From be87dea4f5cea0352f8b263b76875b88de06a1db Mon Sep 17 00:00:00 2001 From: Boris Mann Date: Sun, 27 Sep 2026 17:41:30 -0700 Subject: [PATCH] asusmini: allow LAN (192.168.1.0/24) access to pds/knot/spindle/automerge service ports Commons computer edge is moving to a Caddy LXC on pve (192.168.1.11); the public 80/443 forwards follow shortly. The box firewall currently only opens 22/80/443 on the wired interface, so the edge cannot reach the 5555/5556/6555/3030 service ports. Allow them from the LAN only; tailnet traffic already bypasses the firewall. Follow-up PR: strip the public Caddy vhosts after the UDM flip. --- hosts/asusmini/default.nix | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/hosts/asusmini/default.nix b/hosts/asusmini/default.nix index 116fc49..0a34b5f 100644 --- a/hosts/asusmini/default.nix +++ b/hosts/asusmini/default.nix @@ -97,6 +97,13 @@ # Open ports in the firewall. networking.firewall.allowedTCPPorts = [ 22 80 443 ]; + # Allow the CC edge (Caddy LXC on pve, 192.168.1.11) + LAN to reach the + # service ports directly; the public entry point moves off this box to + # 205.250.24.44 -> pve Caddy (see cc-ansible wiki / onboard plan). + # Tailnet traffic already bypasses this (tailscale0 not restricted). + networking.firewall.extraInputRules = '' + ip saddr 192.168.1.0/24 tcp dport { 5555, 5556, 6555, 3030 } accept + ''; # networking.firewall.allowedUDPPorts = [ ... ]; # Or disable the firewall altogether. # networking.firewall.enable = false;