blake/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

reverse proxying from vaniville

Browse Source
This commit is contained in:
blake
2026-05-02 12:36:21 -05:00
parent 7fddefba21
commit 17a4e2f138
2 changed files with 47 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/nixos/vaniville/configuration.nix
+41 -5
View File
@@ -5,6 +5,7 @@ let
unstable = unstable_pkgs.x86_64;
vpsip4 = "100.100.1.10";
homelabipv4 = "10.10.0.10";
homelab = config.homelab;
in
{
imports =
@@ -33,7 +34,8 @@ in
url = "up.blakedheld.xyz";
};
caddy = {
enable = false;
enable = true;
keys = false;
};
};
@@ -99,21 +101,24 @@ in
# tailscale will also need its UDP port open:
allowedUDPPorts = [ config.services.tailscale.port 25777 21116 ];
trustedInterfaces = [ "tailscale0" ];
/*
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80 # http
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443 # https
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # http
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # https
*/
extraCommands = ''
# Clear any previous rules if you are iterating
iptables -t nat -F
# DNAT: internet -> homelab over tailscale
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80 # http
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443 # https
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${homelabipv4}:7567 # gitea ssh
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${homelabipv4}:25778 # cbblemon mc
# SNAT: ensure replies go back through VPS tailscale IP
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # http
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # https
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # gitea ssh
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc
@@ -131,6 +136,37 @@ in
];
};
# forwarding for caddy
services.caddy = {
virtualHosts = {
# for central uptime monitoring
"up.${homelab.public_domain}".extraConfig = ''
reverse_proxy 127.0.0.1:7901
'';
# below is basically just manually reverse proxying everything in the homelab
# this is instead of forwarding all 80 & 443 traffic to have more explicit
# publishing things to the open web
"media.${homelab.public_domain}".extraConfig = ''
reverse_proxy 10.10.0.10:7100
'';
"pass.${homelab.public_domain}".extraConfig = ''
reverse_proxy 10.10.0.10:7701
'';
"photos.${homelab.public_domain}".extraConfig = ''
reverse_proxy 10.10.0.10:7702
'';
"git.${homelab.public_domain}".extraConfig = ''
reverse_proxy 10.10.0.10:7703
'';
};
};
system.stateVersion = "25.05"; # Did you read the comment?
}
};
};
system.stateVersion = "25.05"; # Did you read the comment?
modules/homelab/caddy/default.nix
+6 -1
View File
@@ -16,6 +16,11 @@ in
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
keys = lib.mkOption {
type = lib.types.bool;
default = true;
description = "host keys directory";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
@@ -53,7 +58,7 @@ in
auto_https ignore_loaded_certs
'';
virtualHosts."keys.${homelab.base_domain}" = {
virtualHosts."keys.${homelab.base_domain}" = lib.mkIf cfg.keys {
serverAliases = [ "keys.${homelab.public_domain}" ];
extraConfig = ''
tls internal