peperunas/nixos
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

refactor: abstract vhost allow rules with new allowVPN, allowLAN, allowWAN options

Browse Source
This commit is contained in:
Giulio De Pasquale (aider) 2025-04-26 16:58:23 +01:00
parent 88990545ed
commit 87511fc1b8
12 changed files with 44 additions and 47 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

27
modules/core/vhost.nix
View File

@ -52,6 +52,24 @@ in
description = "IP address or CIDR block to allow.";
};
allowVPN = mkOption {
type = types.bool;
default = false;
description = "If set to true, allow VPN traffic.";
};
allowLAN = mkOption {
type = types.bool;
default = false;
description = "If set to true, allow LAN traffic.";
};
allowWAN = mkOption {
type = types.bool;
default = false;
description = "If set to true, allow WAN traffic. If false, deny all WAN traffic.";
};
path = mkOption {
type = types.str;
default = "";
@ -62,12 +80,6 @@ in
default = true;
description = "Force the use of recommended proxy configuration.";
};
allowWAN = mkOption {
type = types.bool;
default = false;
description = "If set to false, deny all WAN traffic.";
};
};
});
default = { };
@ -92,7 +104,8 @@ in
recommendedProxySettings = location.recommendedProxySettings;
extraConfig = ''
${concatMapStringsSep "\n" (allowCIDR: "allow ${allowCIDR};") location.allow}
${optionalString location.allowLan ''allow ${config.pepe.core.network.interfaces.${config.pepe.core.network.interfaceTypes.lan}.net};''}
${optionalString location.allowLAN ''allow ${config.pepe.core.network.interfaces.${config.pepe.core.network.interfaceTypes.lan}.net};''}
${optionalString location.allowVPN ''allow ${config.pepe.core.network.interfaces.${config.pepe.core.network.interfaceTypes.vpn}.net};''}
${optionalString (!location.allowWAN) "deny all;"}
'' + location.extraConfig;
})

6
modules/services/bazarr/default.nix
View File

@ -26,10 +26,8 @@ in
dnsInterfaces = [ interfaceTypes.vpn ];
locations."/" = {
port = 6767;
allowLan = true;
allow = [
interfaces.${interfaceTypes.vpn}.net
];
allowLAN = true;
allowVPN = true;
};
};

2
modules/services/gitea/default.nix
View File

@ -22,6 +22,8 @@ in
dnsInterfaces = [ interfaceTypes.lan interfaceTypes.vpn ];
locations."/" = {
port = config.services.gitea.settings.server.HTTP_PORT;
allowLAN = true;
allowVPN = true;
allowWAN = true;
};
};

4
modules/services/immich/default.nix
View File

@ -27,9 +27,9 @@ in
locations."/" = {
host = "[::1]";
port = config.services.immich.port;
allowLan = true;
allowLAN = true;
allowVPN = true;
allowWAN = true;
allow = [ interfaces.${interfaceTypes.vpn}.net ];
proxyWebsockets = true;
extraConfig = ''
# allow large file uploads

12
modules/services/jellyfin/default.nix
View File

@ -29,19 +29,15 @@ in
locations = {
"/" = {
port = 8096;
allowLan = true;
allow = [
interfaces.${interfaceTypes.vpn}.net
];
allowLAN = true;
allowVPN = true;
};
"/socket" = {
port = 8096;
allowLan = true;
allowLAN = true;
allowVPN = true;
proxyWebsockets = true;
allow = [
interfaces.${interfaceTypes.vpn}.net
];
};
};
};

6
modules/services/jellyseer/default.nix
View File

@ -25,10 +25,8 @@ in
dnsInterfaces = [ interfaceTypes.vpn interfaceTypes.lan ];
locations."/" = {
port = config.services.jellyseerr.port;
allowLan = true;
allow = [
interfaces.${interfaceTypes.vpn}.net
];
allowLAN = true;
allowVPN = true;
};
};
};

6
modules/services/lidarr/default.nix
View File

@ -26,10 +26,8 @@ in
dnsInterfaces = [ interfaceTypes.lan interfaceTypes.vpn ];
locations."/" = {
port = 8686;
allowLan = true;
allow = [
interfaces.${interfaceTypes.vpn}.net
];
allowLAN = true;
allowVPN = true;
};
};

3
modules/services/navidrome/default.nix
View File

@ -50,7 +50,8 @@ in
dnsInterfaces = [ interfaceTypes.lan interfaceTypes.vpn ];
locations."/" = {
port = 4533;
allowLan = true;
allowLAN = true;
allowVPN = true;
allowWAN = true;
};
};

6
modules/services/nzbget/default.nix
View File

@ -26,10 +26,8 @@ in
dnsInterfaces = [ interfaceTypes.vpn interfaceTypes.lan ];
locations."/" = {
port = 6789;
allowLan = true;
allow = [
interfaces.${interfaceTypes.vpn}.net
];
allowLAN = true;
allowVPN = true;
};
};

6
modules/services/prowlarr/default.nix
View File

@ -25,11 +25,9 @@ in
dnsInterfaces = [ interfaceTypes.vpn interfaceTypes.lan ];
locations."/" = {
port = 9696;
allowLan = true;
allowLAN = true;
allowVPN = true;
proxyWebsockets = true;
allow = [
interfaces.${interfaceTypes.vpn}.net
];
};
};

7
modules/services/radarr/default.nix
View File

@ -25,11 +25,8 @@ in
dnsInterfaces = [ interfaceTypes.vpn interfaceTypes.lan ];
locations."/" = {
port = 7878;
allowLan = true;
allow = [
interfaces.${interfaceTypes.vpn}.net
];
allowLAN = true;
allowVPN = true;
};
};

6
modules/services/sonarr/default.nix
View File

@ -25,10 +25,8 @@ in
dnsInterfaces = [ interfaceTypes.vpn interfaceTypes.lan ];
locations."/" = {
port = 8989;
allowLan = true;
allow = [
interfaces.${interfaceTypes.vpn}.net
];
allowLAN = true;
allowVPN = true;
};
};