SebastianStork/nixos-config
1
0
Fork 0
mirror of https://github.com/SebastianStork/nixos-config.git synced 2026-01-21 11:41:34 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

vps-public: Only allow access to radicale's login page over vpn

Browse source
This commit is contained in:
SebastianStork 2026-01-15 22:20:48 +01:00
parent 2f246153d4
commit d73e3744a8
Signed by: SebastianStork
SSH key fingerprint: SHA256:tRrGdjYOwgHxpSc/wTOZQZEjxcb15P0tyXRsbAfd+2Q
1 changed files with 81 additions and 68 deletions
Download patch file Download diff file Expand all files Collapse all files

149
hosts/vps-public/default.nix
View file

@ -13,77 +13,90 @@
ports.validate = true; ports.validate = true;
}; };
custom = { custom =
persistence.enable = true; let
sproutedDomain = "sprouted.cloud";
in
{
persistence.enable = true;
sops.enable = true; sops.enable = true;
boot.loader.systemd-boot.enable = true; boot.loader.systemd-boot.enable = true;
networking = { networking = {
overlay.address = "10.254.250.4"; overlay.address = "10.254.250.4";
underlay = { underlay = {
interface = "enp1s0"; interface = "enp1s0";
address = "167.235.73.246"; address = "167.235.73.246";
isPublic = true; isPublic = true;
};
isServer = true;
}; };
isServer = true;
services = {
gc = {
enable = true;
onlyCleanRoots = true;
};
nebula.enable = true;
sshd.enable = true;
caddy.virtualHosts."dav.${sproutedDomain}" = {
inherit (config.custom.web-services.radicale) port;
extraConfig = ''
respond /.web/ "Access denied" 403 {
close
}
'';
};
};
web-services =
let
privateDomain = config.custom.networking.overlay.domain;
sstorkDomain = "sstork.dev";
in
{
personal-blog = {
enable = true;
domain = sstorkDomain;
};
forgejo = {
enable = true;
domain = "git.${sstorkDomain}";
doBackups = true;
};
outline = {
enable = true;
domain = "wiki.${sproutedDomain}";
doBackups = true;
};
it-tools = {
enable = true;
domain = "tools.${sproutedDomain}";
};
privatebin = {
enable = true;
domain = "pastebin.${sproutedDomain}";
branding.name = "SproutedBin";
};
radicale = {
enable = true;
domain = "dav.${privateDomain}";
doBackups = true;
};
alloy = {
enable = true;
domain = "alloy.${config.networking.hostName}.${privateDomain}";
};
};
}; };
services = {
gc = {
enable = true;
onlyCleanRoots = true;
};
nebula.enable = true;
sshd.enable = true;
};
web-services =
let
sstorkDomain = "sstork.dev";
sproutedDomain = "sprouted.cloud";
in
{
personal-blog = {
enable = true;
domain = sstorkDomain;
};
forgejo = {
enable = true;
domain = "git.${sstorkDomain}";
doBackups = true;
};
outline = {
enable = true;
domain = "wiki.${sproutedDomain}";
doBackups = true;
};
it-tools = {
enable = true;
domain = "tools.${sproutedDomain}";
};
privatebin = {
enable = true;
domain = "pastebin.${sproutedDomain}";
branding.name = "SproutedBin";
};
radicale = {
enable = true;
domain = "dav.${sproutedDomain}";
doBackups = true;
};
alloy = {
enable = true;
domain = "alloy.${config.networking.hostName}.${config.custom.networking.overlay.domain}";
};
};
};
} }