
hosts/merope/services/media/prowlarr.nix
+5 -5
View File
@@ -12,12 +12,12 @@
locations."/" = {
proxyPass = "http://localhost:${toString config.services.prowlarr.settings.server.port}";
proxyWebsockets = true;
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
hosts/merope/services/media/radarr.nix
+5 -5
View File
@@ -12,12 +12,12 @@
locations."/" = {
proxyPass = "http://localhost:${toString config.services.radarr.settings.server.port}";
proxyWebsockets = true;
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
hosts/merope/services/media/sonarr.nix
+5 -5
View File
@@ -12,12 +12,12 @@
locations."/" = {
proxyPass = "http://localhost:${toString config.services.sonarr.settings.server.port}";
proxyWebsockets = true;
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};
extraConfig = ''
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v4};
allow ${outputs.nixosConfigurations.alcyone.config.services.headscale.settings.prefixes.v6};
deny all;
'';
};