refactor: abstract vhost allow rules with new allowVPN, allowLAN, allowWAN options

modules/core/vhost.nix

@@ -52,6 +52,24 @@ in
                   description = "IP address or CIDR block to allow.";
                 };
 
+                allowVPN = mkOption {
+                  type = types.bool;
+                  default = false;
+                  description = "If set to true, allow VPN traffic.";
+                };
+
+                allowLAN = mkOption {
+                  type = types.bool;
+                  default = false;
+                  description = "If set to true, allow LAN traffic.";
+                };
+
+                allowWAN = mkOption {
+                  type = types.bool;
+                  default = false;
+                  description = "If set to true, allow WAN traffic. If false, deny all WAN traffic.";
+                };
+
                 path = mkOption {
                   type = types.str;
                   default = "";
@@ -62,12 +80,6 @@ in
                   default = true;
                   description = "Force the use of recommended proxy configuration.";
                 };
-
-                allowWAN = mkOption {
-                  type = types.bool;
-                  default = false;
-                  description = "If set to false, deny all WAN traffic.";
-                };
               };
             });
             default = { };
@@ -92,7 +104,8 @@ in
             recommendedProxySettings = location.recommendedProxySettings;
             extraConfig = ''
               ${concatMapStringsSep "\n" (allowCIDR: "allow ${allowCIDR};") location.allow}
-              ${optionalString location.allowLan ''allow ${config.pepe.core.network.interfaces.${config.pepe.core.network.interfaceTypes.lan}.net};''}
+              ${optionalString location.allowLAN ''allow ${config.pepe.core.network.interfaces.${config.pepe.core.network.interfaceTypes.lan}.net};''}
+              ${optionalString location.allowVPN ''allow ${config.pepe.core.network.interfaces.${config.pepe.core.network.interfaceTypes.vpn}.net};''}
               ${optionalString (!location.allowWAN) "deny all;"}
             '' + location.extraConfig;
           })

modules/services/bazarr/default.nix

@@ -26,10 +26,8 @@ in
       dnsInterfaces = [ interfaceTypes.vpn ];
       locations."/" = {
         port = 6767;
-        allowLan = true;
+        allowLAN = true;
-        allow = [
+        allowVPN = true;
-          interfaces.${interfaceTypes.vpn}.net
-        ];
       };
     };
 

modules/services/gitea/default.nix

@@ -22,6 +22,8 @@ in
         dnsInterfaces = [ interfaceTypes.lan interfaceTypes.vpn ];
         locations."/" = {
           port = config.services.gitea.settings.server.HTTP_PORT;
+          allowLAN = true;
+          allowVPN = true;
           allowWAN = true;
         };
       };

modules/services/immich/default.nix

@@ -27,9 +27,9 @@ in
       locations."/" = {
         host = "[::1]";
         port = config.services.immich.port;
-        allowLan = true;
+        allowLAN = true;
+        allowVPN = true;
         allowWAN = true;
-        allow = [ interfaces.${interfaceTypes.vpn}.net ];
         proxyWebsockets = true;
         extraConfig = ''
           # allow large file uploads

modules/services/jellyfin/default.nix

@@ -29,19 +29,15 @@ in
       locations = {
         "/" = {
           port = 8096;
-          allowLan = true;
+          allowLAN = true;
-          allow = [
+          allowVPN = true;
-            interfaces.${interfaceTypes.vpn}.net
-          ];
         };
 
         "/socket" = {
           port = 8096;
-          allowLan = true;
+          allowLAN = true;
+          allowVPN = true;
           proxyWebsockets = true;
-          allow = [
-            interfaces.${interfaceTypes.vpn}.net
-          ];
         };
       };
     };

modules/services/jellyseer/default.nix

@@ -25,10 +25,8 @@ in
       dnsInterfaces = [ interfaceTypes.vpn interfaceTypes.lan ];
       locations."/" = {
         port = config.services.jellyseerr.port;
-        allowLan = true;
+        allowLAN = true;
-        allow = [
+        allowVPN = true;
-          interfaces.${interfaceTypes.vpn}.net
-        ];
       };
     };
   };

modules/services/lidarr/default.nix

@@ -26,10 +26,8 @@ in
       dnsInterfaces = [ interfaceTypes.lan interfaceTypes.vpn ];
       locations."/" = {
         port = 8686;
-        allowLan = true;
+        allowLAN = true;
-        allow = [
+        allowVPN = true;
-          interfaces.${interfaceTypes.vpn}.net
-        ];
       };
     };
 

modules/services/navidrome/default.nix

@@ -50,7 +50,8 @@ in
       dnsInterfaces = [ interfaceTypes.lan interfaceTypes.vpn ];
       locations."/" = {
         port = 4533;
-        allowLan = true;
+        allowLAN = true;
+        allowVPN = true;
         allowWAN = true;
       };
     };

modules/services/nzbget/default.nix

@@ -26,10 +26,8 @@ in
       dnsInterfaces = [ interfaceTypes.vpn interfaceTypes.lan ];
       locations."/" = {
         port = 6789;
-        allowLan = true;
+        allowLAN = true;
-        allow = [
+        allowVPN = true;
-          interfaces.${interfaceTypes.vpn}.net
-        ];
       };
     };
 

modules/services/prowlarr/default.nix

@@ -25,11 +25,9 @@ in
       dnsInterfaces = [ interfaceTypes.vpn interfaceTypes.lan ];
       locations."/" = {
         port = 9696;
-        allowLan = true;
+        allowLAN = true;
+        allowVPN = true;
         proxyWebsockets = true;
-        allow = [
-          interfaces.${interfaceTypes.vpn}.net
-        ];
       };
     };
 

modules/services/radarr/default.nix

@@ -25,11 +25,8 @@ in
       dnsInterfaces = [ interfaceTypes.vpn interfaceTypes.lan ];
       locations."/" = {
         port = 7878;
-        allowLan = true;
+        allowLAN = true;
-
+        allowVPN = true;
-        allow = [
-          interfaces.${interfaceTypes.vpn}.net
-        ];
       };
     };
 

modules/services/sonarr/default.nix

@@ -25,10 +25,8 @@ in
       dnsInterfaces = [ interfaceTypes.vpn interfaceTypes.lan ];
       locations."/" = {
         port = 8989;
-        allowLan = true;
+        allowLAN = true;
-        allow = [
+        allowVPN = true;
-          interfaces.${interfaceTypes.vpn}.net
-        ];
       };
     };