infrastructure

commit ec975477199053f8e6047c236d39f67f45765e83
parent c96c0c91ff8f28a69ce7f1369f323a1c23436595
Author: Silas Brack <silasbrack@gmail.com>
Date:   Sat, 13 Jun 2026 14:11:41 +0200

fix: bind logs vhost to 0.0.0.0:9090, firewall restricts to wg0

Nginx binds to all interfaces (no WireGuard dependency at startup).
Firewall only opens port 9090 on the wg0 interface, so it's only
reachable from the VPN.

Query: duckdb -c "SELECT * FROM read_json('http://10.100.0.1:9090/2026/06/13/14.json.gz')"

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Diffstat:
M
modules/simple-web-app.nix
 | 
5
+++--

1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/modules/simple-web-app.nix b/modules/simple-web-app.nix
@@ -66,9 +66,10 @@ in
     };
 
 
-    # Serve logs on localhost — access via SSH port forward or VPN
+    # Serve logs — open on all interfaces, firewall restricts to VPN
+    networking.firewall.interfaces."wg0".allowedTCPPorts = [ 9090 ];
     services.nginx.virtualHosts."simple-web-app-logs" = {
-      listen = [{ addr = "127.0.0.1"; port = 9090; }];
+      listen = [{ addr = "0.0.0.0"; port = 9090; }];
       locations."/" = {
         root = "/mnt/volume-hel1-1/simple-web-app/logs";
         extraConfig = "autoindex on;";