infrastructure

commit 1555167a4bdf02f8350efcb36bd3358563c18f14
parent 81e1198fc85c257f8188563ba24c321589cac423
Author: Silas Brack <silasbrack@gmail.com>
Date:   Sat, 13 Jun 2026 14:04:07 +0200

fix: serve logs on VPN vhost with nginx after wireguard

The allow/deny approach didn't work because requests via the
public domain have the public IP as remote_addr, not the VPN IP.

Instead, bind a separate vhost to 10.100.0.1:80 (VPN only) and
ensure nginx starts after wireguard so the interface exists.

Query with: duckdb -c "SELECT * FROM read_json('http://10.100.0.1/2026/06/13/14.json.gz')"

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Diffstat:
M
modules/simple-web-app.nix
 | 
16
+++++++++-------

1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/modules/simple-web-app.nix b/modules/simple-web-app.nix
@@ -63,13 +63,15 @@ in
         proxyPass = "http://127.0.0.1:8000";
         recommendedProxySettings = true;
       };
-      locations."/logs/" = {
-        alias = "/mnt/volume-hel1-1/simple-web-app/logs/";
-        extraConfig = ''
-          autoindex on;
-          allow 10.100.0.0/24;
-          deny all;
-        '';
+    };
+
+    # Serve logs on VPN only — separate vhost on the WireGuard interface
+    systemd.services.nginx.after = [ "wireguard-wg0.service" ];
+    services.nginx.virtualHosts."simple-web-app-logs" = {
+      listen = [{ addr = "10.100.0.1"; port = 80; }];
+      locations."/" = {
+        root = "/mnt/volume-hel1-1/simple-web-app/logs";
+        extraConfig = "autoindex on;";
       };
     };