Merge pull request 'asusmini: open 5555/5556/6555/3030 to the LAN (CC edge Caddy on pve)' (#1 ) from caddy-edge-firewall-open into main

Reviewed-on: #1
asusmini: allow LAN (192.168.1.0/24) access to pds/knot/spindle/automerge service ports
2026-09-28 01:31:06 +00:00 · 2026-09-27 17:41:30 -07:00
1 changed files with 7 additions and 0 deletions
@@ -97,6 +97,13 @@

  # Open ports in the firewall.
  networking.firewall.allowedTCPPorts = [ 22 80 443 ];
+  # Allow the CC edge (Caddy LXC on pve, 192.168.1.11) + LAN to reach the
+  # service ports directly; the public entry point moves off this box to
+  # 205.250.24.44 -> pve Caddy (see cc-ansible wiki / onboard plan).
+  # Tailnet traffic already bypasses this (tailscale0 not restricted).
+  networking.firewall.extraInputRules = ''
+    ip saddr 192.168.1.0/24 tcp dport { 5555, 5556, 6555, 3030 } accept
+  '';
  # networking.firewall.allowedUDPPorts = [ ... ];
  # Or disable the firewall altogether.
  # networking.firewall.enable = false;