chore: merge remote-tracking branch 'refs/remotes/origin/master'

modules/core/printing.nix

@@ -1,7 +1,7 @@
 { pkgs, ... }:
 {
   services.avahi = {
-    enable = true;
+    enable = false;
     nssmdns4 = true;
     openFirewall = true;
   };

modules/core/sshd.nix

@@ -2,7 +2,7 @@
 {
   services.openssh = {
     enable = true;
-    ports = [ 22 ];
+    ports = [ 9123 ];
     settings = {
       PasswordAuthentication = lib.mkDefault false;
       AllowUsers = null;

modules/services/dandelion.nix

@@ -7,5 +7,6 @@
     ++ [ (import ./home-assistant.nix) ]
     ++ [ (import ./monitoring.nix) ]
     ++ [ (import ./smart-monitoring.nix) ]
+    ++ [ (import ./tailscale.nix) ]
     ++ [ (import ./hd-idle.nix) ];
 }

modules/services/monitoring.nix

@@ -23,9 +23,9 @@
       ];
     };
   };
-  networking.firewall = {
-    allowedTCPPorts = [
-      9001
-    ];
-  };
+  # networking.firewall = {
+  # allowedTCPPorts = [
+  # 9001
+  # ];
+  # };
 }

modules/services/mumble.nix

@@ -2,6 +2,6 @@
 {
   services.murmur = {
     enable = true;
-    openFirewall = true;
+    openFirewall = false;
   };
 }

modules/services/nginx.nix

@@ -37,41 +37,35 @@
     recommendedProxySettings = true;
     clientMaxBodySize = lib.mkDefault "10G";
 
-    defaultListen =
-      let
-        listen = [
-          {
-            addr = "[::]";
-            port = 80;
-            extraParameters = [ "proxy_protocol" ];
-          }
-          {
-            addr = "[::]";
-            port = 443;
-            ssl = true;
-            extraParameters = [ "proxy_protocol" ];
-          }
-        ];
-      in
-      map (x: (x // { addr = "0.0.0.0"; })) listen ++ listen;
+    #defaultListen =
+    #  let
+    #    listen = [
+    #      {
+    #        addr = "[::]";
+    #        port = 80;
+    #        extraParameters = [ "proxy_protocol" ];
+    #      }
+    #      {
+    #        addr = "[::]";
+    #        port = 443;
+    #        ssl = true;
+    #        extraParameters = [ "proxy_protocol" ];
+    #      }
+    #    ];
+    #  in
+    #  map (x: (x // { addr = "0.0.0.0"; })) listen ++ listen;
 
     # Hardened TLS and HSTS preloading
     appendHttpConfig = ''
       # Proxying
       # real_ip_header proxy_protocol;
 
-      server {
-        listen 80   proxy_protocol;
-        listen 443  ssl proxy_protocol;
-        # set_real_ip_from 10.7.0.0/24;
-      }
-
       ssl_certificate /var/lib/acme/quack.social/cert.pem;
       ssl_certificate_key /var/lib/acme/quack.social/key.pem;
 
-      proxy_set_header Host            $host;
-      proxy_set_header X-Real-IP       $proxy_protocol_addr;
-      proxy_set_header X-Forwarded-For $proxy_protocol_addr;
+      # proxy_set_header Host            $host;
+      # proxy_set_header X-Real-IP       $proxy_protocol_addr;
+      # proxy_set_header X-Forwarded-For $proxy_protocol_addr;
 
       # Add HSTS header with preloading to HTTPS requests.
       # Do not add HSTS header to HTTP requests.
@@ -98,19 +92,6 @@
       add_header pronouns "any but neopronouns";
       add_header locale "[en_US, nl_NL]";
     '';
-    appendConfig = ''
-      # https://docs.nginx.com/nginx/admin-guide/load-balancer/using-proxy-protocol/
-      # set_real_ip_from 213.210.34.27;
-
-      # real_ip_header proxy_protocol;
-
-      # proxy_set_header Host               $host;
-      # proxy_set_header X-Real-IP          $proxy_protocol_addr;
-      # proxy_set_header X-Forwarded-For    $proxy_protocol_addr;
-      # proxy_set_header X-Forwarded-Proto  $scheme;
-      # proxy_set_header X-Forwarded-Host   $host;
-      # proxy_set_header X-Forwarded-Server $host;
-    '';
   };
   networking.firewall = {
     allowedTCPPorts = [

modules/services/ntfy.nix

@@ -12,7 +12,7 @@ in
         listen-http = "127.0.0.1:${toString port}";
         behind-proxy = true;
         visitor-attachment-daily-bandwidth-limit = "10M";
-        visitor-request-limit-burst = 5;
+        visitor-request-limit-burst = 15;
         visitor-request-limit-replenish = "15s";
       };
     };

modules/services/violet.nix

@@ -20,6 +20,7 @@
     ++ [ (import ./nginx.nix) ]
     # ++ [(import ./komga.nix)]
     ++ [ (import ./radicale.nix) ]
+    ++ [ (import ./tailscale.nix) ]
     ++ [ (import ./readarr.nix) ];
   # ++ [(import ./smart-monitoring.nix)]
   # ++ [(import ./jitsi-meet.nix)]