defiant: cleanup nginx

hosts/burnham/services/wireguard.nix

@@ -32,6 +32,18 @@ in {
           ];
           endpoint = "site3.feal.no:51902";
         }
+        { # Worf
+          publicKey = "kW8SyzCh2tw8GzZV6bPn+IQVNUoUhseNfEm3rHnR1So=";
+          allowedIPs = [
+            "10.100.0.4/32"
+          ];
+        }
+        { # Phone
+          publicKey = "axFXtcTYtW6m1FT9Czn9DRvG+b05D7j+0yRMjn/FJEk=";
+          allowedIPs = [
+            "10.100.0.5/32"
+          ];
+        }
       ];
     };
   };

hosts/defiant/services/nginx.nix

@@ -40,34 +40,21 @@
       forceSSL = true;
 
       locations."/".proxyPass = "${upstream}";
-    };
-  in {
-    "jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/";
-    "git.feal.no" = publicProxy "http://unix:${config.services.gitea.settings.server.HTTP_ADDR}";
-    "wiki.wackattack.eu" = publicProxy "http://pascal.wackattack.home.feal.no/";
-
-    "cloud.feal.no" = {
-      listen = [
-        { addr = "192.168.10.175"; port = 43443; ssl = true; }
-        { addr = "192.168.10.175"; port = 43080; ssl = false; }
-      ];
-      enableACME = true;
-      forceSSL = true;
 
       extraConfig = ''
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        server_tokens off;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        proxy_set_header Host $host;
 
-        # HSTS settings
-        # WARNING: Only add the preload option once you read about
-        # the consequences in https://hstspreload.org/. This option
-        # will add the domain to a hardcoded list that is shipped
-        # in all major browsers and getting removed from this list
-        # could take several months.
-        #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload" always;
+        server_tokens off;
       '';
-      locations."/".proxyPass = "http://voyager.home.feal.no/";
     };
+  in {
+    "auth.feal.no" = publicProxy "https://voyager.home.feal.no";
+    "cloud.feal.no" = publicProxy "http://voyager.home.feal.no";
+    "git.feal.no" = publicProxy "http://unix:${config.services.gitea.settings.server.HTTP_ADDR}";
+    "jf.feal.no" = publicProxy "http://jellyfin.home.feal.no/";
+    "wiki.wackattack.eu" = publicProxy "http://pascal.wackattack.home.feal.no/";
   };
 }

hosts/defiant/services/wireguard.nix

@@ -30,6 +30,7 @@ in {
             "10.100.0.2/32"
             "192.168.11.0/24"
           ];
+          endpoint = "site2.feal.no:51902";
         }
         { # Sulu
           publicKey = "j6YVekgGS4nhL5zUiOTeK2BVQkYGlTQaiUpwcqQyfRk=";
@@ -37,6 +38,18 @@ in {
             "10.100.0.3/32"
           ];
         }
+        { # Worf
+          publicKey = "kW8SyzCh2tw8GzZV6bPn+IQVNUoUhseNfEm3rHnR1So=";
+          allowedIPs = [
+            "10.100.0.4/32"
+          ];
+        }
+        { # Phone
+          publicKey = "axFXtcTYtW6m1FT9Czn9DRvG+b05D7j+0yRMjn/FJEk=";
+          allowedIPs = [
+            "10.100.0.5/32"
+          ];
+        }
       ];
     };
   };