From 65494e9b6726f46c96907b5138be567f8f7954e9 Mon Sep 17 00:00:00 2001 From: hausgeist Date: Sun, 27 Sep 2026 19:15:34 -0700 Subject: [PATCH] =?UTF-8?q?asusmini:=20strip=20public=20Caddy=20vhosts=20+?= =?UTF-8?q?=20drop=2080/443=20=E2=80=94=20public=20edge=20moved=20to=20pve?= =?UTF-8?q?=20Caddy=20LXC=20(205.250.24.44=20->=20.1.11),=20verified=20liv?= =?UTF-8?q?e=202026-09-28?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- hosts/asusmini/atproto.nix | 28 +++++++--------------------- hosts/asusmini/default.nix | 2 +- 2 files changed, 8 insertions(+), 22 deletions(-) diff --git a/hosts/asusmini/atproto.nix b/hosts/asusmini/atproto.nix index a0bba98..1623bbb 100644 --- a/hosts/asusmini/atproto.nix +++ b/hosts/asusmini/atproto.nix @@ -47,25 +47,11 @@ services.automerge-repo-sync-server.enable = true; - services.caddy = { - enable = true; - virtualHosts = { - "knot.commonscomputer.com".extraConfig = '' - reverse_proxy http://localhost:5555 - ''; - "pds.commonscomputer.com".extraConfig = '' - reverse_proxy http://localhost:5556 - ''; - "spindle.commonscomputer.com".extraConfig = '' - reverse_proxy http://localhost:6555 - ''; - "automerge.commonscomputer.com".extraConfig = '' - reverse_proxy http://localhost:3030 - ''; - }; - }; - networking.firewall.allowedTCPPorts = [ - 80 - 443 - ]; + # Public edge moved 2026-09-28: 205.250.24.44 -> pve Caddy LXC (192.168.1.11) + # now fronts pds/knot/spindle/automerge (see cc-ansible wiki / onboard plan). + # PL63 no longer terminates public TLS; its Caddy is removed and the four + # vhosts are served by the edge. Services keep binding the local ports. + # (services.caddy block removed — nothing LAN-local needs it.) + # networking.firewall.allowedTCPPorts = [ 80 443 ]; is likewise gone; + # 80/443 on eth0 are no longer used now that the public forwards moved. } diff --git a/hosts/asusmini/default.nix b/hosts/asusmini/default.nix index 5da03d2..622dd99 100644 --- a/hosts/asusmini/default.nix +++ b/hosts/asusmini/default.nix @@ -103,7 +103,7 @@ # the public forwards move off this box (205.250.24.44 -> pve Caddy LXC # .1.11), leaving LAN (Z_DMZ) + tailnet as the only ingress paths. # Tailnet traffic already bypasses this (tailscale0 not restricted). - networking.firewall.allowedTCPPorts = [ 22 80 443 5555 5556 6555 3030 ]; + networking.firewall.allowedTCPPorts = [ 22 5555 5556 6555 3030 ]; # networking.firewall.allowedUDPPorts = [ ... ]; # Or disable the firewall altogether. # networking.firewall.enable = false; -- 2.39.5