infrastructure

commit 81e1198fc85c257f8188563ba24c321589cac423
parent 74034ab5bee14bee679e70a336588b9318b19e92
Author: Silas Brack <silasbrack@gmail.com>
Date:   Sat, 13 Jun 2026 13:56:50 +0200

feat: serve logs at /logs/ restricted to VPN IPs

Uses allow/deny instead of binding to the VPN interface, so
nginx doesn't fail if WireGuard isn't up yet.

Queryable with duckdb:
  SELECT * FROM read_json('https://simple.fnarglebeast.com/logs/2026/06/13/12.json.gz')

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Diffstat:
M
modules/simple-web-app.nix
 | 
8
++++++++

1 file changed, 8 insertions(+), 0 deletions(-)
diff --git a/modules/simple-web-app.nix b/modules/simple-web-app.nix
@@ -63,6 +63,14 @@ in
         proxyPass = "http://127.0.0.1:8000";
         recommendedProxySettings = true;
       };
+      locations."/logs/" = {
+        alias = "/mnt/volume-hel1-1/simple-web-app/logs/";
+        extraConfig = ''
+          autoindex on;
+          allow 10.100.0.0/24;
+          deny all;
+        '';
+      };
     };
 
     # Archive logs to volume