feat(servers): only expose public apps to WAN

devices/cluster/modules/caddy.nix

@@ -4,7 +4,7 @@
   config,
   ...
 }: let
-  inherit (config.vars) mainUser;
+  inherit (config.vars) hostName mainUser;
   inherit (config.sops) secrets;
 
   caddy = caddy-plugins.packages.${pkgs.system}.default;
@@ -33,35 +33,68 @@ in {
       clusterIP = config.services.pcsd.virtualIps.caddy-vip.ip;
       nosIP = "10.0.0.121";
       serviviIP = "10.0.0.249";
+
+      tlsConf = ''
+        tls {
+          dns cloudflare {$CLOUDFLARE_API_TOKEN}
+          resolvers 1.0.0.1
+        }
+      '';
+
+      mkPublicReverseProxy = subdomain: ip: extraConf:
+        {
+          hostName = "${subdomain}.nelim.org";
+          reverseProxy = ip;
+          listenAddresses = [clusterIP];
+          extraConfig = tlsConf + (extraConf.extraConfig or "");
+        }
+        // (builtins.removeAttrs extraConf ["extraConfig"]);
     in {
+      # Public
+      "Vaultwarden" = mkPublicReverseProxy "vault" "${nosIP}:8781" {};
+      "Hauk" = mkPublicReverseProxy "hauk" "${nosIP}:3003" {};
+      "Headscale" = mkPublicReverseProxy "headscale" "${clusterIP}:8085" {};
+
+      "Jellyfin" = mkPublicReverseProxy "jelly" "${nosIP}:8096" {
+        subDirectories.jfa-go = {
+          subDirName = "accounts";
+          reverseProxy = "${nosIP}:8056";
+        };
+      };
+
+      "Jellyseer" = mkPublicReverseProxy "seerr" "${nosIP}:5055" {};
+
+      "Gameyfin" = mkPublicReverseProxy "games" "${nosIP}:8074" {};
+
+      "Forgejo" = mkPublicReverseProxy "git" "${nosIP}:3000" {};
+
+      "Nextcloud" = mkPublicReverseProxy "cloud" "${nosIP}:8042" {
+        extraConfig = ''
+          redir /.well-known/carddav /remote.php/dav 301
+          redir /.well-known/caldav /remote.php/dav 301
+          redir /.well-known/webfinger /index.php/.well-known/webfinger 301
+          redir /.well-known/nodeinfo /index.php/.well-known/nodeinfo 301
+        '';
+      };
+      "OnlyOffice" = mkPublicReverseProxy "office" "http://${nosIP}:8055" {};
+
+      "Immich" = mkPublicReverseProxy "photos" "${nosIP}:2283" {};
+
+      # Private
       "nelim.org" = {
         serverAliases = ["*.nelim.org"];
-        extraConfig = ''
+        extraConfig = tlsConf;
-          tls {
+        listenAddresses = [
-            dns cloudflare {$CLOUDFLARE_API_TOKEN}
+          (
-            resolvers 1.0.0.1
+            if hostName == "thingone"
-          }
+            then "100.64.0.8"
-        '';
+            else "100.64.0.9"
+          )
+        ];
 
         subDomains = {
-          # Misc one-liners
-          vault.reverseProxy = "${nosIP}:8781";
-          hauk.reverseProxy = "${nosIP}:3003";
-          headscale.reverseProxy = "${clusterIP}:8085";
           pr-tracker.reverseProxy = "${serviviIP}:3000";
 
-          jellyfin = {
-            subDomainName = "jelly";
-            reverseProxy = "${nosIP}:8096";
-
-            subDirectories = {
-              jfa-go = {
-                subDirName = "accounts";
-                reverseProxy = "${nosIP}:8056";
-              };
-            };
-          };
-
           pcsd = {
             extraConfig = ''
               reverse_proxy https://${clusterIP}:2224 {
@@ -72,42 +105,14 @@ in {
             '';
           };
 
-          # Resume builder
-          resume.reverseProxy = "${nosIP}:3060";
-          resauth.reverseProxy = "${nosIP}:3100";
-
-          # Nextcloud & Co
-          office.reverseProxy = "http://${nosIP}:8055";
-          nextcloud = {
-            subDomainName = "cloud";
-            extraConfig = ''
-              redir /.well-known/carddav /remote.php/dav 301
-              redir /.well-known/caldav /remote.php/dav 301
-              redir /.well-known/webfinger /index.php/.well-known/webfinger 301
-              redir /.well-known/nodeinfo /index.php/.well-known/nodeinfo 301
-            '';
-            reverseProxy = "${nosIP}:8042";
-          };
-
-          forgejo = {
-            subDomainName = "git";
-            reverseProxy = "${nosIP}:3000";
-          };
-
           nix-binary-cache = {
             subDomainName = "cache";
             reverseProxy = "${serviviIP}:5000";
           };
 
-          calibre = {
+          # Resume builder
-            subDomainName = "books";
+          resume.reverseProxy = "${nosIP}:3060";
-            reverseProxy = "${nosIP}:8083";
+          resauth.reverseProxy = "${nosIP}:3100";
-          };
-
-          immich = {
-            subDomainName = "photos";
-            reverseProxy = "${nosIP}:2283";
-          };
 
           # FreshRSS & Co
           bridge.reverseProxy = "${nosIP}:3006";
@@ -117,16 +122,6 @@ in {
             reverseProxy = "${nosIP}:2800";
           };
 
-          jellyseer = {
-            subDomainName = "seerr";
-            reverseProxy = "${nosIP}:5055";
-          };
-
-          gameyfin = {
-            subDomainName = "games";
-            reverseProxy = "${nosIP}:8074";
-          };
-
           wgui.reverseProxy = "${nosIP}:51821";
 
           lan = {
@@ -137,12 +132,10 @@ in {
 
             subDirectories = {
               bazarr.reverseProxy = "${nosIP}:6767";
-
               prowlarr.reverseProxy = "${nosIP}:9696";
               radarr.reverseProxy = "${nosIP}:7878";
               sabnzbd.reverseProxy = "${nosIP}:8382";
               sonarr.reverseProxy = "${nosIP}:8989";
-              calibre.reverseProxy = "${nosIP}:8580";
 
               qbittorent = {
                 subDirName = "qbt";

devices/cluster/modules/unbound.nix

@@ -1,5 +1,24 @@
-{config, ...}: let
+{
+  config,
+  lib,
+  ...
+}: let
+  inherit (lib) foldl isList mapAttrsToList mergeAttrsWithFunc remove unique;
+  mergeAttrsList = list:
+    foldl (mergeAttrsWithFunc (a: b:
+      if isList a && isList b
+      then unique (a ++ b)
+      else b)) {}
+    list;
+
   inherit (config.vars) mainUser hostName;
+
+  wanIP = "166.62.180.199";
+  serviviIP = "100.64.0.7";
+  caddyIp =
+    if hostName == "thingone"
+    then "100.64.0.8"
+    else "100.64.0.9";
 in {
   # https://github.com/MatthewVance/unbound-docker-rpi/issues/4#issuecomment-1001879602
   boot.kernel.sysctl."net.core.rmem_max" = 1048576;
@@ -12,70 +31,62 @@ in {
     resolveLocalQueries = false;
 
     settings = {
-      server = {
+      server = let
-        interface = ["127.0.0.1"];
+        mkLocalEntry = domain: ip: {
-        port = 5335;
+          local-zone = ["${domain} redirect"];
+          local-data = ["\"${domain} IN A ${ip}\""];
+        };
 
-        # Custom DNS
+        mkMinecraftEntry = domain: port: {
-        local-zone = [
+          local-zone = ["${domain} transparent"];
-          "headscale.nelim.org redirect"
+          local-data = [
-          "git.nelim.org redirect"
+            "\"${domain} IN A ${serviviIP}\""
-          "mc.nelim.org transparent"
+            "\"_minecraft._tcp.${domain}. 180 IN SRV 0 0 ${toString port} ${domain}.\""
-          "cv.nelim.org transparent"
+          ];
-          "mc2.nelim.org transparent"
+        };
-          "ota.nelim.org redirect"
-          "nelim.org redirect"
-        ];
-        local-data = let
-          wanIP = "166.62.180.199";
-          caddyIp =
-            if hostName == "thingone"
-            then "100.64.0.8"
-            else "100.64.0.9";
-        in [
-          "\"headscale.nelim.org. IN A ${wanIP}\""
 
-          "\"git.nelim.org. IN A ${wanIP}\""
+        publicApps = remove "nelim.org" (mapAttrsToList (n: v: v.hostName) config.services.caddy.virtualHosts);
+      in
+        mergeAttrsList (
+          (map (x: mkLocalEntry x wanIP) publicApps)
+          ++ [
+            (mkMinecraftEntry "mc.nelim.org" 25569)
+            (mkMinecraftEntry "mc2.nelim.org" 25560)
+            (mkMinecraftEntry "cv.nelim.org" 25566)
 
-          "\"mc.nelim.org IN A 100.64.0.7\""
+            (mkLocalEntry "nelim.org" caddyIp)
-          "\"_minecraft._tcp.mc.nelim.org. 180 IN SRV 0 0 25569 mc.nelim.org.\""
 
-          "\"cv.nelim.org IN A 100.64.0.7\""
+            {
-          "\"_minecraft._tcp.cv.nelim.org. 180 IN SRV 0 0 25566 cv.nelim.org.\""
+              interface = ["127.0.0.1"];
+              port = 5335;
 
-          "\"mc2.nelim.org IN A 100.64.0.7\""
+              do-ip4 = true;
-          "\"_minecraft._tcp.mc2.nelim.org. 180 IN SRV 0 0 25560 mc2.nelim.org.\""
+              do-ip6 = false;
+              prefer-ip6 = false;
+              do-udp = true;
+              do-tcp = true;
 
-          "\"ota.nelim.org. IN A 100.64.0.5\""
+              # Performance
+              prefetch = true;
+              num-threads = 1;
 
-          "\"nelim.org 0 A ${caddyIp}\""
+              private-address = [
-        ];
+                "172.16.0.0/12"
+                "10.0.0.0/8"
+                "100.64.0.0/8"
+                "fd00::/8"
+                "fe80::/10"
+              ];
 
-        do-ip4 = true;
+              # Default stuff
-        do-ip6 = false;
+              harden-glue = true;
-        prefer-ip6 = false;
+              harden-dnssec-stripped = true;
-        do-udp = true;
+              use-caps-for-id = false;
-        do-tcp = true;
+              edns-buffer-size = 1232;
-
+              so-rcvbuf = "1m";
-        # Performance
+            }
-        prefetch = true;
+          ]
-        num-threads = 1;
+        );
-
-        private-address = [
-          "172.16.0.0/12"
-          "10.0.0.0/8"
-          "100.64.0.0/8"
-          "fd00::/8"
-          "fe80::/10"
-        ];
-
-        # Default stuff
-        harden-glue = true;
-        harden-dnssec-stripped = true;
-        use-caps-for-id = false;
-        edns-buffer-size = 1232;
-        so-rcvbuf = "1m";
-      };
     };
   };
 }

devices/nos/modules/docker/freshrss/compose.nix

@@ -17,10 +17,6 @@ in {
         restart = "always";
 
         ports = ["2800:80"];
-        extraHosts = [
-          "drss.nelim.org:10.0.0.130"
-          "bridge.nelim.org:10.0.0.130"
-        ];
         networks = ["proxy_net"];
 
         volumes = let
@@ -70,7 +66,7 @@ in {
         };
       };
 
-      "docker-hub-rss" = {
+      "drss.nelim.org" = {
         image = import ./images/docker-hub-rss.nix pkgs;
         restart = "always";
         ports = ["3007:3000"];
@@ -78,7 +74,7 @@ in {
         networks = ["proxy_net"];
       };
 
-      "rss-bridge" = {
+      "bridge.nelim.org" = {
         image = import ./images/rss-bridge.nix pkgs;
         restart = "always";
 

devices/nos/modules/docker/homepage/services.nix

@@ -95,74 +95,74 @@
   {
     "video automation" = [
       {
-        qbit = rec {
+        qbit = {
           href = "https://lan.nelim.org/qbt";
           icon = "qbittorrent.png";
           description = "torrent client";
           widget = {
             type = "qbittorrent";
-            url = href;
+            url = "http://10.0.0.121:8080";
             username = "admin";
             password = "{{HOMEPAGE_VAR_QBIT_PASS}}";
           };
         };
       }
       {
-        sabnzbd = rec {
+        sabnzbd = {
           href = "https://lan.nelim.org/sabnzbd";
           icon = "sabnzbd.png";
           description = "nzb client";
           widget = {
             type = "sabnzbd";
-            url = href;
+            url = "http://10.0.0.121:8382";
             key = "{{HOMEPAGE_VAR_SAB_API}}";
           };
         };
       }
       {
-        sonarr = rec {
+        sonarr = {
           href = "https://lan.nelim.org/sonarr";
           icon = "sonarr.png";
           description = "fetches tv shows";
           widget = {
             type = "sonarr";
-            url = href;
+            url = "http://sonarr:8989";
             key = "{{HOMEPAGE_VAR_SONARR_API}}";
           };
         };
       }
       {
-        radarr = rec {
+        radarr = {
           href = "https://lan.nelim.org/radarr";
           icon = "radarr.png";
           description = "fetches movies";
           widget = {
             type = "radarr";
-            url = href;
+            url = "http://radarr:7878";
             key = "{{HOMEPAGE_VAR_RADARR_API}}";
           };
         };
       }
       {
-        bazarr = rec {
+        bazarr = {
           href = "https://lan.nelim.org/bazarr";
           icon = "bazarr.png";
           description = "fetches subs";
           widget = {
             type = "bazarr";
-            url = href;
+            url = "http://bazarr:6767/bazarr";
             key = "{{HOMEPAGE_VAR_BAZARR_API}}";
           };
         };
       }
       {
-        prowlarr = rec {
+        prowlarr = {
           href = "https://lan.nelim.org/prowlarr";
           icon = "prowlarr.png";
           description = "fetches tracker queries";
           widget = {
             type = "prowlarr";
-            url = href;
+            url = "http://prowlarr:9696";
             key = "{{HOMEPAGE_VAR_PROWLARR_API}}";
           };
         };

devices/nos/modules/docker/media/bazarr/compose.nix

@@ -20,7 +20,6 @@ in {
         TZ = "America/New_York";
       };
 
-      extraHosts = ["lan.nelim.org:10.0.0.130"];
       ports = [
         "6767:6767"
       ];

devices/nos/modules/docker/media/joal/compose.nix

@@ -15,7 +15,6 @@ in {
       restart = "always";
 
       volumes = ["${rwPath}/data:/data"];
-      extraHosts = ["lan.nelim.org:10.0.0.130"];
       ports = ["5656:5656"];
 
       cmd = [

devices/nos/modules/docker/media/prowlarr/compose.nix

@@ -22,7 +22,7 @@ in {
         };
 
         volumes = ["${rwPath}/data:/config"];
-        extraHosts = ["lan.nelim.org:10.0.0.130"];
+
         ports = ["9696:9696"];
         networks = ["proxy_net"];
       };
@@ -38,7 +38,6 @@ in {
           TZ = "America/New_York";
         };
 
-        extraHosts = ["lan.nelim.org:10.0.0.130"];
         ports = ["8191:8191"];
 
         dependsOn = ["prowlarr"];

devices/nos/modules/docker/media/radarr/compose.nix

@@ -14,7 +14,6 @@ in {
       image = import ./images/radarr.nix pkgs;
       restart = "always";
 
-      extraHosts = ["lan.nelim.org:10.0.0.130"];
       ports = ["7878:7878"];
 
       environment = {

devices/nos/modules/docker/media/sabnzbd/compose.nix

@@ -14,7 +14,6 @@ in {
       image = import ./images/sabnzbd.nix pkgs;
       restart = "always";
 
-      extraHosts = ["lan.nelim.org:10.0.0.130"];
       ports = ["8382:8082"];
 
       environment = {

devices/nos/modules/docker/media/seerr/compose.nix

@@ -23,7 +23,6 @@ in {
         "${rwPath}/data:/app/config"
       ];
 
-      extraHosts = ["lan.nelim.org:10.0.0.130"];
       networks = ["proxy_net"];
       ports = ["5055:5055"];
     };

devices/nos/modules/docker/media/sonarr/compose.nix

@@ -14,7 +14,6 @@ in {
       image = import ./images/sonarr.nix pkgs;
       restart = "always";
 
-      extraHosts = ["lan.nelim.org:10.0.0.130"];
       ports = ["8989:8989"];
 
       environment = {