aynish/commoncomputing-nix
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Activity

asusmini: allow LAN (192.168.1.0/24) access to pds/knot/spindle/automerge service ports

Browse Source 
Commons computer edge is moving to a Caddy LXC on pve (192.168.1.11);
the public 80/443 forwards follow shortly. The box firewall currently
only opens 22/80/443 on the wired interface, so the edge cannot reach
the 5555/5556/6555/3030 service ports. Allow them from the LAN only;
tailnet traffic already bypasses the firewall.

Follow-up PR: strip the public Caddy vhosts after the UDM flip.
This commit is contained in:
boris
2026-09-27 17:41:30 -07:00
parent c152c08540
commit be87dea4f5
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
hosts/asusmini/default.nix
+7
View File
@@ -97,6 +97,13 @@
# Open ports in the firewall.
networking.firewall.allowedTCPPorts = [ 22 80 443 ];
# Allow the CC edge (Caddy LXC on pve, 192.168.1.11) + LAN to reach the
# service ports directly; the public entry point moves off this box to
# 205.250.24.44 -> pve Caddy (see cc-ansible wiki / onboard plan).
# Tailnet traffic already bypasses this (tailscale0 not restricted).
networking.firewall.extraInputRules = ''
ip saddr 192.168.1.0/24 tcp dport { 5555, 5556, 6555, 3030 } accept
'';
# networking.firewall.allowedUDPPorts = [ ... ];
# Or disable the firewall altogether.
# networking.firewall.enable = false;