blake/nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Compare commits

base: blake/nix:9dd2015202d8e3a9f893fc796cc8d1f021908d85
Branches Tags
blake/nix:trunk
...
compare: blake/nix:17a4e2f1386a61a84bb8aae9b53c9669726c24cb
Branches Tags
blake/nix:trunk
2 Commits
9dd2015202 ... 17a4e2f138
Author SHA1 Message Date
blake 17a4e2f138 reverse proxying from vaniville 2026-05-02 12:36:21 -05:00
blake 7fddefba21 updates 2026-05-02 12:36:00 -05:00
3 changed files with 81 additions and 40 deletions
Expand all files Collapse all files
flake.lock
Generated
+34 -34
View File
@@ -106,16 +106,16 @@
"brew-src": {
"flake": false,
"locked": {
"lastModified": 1774235677,
"narHash": "sha256-0ryNYmzDAeRlrzPTAgmzGH/Cgc8iv/LBN6jWGUANvIk=",
"lastModified": 1776478798,
"narHash": "sha256-ERStG27tf83VbCfYMxtDSs+sa8FUMJ/3jSu/QfX9rKE=",
"owner": "Homebrew",
"repo": "brew",
"rev": "894a3d23ac0c8aaf561b9874b528b9cb2e839201",
"rev": "3aae056b8d072624255bc8fd27febb7f327b2265",
"type": "github"
},
"original": {
"owner": "Homebrew",
"ref": "5.1.1",
"ref": "5.1.7",
"repo": "brew",
"type": "github"
}
@@ -126,11 +126,11 @@
"nixpkgs": "nixpkgs"
},
"locked": {
"lastModified": 1776983715,
"narHash": "sha256-XonefkUGuMkCvyFfy3B6crz6FV8Ghsrc3Lg1SIWi2hg=",
"lastModified": 1777069669,
"narHash": "sha256-cEyV6jpC7pX/TNoHI+VDiTDjQc0rfYAkDLRJP2hZrzc=",
"owner": "9001",
"repo": "copyparty",
"rev": "1e7de5d14f00f8821b1a32f3009f4328b1a5e04a",
"rev": "6e25d648a900f65a4546a1b17a9761c0f1e9e3cb",
"type": "github"
},
"original": {
@@ -606,11 +606,11 @@
]
},
"locked": {
"lastModified": 1776989775,
"narHash": "sha256-sIIeTZz5sWfrkV/SplDAthZNAzLhSxnJ7Foia6bAxB4=",
"lastModified": 1777733408,
"narHash": "sha256-lyKV2GtkMPS1Mp8bKJ8sBr7LPCzL4GnVnQQYa4e7UsQ=",
"owner": "nix-community",
"repo": "home-manager",
"rev": "5bba6a1e027b79ba56dd6ed8e6edbed80aa8e3cb",
"rev": "9ce9f7f128c5834bb71a4f5c62232187371379b6",
"type": "github"
},
"original": {
@@ -794,11 +794,11 @@
"brew-src": "brew-src"
},
"locked": {
"lastModified": 1774720267,
"narHash": "sha256-YYftFe8jyfpQI649yfr0E+dqEXE2jznZNcYvy/lKV1U=",
"lastModified": 1777250621,
"narHash": "sha256-WynkkG0hdZ5niYPJUbVg7oMfu8MVwGGzKZ6lKmfa+O8=",
"owner": "zhaofengli",
"repo": "nix-homebrew",
"rev": "a7760a3a83f7609f742861afb5732210fdc437ed",
"rev": "aeb2069920742d0d6570089e8b3b8620050bacf2",
"type": "github"
},
"original": {
@@ -847,11 +847,11 @@
]
},
"locked": {
"lastModified": 1777394230,
"narHash": "sha256-So0O9VEARU3xTRIFkBtvfzpRDxx4W2WPZPgucxdKBm8=",
"lastModified": 1777732699,
"narHash": "sha256-2uX/XtOWZ/oy2rerRynVhqVA//ZXZ3Fo60PikLHEPQc=",
"owner": "nix-community",
"repo": "NixOS-WSL",
"rev": "d2e09229638f08f6d5c99060573f6fa4b1dde852",
"rev": "5482f113fd31ebac131d1ebeb2ae90bf0d5e41f5",
"type": "github"
},
"original": {
@@ -878,11 +878,11 @@
},
"nixpkgs-unstable": {
"locked": {
"lastModified": 1776548001,
"narHash": "sha256-ZSK0NL4a1BwVbbTBoSnWgbJy9HeZFXLYQizjb2DPF24=",
"lastModified": 1777578337,
"narHash": "sha256-Ad49moKWeXtKBJNy2ebiTQUEgdLyvGmTeykAQ9xM+Z4=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "b12141ef619e0a9c1c84dc8c684040326f27cdcc",
"rev": "15f4ee454b1dce334612fa6843b3e05cf546efab",
"type": "github"
},
"original": {
@@ -893,11 +893,11 @@
},
"nixpkgs_2": {
"locked": {
"lastModified": 1776734388,
"narHash": "sha256-vl3dkhlE5gzsItuHoEMVe+DlonsK+0836LIRDnm6MXQ=",
"lastModified": 1777428379,
"narHash": "sha256-ypxFOeDz+CqADEQNL72haqGjvZQdBR5Vc7pyx2JDttI=",
"owner": "NixOS",
"repo": "nixpkgs",
"rev": "10e7ad5bbcb421fe07e3a4ad53a634b0cd57ffac",
"rev": "755f5aa91337890c432639c60b6064bb7fe67769",
"type": "github"
},
"original": {
@@ -974,11 +974,11 @@
"systems": "systems"
},
"locked": {
"lastModified": 1776987992,
"narHash": "sha256-hcAGb1ZH8AXFjy0UefPIgj0GCSKaaKXWU4kfPJtHutA=",
"lastModified": 1777478067,
"narHash": "sha256-2vZnUuv8fg2sIE6pXgGxZQQ3ZhQW1XE7Sxieg8gK2p4=",
"owner": "notashelf",
"repo": "nvf",
"rev": "26b98908d9c1a3260724dc5fabd16f3da1e6ba6c",
"rev": "13c4ad4b4bb926c22945e2fb8862769fe51f27f1",
"type": "github"
},
"original": {
@@ -1220,11 +1220,11 @@
]
},
"locked": {
"lastModified": 1774370155,
"narHash": "sha256-emNcbleHPyUszpRFV5mHnU3q4E0aq7FNJxPtIAvsJqE=",
"lastModified": 1777492414,
"narHash": "sha256-1gmodLfwgw4UpOIYj9KBur57rD0O08Qd/r0miE58/Ww=",
"owner": "lytedev",
"repo": "slippi-nix",
"rev": "c1f16cb34f7e09e8a9c7fe49744305c2f65a5b5f",
"rev": "4e8d34e9f469f7ec5a66babf66eb897f9128ca18",
"type": "github"
},
"original": {
@@ -1240,11 +1240,11 @@
]
},
"locked": {
"lastModified": 1776771786,
"narHash": "sha256-DRFGPfFV6hbrfO9a1PH1FkCi7qR5FgjSqsQGGvk1rdI=",
"lastModified": 1777338324,
"narHash": "sha256-bc+ZZCmOTNq86/svGnw0tVpH7vJaLYvGLLKFYP08Q8E=",
"owner": "Mic92",
"repo": "sops-nix",
"rev": "bef289e2248991f7afeb95965c82fbcd8ff72598",
"rev": "8eaee5c45428b28b8c47a83e4c09dccec5f279b5",
"type": "github"
},
"original": {
@@ -1320,11 +1320,11 @@
"tinted-zed": "tinted-zed"
},
"locked": {
"lastModified": 1776893932,
"narHash": "sha256-AFD5cf9eNqXq1brHS63xeZy2xKZMgG9J86XJ9I2eLn8=",
"lastModified": 1777580129,
"narHash": "sha256-6buSTzDtHYCJP1JNAIZCmgNcOs76oN03j+21CxdijVo=",
"owner": "nix-community",
"repo": "stylix",
"rev": "84971726c7ef0bb3669a5443e151cc226e65c518",
"rev": "20ff51f523e2dd67e5f31a321719d30708c1b771",
"type": "github"
},
"original": {
hosts/nixos/vaniville/configuration.nix
+41 -5
View File
@@ -5,6 +5,7 @@ let
unstable = unstable_pkgs.x86_64;
vpsip4 = "100.100.1.10";
homelabipv4 = "10.10.0.10";
homelab = config.homelab;
in
{
imports =
@@ -33,7 +34,8 @@ in
url = "up.blakedheld.xyz";
};
caddy = {
enable = false;
enable = true;
keys = false;
};
};
@@ -99,21 +101,24 @@ in
# tailscale will also need its UDP port open:
allowedUDPPorts = [ config.services.tailscale.port 25777 21116 ];
trustedInterfaces = [ "tailscale0" ];
/*
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80 # http
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443 # https
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # http
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # https
*/
extraCommands = ''
# Clear any previous rules if you are iterating
iptables -t nat -F
# DNAT: internet -> homelab over tailscale
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 80 -j DNAT --to-destination ${homelabipv4}:80 # http
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j DNAT --to-destination ${homelabipv4}:443 # https
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 7567 -j DNAT --to-destination ${homelabipv4}:7567 # gitea ssh
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p udp --dport 25777 -j DNAT --to-destination ${homelabipv4}:25777 # recpro mc
iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 25778 -j DNAT --to-destination ${homelabipv4}:25778 # cbblemon mc
# SNAT: ensure replies go back through VPS tailscale IP
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 80 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # http
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 443 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # https
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 7567 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # gitea ssh
iptables -t nat -A POSTROUTING -o tailscale0 -p tcp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc
iptables -t nat -A POSTROUTING -o tailscale0 -p udp --dport 25777 -d ${homelabipv4}/32 -j SNAT --to-source ${vpsip4} # recpro mc
@@ -131,6 +136,37 @@ in
];
};
# forwarding for caddy
services.caddy = {
virtualHosts = {
# for central uptime monitoring
"up.${homelab.public_domain}".extraConfig = ''
reverse_proxy 127.0.0.1:7901
'';
# below is basically just manually reverse proxying everything in the homelab
# this is instead of forwarding all 80 & 443 traffic to have more explicit
# publishing things to the open web
"media.${homelab.public_domain}".extraConfig = ''
reverse_proxy 10.10.0.10:7100
'';
"pass.${homelab.public_domain}".extraConfig = ''
reverse_proxy 10.10.0.10:7701
'';
"photos.${homelab.public_domain}".extraConfig = ''
reverse_proxy 10.10.0.10:7702
'';
"git.${homelab.public_domain}".extraConfig = ''
reverse_proxy 10.10.0.10:7703
'';
};
};
system.stateVersion = "25.05"; # Did you read the comment?
}
};
};
system.stateVersion = "25.05"; # Did you read the comment?
modules/homelab/caddy/default.nix
+6 -1
View File
@@ -16,6 +16,11 @@ in
default = "/var/lib/${service}";
description = "set data directory for ${service}";
};
keys = lib.mkOption {
type = lib.types.bool;
default = true;
description = "host keys directory";
};
backup = lib.mkOption {
type = lib.types.bool;
default = true;
@@ -53,7 +58,7 @@ in
auto_https ignore_loaded_certs
'';
virtualHosts."keys.${homelab.base_domain}" = {
virtualHosts."keys.${homelab.base_domain}" = lib.mkIf cfg.keys {
serverAliases = [ "keys.${homelab.public_domain}" ];
extraConfig = ''
tls internal