From 3f3ed3a396719edee452dc4a069ea95fd218116a Mon Sep 17 00:00:00 2001 From: "nekomimi.pet" Date: Sat, 17 Oct 2026 07:30:23 -0400 Subject: [PATCH] valefar: proxy the wisp mesh to web-extract on vassago, for search.nkp.pet baal's caddy serves search.nkp.pet but cannot reach the tailnet, so valefar forwards 10.88.0.10:8787 to vassago over it, the same socket-proxyd pattern as bonsai's LAN listener. --- hosts/valefar/default.nix | 1 + hosts/valefar/web-extract-public.nix | 24 ++++++++++++++++++++++++ 2 files changed, 25 insertions(+) create mode 100644 hosts/valefar/web-extract-public.nix diff --git a/hosts/valefar/default.nix b/hosts/valefar/default.nix index 5f6a2c7..15e932d 100644 --- a/hosts/valefar/default.nix +++ b/hosts/valefar/default.nix @@ -25,6 +25,7 @@ ./remote-builder.nix ./spindle.nix ./sorcery.nix + ./web-extract-public.nix ]; services.proxmox-ve = { diff --git a/hosts/valefar/web-extract-public.nix b/hosts/valefar/web-extract-public.nix new file mode 100644 index 0000000..43a2e34 --- /dev/null +++ b/hosts/valefar/web-extract-public.nix @@ -0,0 +1,24 @@ +# search.nkp.pet: the public side of web-extract, which runs on vassago (the +# Mac mini). baal's caddy terminates TLS but is not on the tailnet, so it reaches +# vassago through this proxy on valefar's wisp mesh address. Plain TCP, so +# caddy's X-Forwarded-For reaches web-extract unchanged; web-extract trusts it +# from valefar's tailnet address (TRUSTED_PROXIES). +{ config, ... }: +let + port = 8787; +in +{ + systemd.sockets.web-extract-public = { + wantedBy = [ "sockets.target" ]; + listenStreams = [ "10.88.0.10:${toString port}" ]; + socketConfig.FreeBind = true; + }; + systemd.services.web-extract-public = { + description = "Proxy from the wisp mesh to web-extract on vassago"; + serviceConfig = { + ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd --exit-idle-time=10min 100.64.0.16:${toString port}"; + DynamicUser = true; + PrivateTmp = true; + }; + }; +} -- 2.51.2