r5: switch searchix to -stable, expose via tailnet
1 file changed, 28 insertions(+), 12 deletions(-)
changed files
M system/hosts/r5.nix → system/hosts/r5.nix
@@ -27,7 +27,7 @@ ../roles/video-library.nix ../roles/music-library/all.nix ../roles/webserver/local-ca.nix ../roles/webserver/reverse-proxy.nix - ../settings/services/searchix.nix + ../settings/services/searchix-stable.nix ../settings/hardware/usb-serial-tty.nix ]; age.secrets = {@@ -61,17 +61,11 @@ "searchix.${domain},${hostName}.${domain}" ]; services.searchix.settings.web = { listenAddress = "::"; - baseURL = "https://searchix.${domain}/"; + baseURL = "https://searchix.${data.tailnet}/"; }; - services.caddy.virtualHosts = { - "searchix.${domain}" = { - serverAliases = [ "searchix.ovh" ]; - extraConfig = '' - tls { - issuer internal { - ca home - } - } + services.caddy.virtualHosts = + let + searchixCommon = '' encode reverse_proxy localhost:${toString config.services.searchix.settings.web.port} { health_uri /health@@ -80,9 +74,31 @@ health_interval 10s health_timeout 1s health_fails 2 } + ''; + in + { + "searchix.${domain}" = { + serverAliases = [ "searchix.ovh" ]; + extraConfig = '' + tls { + issuer internal { + ca home + } + } + ${searchixCommon} + ''; + }; + "searchix.${data.tailnet}" = { + extraConfig = '' + bind tailscale/searchix + tls { + get_certificate tailscale + } + ${searchixCommon} + ''; + }; }; - }; systemd.network.networks = { "40-${wan}" = {