hosts/architect/default.nix

@@ -37,6 +37,7 @@ in
     #./calibre.nix
     ./docker.nix
     ./keycloak.nix
+    ./lezzo.nix
     ./runas.nix
     ./tailscale.nix
     ./searx.nix

hosts/architect/firewall.nix

@@ -132,17 +132,12 @@ in
           chain FORWARD {
             type filter hook forward priority filter; policy drop;
             ct state established,related accept
-
-            # client to client
-            ip saddr {${lib.concatStringsSep "," c2c-wg}} ip daddr {${
-               lib.concatStringsSep "," c2c-wg
-            }} accept                    
                     
             # nat to wan
             oifname ${wan-if} ip saddr {${
               lib.concatStringsSep "," towan-wg
             }} accept
-
+                    
             oifname ${wan-if} ip saddr ${docker-net} accept
             oifname ${wan-if} ip saddr ${tailscale-net} accept
                     

hosts/architect/lezzo.nix

@@ -0,0 +1,46 @@
+{ services, pkgs, lib, makeBinPath, ... }:
+let
+  domain = "lezzo.org";
+  lezzo_root = "/var/lib/lezzo.org";
+  service_name = "lezzo-pull";
+  network = import ./network.nix;
+  mkStartScript = name: pkgs.writeShellScript "${name}.sh" ''
+    set -euo pipefail
+    cd ${lezzo_root}
+    git pull origin master --rebase
+  '';
+in
+{
+  services.nginx.virtualHosts.${domain} = {
+    enableACME = true;
+    forceSSL = true;
+
+    root = lezzo_root;
+
+    locations."/.git" = { return = "404"; };
+  };
+
+  systemd = {
+    services.${service_name} = {
+      path = [ pkgs.git ];
+      enable = true;
+      serviceConfig = {
+        Type = "oneshot";
+        ExecStart = mkStartScript "${service_name}";
+      };
+    };
+    timers.${service_name} = {
+      wantedBy = [ "timers.target" ];
+      timerConfig = {
+        OnCalendar = "hourly";
+        Unit = "${service_name}.service";
+      };
+    };
+  };
+
+  networking.extraHosts = ''
+    ${network.architect-lan} ${domain}
+    ${network.architect-wg} ${domain}
+    ${network.architect-ts} ${domain}
+  '';
+}

hosts/architect/network.nix

@@ -56,8 +56,7 @@ rec {
   dodino-ts = "100.106.244.35";
 
   framecca-devices = [ framecca-wg framecca_one-wg framecca_three-wg framecca_four-wg ];
-  c2c-wg = framecca-devices;
+
-  
   # groups
   gdevices = [ giuliophone-ts architect-ts giuliopc-ts dodino-ts ];
   towan-wg = [ shield-wg parina-wg parina-ipad-wg germano-wg ] ++ framecca-devices;