2026-09-28 01:31:06 +00:00
1 changed files with 7 additions and 0 deletions
@@ -97,6 +97,13 @@

  # Open ports in the firewall.
  networking.firewall.allowedTCPPorts = [ 22 80 443 ];
+  # Allow the CC edge (Caddy LXC on pve, 192.168.1.11) + LAN to reach the
+  # service ports directly; the public entry point moves off this box to
+  # 205.250.24.44 -> pve Caddy (see cc-ansible wiki / onboard plan).
+  # Tailnet traffic already bypasses this (tailscale0 not restricted).
+  networking.firewall.extraInputRules = ''
+    ip saddr 192.168.1.0/24 tcp dport { 5555, 5556, 6555, 3030 } accept
+  '';
  # networking.firewall.allowedUDPPorts = [ ... ];
  # Or disable the firewall altogether.
  # networking.firewall.enable = false;