From 8a765c60689d69531e9caa2a67a58a3bcd8b6e33 Mon Sep 17 00:00:00 2001 From: "nekomimi.pet" Date: Fri, 16 Oct 2026 20:29:19 -0400 Subject: [PATCH] valefar: bonsai also listens on the wisp mesh, for wisp moderation's first pass The moderation service on baal sends new wisp sites to bonsai over the wisp WireGuard mesh, so the socket proxy binds 10.88.0.10:8899 beside the LAN and tailnet addresses. Only mesh peers (wisp hosts) reach it. --- hosts/valefar/bonsai.nix | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/hosts/valefar/bonsai.nix b/hosts/valefar/bonsai.nix index efc501d..f4a9a95 100644 --- a/hosts/valefar/bonsai.nix +++ b/hosts/valefar/bonsai.nix @@ -115,17 +115,20 @@ in }; # The host firewall is off, so a wildcard bind would also expose the - # docker bridges, the wireguard mesh, the PIA containers and the VMs. + # docker bridges, the PIA containers and the VMs. The wisp mesh address is + # bound on purpose: wisp's moderation service on baal asks bonsai for a + # first pass over new sites. systemd.sockets.bonsai2-lan = { wantedBy = [ "sockets.target" ]; listenStreams = [ "10.0.0.30:${toString port}" "100.64.0.11:${toString port}" + "10.88.0.10:${toString port}" ]; socketConfig.FreeBind = true; }; systemd.services.bonsai2-lan = { - description = "Bonsai 2 API proxy for the LAN and tailnet"; + description = "Bonsai 2 API proxy for the LAN, tailnet and wisp mesh"; requires = [ "bonsai2.service" ]; after = [ "bonsai2.service" ]; serviceConfig.ExecStart = "${config.systemd.package}/lib/systemd/systemd-socket-proxyd 127.0.0.1:${toString port}"; -- 2.51.2