diff options
Diffstat (limited to 'nix/per-host/rproxy-2')
| -rw-r--r-- | nix/per-host/rproxy-2/configuration.nix | 28 |
1 files changed, 27 insertions, 1 deletions
diff --git a/nix/per-host/rproxy-2/configuration.nix b/nix/per-host/rproxy-2/configuration.nix index d1580e8..efa75eb 100644 --- a/nix/per-host/rproxy-2/configuration.nix +++ b/nix/per-host/rproxy-2/configuration.nix @@ -10,7 +10,23 @@ }; networking.hostName = "rproxy-2"; - networking.firewall.allowedTCPPorts = [ 80 443 ]; + networking.firewall.allowedTCPPorts = [ 80 443 2222 ]; + + # caddy can't proxy raw SSH, so relay TCP :2222 to the git VM's sshd. + # This is how git push works via git.kumardamani.net: clients use + # ssh://git@git.kumardamani.net:2222/<repo>.git + # or a "Port 2222" entry for git.kumardamani.net in ~/.ssh/config. + systemd.services.git-ssh-relay = { + description = "Relay TCP :2222 to git:22 (SSH push via git.kumardamani.net)"; + wantedBy = [ "multi-user.target" ]; + after = [ "network-online.target" ]; + wants = [ "network-online.target" ]; + serviceConfig = { + ExecStart = "${pkgs.socat}/bin/socat TCP-LISTEN:2222,fork,reuseaddr TCP:git:22"; + Restart = "always"; + RestartSec = 2; + }; + }; services.caddy = { enable = true; @@ -36,6 +52,16 @@ } ''; + virtualHosts."git.kumardamani.net:443".extraConfig = '' + reverse_proxy git:80 + tls { + dns namecheap { + api_key {$NAMECHEAP_API_KEY} + user {$NAMECHEAP_API_USER} + } + } + ''; + virtualHosts."radarr.kumardamani.net:443".extraConfig = '' reverse_proxy med-dl:7878 tls { |